@openclaw/googlechat 2026.5.2-beta.2 → 2026.5.3-beta.2

package/src/api.ts

@@ -1,322 +0,0 @@
-import crypto from "node:crypto";
-import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
-import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
-import type { ResolvedGoogleChatAccount } from "./accounts.js";
-import { getGoogleChatAccessToken } from "./auth.js";
-import type { GoogleChatReaction } from "./types.js";
-
-const CHAT_API_BASE = "https://chat.googleapis.com/v1";
-const CHAT_UPLOAD_BASE = "https://chat.googleapis.com/upload/v1";
-
-const headersToObject = (headers?: HeadersInit): Record<string, string> =>
-  headers instanceof Headers
-    ? Object.fromEntries(headers.entries())
-    : Array.isArray(headers)
-      ? Object.fromEntries(headers)
-      : headers || {};
-
-async function withGoogleChatResponse<T>(params: {
-  account: ResolvedGoogleChatAccount;
-  url: string;
-  init?: RequestInit;
-  auditContext: string;
-  errorPrefix?: string;
-  handleResponse: (response: Response) => Promise<T>;
-}): Promise<T> {
-  const {
-    account,
-    url,
-    init,
-    auditContext,
-    errorPrefix = "Google Chat API",
-    handleResponse,
-  } = params;
-  const token = await getGoogleChatAccessToken(account);
-  const { response, release } = await fetchWithSsrFGuard({
-    url,
-    init: {
-      ...init,
-      headers: {
-        ...headersToObject(init?.headers),
-        Authorization: `Bearer ${token}`,
-      },
-    },
-    auditContext,
-  });
-  try {
-    if (!response.ok) {
-      const text = await response.text().catch(() => "");
-      throw new Error(`${errorPrefix} ${response.status}: ${text || response.statusText}`);
-    }
-    return await handleResponse(response);
-  } finally {
-    await release();
-  }
-}
-
-async function fetchJson<T>(
-  account: ResolvedGoogleChatAccount,
-  url: string,
-  init: RequestInit,
-): Promise<T> {
-  return await withGoogleChatResponse({
-    account,
-    url,
-    init: {
-      ...init,
-      headers: {
-        ...headersToObject(init.headers),
-        "Content-Type": "application/json",
-      },
-    },
-    auditContext: "googlechat.api.json",
-    handleResponse: async (response) => (await response.json()) as T,
-  });
-}
-
-async function fetchOk(
-  account: ResolvedGoogleChatAccount,
-  url: string,
-  init: RequestInit,
-): Promise<void> {
-  await withGoogleChatResponse({
-    account,
-    url,
-    init,
-    auditContext: "googlechat.api.ok",
-    handleResponse: async () => undefined,
-  });
-}
-
-async function fetchBuffer(
-  account: ResolvedGoogleChatAccount,
-  url: string,
-  init?: RequestInit,
-  options?: { maxBytes?: number },
-): Promise<{ buffer: Buffer; contentType?: string }> {
-  return await withGoogleChatResponse({
-    account,
-    url,
-    init,
-    auditContext: "googlechat.api.buffer",
-    handleResponse: async (res) => {
-      const maxBytes = options?.maxBytes;
-      const lengthHeader = res.headers.get("content-length");
-      if (maxBytes && lengthHeader) {
-        const length = Number(lengthHeader);
-        if (Number.isFinite(length) && length > maxBytes) {
-          throw new Error(`Google Chat media exceeds max bytes (${maxBytes})`);
-        }
-      }
-      if (!maxBytes || !res.body) {
-        const buffer = Buffer.from(await res.arrayBuffer());
-        const contentType = res.headers.get("content-type") ?? undefined;
-        return { buffer, contentType };
-      }
-      const reader = res.body.getReader();
-      const chunks: Buffer[] = [];
-      let total = 0;
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done) {
-          break;
-        }
-        if (!value) {
-          continue;
-        }
-        total += value.length;
-        if (total > maxBytes) {
-          await reader.cancel();
-          throw new Error(`Google Chat media exceeds max bytes (${maxBytes})`);
-        }
-        chunks.push(Buffer.from(value));
-      }
-      const buffer = Buffer.concat(chunks, total);
-      const contentType = res.headers.get("content-type") ?? undefined;
-      return { buffer, contentType };
-    },
-  });
-}
-
-export async function sendGoogleChatMessage(params: {
-  account: ResolvedGoogleChatAccount;
-  space: string;
-  text?: string;
-  thread?: string;
-  attachments?: Array<{ attachmentUploadToken: string; contentName?: string }>;
-}): Promise<{ messageName?: string } | null> {
-  const { account, space, text, thread, attachments } = params;
-  const body: Record<string, unknown> = {};
-  if (text) {
-    body.text = text;
-  }
-  if (thread) {
-    body.thread = { name: thread };
-  }
-  if (attachments && attachments.length > 0) {
-    body.attachment = attachments.map((item) =>
-      Object.assign(
-        { attachmentDataRef: { attachmentUploadToken: item.attachmentUploadToken } },
-        item.contentName ? { contentName: item.contentName } : {},
-      ),
-    );
-  }
-  const urlObj = new URL(`${CHAT_API_BASE}/${space}/messages`);
-  if (thread) {
-    urlObj.searchParams.set("messageReplyOption", "REPLY_MESSAGE_FALLBACK_TO_NEW_THREAD");
-  }
-  const url = urlObj.toString();
-  const result = await fetchJson<{ name?: string }>(account, url, {
-    method: "POST",
-    body: JSON.stringify(body),
-  });
-  return result ? { messageName: result.name } : null;
-}
-
-export async function updateGoogleChatMessage(params: {
-  account: ResolvedGoogleChatAccount;
-  messageName: string;
-  text: string;
-}): Promise<{ messageName?: string }> {
-  const { account, messageName, text } = params;
-  const url = `${CHAT_API_BASE}/${messageName}?updateMask=text`;
-  const result = await fetchJson<{ name?: string }>(account, url, {
-    method: "PATCH",
-    body: JSON.stringify({ text }),
-  });
-  return { messageName: result.name };
-}
-
-export async function deleteGoogleChatMessage(params: {
-  account: ResolvedGoogleChatAccount;
-  messageName: string;
-}): Promise<void> {
-  const { account, messageName } = params;
-  const url = `${CHAT_API_BASE}/${messageName}`;
-  await fetchOk(account, url, { method: "DELETE" });
-}
-
-export async function uploadGoogleChatAttachment(params: {
-  account: ResolvedGoogleChatAccount;
-  space: string;
-  filename: string;
-  buffer: Buffer;
-  contentType?: string;
-}): Promise<{ attachmentUploadToken?: string }> {
-  const { account, space, filename, buffer, contentType } = params;
-  const boundary = `openclaw-${crypto.randomUUID()}`;
-  const metadata = JSON.stringify({ filename });
-  const header = `--${boundary}\r\nContent-Type: application/json; charset=UTF-8\r\n\r\n${metadata}\r\n`;
-  const mediaHeader = `--${boundary}\r\nContent-Type: ${contentType ?? "application/octet-stream"}\r\n\r\n`;
-  const footer = `\r\n--${boundary}--\r\n`;
-  const body = Buffer.concat([
-    Buffer.from(header, "utf8"),
-    Buffer.from(mediaHeader, "utf8"),
-    buffer,
-    Buffer.from(footer, "utf8"),
-  ]);
-
-  const url = `${CHAT_UPLOAD_BASE}/${space}/attachments:upload?uploadType=multipart`;
-  const payload = await withGoogleChatResponse<{
-    attachmentDataRef?: { attachmentUploadToken?: string };
-  }>({
-    account,
-    url,
-    init: {
-      method: "POST",
-      headers: {
-        "Content-Type": `multipart/related; boundary=${boundary}`,
-      },
-      body,
-    },
-    auditContext: "googlechat.upload",
-    errorPrefix: "Google Chat upload",
-    handleResponse: async (response) =>
-      (await response.json()) as {
-        attachmentDataRef?: { attachmentUploadToken?: string };
-      },
-  });
-  return {
-    attachmentUploadToken: payload.attachmentDataRef?.attachmentUploadToken,
-  };
-}
-
-export async function downloadGoogleChatMedia(params: {
-  account: ResolvedGoogleChatAccount;
-  resourceName: string;
-  maxBytes?: number;
-}): Promise<{ buffer: Buffer; contentType?: string }> {
-  const { account, resourceName, maxBytes } = params;
-  const url = `${CHAT_API_BASE}/media/${resourceName}?alt=media`;
-  return await fetchBuffer(account, url, undefined, { maxBytes });
-}
-
-export async function createGoogleChatReaction(params: {
-  account: ResolvedGoogleChatAccount;
-  messageName: string;
-  emoji: string;
-}): Promise<GoogleChatReaction> {
-  const { account, messageName, emoji } = params;
-  const url = `${CHAT_API_BASE}/${messageName}/reactions`;
-  return await fetchJson<GoogleChatReaction>(account, url, {
-    method: "POST",
-    body: JSON.stringify({ emoji: { unicode: emoji } }),
-  });
-}
-
-export async function listGoogleChatReactions(params: {
-  account: ResolvedGoogleChatAccount;
-  messageName: string;
-  limit?: number;
-}): Promise<GoogleChatReaction[]> {
-  const { account, messageName, limit } = params;
-  const url = new URL(`${CHAT_API_BASE}/${messageName}/reactions`);
-  if (limit && limit > 0) {
-    url.searchParams.set("pageSize", String(limit));
-  }
-  const result = await fetchJson<{ reactions?: GoogleChatReaction[] }>(account, url.toString(), {
-    method: "GET",
-  });
-  return result.reactions ?? [];
-}
-
-export async function deleteGoogleChatReaction(params: {
-  account: ResolvedGoogleChatAccount;
-  reactionName: string;
-}): Promise<void> {
-  const { account, reactionName } = params;
-  const url = `${CHAT_API_BASE}/${reactionName}`;
-  await fetchOk(account, url, { method: "DELETE" });
-}
-
-export async function findGoogleChatDirectMessage(params: {
-  account: ResolvedGoogleChatAccount;
-  userName: string;
-}): Promise<{ name?: string; displayName?: string } | null> {
-  const { account, userName } = params;
-  const url = new URL(`${CHAT_API_BASE}/spaces:findDirectMessage`);
-  url.searchParams.set("name", userName);
-  return await fetchJson<{ name?: string; displayName?: string }>(account, url.toString(), {
-    method: "GET",
-  });
-}
-
-export async function probeGoogleChat(account: ResolvedGoogleChatAccount): Promise<{
-  ok: boolean;
-  status?: number;
-  error?: string;
-}> {
-  try {
-    const url = new URL(`${CHAT_API_BASE}/spaces`);
-    url.searchParams.set("pageSize", "1");
-    await fetchJson<Record<string, unknown>>(account, url.toString(), {
-      method: "GET",
-    });
-    return { ok: true };
-  } catch (err) {
-    return {
-      ok: false,
-      error: formatErrorMessage(err),
-    };
-  }
-}

package/src/approval-auth.test.ts

@@ -1,24 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { googleChatApprovalAuth } from "./approval-auth.js";
-
-describe("googleChatApprovalAuth", () => {
-  it("authorizes stable users/* ids and ignores email-style approvers", () => {
-    expect(
-      googleChatApprovalAuth.authorizeActorAction({
-        cfg: { channels: { googlechat: { dm: { allowFrom: ["users/123"] } } } },
-        senderId: "users/123",
-        action: "approve",
-        approvalKind: "exec",
-      }),
-    ).toEqual({ authorized: true });
-
-    expect(
-      googleChatApprovalAuth.authorizeActorAction({
-        cfg: { channels: { googlechat: { dm: { allowFrom: ["owner@example.com"] } } } },
-        senderId: "users/attacker",
-        action: "approve",
-        approvalKind: "exec",
-      }),
-    ).toEqual({ authorized: true });
-  });
-});

package/src/approval-auth.ts

@@ -1,32 +0,0 @@
-import {
-  createResolvedApproverActionAuthAdapter,
-  resolveApprovalApprovers,
-} from "openclaw/plugin-sdk/approval-auth-runtime";
-import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
-import { resolveGoogleChatAccount } from "./accounts.js";
-import { isGoogleChatUserTarget, normalizeGoogleChatTarget } from "./targets.js";
-
-function normalizeGoogleChatApproverId(value: string | number): string | undefined {
-  const normalized = normalizeGoogleChatTarget(String(value));
-  if (!normalized || !isGoogleChatUserTarget(normalized)) {
-    return undefined;
-  }
-  const suffix = normalizeLowercaseStringOrEmpty(normalized.slice("users/".length));
-  if (!suffix || suffix.includes("@")) {
-    return undefined;
-  }
-  return `users/${suffix}`;
-}
-
-export const googleChatApprovalAuth = createResolvedApproverActionAuthAdapter({
-  channelLabel: "Google Chat",
-  resolveApprovers: ({ cfg, accountId }) => {
-    const account = resolveGoogleChatAccount({ cfg, accountId }).config;
-    return resolveApprovalApprovers({
-      allowFrom: account.dm?.allowFrom,
-      defaultTo: account.defaultTo,
-      normalizeApprover: normalizeGoogleChatApproverId,
-    });
-  },
-  normalizeSenderId: (value) => normalizeGoogleChatApproverId(value),
-});

package/src/auth.ts

@@ -1,209 +0,0 @@
-import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
-import { fetchWithSsrFGuard } from "../runtime-api.js";
-import type { ResolvedGoogleChatAccount } from "./accounts.js";
-import {
-  __testing as googleAuthRuntimeTesting,
-  getGoogleAuthTransport,
-  loadGoogleAuthRuntime,
-  resolveValidatedGoogleChatCredentials,
-} from "./google-auth.runtime.js";
-
-const CHAT_SCOPE = "https://www.googleapis.com/auth/chat.bot";
-const CHAT_ISSUER = "chat@system.gserviceaccount.com";
-// Google Workspace Add-ons use a different service account pattern
-const ADDON_ISSUER_PATTERN = /^service-\d+@gcp-sa-gsuiteaddons\.iam\.gserviceaccount\.com$/;
-const CHAT_CERTS_URL =
-  "https://www.googleapis.com/service_accounts/v1/metadata/x509/chat@system.gserviceaccount.com";
-
-// Size-capped to prevent unbounded growth in long-running deployments (#4948)
-const MAX_AUTH_CACHE_SIZE = 32;
-type GoogleAuthModule = typeof import("google-auth-library");
-type GoogleAuthRuntime = {
-  GoogleAuth: GoogleAuthModule["GoogleAuth"];
-  OAuth2Client: GoogleAuthModule["OAuth2Client"];
-};
-type GoogleAuthInstance = InstanceType<GoogleAuthRuntime["GoogleAuth"]>;
-type GoogleAuthOptions = ConstructorParameters<GoogleAuthRuntime["GoogleAuth"]>[0];
-type GoogleAuthTransport = NonNullable<GoogleAuthOptions>["clientOptions"] extends {
-  transporter?: infer T;
-}
-  ? T
-  : never;
-type OAuth2ClientInstance = InstanceType<GoogleAuthRuntime["OAuth2Client"]>;
-
-const authCache = new Map<string, { key: string; auth: GoogleAuthInstance }>();
-
-let cachedCerts: { fetchedAt: number; certs: Record<string, string> } | null = null;
-let verifyClientPromise: Promise<OAuth2ClientInstance> | null = null;
-
-async function getVerifyClient(): Promise<OAuth2ClientInstance> {
-  if (!verifyClientPromise) {
-    verifyClientPromise = (async () => {
-      try {
-        const { OAuth2Client } = await loadGoogleAuthRuntime();
-        // google-auth-library types its transporter through gaxios' CJS surface,
-        // while the plugin imports the ESM entrypoint directly.
-        const transporter = (await getGoogleAuthTransport()) as unknown as GoogleAuthTransport;
-        return new OAuth2Client({ transporter });
-      } catch (error) {
-        verifyClientPromise = null;
-        throw error;
-      }
-    })();
-  }
-  return await verifyClientPromise;
-}
-
-function buildAuthKey(account: ResolvedGoogleChatAccount): string {
-  if (account.credentialsFile) {
-    return `file:${account.credentialsFile}`;
-  }
-  if (account.credentials) {
-    return `inline:${JSON.stringify(account.credentials)}`;
-  }
-  return "none";
-}
-
-async function getAuthInstance(account: ResolvedGoogleChatAccount): Promise<GoogleAuthInstance> {
-  const key = buildAuthKey(account);
-  const cached = authCache.get(account.accountId);
-  if (cached && cached.key === key) {
-    return cached.auth;
-  }
-  const [{ GoogleAuth }, rawTransporter, credentials] = await Promise.all([
-    loadGoogleAuthRuntime(),
-    getGoogleAuthTransport(),
-    resolveValidatedGoogleChatCredentials(account),
-  ]);
-  const transporter = rawTransporter as unknown as GoogleAuthTransport;
-
-  const evictOldest = () => {
-    if (authCache.size > MAX_AUTH_CACHE_SIZE) {
-      const oldest = authCache.keys().next().value;
-      if (oldest !== undefined) {
-        authCache.delete(oldest);
-      }
-    }
-  };
-
-  const auth = new GoogleAuth({
-    ...(credentials ? { credentials } : {}),
-    clientOptions: { transporter },
-    scopes: [CHAT_SCOPE],
-  });
-  authCache.set(account.accountId, { key, auth });
-  evictOldest();
-  return auth;
-}
-
-export async function getGoogleChatAccessToken(
-  account: ResolvedGoogleChatAccount,
-): Promise<string> {
-  const auth = await getAuthInstance(account);
-  const client = await auth.getClient();
-  const access = await client.getAccessToken();
-  const token = typeof access === "string" ? access : access?.token;
-  if (!token) {
-    throw new Error("Missing Google Chat access token");
-  }
-  return token;
-}
-
-async function fetchChatCerts(): Promise<Record<string, string>> {
-  const now = Date.now();
-  if (cachedCerts && now - cachedCerts.fetchedAt < 10 * 60 * 1000) {
-    return cachedCerts.certs;
-  }
-  const { response, release } = await fetchWithSsrFGuard({
-    url: CHAT_CERTS_URL,
-    auditContext: "googlechat.auth.certs",
-  });
-  try {
-    if (!response.ok) {
-      throw new Error(`Failed to fetch Chat certs (${response.status})`);
-    }
-    const certs = (await response.json()) as Record<string, string>;
-    cachedCerts = { fetchedAt: now, certs };
-    return certs;
-  } finally {
-    await release();
-  }
-}
-
-export type GoogleChatAudienceType = "app-url" | "project-number";
-
-export async function verifyGoogleChatRequest(params: {
-  bearer?: string | null;
-  audienceType?: GoogleChatAudienceType | null;
-  audience?: string | null;
-  expectedAddOnPrincipal?: string | null;
-}): Promise<{ ok: boolean; reason?: string }> {
-  const bearer = params.bearer?.trim();
-  if (!bearer) {
-    return { ok: false, reason: "missing token" };
-  }
-  const audience = params.audience?.trim();
-  if (!audience) {
-    return { ok: false, reason: "missing audience" };
-  }
-  const audienceType = params.audienceType ?? null;
-
-  if (audienceType === "app-url") {
-    try {
-      const verifyClient = await getVerifyClient();
-      const ticket = await verifyClient.verifyIdToken({
-        idToken: bearer,
-        audience,
-      });
-      const payload = ticket.getPayload();
-      const email = normalizeLowercaseStringOrEmpty(payload?.email ?? "");
-      if (!payload?.email_verified) {
-        return { ok: false, reason: "email not verified" };
-      }
-      if (email === CHAT_ISSUER) {
-        return { ok: true };
-      }
-      if (!ADDON_ISSUER_PATTERN.test(email)) {
-        return { ok: false, reason: `invalid issuer: ${email}` };
-      }
-      const expectedAddOnPrincipal = normalizeLowercaseStringOrEmpty(
-        params.expectedAddOnPrincipal ?? "",
-      );
-      if (!expectedAddOnPrincipal) {
-        return { ok: false, reason: "missing add-on principal binding" };
-      }
-      const tokenPrincipal = normalizeLowercaseStringOrEmpty(payload?.sub ?? "");
-      if (!tokenPrincipal || tokenPrincipal !== expectedAddOnPrincipal) {
-        return {
-          ok: false,
-          reason: `unexpected add-on principal: ${tokenPrincipal || "<missing>"}`,
-        };
-      }
-      return { ok: true };
-    } catch (err) {
-      return { ok: false, reason: err instanceof Error ? err.message : "invalid token" };
-    }
-  }
-
-  if (audienceType === "project-number") {
-    try {
-      const verifyClient = await getVerifyClient();
-      const certs = await fetchChatCerts();
-      await verifyClient.verifySignedJwtWithCertsAsync(bearer, certs, audience, [CHAT_ISSUER]);
-      return { ok: true };
-    } catch (err) {
-      return { ok: false, reason: err instanceof Error ? err.message : "invalid token" };
-    }
-  }
-
-  return { ok: false, reason: "unsupported audience type" };
-}
-
-export const __testing = {
-  resetGoogleChatAuthForTests(): void {
-    authCache.clear();
-    cachedCerts = null;
-    verifyClientPromise = null;
-    googleAuthRuntimeTesting.resetGoogleAuthRuntimeForTests();
-  },
-};

package/src/channel-config.test.ts

@@ -1,39 +0,0 @@
-import type { OpenClawConfig } from "openclaw/plugin-sdk/config-types";
-import { describe, expect, it } from "vitest";
-import { googlechatPlugin } from "./channel.js";
-
-describe("googlechatPlugin config adapter", () => {
-  it("keeps read-only accessors from resolving service account SecretRefs", () => {
-    const cfg = {
-      secrets: {
-        providers: {
-          google_chat_service_account: {
-            source: "file",
-            path: "/tmp/openclaw-missing-google-chat-service-account",
-            mode: "singleValue",
-          },
-        },
-      },
-      channels: {
-        googlechat: {
-          serviceAccount: {
-            source: "file",
-            provider: "google_chat_service_account",
-            id: "value",
-          },
-          dm: {
-            allowFrom: ["users/123"],
-          },
-          defaultTo: "spaces/AAA",
-        },
-      },
-    } as OpenClawConfig;
-
-    expect(googlechatPlugin.config.resolveAllowFrom?.({ cfg, accountId: "default" })).toEqual([
-      "users/123",
-    ]);
-    expect(googlechatPlugin.config.resolveDefaultTo?.({ cfg, accountId: "default" })).toBe(
-      "spaces/AAA",
-    );
-  });
-});