@openclaw/nextcloud-talk 2026.3.12 → 2026.5.1-beta.2

package/src/setup-surface.ts

@@ -0,0 +1,190 @@
+import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/routing";
+import { hasConfiguredSecretInput } from "openclaw/plugin-sdk/secret-input";
+import {
+  createStandardChannelSetupStatus,
+  formatDocsLink,
+  setSetupChannelEnabled,
+  type ChannelSetupWizard,
+} from "openclaw/plugin-sdk/setup";
+import { normalizeOptionalString } from "openclaw/plugin-sdk/text-runtime";
+import { resolveNextcloudTalkAccount } from "./accounts.js";
+import {
+  clearNextcloudTalkAccountFields,
+  nextcloudTalkDmPolicy,
+  normalizeNextcloudTalkBaseUrl,
+  setNextcloudTalkAccountConfig,
+  validateNextcloudTalkBaseUrl,
+} from "./setup-core.js";
+import type { CoreConfig } from "./types.js";
+
+const channel = "nextcloud-talk" as const;
+const CONFIGURE_API_FLAG = "__nextcloudTalkConfigureApiCredentials";
+
+export const nextcloudTalkSetupWizard: ChannelSetupWizard = {
+  channel,
+  stepOrder: "text-first",
+  status: createStandardChannelSetupStatus({
+    channelLabel: "Nextcloud Talk",
+    configuredLabel: "configured",
+    unconfiguredLabel: "needs setup",
+    configuredHint: "configured",
+    unconfiguredHint: "self-hosted chat",
+    configuredScore: 1,
+    unconfiguredScore: 5,
+    resolveConfigured: ({ cfg, accountId }) => {
+      const account = resolveNextcloudTalkAccount({ cfg: cfg as CoreConfig, accountId });
+      return Boolean(account.secret && account.baseUrl);
+    },
+  }),
+  introNote: {
+    title: "Nextcloud Talk bot setup",
+    lines: [
+      "1) SSH into your Nextcloud server",
+      '2) Run: ./occ talk:bot:install "OpenClaw" "<shared-secret>" "<webhook-url>" --feature reaction',
+      "3) Copy the shared secret you used in the command",
+      "4) Enable the bot in your Nextcloud Talk room settings",
+      "Tip: you can also set NEXTCLOUD_TALK_BOT_SECRET in your env.",
+      `Docs: ${formatDocsLink("/channels/nextcloud-talk", "channels/nextcloud-talk")}`,
+    ],
+    shouldShow: ({ cfg, accountId }) => {
+      const account = resolveNextcloudTalkAccount({ cfg: cfg as CoreConfig, accountId });
+      return !account.secret || !account.baseUrl;
+    },
+  },
+  prepare: async ({ cfg, accountId, credentialValues, prompter }) => {
+    const resolvedAccount = resolveNextcloudTalkAccount({ cfg: cfg as CoreConfig, accountId });
+    const hasApiCredentials = Boolean(
+      resolvedAccount.config.apiUser?.trim() &&
+      (hasConfiguredSecretInput(resolvedAccount.config.apiPassword) ||
+        resolvedAccount.config.apiPasswordFile),
+    );
+    const configureApiCredentials = await prompter.confirm({
+      message: "Configure optional Nextcloud Talk API credentials for room lookups?",
+      initialValue: hasApiCredentials,
+    });
+    if (!configureApiCredentials) {
+      return undefined;
+    }
+    return {
+      credentialValues: {
+        ...credentialValues,
+        [CONFIGURE_API_FLAG]: "1",
+      },
+    };
+  },
+  credentials: [
+    {
+      inputKey: "token",
+      providerHint: channel,
+      credentialLabel: "bot secret",
+      preferredEnvVar: "NEXTCLOUD_TALK_BOT_SECRET",
+      envPrompt: "NEXTCLOUD_TALK_BOT_SECRET detected. Use env var?",
+      keepPrompt: "Nextcloud Talk bot secret already configured. Keep it?",
+      inputPrompt: "Enter Nextcloud Talk bot secret",
+      allowEnv: ({ accountId }) => accountId === DEFAULT_ACCOUNT_ID,
+      inspect: ({ cfg, accountId }) => {
+        const resolvedAccount = resolveNextcloudTalkAccount({ cfg: cfg as CoreConfig, accountId });
+        return {
+          accountConfigured: Boolean(resolvedAccount.secret && resolvedAccount.baseUrl),
+          hasConfiguredValue: Boolean(
+            hasConfiguredSecretInput(resolvedAccount.config.botSecret) ||
+            resolvedAccount.config.botSecretFile,
+          ),
+          resolvedValue: resolvedAccount.secret || undefined,
+          envValue:
+            accountId === DEFAULT_ACCOUNT_ID
+              ? normalizeOptionalString(process.env.NEXTCLOUD_TALK_BOT_SECRET)
+              : undefined,
+        };
+      },
+      applyUseEnv: async (params) => {
+        const resolvedAccount = resolveNextcloudTalkAccount({
+          cfg: params.cfg as CoreConfig,
+          accountId: params.accountId,
+        });
+        const cleared = clearNextcloudTalkAccountFields(
+          params.cfg as CoreConfig,
+          params.accountId,
+          ["botSecret", "botSecretFile"],
+        );
+        return setNextcloudTalkAccountConfig(cleared, params.accountId, {
+          baseUrl: resolvedAccount.baseUrl,
+        });
+      },
+      applySet: async (params) =>
+        setNextcloudTalkAccountConfig(
+          clearNextcloudTalkAccountFields(params.cfg as CoreConfig, params.accountId, [
+            "botSecret",
+            "botSecretFile",
+          ]),
+          params.accountId,
+          {
+            botSecret: params.value,
+          },
+        ),
+    },
+    {
+      inputKey: "password",
+      providerHint: "nextcloud-talk-api",
+      credentialLabel: "API password",
+      preferredEnvVar: "NEXTCLOUD_TALK_API_PASSWORD",
+      envPrompt: "",
+      keepPrompt: "Nextcloud Talk API password already configured. Keep it?",
+      inputPrompt: "Enter Nextcloud Talk API password",
+      inspect: ({ cfg, accountId }) => {
+        const resolvedAccount = resolveNextcloudTalkAccount({ cfg: cfg as CoreConfig, accountId });
+        const apiUser = resolvedAccount.config.apiUser?.trim();
+        const apiPasswordConfigured = Boolean(
+          hasConfiguredSecretInput(resolvedAccount.config.apiPassword) ||
+          resolvedAccount.config.apiPasswordFile,
+        );
+        return {
+          accountConfigured: Boolean(apiUser && apiPasswordConfigured),
+          hasConfiguredValue: apiPasswordConfigured,
+        };
+      },
+      shouldPrompt: ({ credentialValues }) => credentialValues[CONFIGURE_API_FLAG] === "1",
+      applySet: async (params) =>
+        setNextcloudTalkAccountConfig(
+          clearNextcloudTalkAccountFields(params.cfg as CoreConfig, params.accountId, [
+            "apiPassword",
+            "apiPasswordFile",
+          ]),
+          params.accountId,
+          {
+            apiPassword: params.value,
+          },
+        ),
+    },
+  ],
+  textInputs: [
+    {
+      inputKey: "httpUrl",
+      message: "Enter Nextcloud instance URL (e.g., https://cloud.example.com)",
+      currentValue: ({ cfg, accountId }) =>
+        resolveNextcloudTalkAccount({ cfg: cfg as CoreConfig, accountId }).baseUrl || undefined,
+      shouldPrompt: ({ currentValue }) => !currentValue,
+      validate: ({ value }) => validateNextcloudTalkBaseUrl(value),
+      normalizeValue: ({ value }) => normalizeNextcloudTalkBaseUrl(value),
+      applySet: async (params) =>
+        setNextcloudTalkAccountConfig(params.cfg as CoreConfig, params.accountId, {
+          baseUrl: params.value,
+        }),
+    },
+    {
+      inputKey: "userId",
+      message: "Nextcloud Talk API user",
+      currentValue: ({ cfg, accountId }) =>
+        resolveNextcloudTalkAccount({ cfg: cfg as CoreConfig, accountId }).config.apiUser?.trim() ||
+        undefined,
+      shouldPrompt: ({ credentialValues }) => credentialValues[CONFIGURE_API_FLAG] === "1",
+      validate: ({ value }) => (value ? undefined : "Required"),
+      applySet: async (params) =>
+        setNextcloudTalkAccountConfig(params.cfg as CoreConfig, params.accountId, {
+          apiUser: params.value,
+        }),
+    },
+  ],
+  dmPolicy: nextcloudTalkDmPolicy,
+  disable: (cfg) => setSetupChannelEnabled(cfg, channel, false),
+};

package/src/setup.test.ts

@@ -0,0 +1,422 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/routing";
+import { describe, expect, it } from "vitest";
+import { resolveNextcloudTalkAccount } from "./accounts.js";
+import {
+  clearNextcloudTalkAccountFields,
+  nextcloudTalkDmPolicy,
+  nextcloudTalkSetupAdapter,
+  normalizeNextcloudTalkBaseUrl,
+  setNextcloudTalkAccountConfig,
+  validateNextcloudTalkBaseUrl,
+} from "./setup-core.js";
+import { nextcloudTalkSetupWizard } from "./setup-surface.js";
+import type { CoreConfig } from "./types.js";
+
+describe("nextcloud talk setup", () => {
+  it("normalizes and validates base urls", () => {
+    expect(normalizeNextcloudTalkBaseUrl(" https://cloud.example.com/// ")).toBe(
+      "https://cloud.example.com",
+    );
+    expect(normalizeNextcloudTalkBaseUrl(undefined)).toBe("");
+
+    expect(validateNextcloudTalkBaseUrl("")).toBe("Required");
+    expect(validateNextcloudTalkBaseUrl("cloud.example.com")).toBe(
+      "URL must start with http:// or https://",
+    );
+    expect(validateNextcloudTalkBaseUrl("https://cloud.example.com")).toBeUndefined();
+  });
+
+  it("patches scoped account config and clears selected fields", () => {
+    const cfg: CoreConfig = {
+      channels: {
+        "nextcloud-talk": {
+          baseUrl: "https://cloud.example.com",
+          botSecret: "top-secret",
+          accounts: {
+            work: {
+              botSecret: "work-secret",
+              botSecretFile: "/tmp/work-secret",
+              apiPassword: "api-secret",
+            },
+          },
+        },
+      },
+    };
+
+    expect(
+      setNextcloudTalkAccountConfig(cfg, DEFAULT_ACCOUNT_ID, {
+        apiUser: "bot",
+      }),
+    ).toMatchObject({
+      channels: {
+        "nextcloud-talk": {
+          apiUser: "bot",
+        },
+      },
+    });
+
+    expect(clearNextcloudTalkAccountFields(cfg, DEFAULT_ACCOUNT_ID, ["botSecret"])).toMatchObject({
+      channels: {
+        "nextcloud-talk": {
+          baseUrl: "https://cloud.example.com",
+        },
+      },
+    });
+    expect(
+      clearNextcloudTalkAccountFields(cfg, DEFAULT_ACCOUNT_ID, ["botSecret"]),
+    ).not.toMatchObject({
+      channels: {
+        "nextcloud-talk": {
+          botSecret: expect.anything(),
+        },
+      },
+    });
+
+    expect(
+      clearNextcloudTalkAccountFields(cfg, "work", ["botSecret", "botSecretFile"]),
+    ).toMatchObject({
+      channels: {
+        "nextcloud-talk": {
+          accounts: {
+            work: {
+              apiPassword: "api-secret",
+            },
+          },
+        },
+      },
+    });
+  });
+
+  it("sets top-level DM policy state", async () => {
+    const base: CoreConfig = {
+      channels: {
+        "nextcloud-talk": {},
+      },
+    };
+
+    expect(nextcloudTalkDmPolicy.getCurrent(base)).toBe("pairing");
+    expect(nextcloudTalkDmPolicy.setPolicy(base, "open")).toMatchObject({
+      channels: {
+        "nextcloud-talk": {
+          dmPolicy: "open",
+        },
+      },
+    });
+  });
+
+  it("honors named-account DM policy state and config keys", () => {
+    const base: CoreConfig = {
+      channels: {
+        "nextcloud-talk": {
+          dmPolicy: "disabled",
+          accounts: {
+            work: {
+              baseUrl: "https://cloud.example.com",
+              botSecret: "work-secret",
+              dmPolicy: "allowlist",
+            },
+          },
+        },
+      },
+    };
+
+    expect(nextcloudTalkDmPolicy.getCurrent(base, "work")).toBe("allowlist");
+    expect(nextcloudTalkDmPolicy.resolveConfigKeys?.(base, "work")).toEqual({
+      policyKey: "channels.nextcloud-talk.accounts.work.dmPolicy",
+      allowFromKey: "channels.nextcloud-talk.accounts.work.allowFrom",
+    });
+  });
+
+  it("uses configured defaultAccount for omitted DM policy account context", () => {
+    const base: CoreConfig = {
+      channels: {
+        "nextcloud-talk": {
+          defaultAccount: "work",
+          dmPolicy: "disabled",
+          accounts: {
+            work: {
+              baseUrl: "https://cloud.example.com",
+              botSecret: "work-secret",
+              dmPolicy: "allowlist",
+            },
+          },
+        },
+      },
+    };
+
+    expect(nextcloudTalkDmPolicy.getCurrent(base)).toBe("allowlist");
+    expect(nextcloudTalkDmPolicy.resolveConfigKeys?.(base)).toEqual({
+      policyKey: "channels.nextcloud-talk.accounts.work.dmPolicy",
+      allowFromKey: "channels.nextcloud-talk.accounts.work.allowFrom",
+    });
+
+    const next = nextcloudTalkDmPolicy.setPolicy(base, "open");
+    expect(next.channels?.["nextcloud-talk"]?.dmPolicy).toBe("disabled");
+    const workAccount = next.channels?.["nextcloud-talk"]?.accounts?.work as
+      | { dmPolicy?: string; allowFrom?: Array<string | number> }
+      | undefined;
+    expect(workAccount?.dmPolicy).toBe("open");
+  });
+
+  it('writes open DM policy to the named account and preserves inherited allowFrom with "*"', () => {
+    const next = nextcloudTalkDmPolicy.setPolicy(
+      {
+        channels: {
+          "nextcloud-talk": {
+            allowFrom: ["alice"],
+            accounts: {
+              work: {
+                baseUrl: "https://cloud.example.com",
+                botSecret: "work-secret",
+              },
+            },
+          },
+        },
+      },
+      "open",
+      "work",
+    );
+
+    expect(next.channels?.["nextcloud-talk"]?.dmPolicy).toBeUndefined();
+    const workAccount = next.channels?.["nextcloud-talk"]?.accounts?.work as
+      | { dmPolicy?: string; allowFrom?: Array<string | number> }
+      | undefined;
+    expect(workAccount?.dmPolicy).toBe("open");
+    expect(workAccount?.allowFrom).toEqual(["alice", "*"]);
+  });
+
+  it("validates env/default-account constraints and applies config patches", () => {
+    const validateInput = nextcloudTalkSetupAdapter.validateInput;
+    const applyAccountConfig = nextcloudTalkSetupAdapter.applyAccountConfig;
+    expect(validateInput).toBeTypeOf("function");
+    expect(applyAccountConfig).toBeTypeOf("function");
+
+    expect(
+      validateInput!({
+        accountId: "work",
+        input: { useEnv: true },
+      } as never),
+    ).toBe("NEXTCLOUD_TALK_BOT_SECRET can only be used for the default account.");
+
+    expect(
+      validateInput!({
+        accountId: DEFAULT_ACCOUNT_ID,
+        input: { useEnv: false, baseUrl: "", secret: "" },
+      } as never),
+    ).toBe("Nextcloud Talk requires bot secret or --secret-file (or --use-env).");
+
+    expect(
+      validateInput!({
+        accountId: DEFAULT_ACCOUNT_ID,
+        input: { useEnv: false, secret: "secret", baseUrl: "" },
+      } as never),
+    ).toBe("Nextcloud Talk requires --base-url.");
+
+    expect(
+      applyAccountConfig({
+        cfg: {
+          channels: {
+            "nextcloud-talk": {},
+          },
+        },
+        accountId: DEFAULT_ACCOUNT_ID,
+        input: {
+          name: "Default",
+          baseUrl: "https://cloud.example.com///",
+          secret: "bot-secret",
+        },
+      } as never),
+    ).toEqual({
+      channels: {
+        "nextcloud-talk": {
+          enabled: true,
+          name: "Default",
+          baseUrl: "https://cloud.example.com",
+          botSecret: "bot-secret",
+        },
+      },
+    });
+
+    expect(
+      applyAccountConfig({
+        cfg: {
+          channels: {
+            "nextcloud-talk": {
+              accounts: {
+                work: {
+                  botSecret: "old-secret",
+                },
+              },
+            },
+          },
+        },
+        accountId: "work",
+        input: {
+          name: "Work",
+          useEnv: true,
+          baseUrl: "https://cloud.example.com",
+        },
+      } as never),
+    ).toMatchObject({
+      channels: {
+        "nextcloud-talk": {
+          accounts: {
+            work: {
+              enabled: true,
+              name: "Work",
+              baseUrl: "https://cloud.example.com",
+            },
+          },
+        },
+      },
+    });
+  });
+
+  it("clears stored bot secret fields when switching the default account to env", () => {
+    type ApplyAccountConfigContext = Parameters<
+      typeof nextcloudTalkSetupAdapter.applyAccountConfig
+    >[0];
+
+    const next = nextcloudTalkSetupAdapter.applyAccountConfig({
+      cfg: {
+        channels: {
+          "nextcloud-talk": {
+            enabled: true,
+            baseUrl: "https://cloud.old.example",
+            botSecret: "stored-secret",
+            botSecretFile: "/tmp/secret.txt",
+          },
+        },
+      },
+      accountId: DEFAULT_ACCOUNT_ID,
+      input: {
+        baseUrl: "https://cloud.example.com",
+        useEnv: true,
+      },
+    } as unknown as ApplyAccountConfigContext);
+
+    expect(next.channels?.["nextcloud-talk"]?.baseUrl).toBe("https://cloud.example.com");
+    expect(next.channels?.["nextcloud-talk"]).not.toHaveProperty("botSecret");
+    expect(next.channels?.["nextcloud-talk"]).not.toHaveProperty("botSecretFile");
+  });
+
+  it("clears stored bot secret fields when the wizard switches to env", async () => {
+    const credential = nextcloudTalkSetupWizard.credentials[0];
+    const next = await credential.applyUseEnv?.({
+      cfg: {
+        channels: {
+          "nextcloud-talk": {
+            enabled: true,
+            baseUrl: "https://cloud.example.com",
+            botSecret: "stored-secret",
+            botSecretFile: "/tmp/secret.txt",
+          },
+        },
+      },
+      accountId: DEFAULT_ACCOUNT_ID,
+    });
+
+    expect(next?.channels?.["nextcloud-talk"]).not.toHaveProperty("botSecret");
+    expect(next?.channels?.["nextcloud-talk"]).not.toHaveProperty("botSecretFile");
+  });
+});
+
+describe("resolveNextcloudTalkAccount", () => {
+  it("matches normalized configured account ids", () => {
+    const account = resolveNextcloudTalkAccount({
+      cfg: {
+        channels: {
+          "nextcloud-talk": {
+            accounts: {
+              "Ops Team": {
+                baseUrl: "https://cloud.example.com",
+                botSecret: "bot-secret",
+              },
+            },
+          },
+        },
+      } as CoreConfig,
+      accountId: "ops-team",
+    });
+
+    expect(account.accountId).toBe("ops-team");
+    expect(account.baseUrl).toBe("https://cloud.example.com");
+    expect(account.secret).toBe("bot-secret");
+    expect(account.secretSource).toBe("config");
+  });
+
+  it.runIf(process.platform !== "win32")("rejects symlinked botSecretFile paths", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-nextcloud-talk-"));
+    const secretFile = path.join(dir, "secret.txt");
+    const secretLink = path.join(dir, "secret-link.txt");
+    fs.writeFileSync(secretFile, "bot-secret\n", "utf8");
+    fs.symlinkSync(secretFile, secretLink);
+
+    const cfg = {
+      channels: {
+        "nextcloud-talk": {
+          baseUrl: "https://cloud.example.com",
+          botSecretFile: secretLink,
+        },
+      },
+    } as CoreConfig;
+
+    const account = resolveNextcloudTalkAccount({ cfg });
+    expect(account.secret).toBe("");
+    expect(account.secretSource).toBe("none");
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("uses configured defaultAccount when accountId is omitted", () => {
+    const account = resolveNextcloudTalkAccount({
+      cfg: {
+        channels: {
+          "nextcloud-talk": {
+            defaultAccount: "work",
+            botSecret: "top-secret",
+            accounts: {
+              work: {
+                baseUrl: "https://cloud.example.com",
+                botSecret: "work-secret",
+              },
+            },
+          },
+        },
+      } as CoreConfig,
+    });
+
+    expect(account.accountId).toBe("work");
+    expect(account.baseUrl).toBe("https://cloud.example.com");
+    expect(account.secret).toBe("work-secret");
+    expect(account.secretSource).toBe("config");
+  });
+
+  it("uses configured defaultAccount for omitted setup configured state", () => {
+    const configured = nextcloudTalkSetupWizard.status.resolveConfigured({
+      cfg: {
+        channels: {
+          "nextcloud-talk": {
+            defaultAccount: "work",
+            baseUrl: "https://root.example.com",
+            botSecret: "root-secret",
+            accounts: {
+              alerts: {
+                baseUrl: "https://alerts.example.com",
+                botSecret: "alerts-secret",
+              },
+              work: {
+                baseUrl: "",
+                botSecret: "",
+              },
+            },
+          },
+        },
+      } as CoreConfig,
+    });
+
+    expect(configured).toBe(false);
+  });
+});

package/src/signature.ts

@@ -1,4 +1,5 @@
-import { createHmac, randomBytes } from "node:crypto";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
 import type { NextcloudTalkWebhookHeaders } from "./types.js";
 
 const SIGNATURE_HEADER = "x-nextcloud-talk-signature";
@@ -24,14 +25,23 @@ export function verifyNextcloudTalkSignature(params: {
     .update(random + body)
     .digest("hex");
 
-  if (signature.length !== expected.length) {
-    return false;
-  }
-  let result = 0;
-  for (let i = 0; i < signature.length; i++) {
-    result |= signature.charCodeAt(i) ^ expected.charCodeAt(i);
-  }
-  return result === 0;
+  const expectedBuf = Buffer.from(expected, "utf8");
+  const signatureBuf = Buffer.from(signature, "utf8");
+
+  // Pad to equal length before constant-time comparison to prevent
+  // leaking length information via early-return timing.
+  // Note: digest("hex") always produces lowercase ASCII (64 bytes for SHA-256),
+  // so expectedBuf is always 64 bytes — no variable-length concern on the expected side.
+  const maxLen = Math.max(expectedBuf.length, signatureBuf.length);
+  const paddedExpected = Buffer.alloc(maxLen);
+  const paddedSignature = Buffer.alloc(maxLen);
+  expectedBuf.copy(paddedExpected);
+  signatureBuf.copy(paddedSignature);
+
+  // Use crypto.timingSafeEqual instead of manual XOR loop to avoid
+  // potential JIT-optimisation timing leaks in the JavaScript engine.
+  const timingResult = timingSafeEqual(paddedExpected, paddedSignature);
+  return expectedBuf.length === signatureBuf.length && timingResult;
 }
 
 /**
@@ -41,7 +51,7 @@ export function extractNextcloudTalkHeaders(
   headers: Record<string, string | string[] | undefined>,
 ): NextcloudTalkWebhookHeaders | null {
   const getHeader = (name: string): string | undefined => {
-    const value = headers[name] ?? headers[name.toLowerCase()];
+    const value = headers[name] ?? headers[normalizeLowercaseStringOrEmpty(name)];
     return Array.isArray(value) ? value[0] : value;
   };