@openclaw/nextcloud-talk 2026.5.2-beta.2 → 2026.5.3-beta.1

package/src/core.test.ts

@@ -1,397 +0,0 @@
-import { mkdtemp, rm } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import {
-  looksLikeNextcloudTalkTargetId,
-  normalizeNextcloudTalkMessagingTarget,
-  stripNextcloudTalkTargetPrefix,
-} from "./normalize.js";
-import { resolveNextcloudTalkAllowlistMatch, resolveNextcloudTalkGroupAllow } from "./policy.js";
-import { createNextcloudTalkReplayGuard } from "./replay-guard.js";
-import { resolveNextcloudTalkOutboundSessionRoute } from "./session-route.js";
-import {
-  extractNextcloudTalkHeaders,
-  generateNextcloudTalkSignature,
-  verifyNextcloudTalkSignature,
-} from "./signature.js";
-
-const tempDirs: string[] = [];
-
-afterEach(async () => {
-  while (tempDirs.length > 0) {
-    const dir = tempDirs.pop();
-    if (dir) {
-      await rm(dir, { recursive: true, force: true });
-    }
-  }
-});
-
-async function makeTempDir(): Promise<string> {
-  const dir = await mkdtemp(path.join(os.tmpdir(), "nextcloud-talk-replay-"));
-  tempDirs.push(dir);
-  return dir;
-}
-
-describe("nextcloud talk core", () => {
-  it("builds an outbound session route for normalized room targets", () => {
-    const route = resolveNextcloudTalkOutboundSessionRoute({
-      cfg: {},
-      agentId: "main",
-      accountId: "acct-1",
-      target: "nextcloud-talk:room-123",
-    });
-
-    expect(route).toMatchObject({
-      peer: {
-        kind: "group",
-        id: "room-123",
-      },
-      from: "nextcloud-talk:room:room-123",
-      to: "nextcloud-talk:room-123",
-    });
-  });
-
-  it("returns null when the target cannot be normalized to a room id", () => {
-    expect(
-      resolveNextcloudTalkOutboundSessionRoute({
-        cfg: {},
-        agentId: "main",
-        accountId: "acct-1",
-        target: "",
-      }),
-    ).toBeNull();
-  });
-
-  it("normalizes and recognizes supported room target formats", () => {
-    expect(stripNextcloudTalkTargetPrefix(" room:abc123 ")).toBe("abc123");
-    expect(stripNextcloudTalkTargetPrefix("nextcloud-talk:room:AbC123")).toBe("AbC123");
-    expect(stripNextcloudTalkTargetPrefix("nc-talk:room:ops")).toBe("ops");
-    expect(stripNextcloudTalkTargetPrefix("nc:room:ops")).toBe("ops");
-    expect(stripNextcloudTalkTargetPrefix("room:   ")).toBeUndefined();
-
-    expect(normalizeNextcloudTalkMessagingTarget("room:AbC123")).toBe("nextcloud-talk:abc123");
-    expect(normalizeNextcloudTalkMessagingTarget("nc-talk:room:Ops")).toBe("nextcloud-talk:ops");
-
-    expect(looksLikeNextcloudTalkTargetId("nextcloud-talk:room:abc12345")).toBe(true);
-    expect(looksLikeNextcloudTalkTargetId("nc:opsroom1")).toBe(true);
-    expect(looksLikeNextcloudTalkTargetId("abc12345")).toBe(true);
-    expect(looksLikeNextcloudTalkTargetId("")).toBe(false);
-  });
-
-  it("verifies generated signatures and extracts normalized headers", () => {
-    const body = JSON.stringify({ hello: "world" });
-    const generated = generateNextcloudTalkSignature({
-      body,
-      secret: "secret-123",
-    });
-
-    expect(generated.random).toMatch(/^[0-9a-f]{64}$/);
-    expect(generated.signature).toMatch(/^[0-9a-f]{64}$/);
-    expect(
-      verifyNextcloudTalkSignature({
-        signature: generated.signature,
-        random: generated.random,
-        body,
-        secret: "secret-123",
-      }),
-    ).toBe(true);
-    expect(
-      verifyNextcloudTalkSignature({
-        signature: "",
-        random: "abc",
-        body: "body",
-        secret: "secret",
-      }),
-    ).toBe(false);
-    expect(
-      verifyNextcloudTalkSignature({
-        signature: "deadbeef",
-        random: "abc",
-        body: "body",
-        secret: "secret",
-      }),
-    ).toBe(false);
-
-    expect(
-      extractNextcloudTalkHeaders({
-        "x-nextcloud-talk-signature": "sig",
-        "x-nextcloud-talk-random": "rand",
-        "x-nextcloud-talk-backend": "backend",
-      }),
-    ).toEqual({
-      signature: "sig",
-      random: "rand",
-      backend: "backend",
-    });
-    expect(
-      extractNextcloudTalkHeaders({
-        "X-Nextcloud-Talk-Signature": "sig",
-      }),
-    ).toBeNull();
-  });
-
-  it("rejects tampered bodies, wrong secrets, and tampered signatures", () => {
-    const body = JSON.stringify({ hello: "world" });
-    const generated = generateNextcloudTalkSignature({
-      body,
-      secret: "secret-123",
-    });
-
-    expect(
-      verifyNextcloudTalkSignature({
-        signature: generated.signature,
-        random: generated.random,
-        body: JSON.stringify({ hello: "tampered" }),
-        secret: "secret-123",
-      }),
-    ).toBe(false);
-    expect(
-      verifyNextcloudTalkSignature({
-        signature: generated.signature,
-        random: generated.random,
-        body,
-        secret: "wrong-secret",
-      }),
-    ).toBe(false);
-    expect(
-      verifyNextcloudTalkSignature({
-        signature: "a".repeat(generated.signature.length),
-        random: generated.random,
-        body,
-        secret: "secret-123",
-      }),
-    ).toBe(false);
-  });
-
-  it("takes the first value from array-backed headers", () => {
-    expect(
-      extractNextcloudTalkHeaders({
-        "x-nextcloud-talk-signature": ["sig1", "sig2"],
-        "x-nextcloud-talk-random": ["rand1", "rand2"],
-        "x-nextcloud-talk-backend": ["backend1", "backend2"],
-      }),
-    ).toEqual({
-      signature: "sig1",
-      random: "rand1",
-      backend: "backend1",
-    });
-  });
-
-  it("still runs timingSafeEqual when the supplied signature length mismatches", async () => {
-    const timingSafeEqualMock = vi.fn();
-
-    vi.resetModules();
-    vi.doMock("node:crypto", async (importOriginal) => {
-      const actual = await importOriginal<typeof import("node:crypto")>();
-      return {
-        ...actual,
-        timingSafeEqual: vi.fn((left: NodeJS.ArrayBufferView, right: NodeJS.ArrayBufferView) => {
-          timingSafeEqualMock(left, right);
-          return actual.timingSafeEqual(left, right);
-        }),
-      };
-    });
-
-    const { generateNextcloudTalkSignature, verifyNextcloudTalkSignature } =
-      await import("./signature.js");
-    const body = JSON.stringify({ hello: "world" });
-    const generated = generateNextcloudTalkSignature({
-      body,
-      secret: "secret-123",
-    });
-    const shortSignature = generated.signature.slice(0, 12);
-
-    expect(
-      verifyNextcloudTalkSignature({
-        signature: shortSignature,
-        random: generated.random,
-        body,
-        secret: "secret-123",
-      }),
-    ).toBe(false);
-
-    expect(timingSafeEqualMock).toHaveBeenCalledOnce();
-    const [leftBuffer, rightBuffer] = timingSafeEqualMock.mock.calls[0] ?? [];
-    expect(Buffer.isBuffer(leftBuffer)).toBe(true);
-    expect(Buffer.isBuffer(rightBuffer)).toBe(true);
-    if (!Buffer.isBuffer(leftBuffer) || !Buffer.isBuffer(rightBuffer)) {
-      throw new TypeError("Expected timingSafeEqual to receive Buffer arguments");
-    }
-    expect(leftBuffer).toHaveLength(rightBuffer.length);
-
-    vi.doUnmock("node:crypto");
-    vi.resetModules();
-  });
-
-  it("persists replay decisions across guard instances and scopes account namespaces", async () => {
-    const stateDir = await makeTempDir();
-
-    const firstGuard = createNextcloudTalkReplayGuard({ stateDir });
-    const firstAttempt = await firstGuard.shouldProcessMessage({
-      accountId: "account-a",
-      roomToken: "room-1",
-      messageId: "msg-1",
-    });
-    const replayAttempt = await firstGuard.shouldProcessMessage({
-      accountId: "account-a",
-      roomToken: "room-1",
-      messageId: "msg-1",
-    });
-
-    const secondGuard = createNextcloudTalkReplayGuard({ stateDir });
-    const restartReplayAttempt = await secondGuard.shouldProcessMessage({
-      accountId: "account-a",
-      roomToken: "room-1",
-      messageId: "msg-1",
-    });
-    const otherAccountFirstAttempt = await secondGuard.shouldProcessMessage({
-      accountId: "account-b",
-      roomToken: "room-1",
-      messageId: "msg-1",
-    });
-
-    expect(firstAttempt).toBe(true);
-    expect(replayAttempt).toBe(false);
-    expect(restartReplayAttempt).toBe(false);
-    expect(otherAccountFirstAttempt).toBe(true);
-  });
-
-  it("releases in-flight replay claims when processing fails", async () => {
-    const guard = createNextcloudTalkReplayGuard({});
-
-    const firstClaim = await guard.claimMessage({
-      accountId: "account-a",
-      roomToken: "room-1",
-      messageId: "msg-claim",
-    });
-    const secondClaim = await guard.claimMessage({
-      accountId: "account-a",
-      roomToken: "room-1",
-      messageId: "msg-claim",
-    });
-
-    expect(firstClaim).toBe("claimed");
-    expect(secondClaim).toBe("inflight");
-
-    guard.releaseMessage({
-      accountId: "account-a",
-      roomToken: "room-1",
-      messageId: "msg-claim",
-      error: new Error("transient"),
-    });
-
-    const retryClaim = await guard.claimMessage({
-      accountId: "account-a",
-      roomToken: "room-1",
-      messageId: "msg-claim",
-    });
-    expect(retryClaim).toBe("claimed");
-  });
-
-  it("resolves allowlist matches and group policy decisions", () => {
-    expect(
-      resolveNextcloudTalkAllowlistMatch({
-        allowFrom: ["*"],
-        senderId: "user-id",
-      }).allowed,
-    ).toBe(true);
-    expect(
-      resolveNextcloudTalkAllowlistMatch({
-        allowFrom: ["nc:User-Id"],
-        senderId: "user-id",
-      }),
-    ).toEqual({ allowed: true, matchKey: "user-id", matchSource: "id" });
-    expect(
-      resolveNextcloudTalkAllowlistMatch({
-        allowFrom: ["allowed"],
-        senderId: "other",
-      }).allowed,
-    ).toBe(false);
-
-    expect(
-      resolveNextcloudTalkGroupAllow({
-        groupPolicy: "disabled",
-        outerAllowFrom: ["owner"],
-        innerAllowFrom: ["room-user"],
-        senderId: "owner",
-      }),
-    ).toEqual({
-      allowed: false,
-      outerMatch: { allowed: false },
-      innerMatch: { allowed: false },
-    });
-    expect(
-      resolveNextcloudTalkGroupAllow({
-        groupPolicy: "open",
-        outerAllowFrom: [],
-        innerAllowFrom: [],
-        senderId: "owner",
-      }),
-    ).toEqual({
-      allowed: true,
-      outerMatch: { allowed: true },
-      innerMatch: { allowed: true },
-    });
-    expect(
-      resolveNextcloudTalkGroupAllow({
-        groupPolicy: "allowlist",
-        outerAllowFrom: [],
-        innerAllowFrom: [],
-        senderId: "owner",
-      }),
-    ).toEqual({
-      allowed: false,
-      outerMatch: { allowed: false },
-      innerMatch: { allowed: false },
-    });
-    expect(
-      resolveNextcloudTalkGroupAllow({
-        groupPolicy: "allowlist",
-        outerAllowFrom: [],
-        innerAllowFrom: ["room-user"],
-        senderId: "room-user",
-      }),
-    ).toEqual({
-      allowed: true,
-      outerMatch: { allowed: false },
-      innerMatch: { allowed: true, matchKey: "room-user", matchSource: "id" },
-    });
-    expect(
-      resolveNextcloudTalkGroupAllow({
-        groupPolicy: "allowlist",
-        outerAllowFrom: ["team-owner"],
-        innerAllowFrom: ["room-user"],
-        senderId: "room-user",
-      }),
-    ).toEqual({
-      allowed: false,
-      outerMatch: { allowed: false },
-      innerMatch: { allowed: true, matchKey: "room-user", matchSource: "id" },
-    });
-    expect(
-      resolveNextcloudTalkGroupAllow({
-        groupPolicy: "allowlist",
-        outerAllowFrom: ["team-owner"],
-        innerAllowFrom: ["room-user"],
-        senderId: "team-owner",
-      }),
-    ).toEqual({
-      allowed: false,
-      outerMatch: { allowed: true, matchKey: "team-owner", matchSource: "id" },
-      innerMatch: { allowed: false },
-    });
-    expect(
-      resolveNextcloudTalkGroupAllow({
-        groupPolicy: "allowlist",
-        outerAllowFrom: ["shared-user"],
-        innerAllowFrom: ["shared-user"],
-        senderId: "shared-user",
-      }),
-    ).toEqual({
-      allowed: true,
-      outerMatch: { allowed: true, matchKey: "shared-user", matchSource: "id" },
-      innerMatch: { allowed: true, matchKey: "shared-user", matchSource: "id" },
-    });
-  });
-});

package/src/doctor-contract.ts

@@ -1,9 +0,0 @@
-import { createLegacyPrivateNetworkDoctorContract } from "openclaw/plugin-sdk/ssrf-runtime";
-
-const contract = createLegacyPrivateNetworkDoctorContract({
-  channelKey: "nextcloud-talk",
-});
-
-export const legacyConfigRules = contract.legacyConfigRules;
-
-export const normalizeCompatibilityConfig = contract.normalizeCompatibilityConfig;

package/src/doctor.test.ts

@@ -1,40 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { nextcloudTalkDoctor } from "./doctor.js";
-
-describe("nextcloud-talk doctor", () => {
-  it("normalizes legacy private-network aliases", () => {
-    const normalize = nextcloudTalkDoctor.normalizeCompatibilityConfig;
-    expect(normalize).toBeDefined();
-    if (!normalize) {
-      return;
-    }
-
-    const result = normalize({
-      cfg: {
-        channels: {
-          "nextcloud-talk": {
-            allowPrivateNetwork: true,
-            accounts: {
-              work: {
-                allowPrivateNetwork: false,
-              },
-            },
-          },
-        },
-      } as never,
-    });
-
-    expect(result.config.channels?.["nextcloud-talk"]?.network).toEqual({
-      dangerouslyAllowPrivateNetwork: true,
-    });
-    expect(
-      (
-        result.config.channels?.["nextcloud-talk"]?.accounts?.work as
-          | { network?: Record<string, unknown> }
-          | undefined
-      )?.network,
-    ).toEqual({
-      dangerouslyAllowPrivateNetwork: false,
-    });
-  });
-});

package/src/doctor.ts

@@ -1,10 +0,0 @@
-import type { ChannelDoctorAdapter } from "openclaw/plugin-sdk/channel-contract";
-import {
-  legacyConfigRules as NEXTCLOUD_TALK_LEGACY_CONFIG_RULES,
-  normalizeCompatibilityConfig as normalizeNextcloudTalkCompatibilityConfig,
-} from "./doctor-contract.js";
-
-export const nextcloudTalkDoctor: ChannelDoctorAdapter = {
-  legacyConfigRules: NEXTCLOUD_TALK_LEGACY_CONFIG_RULES,
-  normalizeCompatibilityConfig: normalizeNextcloudTalkCompatibilityConfig,
-};

package/src/gateway.ts

@@ -1,109 +0,0 @@
-import { createAccountStatusSink } from "openclaw/plugin-sdk/channel-lifecycle";
-import { runStoppablePassiveMonitor } from "openclaw/plugin-sdk/extension-shared";
-import { resolveNextcloudTalkAccount, type ResolvedNextcloudTalkAccount } from "./accounts.js";
-import {
-  clearAccountEntryFields,
-  DEFAULT_ACCOUNT_ID,
-  type ChannelPlugin,
-  type OpenClawConfig,
-} from "./channel-api.js";
-import { monitorNextcloudTalkProvider } from "./monitor-runtime.js";
-import { getNextcloudTalkRuntime } from "./runtime.js";
-import type { CoreConfig } from "./types.js";
-
-export const nextcloudTalkGatewayAdapter: NonNullable<
-  ChannelPlugin<ResolvedNextcloudTalkAccount>["gateway"]
-> = {
-  startAccount: async (ctx) => {
-    const account = ctx.account;
-    if (!account.secret || !account.baseUrl) {
-      throw new Error(
-        `Nextcloud Talk not configured for account "${account.accountId}" (missing secret or baseUrl)`,
-      );
-    }
-
-    ctx.log?.info(`[${account.accountId}] starting Nextcloud Talk webhook server`);
-
-    const statusSink = createAccountStatusSink({
-      accountId: ctx.accountId,
-      setStatus: ctx.setStatus,
-    });
-
-    await runStoppablePassiveMonitor({
-      abortSignal: ctx.abortSignal,
-      start: async () =>
-        await monitorNextcloudTalkProvider({
-          accountId: account.accountId,
-          config: ctx.cfg as CoreConfig,
-          runtime: ctx.runtime,
-          abortSignal: ctx.abortSignal,
-          statusSink,
-        }),
-    });
-  },
-  logoutAccount: async ({ accountId, cfg }) => {
-    const nextCfg = { ...cfg } as OpenClawConfig;
-    const nextSection = cfg.channels?.["nextcloud-talk"]
-      ? { ...cfg.channels["nextcloud-talk"] }
-      : undefined;
-    let cleared = false;
-    let changed = false;
-
-    if (nextSection) {
-      if (accountId === DEFAULT_ACCOUNT_ID && nextSection.botSecret) {
-        delete nextSection.botSecret;
-        cleared = true;
-        changed = true;
-      }
-      const accountCleanup = clearAccountEntryFields({
-        accounts: nextSection.accounts as Record<string, object> | undefined,
-        accountId,
-        fields: ["botSecret"],
-      });
-      if (accountCleanup.changed) {
-        changed = true;
-        if (accountCleanup.cleared) {
-          cleared = true;
-        }
-        if (accountCleanup.nextAccounts) {
-          nextSection.accounts = accountCleanup.nextAccounts as Record<string, unknown>;
-        } else {
-          delete nextSection.accounts;
-        }
-      }
-    }
-
-    if (changed) {
-      if (nextSection && Object.keys(nextSection).length > 0) {
-        nextCfg.channels = { ...nextCfg.channels, "nextcloud-talk": nextSection };
-      } else {
-        const nextChannels = { ...nextCfg.channels } as Record<string, unknown>;
-        delete nextChannels["nextcloud-talk"];
-        if (Object.keys(nextChannels).length > 0) {
-          nextCfg.channels = nextChannels as OpenClawConfig["channels"];
-        } else {
-          delete nextCfg.channels;
-        }
-      }
-    }
-
-    const resolved = resolveNextcloudTalkAccount({
-      cfg: changed ? (nextCfg as CoreConfig) : (cfg as CoreConfig),
-      accountId,
-    });
-    const loggedOut = resolved.secretSource === "none";
-
-    if (changed) {
-      await getNextcloudTalkRuntime().config.replaceConfigFile({
-        nextConfig: nextCfg,
-        afterWrite: { mode: "auto" },
-      });
-    }
-
-    return {
-      cleared,
-      envSecret: Boolean(process.env.NEXTCLOUD_TALK_BOT_SECRET?.trim()),
-      loggedOut,
-    };
-  },
-};