@openclaw/nextcloud-talk 2026.3.12 → 2026.5.1-beta.2

package/src/monitor.replay.test.ts

@@ -1,9 +1,112 @@
+import { createMockIncomingRequest } from "openclaw/plugin-sdk/test-env";
 import { describe, expect, it, vi } from "vitest";
+import {
+  NextcloudTalkRetryableWebhookError,
+  processNextcloudTalkReplayGuardedMessage,
+  readNextcloudTalkWebhookBody,
+} from "./monitor.js";
 import { createSignedCreateMessageRequest } from "./monitor.test-fixtures.js";
 import { startWebhookServer } from "./monitor.test-harness.js";
+import { createNextcloudTalkReplayGuard } from "./replay-guard.js";
+import { generateNextcloudTalkSignature } from "./signature.js";
 import type { NextcloudTalkInboundMessage } from "./types.js";
 
+describe("readNextcloudTalkWebhookBody", () => {
+  it("reads valid body within max bytes", async () => {
+    const req = createMockIncomingRequest(['{"type":"Create"}']);
+    const body = await readNextcloudTalkWebhookBody(req, 1024);
+    expect(body).toBe('{"type":"Create"}');
+  });
+
+  it("rejects when payload exceeds max bytes", async () => {
+    const req = createMockIncomingRequest(["x".repeat(300)]);
+    await expect(readNextcloudTalkWebhookBody(req, 128)).rejects.toThrow("PayloadTooLarge");
+  });
+});
+
+describe("createNextcloudTalkWebhookServer auth order", () => {
+  it("rejects missing signature headers before reading request body", async () => {
+    const readBody = vi.fn(async () => {
+      throw new Error("should not be called for missing signature headers");
+    });
+    const harness = await startWebhookServer({
+      path: "/nextcloud-auth-order",
+      maxBodyBytes: 128,
+      readBody,
+      onMessage: vi.fn(),
+    });
+
+    const response = await fetch(harness.webhookUrl, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+      },
+      body: "{}",
+    });
+
+    expect(response.status).toBe(400);
+    expect(await response.json()).toEqual({ error: "Missing signature headers" });
+    expect(readBody).not.toHaveBeenCalled();
+  });
+});
+
+describe("createNextcloudTalkWebhookServer backend allowlist", () => {
+  it("rejects requests from unexpected backend origins", async () => {
+    const onMessage = vi.fn(async () => {});
+    const harness = await startWebhookServer({
+      path: "/nextcloud-backend-check",
+      isBackendAllowed: (backend) => backend === "https://nextcloud.expected",
+      onMessage,
+    });
+
+    const { body, headers } = createSignedCreateMessageRequest({
+      backend: "https://nextcloud.unexpected",
+    });
+    const response = await fetch(harness.webhookUrl, {
+      method: "POST",
+      headers,
+      body,
+    });
+
+    expect(response.status).toBe(401);
+    expect(await response.json()).toEqual({ error: "Invalid backend" });
+    expect(onMessage).not.toHaveBeenCalled();
+  });
+});
+
 describe("createNextcloudTalkWebhookServer replay handling", () => {
+  function createReplayGuardedProcess(params: {
+    stateDir?: string;
+    accountId?: string;
+    handleMessage: () => Promise<void>;
+  }) {
+    const replayGuard = createNextcloudTalkReplayGuard(
+      params.stateDir ? { stateDir: params.stateDir } : {},
+    );
+
+    return (message: NextcloudTalkInboundMessage) =>
+      processNextcloudTalkReplayGuardedMessage({
+        replayGuard,
+        accountId: params.accountId ?? "acct",
+        message,
+        handleMessage: params.handleMessage,
+      });
+  }
+
+  function buildInboundMessage(): NextcloudTalkInboundMessage {
+    return {
+      messageId: "msg-1",
+      roomToken: "room-token",
+      roomName: "Room 1",
+      senderId: "alice",
+      senderName: "Alice",
+      text: "hello",
+      mediaType: "text/plain",
+      timestamp: 1_700_000_000_000,
+      isGroupChat: true,
+    };
+  }
+
   it("acknowledges replayed requests and skips onMessage side effects", async () => {
     const seen = new Set<string>();
     const onMessage = vi.fn(async () => {});
@@ -38,4 +141,139 @@ describe("createNextcloudTalkWebhookServer replay handling", () => {
     expect(shouldProcessMessage).toHaveBeenCalledTimes(2);
     expect(onMessage).toHaveBeenCalledTimes(1);
   });
+
+  it("allows a retry after replay-guarded processing fails before commit", async () => {
+    let attempts = 0;
+    const handleMessage = vi.fn(async () => {
+      attempts += 1;
+      if (attempts === 1) {
+        throw new NextcloudTalkRetryableWebhookError("transient nextcloud failure");
+      }
+    });
+    const processMessage = createReplayGuardedProcess({
+      handleMessage,
+    });
+    const message = buildInboundMessage();
+
+    await expect(processMessage(message)).rejects.toThrow("transient nextcloud failure");
+    await expect(processMessage(message)).resolves.toBe("processed");
+
+    expect(handleMessage).toHaveBeenCalledTimes(2);
+  });
+
+  it("keeps replay committed after a non-retryable replay-guarded processing failure", async () => {
+    const visibleSideEffect = vi.fn();
+    const handleMessage = vi.fn(async () => {
+      visibleSideEffect();
+      throw new Error("post-send failure");
+    });
+    const processMessage = createReplayGuardedProcess({
+      handleMessage,
+    });
+    const message = buildInboundMessage();
+
+    await expect(processMessage(message)).rejects.toThrow("post-send failure");
+    await expect(processMessage(message)).resolves.toBe("duplicate");
+
+    expect(handleMessage).toHaveBeenCalledTimes(1);
+    expect(visibleSideEffect).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("createNextcloudTalkWebhookServer payload validation", () => {
+  it("rejects malformed webhook payloads after signature verification", async () => {
+    const payload = {
+      type: "Create",
+      actor: { type: "Person", id: "alice", name: "Alice" },
+      object: {
+        type: "Note",
+        id: "msg-1",
+        name: "hello",
+        content: "hello",
+        mediaType: "text/plain",
+      },
+      target: { type: "Collection", id: "", name: "Room 1" },
+    };
+    const body = JSON.stringify(payload);
+    const { random, signature } = generateNextcloudTalkSignature({
+      body,
+      secret: "nextcloud-secret", // pragma: allowlist secret
+    });
+    const harness = await startWebhookServer({
+      path: "/nextcloud-invalid-payload",
+      onMessage: vi.fn(),
+    });
+
+    const response = await fetch(harness.webhookUrl, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-nextcloud-talk-random": random,
+        "x-nextcloud-talk-signature": signature,
+        "x-nextcloud-talk-backend": "https://nextcloud.example",
+      },
+      body,
+    });
+
+    expect(response.status).toBe(400);
+    expect(await response.json()).toEqual({ error: "Invalid payload format" });
+  });
+});
+
+describe("createNextcloudTalkWebhookServer auth rate limiting", () => {
+  it("rate limits repeated invalid signature attempts from the same source", async () => {
+    const maxRequests = 1;
+    const harness = await startWebhookServer({
+      path: "/nextcloud-auth-rate-limit",
+      authRateLimit: { maxRequests },
+      onMessage: vi.fn(),
+    });
+    const { body, headers } = createSignedCreateMessageRequest();
+    const invalidHeaders = {
+      ...headers,
+      "x-nextcloud-talk-signature": "invalid-signature",
+    };
+
+    let firstResponse: Response | undefined;
+    let lastResponse: Response | undefined;
+    for (let attempt = 0; attempt <= maxRequests; attempt += 1) {
+      const response = await fetch(harness.webhookUrl, {
+        method: "POST",
+        headers: invalidHeaders,
+        body,
+      });
+      if (attempt === 0) {
+        firstResponse = response;
+      }
+      lastResponse = response;
+    }
+
+    expect(firstResponse).toBeDefined();
+    expect(firstResponse?.status).toBe(401);
+    expect(lastResponse).toBeDefined();
+    expect(lastResponse?.status).toBe(429);
+    expect(await lastResponse?.text()).toBe("Too Many Requests");
+  });
+
+  it("does not rate limit valid signed webhook bursts from the same source", async () => {
+    const maxRequests = 1;
+    const harness = await startWebhookServer({
+      path: "/nextcloud-auth-rate-limit-valid",
+      authRateLimit: { maxRequests },
+      onMessage: vi.fn(),
+    });
+    const { body, headers } = createSignedCreateMessageRequest();
+
+    let lastResponse: Response | undefined;
+    for (let attempt = 0; attempt <= maxRequests; attempt += 1) {
+      lastResponse = await fetch(harness.webhookUrl, {
+        method: "POST",
+        headers,
+        body,
+      });
+    }
+
+    expect(lastResponse).toBeDefined();
+    expect(lastResponse?.status).toBe(200);
+  });
 });

package/src/monitor.test-harness.ts

@@ -3,7 +3,7 @@ import { afterEach } from "vitest";
 import { createNextcloudTalkWebhookServer } from "./monitor.js";
 import type { NextcloudTalkWebhookServerOptions } from "./types.js";
 
-export type WebhookHarness = {
+type WebhookHarness = {
   webhookUrl: string;
   stop: () => Promise<void>;
 };
@@ -19,7 +19,7 @@ afterEach(async () => {
   }
 });
 
-export type StartWebhookServerParams = Omit<
+type StartWebhookServerParams = Omit<
   NextcloudTalkWebhookServerOptions,
   "port" | "host" | "path" | "secret"
 > & {

package/src/monitor.ts

@@ -1,31 +1,47 @@
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
-import os from "node:os";
+import { safeParseJsonWithSchema } from "openclaw/plugin-sdk/extension-shared";
 import {
-  createLoggerBackedRuntime,
-  type RuntimeEnv,
+  WEBHOOK_RATE_LIMIT_DEFAULTS,
+  createAuthRateLimiter,
   isRequestBodyLimitError,
   readRequestBodyWithLimit,
   requestBodyErrorToText,
-} from "openclaw/plugin-sdk/nextcloud-talk";
-import { resolveNextcloudTalkAccount } from "./accounts.js";
-import { handleNextcloudTalkInbound } from "./inbound.js";
-import { createNextcloudTalkReplayGuard } from "./replay-guard.js";
-import { getNextcloudTalkRuntime } from "./runtime.js";
+} from "openclaw/plugin-sdk/webhook-ingress";
+import { z } from "zod";
+import type { NextcloudTalkReplayGuard } from "./replay-guard.js";
 import { extractNextcloudTalkHeaders, verifyNextcloudTalkSignature } from "./signature.js";
 import type {
-  CoreConfig,
   NextcloudTalkInboundMessage,
   NextcloudTalkWebhookHeaders,
   NextcloudTalkWebhookPayload,
   NextcloudTalkWebhookServerOptions,
 } from "./types.js";
 
-const DEFAULT_WEBHOOK_PORT = 8788;
-const DEFAULT_WEBHOOK_HOST = "0.0.0.0";
-const DEFAULT_WEBHOOK_PATH = "/nextcloud-talk-webhook";
 const DEFAULT_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
-const DEFAULT_WEBHOOK_BODY_TIMEOUT_MS = 30_000;
+const PREAUTH_WEBHOOK_MAX_BODY_BYTES = 64 * 1024;
+const PREAUTH_WEBHOOK_BODY_TIMEOUT_MS = 5_000;
 const HEALTH_PATH = "/healthz";
+const WEBHOOK_AUTH_RATE_LIMIT_SCOPE = "nextcloud-talk-webhook-auth";
+const NextcloudTalkWebhookPayloadSchema: z.ZodType<NextcloudTalkWebhookPayload> = z.object({
+  type: z.enum(["Create", "Update", "Delete"]),
+  actor: z.object({
+    type: z.literal("Person"),
+    id: z.string().min(1),
+    name: z.string(),
+  }),
+  object: z.object({
+    type: z.literal("Note"),
+    id: z.string().min(1),
+    name: z.string(),
+    content: z.string(),
+    mediaType: z.string(),
+  }),
+  target: z.object({
+    type: z.literal("Collection"),
+    id: z.string().min(1),
+    name: z.string(),
+  }),
+});
 const WEBHOOK_ERRORS = {
   missingSignatureHeaders: "Missing signature headers",
   invalidBackend: "Invalid backend",
@@ -35,41 +51,68 @@ const WEBHOOK_ERRORS = {
   internalServerError: "Internal server error",
 } as const;
 
-function formatError(err: unknown): string {
-  if (err instanceof Error) {
-    return err.message;
+export class NextcloudTalkRetryableWebhookError extends Error {
+  constructor(message: string, options?: ErrorOptions) {
+    super(message, options);
+    this.name = "NextcloudTalkRetryableWebhookError";
   }
-  return typeof err === "string" ? err : JSON.stringify(err);
 }
 
-function normalizeOrigin(value: string): string | null {
-  try {
-    return new URL(value).origin.toLowerCase();
-  } catch {
-    return null;
+export async function processNextcloudTalkReplayGuardedMessage(params: {
+  replayGuard: NextcloudTalkReplayGuard;
+  accountId: string;
+  message: NextcloudTalkInboundMessage;
+  handleMessage: () => Promise<void>;
+}): Promise<"processed" | "duplicate"> {
+  const claim = await params.replayGuard.claimMessage({
+    accountId: params.accountId,
+    roomToken: params.message.roomToken,
+    messageId: params.message.messageId,
+  });
+  if (claim !== "claimed") {
+    return "duplicate";
   }
-}
 
-function parseWebhookPayload(body: string): NextcloudTalkWebhookPayload | null {
   try {
-    const data = JSON.parse(body);
-    if (
-      !data.type ||
-      !data.actor?.type ||
-      !data.actor?.id ||
-      !data.object?.type ||
-      !data.object?.id ||
-      !data.target?.type ||
-      !data.target?.id
-    ) {
-      return null;
+    await params.handleMessage();
+    await params.replayGuard.commitMessage({
+      accountId: params.accountId,
+      roomToken: params.message.roomToken,
+      messageId: params.message.messageId,
+    });
+    return "processed";
+  } catch (error) {
+    if (error instanceof NextcloudTalkRetryableWebhookError) {
+      params.replayGuard.releaseMessage({
+        accountId: params.accountId,
+        roomToken: params.message.roomToken,
+        messageId: params.message.messageId,
+        error,
+      });
+    } else {
+      // Generic failures are treated as non-retryable because the handler may already
+      // have produced a visible side effect, and replaying the webhook would duplicate it.
+      await params.replayGuard.commitMessage({
+        accountId: params.accountId,
+        roomToken: params.message.roomToken,
+        messageId: params.message.messageId,
+      });
     }
-    return data as NextcloudTalkWebhookPayload;
-  } catch {
-    return null;
+    throw error;
   }
 }
 
+function formatError(err: unknown): string {
+  if (err instanceof Error) {
+    return err.message;
+  }
+  return typeof err === "string" ? err : JSON.stringify(err);
+}
+
+function parseWebhookPayload(body: string): NextcloudTalkWebhookPayload | null {
+  return safeParseJsonWithSchema(NextcloudTalkWebhookPayloadSchema, body);
+}
+
 function writeJsonResponse(
   res: ServerResponse,
   status: number,
@@ -115,6 +158,8 @@ function verifyWebhookSignature(params: {
   body: string;
   secret: string;
   res: ServerResponse;
+  clientIp: string;
+  authRateLimiter: ReturnType<typeof createAuthRateLimiter>;
 }): boolean {
   const isValid = verifyNextcloudTalkSignature({
     signature: params.headers.signature,
@@ -123,9 +168,11 @@ function verifyWebhookSignature(params: {
     secret: params.secret,
   });
   if (!isValid) {
+    params.authRateLimiter.recordFailure(params.clientIp, WEBHOOK_AUTH_RATE_LIMIT_SCOPE);
     writeWebhookError(params.res, 401, WEBHOOK_ERRORS.invalidSignature);
     return false;
   }
+  params.authRateLimiter.reset(params.clientIp, WEBHOOK_AUTH_RATE_LIMIT_SCOPE);
   return true;
 }
 
@@ -154,7 +201,7 @@ function payloadToInboundMessage(
   const isGroupChat = true;
 
   return {
-    messageId: String(payload.object.id),
+    messageId: payload.object.id,
     roomToken: payload.target.id,
     roomName: payload.target.name,
     senderId: payload.actor.id,
@@ -171,8 +218,10 @@ export function readNextcloudTalkWebhookBody(
   maxBodyBytes: number,
 ): Promise<string> {
   return readRequestBodyWithLimit(req, {
-    maxBytes: maxBodyBytes,
-    timeoutMs: DEFAULT_WEBHOOK_BODY_TIMEOUT_MS,
+    // This read happens before signature verification, so keep the unauthenticated
+    // body budget bounded even if the operator-configured post-parse limit is larger.
+    maxBytes: Math.min(maxBodyBytes, PREAUTH_WEBHOOK_MAX_BODY_BYTES),
+    timeoutMs: PREAUTH_WEBHOOK_BODY_TIMEOUT_MS,
   });
 }
 
@@ -191,6 +240,22 @@ export function createNextcloudTalkWebhookServer(opts: NextcloudTalkWebhookServe
   const readBody = opts.readBody ?? readNextcloudTalkWebhookBody;
   const isBackendAllowed = opts.isBackendAllowed;
   const shouldProcessMessage = opts.shouldProcessMessage;
+  const processMessage = opts.processMessage;
+  const authRateLimitMaxRequests =
+    typeof opts.authRateLimit?.maxRequests === "number"
+      ? opts.authRateLimit.maxRequests
+      : WEBHOOK_RATE_LIMIT_DEFAULTS.maxRequests;
+  const authRateLimitWindowMs =
+    typeof opts.authRateLimit?.windowMs === "number"
+      ? opts.authRateLimit.windowMs
+      : WEBHOOK_RATE_LIMIT_DEFAULTS.windowMs;
+  const webhookAuthRateLimiter = createAuthRateLimiter({
+    maxAttempts: authRateLimitMaxRequests,
+    windowMs: authRateLimitWindowMs,
+    lockoutMs: authRateLimitWindowMs,
+    exemptLoopback: false,
+    pruneIntervalMs: authRateLimitWindowMs,
+  });
 
   const server = createServer(async (req: IncomingMessage, res: ServerResponse) => {
     if (req.url === HEALTH_PATH) {
@@ -205,6 +270,13 @@ export function createNextcloudTalkWebhookServer(opts: NextcloudTalkWebhookServe
       return;
     }
 
+    const clientIp = req.socket.remoteAddress ?? "unknown";
+    if (!webhookAuthRateLimiter.check(clientIp, WEBHOOK_AUTH_RATE_LIMIT_SCOPE).allowed) {
+      res.writeHead(429);
+      res.end("Too Many Requests");
+      return;
+    }
+
     try {
       const headers = validateWebhookHeaders({
         req,
@@ -222,6 +294,8 @@ export function createNextcloudTalkWebhookServer(opts: NextcloudTalkWebhookServe
         body,
         secret,
         res,
+        clientIp,
+        authRateLimiter: webhookAuthRateLimiter,
       });
       if (!hasValidSignature) {
         return;
@@ -240,6 +314,16 @@ export function createNextcloudTalkWebhookServer(opts: NextcloudTalkWebhookServe
       }
 
       const message = decoded.message;
+      if (processMessage) {
+        writeJsonResponse(res, 200);
+        try {
+          await processMessage(message);
+        } catch (err) {
+          onError?.(err instanceof Error ? err : new Error(formatError(err)));
+        }
+        return;
+      }
+
       if (shouldProcessMessage) {
         const shouldProcess = await shouldProcessMessage(message);
         if (!shouldProcess) {
@@ -299,117 +383,3 @@ export function createNextcloudTalkWebhookServer(opts: NextcloudTalkWebhookServe
 
   return { server, start, stop };
 }
-
-export type NextcloudTalkMonitorOptions = {
-  accountId?: string;
-  config?: CoreConfig;
-  runtime?: RuntimeEnv;
-  abortSignal?: AbortSignal;
-  onMessage?: (message: NextcloudTalkInboundMessage) => void | Promise<void>;
-  statusSink?: (patch: { lastInboundAt?: number; lastOutboundAt?: number }) => void;
-};
-
-export async function monitorNextcloudTalkProvider(
-  opts: NextcloudTalkMonitorOptions,
-): Promise<{ stop: () => void }> {
-  const core = getNextcloudTalkRuntime();
-  const cfg = opts.config ?? (core.config.loadConfig() as CoreConfig);
-  const account = resolveNextcloudTalkAccount({
-    cfg,
-    accountId: opts.accountId,
-  });
-  const runtime: RuntimeEnv =
-    opts.runtime ??
-    createLoggerBackedRuntime({
-      logger: core.logging.getChildLogger(),
-      exitError: () => new Error("Runtime exit not available"),
-    });
-
-  if (!account.secret) {
-    throw new Error(`Nextcloud Talk bot secret not configured for account "${account.accountId}"`);
-  }
-
-  const port = account.config.webhookPort ?? DEFAULT_WEBHOOK_PORT;
-  const host = account.config.webhookHost ?? DEFAULT_WEBHOOK_HOST;
-  const path = account.config.webhookPath ?? DEFAULT_WEBHOOK_PATH;
-
-  const logger = core.logging.getChildLogger({
-    channel: "nextcloud-talk",
-    accountId: account.accountId,
-  });
-  const expectedBackendOrigin = normalizeOrigin(account.baseUrl);
-  const replayGuard = createNextcloudTalkReplayGuard({
-    stateDir: core.state.resolveStateDir(process.env, os.homedir),
-    onDiskError: (error) => {
-      logger.warn(
-        `[nextcloud-talk:${account.accountId}] replay guard disk error: ${String(error)}`,
-      );
-    },
-  });
-
-  const { start, stop } = createNextcloudTalkWebhookServer({
-    port,
-    host,
-    path,
-    secret: account.secret,
-    isBackendAllowed: (backend) => {
-      if (!expectedBackendOrigin) {
-        return true;
-      }
-      const backendOrigin = normalizeOrigin(backend);
-      return backendOrigin === expectedBackendOrigin;
-    },
-    shouldProcessMessage: async (message) => {
-      const shouldProcess = await replayGuard.shouldProcessMessage({
-        accountId: account.accountId,
-        roomToken: message.roomToken,
-        messageId: message.messageId,
-      });
-      if (!shouldProcess) {
-        logger.warn(
-          `[nextcloud-talk:${account.accountId}] replayed webhook ignored room=${message.roomToken} messageId=${message.messageId}`,
-        );
-      }
-      return shouldProcess;
-    },
-    onMessage: async (message) => {
-      core.channel.activity.record({
-        channel: "nextcloud-talk",
-        accountId: account.accountId,
-        direction: "inbound",
-        at: message.timestamp,
-      });
-      if (opts.onMessage) {
-        await opts.onMessage(message);
-        return;
-      }
-      await handleNextcloudTalkInbound({
-        message,
-        account,
-        config: cfg,
-        runtime,
-        statusSink: opts.statusSink,
-      });
-    },
-    onError: (error) => {
-      logger.error(`[nextcloud-talk:${account.accountId}] webhook error: ${error.message}`);
-    },
-    abortSignal: opts.abortSignal,
-  });
-
-  if (opts.abortSignal?.aborted) {
-    return { stop };
-  }
-  await start();
-  if (opts.abortSignal?.aborted) {
-    stop();
-    return { stop };
-  }
-
-  const publicUrl =
-    account.config.webhookPublicUrl ??
-    `http://${host === "0.0.0.0" ? "localhost" : host}:${port}${path}`;
-  logger.info(`[nextcloud-talk:${account.accountId}] webhook listening on ${publicUrl}`);
-
-  return { stop };
-}

package/src/normalize.ts

@@ -1,4 +1,4 @@
-export function normalizeNextcloudTalkMessagingTarget(raw: string): string | undefined {
+export function stripNextcloudTalkTargetPrefix(raw: string): string | undefined {
   const trimmed = raw.trim();
   if (!trimmed) {
     return undefined;
@@ -22,7 +22,12 @@ export function normalizeNextcloudTalkMessagingTarget(raw: string): string | und
     return undefined;
   }
 
-  return `nextcloud-talk:${normalized}`.toLowerCase();
+  return normalized;
+}
+
+export function normalizeNextcloudTalkMessagingTarget(raw: string): string | undefined {
+  const normalized = stripNextcloudTalkTargetPrefix(raw);
+  return normalized ? `nextcloud-talk:${normalized}`.toLowerCase() : undefined;
 }
 
 export function looksLikeNextcloudTalkTargetId(raw: string): boolean {