@openclaw/nextcloud-talk 2026.5.2 → 2026.5.3-beta.2

package/src/replay-guard.ts

@@ -1,128 +0,0 @@
-import path from "node:path";
-import { createClaimableDedupe } from "openclaw/plugin-sdk/persistent-dedupe";
-
-const DEFAULT_REPLAY_TTL_MS = 24 * 60 * 60 * 1000;
-const DEFAULT_MEMORY_MAX_SIZE = 1_000;
-const DEFAULT_FILE_MAX_ENTRIES = 10_000;
-
-function sanitizeSegment(value: string): string {
-  const trimmed = value.trim();
-  if (!trimmed) {
-    return "default";
-  }
-  return trimmed.replace(/[^a-zA-Z0-9_-]/g, "_");
-}
-
-function buildReplayKey(params: { roomToken: string; messageId: string }): string | null {
-  const roomToken = params.roomToken.trim();
-  const messageId = params.messageId.trim();
-  if (!roomToken || !messageId) {
-    return null;
-  }
-  return `${roomToken}:${messageId}`;
-}
-
-type NextcloudTalkReplayGuardOptions = {
-  stateDir?: string;
-  ttlMs?: number;
-  memoryMaxSize?: number;
-  fileMaxEntries?: number;
-  onDiskError?: (error: unknown) => void;
-};
-
-export type NextcloudTalkReplayGuard = {
-  claimMessage: (params: {
-    accountId: string;
-    roomToken: string;
-    messageId: string;
-  }) => Promise<"claimed" | "duplicate" | "inflight" | "invalid">;
-  commitMessage: (params: {
-    accountId: string;
-    roomToken: string;
-    messageId: string;
-  }) => Promise<boolean>;
-  releaseMessage: (params: {
-    accountId: string;
-    roomToken: string;
-    messageId: string;
-    error?: unknown;
-  }) => void;
-  shouldProcessMessage: (params: {
-    accountId: string;
-    roomToken: string;
-    messageId: string;
-  }) => Promise<boolean>;
-};
-
-export function createNextcloudTalkReplayGuard(
-  options: NextcloudTalkReplayGuardOptions,
-): NextcloudTalkReplayGuard {
-  const stateDir = options.stateDir?.trim();
-  const baseOptions = {
-    ttlMs: options.ttlMs ?? DEFAULT_REPLAY_TTL_MS,
-    memoryMaxSize: options.memoryMaxSize ?? DEFAULT_MEMORY_MAX_SIZE,
-  };
-  const dedupe = createClaimableDedupe(
-    stateDir
-      ? {
-          ...baseOptions,
-          fileMaxEntries: options.fileMaxEntries ?? DEFAULT_FILE_MAX_ENTRIES,
-          resolveFilePath: (namespace) =>
-            path.join(
-              stateDir,
-              "nextcloud-talk",
-              "replay-dedupe",
-              `${sanitizeSegment(namespace)}.json`,
-            ),
-          onDiskError: options.onDiskError,
-        }
-      : baseOptions,
-  );
-
-  return {
-    claimMessage: async ({ accountId, roomToken, messageId }) => {
-      const replayKey = buildReplayKey({ roomToken, messageId });
-      if (!replayKey) {
-        return "invalid";
-      }
-      const result = await dedupe.claim(replayKey, {
-        namespace: accountId,
-      });
-      return result.kind;
-    },
-    commitMessage: async ({ accountId, roomToken, messageId }) => {
-      const replayKey = buildReplayKey({ roomToken, messageId });
-      if (!replayKey) {
-        return true;
-      }
-      return await dedupe.commit(replayKey, {
-        namespace: accountId,
-      });
-    },
-    releaseMessage: ({ accountId, roomToken, messageId, error }) => {
-      const replayKey = buildReplayKey({ roomToken, messageId });
-      if (!replayKey) {
-        return;
-      }
-      dedupe.release(replayKey, {
-        namespace: accountId,
-        error,
-      });
-    },
-    shouldProcessMessage: async ({ accountId, roomToken, messageId }) => {
-      const replayKey = buildReplayKey({ roomToken, messageId });
-      if (!replayKey) {
-        return true;
-      }
-      const result = await dedupe.claim(replayKey, {
-        namespace: accountId,
-      });
-      if (result.kind !== "claimed") {
-        return false;
-      }
-      return await dedupe.commit(replayKey, {
-        namespace: accountId,
-      });
-    },
-  };
-}

package/src/room-info.test.ts

@@ -1,116 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { resolveNextcloudTalkRoomKind, __testing } from "./room-info.js";
-
-const fetchWithSsrFGuard = vi.hoisted(() => vi.fn());
-const readFileSync = vi.hoisted(() => vi.fn());
-
-vi.mock("../runtime-api.js", () => {
-  return vi
-    .importActual<typeof import("../runtime-api.js")>("../runtime-api.js")
-    .then((actual) => ({
-      ...actual,
-      fetchWithSsrFGuard,
-    }));
-});
-
-vi.mock("node:fs", () => {
-  return vi.importActual<typeof import("node:fs")>("node:fs").then((actual) => ({
-    ...actual,
-    readFileSync,
-  }));
-});
-
-afterEach(() => {
-  fetchWithSsrFGuard.mockReset();
-  readFileSync.mockReset();
-  __testing.resetRoomCache();
-});
-
-describe("nextcloud talk room info", () => {
-  it("resolves direct rooms from the room info endpoint", async () => {
-    const release = vi.fn(async () => {});
-    fetchWithSsrFGuard.mockResolvedValue({
-      response: {
-        ok: true,
-        json: async () => ({
-          ocs: {
-            data: {
-              type: 1,
-            },
-          },
-        }),
-      },
-      release,
-    });
-
-    const kind = await resolveNextcloudTalkRoomKind({
-      account: {
-        accountId: "acct-direct",
-        baseUrl: "https://nc.example.com",
-        config: {
-          apiUser: "bot",
-          apiPassword: "secret",
-        },
-      } as never,
-      roomToken: "room-direct",
-    });
-
-    expect(kind).toBe("direct");
-    expect(fetchWithSsrFGuard).toHaveBeenCalledWith(
-      expect.objectContaining({
-        url: "https://nc.example.com/ocs/v2.php/apps/spreed/api/v4/room/room-direct",
-        auditContext: "nextcloud-talk.room-info",
-      }),
-    );
-    expect(release).toHaveBeenCalledTimes(1);
-  });
-
-  it("reads the api password from a file and logs non-ok room info responses", async () => {
-    const release = vi.fn(async () => {});
-    const log = vi.fn();
-    const error = vi.fn();
-    const exit = vi.fn();
-    readFileSync.mockReturnValue("file-secret\n");
-    fetchWithSsrFGuard.mockResolvedValue({
-      response: {
-        ok: false,
-        status: 403,
-        json: async () => ({}),
-      },
-      release,
-    });
-
-    const kind = await resolveNextcloudTalkRoomKind({
-      account: {
-        accountId: "acct-group",
-        baseUrl: "https://nc.example.com",
-        config: {
-          apiUser: "bot",
-          apiPasswordFile: "/tmp/nextcloud-secret",
-        },
-      } as never,
-      roomToken: "room-group",
-      runtime: { log, error, exit },
-    });
-
-    expect(kind).toBeUndefined();
-    expect(readFileSync).toHaveBeenCalledWith("/tmp/nextcloud-secret", "utf-8");
-    expect(log).toHaveBeenCalledWith("nextcloud-talk: room lookup failed (403) token=room-group");
-    expect(release).toHaveBeenCalledTimes(1);
-  });
-
-  it("returns undefined from room info without credentials or base url", async () => {
-    await expect(
-      resolveNextcloudTalkRoomKind({
-        account: {
-          accountId: "acct-missing",
-          baseUrl: "",
-          config: {},
-        } as never,
-        roomToken: "room-missing",
-      }),
-    ).resolves.toBeUndefined();
-
-    expect(fetchWithSsrFGuard).not.toHaveBeenCalled();
-  });
-});

package/src/room-info.ts

@@ -1,148 +0,0 @@
-import { readFileSync } from "node:fs";
-import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
-import { ssrfPolicyFromPrivateNetworkOptIn } from "openclaw/plugin-sdk/ssrf-runtime";
-import { fetchWithSsrFGuard, type RuntimeEnv } from "../runtime-api.js";
-import type { ResolvedNextcloudTalkAccount } from "./accounts.js";
-import { normalizeResolvedSecretInputString } from "./secret-input.js";
-
-const ROOM_CACHE_TTL_MS = 5 * 60 * 1000;
-const ROOM_CACHE_ERROR_TTL_MS = 30 * 1000;
-
-const roomCache = new Map<
-  string,
-  { kind?: "direct" | "group"; fetchedAt: number; error?: string }
->();
-
-export const __testing = {
-  resetRoomCache() {
-    roomCache.clear();
-  },
-};
-
-function resolveRoomCacheKey(params: { accountId: string; roomToken: string }) {
-  return `${params.accountId}:${params.roomToken}`;
-}
-
-function readApiPassword(params: {
-  apiPassword?: unknown;
-  apiPasswordFile?: string;
-}): string | undefined {
-  const inlinePassword = normalizeResolvedSecretInputString({
-    value: params.apiPassword,
-    path: "channels.nextcloud-talk.apiPassword",
-  });
-  if (inlinePassword) {
-    return inlinePassword;
-  }
-  if (!params.apiPasswordFile) {
-    return undefined;
-  }
-  try {
-    const value = readFileSync(params.apiPasswordFile, "utf-8").trim();
-    return value || undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-function coerceRoomType(value: unknown): number | undefined {
-  if (typeof value === "number" && Number.isFinite(value)) {
-    return value;
-  }
-  if (typeof value === "string" && value.trim()) {
-    const parsed = Number.parseInt(value, 10);
-    return Number.isFinite(parsed) ? parsed : undefined;
-  }
-  return undefined;
-}
-
-function resolveRoomKindFromType(type: number | undefined): "direct" | "group" | undefined {
-  if (!type) {
-    return undefined;
-  }
-  if (type === 1 || type === 5 || type === 6) {
-    return "direct";
-  }
-  return "group";
-}
-
-export async function resolveNextcloudTalkRoomKind(params: {
-  account: ResolvedNextcloudTalkAccount;
-  roomToken: string;
-  runtime?: RuntimeEnv;
-}): Promise<"direct" | "group" | undefined> {
-  const { account, roomToken, runtime } = params;
-  const key = resolveRoomCacheKey({ accountId: account.accountId, roomToken });
-  const cached = roomCache.get(key);
-  if (cached) {
-    const age = Date.now() - cached.fetchedAt;
-    if (cached.kind && age < ROOM_CACHE_TTL_MS) {
-      return cached.kind;
-    }
-    if (cached.error && age < ROOM_CACHE_ERROR_TTL_MS) {
-      return undefined;
-    }
-  }
-
-  const apiUser = account.config.apiUser?.trim();
-  const apiPassword = readApiPassword({
-    apiPassword: account.config.apiPassword,
-    apiPasswordFile: account.config.apiPasswordFile,
-  });
-  if (!apiUser || !apiPassword) {
-    return undefined;
-  }
-
-  const baseUrl = account.baseUrl?.trim();
-  if (!baseUrl) {
-    return undefined;
-  }
-
-  const url = `${baseUrl}/ocs/v2.php/apps/spreed/api/v4/room/${roomToken}`;
-  const auth = Buffer.from(`${apiUser}:${apiPassword}`, "utf-8").toString("base64");
-
-  try {
-    const { response, release } = await fetchWithSsrFGuard({
-      url,
-      init: {
-        method: "GET",
-        headers: {
-          Authorization: `Basic ${auth}`,
-          "OCS-APIRequest": "true",
-          Accept: "application/json",
-        },
-      },
-      auditContext: "nextcloud-talk.room-info",
-      policy: ssrfPolicyFromPrivateNetworkOptIn(account.config),
-    });
-    try {
-      if (!response.ok) {
-        roomCache.set(key, {
-          fetchedAt: Date.now(),
-          error: `status:${response.status}`,
-        });
-        runtime?.log?.(
-          `nextcloud-talk: room lookup failed (${response.status}) token=${roomToken}`,
-        );
-        return undefined;
-      }
-
-      const payload = (await response.json()) as {
-        ocs?: { data?: { type?: number | string } };
-      };
-      const type = coerceRoomType(payload.ocs?.data?.type);
-      const kind = resolveRoomKindFromType(type);
-      roomCache.set(key, { fetchedAt: Date.now(), kind });
-      return kind;
-    } finally {
-      await release();
-    }
-  } catch (err) {
-    roomCache.set(key, {
-      fetchedAt: Date.now(),
-      error: formatErrorMessage(err),
-    });
-    runtime?.error?.(`nextcloud-talk: room lookup error: ${String(err)}`);
-    return undefined;
-  }
-}

package/src/runtime.ts

@@ -1,9 +0,0 @@
-import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
-import type { PluginRuntime } from "openclaw/plugin-sdk/runtime-store";
-
-const { setRuntime: setNextcloudTalkRuntime, getRuntime: getNextcloudTalkRuntime } =
-  createPluginRuntimeStore<PluginRuntime>({
-    pluginId: "nextcloud-talk",
-    errorMessage: "Nextcloud Talk runtime not initialized",
-  });
-export { getNextcloudTalkRuntime, setNextcloudTalkRuntime };

package/src/secret-contract.ts

@@ -1,103 +0,0 @@
-import {
-  collectConditionalChannelFieldAssignments,
-  getChannelSurface,
-  hasOwnProperty,
-  type ChannelAccountEntry,
-  type ResolverContext,
-  type SecretDefaults,
-} from "openclaw/plugin-sdk/channel-secret-basic-runtime";
-
-export const secretTargetRegistryEntries: import("openclaw/plugin-sdk/channel-secret-basic-runtime").SecretTargetRegistryEntry[] =
-  [
-    {
-      id: "channels.nextcloud-talk.accounts.*.apiPassword",
-      targetType: "channels.nextcloud-talk.accounts.*.apiPassword",
-      configFile: "openclaw.json",
-      pathPattern: "channels.nextcloud-talk.accounts.*.apiPassword",
-      secretShape: "secret_input",
-      expectedResolvedValue: "string",
-      includeInPlan: true,
-      includeInConfigure: true,
-      includeInAudit: true,
-    },
-    {
-      id: "channels.nextcloud-talk.accounts.*.botSecret",
-      targetType: "channels.nextcloud-talk.accounts.*.botSecret",
-      configFile: "openclaw.json",
-      pathPattern: "channels.nextcloud-talk.accounts.*.botSecret",
-      secretShape: "secret_input",
-      expectedResolvedValue: "string",
-      includeInPlan: true,
-      includeInConfigure: true,
-      includeInAudit: true,
-    },
-    {
-      id: "channels.nextcloud-talk.apiPassword",
-      targetType: "channels.nextcloud-talk.apiPassword",
-      configFile: "openclaw.json",
-      pathPattern: "channels.nextcloud-talk.apiPassword",
-      secretShape: "secret_input",
-      expectedResolvedValue: "string",
-      includeInPlan: true,
-      includeInConfigure: true,
-      includeInAudit: true,
-    },
-    {
-      id: "channels.nextcloud-talk.botSecret",
-      targetType: "channels.nextcloud-talk.botSecret",
-      configFile: "openclaw.json",
-      pathPattern: "channels.nextcloud-talk.botSecret",
-      secretShape: "secret_input",
-      expectedResolvedValue: "string",
-      includeInPlan: true,
-      includeInConfigure: true,
-      includeInAudit: true,
-    },
-  ];
-
-export function collectRuntimeConfigAssignments(params: {
-  config: { channels?: Record<string, unknown> };
-  defaults?: SecretDefaults;
-  context: ResolverContext;
-}): void {
-  const resolved = getChannelSurface(params.config, "nextcloud-talk");
-  if (!resolved) {
-    return;
-  }
-  const { channel: nextcloudTalk, surface } = resolved;
-  const inheritsField =
-    (field: string) =>
-    ({ account, enabled }: ChannelAccountEntry) =>
-      enabled && !hasOwnProperty(account, field);
-  collectConditionalChannelFieldAssignments({
-    channelKey: "nextcloud-talk",
-    field: "botSecret",
-    channel: nextcloudTalk,
-    surface,
-    defaults: params.defaults,
-    context: params.context,
-    topLevelActiveWithoutAccounts: true,
-    topLevelInheritedAccountActive: inheritsField("botSecret"),
-    accountActive: ({ enabled }) => enabled,
-    topInactiveReason: "no enabled Nextcloud Talk surface inherits this top-level botSecret.",
-    accountInactiveReason: "Nextcloud Talk account is disabled.",
-  });
-  collectConditionalChannelFieldAssignments({
-    channelKey: "nextcloud-talk",
-    field: "apiPassword",
-    channel: nextcloudTalk,
-    surface,
-    defaults: params.defaults,
-    context: params.context,
-    topLevelActiveWithoutAccounts: true,
-    topLevelInheritedAccountActive: inheritsField("apiPassword"),
-    accountActive: ({ enabled }) => enabled,
-    topInactiveReason: "no enabled Nextcloud Talk surface inherits this top-level apiPassword.",
-    accountInactiveReason: "Nextcloud Talk account is disabled.",
-  });
-}
-
-export const channelSecrets = {
-  secretTargetRegistryEntries,
-  collectRuntimeConfigAssignments,
-};

package/src/secret-input.ts

@@ -1,4 +0,0 @@
-export {
-  buildSecretInputSchema,
-  normalizeResolvedSecretInputString,
-} from "openclaw/plugin-sdk/secret-input";

package/src/send.cfg-threading.test.ts

@@ -1,153 +0,0 @@
-import {
-  createSendCfgThreadingRuntime,
-  expectProvidedCfgSkipsRuntimeLoad,
-} from "openclaw/plugin-sdk/channel-test-helpers";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-const hoisted = vi.hoisted(() => ({
-  loadConfig: vi.fn(),
-  resolveMarkdownTableMode: vi.fn(() => "preserve"),
-  convertMarkdownTables: vi.fn((text: string) => text),
-  record: vi.fn(),
-  resolveNextcloudTalkAccount: vi.fn(),
-  ssrfPolicyFromPrivateNetworkOptIn: vi.fn(() => undefined),
-  generateNextcloudTalkSignature: vi.fn(() => ({
-    random: "r",
-    signature: "s",
-  })),
-  mockFetchGuard: vi.fn(),
-}));
-
-vi.mock("./send.runtime.js", () => {
-  return {
-    convertMarkdownTables: hoisted.convertMarkdownTables,
-    fetchWithSsrFGuard: hoisted.mockFetchGuard,
-    generateNextcloudTalkSignature: hoisted.generateNextcloudTalkSignature,
-    getNextcloudTalkRuntime: () => createSendCfgThreadingRuntime(hoisted),
-    requireRuntimeConfig: (cfg: unknown, context: string) => {
-      if (cfg) {
-        return cfg;
-      }
-      throw new Error(`${context} requires a resolved runtime config`);
-    },
-    resolveNextcloudTalkAccount: hoisted.resolveNextcloudTalkAccount,
-    resolveMarkdownTableMode: hoisted.resolveMarkdownTableMode,
-    ssrfPolicyFromPrivateNetworkOptIn: hoisted.ssrfPolicyFromPrivateNetworkOptIn,
-  };
-});
-
-const { sendMessageNextcloudTalk, sendReactionNextcloudTalk } = await import("./send.js");
-
-function expectProvidedMessageCfgThreading(cfg: unknown): void {
-  expectProvidedCfgSkipsRuntimeLoad({
-    loadConfig: hoisted.loadConfig,
-    resolveAccount: hoisted.resolveNextcloudTalkAccount,
-    cfg,
-    accountId: "work",
-  });
-  expect(hoisted.resolveMarkdownTableMode).toHaveBeenCalledWith({
-    cfg,
-    channel: "nextcloud-talk",
-    accountId: "default",
-  });
-  expect(hoisted.convertMarkdownTables).toHaveBeenCalledWith("hello", "preserve");
-}
-
-describe("nextcloud-talk send cfg threading", () => {
-  const fetchMock = vi.fn<typeof fetch>();
-  const defaultAccount = {
-    accountId: "default",
-    baseUrl: "https://nextcloud.example.com",
-    secret: "secret-value",
-  };
-
-  function mockNextcloudMessageResponse(messageId: number, timestamp: number): void {
-    fetchMock.mockResolvedValueOnce(
-      new Response(
-        JSON.stringify({
-          ocs: { data: { id: messageId, timestamp } },
-        }),
-        { status: 200, headers: { "content-type": "application/json" } },
-      ),
-    );
-  }
-
-  beforeEach(() => {
-    vi.stubGlobal("fetch", fetchMock);
-    // Route the SSRF guard mock through the global fetch mock.
-    hoisted.mockFetchGuard.mockImplementation(async (p: { url: string; init?: RequestInit }) => {
-      const response = await globalThis.fetch(p.url, p.init);
-      return { response, release: async () => {}, finalUrl: p.url };
-    });
-    hoisted.loadConfig.mockReset();
-    hoisted.resolveMarkdownTableMode.mockClear();
-    hoisted.convertMarkdownTables.mockClear();
-    hoisted.record.mockReset();
-    hoisted.ssrfPolicyFromPrivateNetworkOptIn.mockClear();
-    hoisted.generateNextcloudTalkSignature.mockClear();
-    hoisted.resolveNextcloudTalkAccount.mockReset();
-    hoisted.resolveNextcloudTalkAccount.mockReturnValue(defaultAccount);
-  });
-
-  afterEach(() => {
-    fetchMock.mockReset();
-    hoisted.mockFetchGuard.mockReset();
-    vi.unstubAllGlobals();
-  });
-
-  it("uses provided cfg for sendMessage and skips runtime loadConfig", async () => {
-    const cfg = { source: "provided" } as const;
-    mockNextcloudMessageResponse(12345, 1_706_000_000);
-
-    const result = await sendMessageNextcloudTalk("room:abc123", "hello", {
-      cfg,
-      accountId: "work",
-    });
-
-    expectProvidedMessageCfgThreading(cfg);
-    expect(hoisted.record).toHaveBeenCalledWith({
-      channel: "nextcloud-talk",
-      accountId: "default",
-      direction: "outbound",
-    });
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(result).toEqual({
-      messageId: "12345",
-      roomToken: "abc123",
-      timestamp: 1_706_000_000,
-    });
-  });
-
-  it("sends with provided cfg even when the runtime store is not initialized", async () => {
-    const cfg = { source: "provided" } as const;
-    hoisted.record.mockImplementation(() => {
-      throw new Error("Nextcloud Talk runtime not initialized");
-    });
-    mockNextcloudMessageResponse(12346, 1_706_000_001);
-
-    const result = await sendMessageNextcloudTalk("room:abc123", "hello", {
-      cfg,
-      accountId: "work",
-    });
-
-    expectProvidedMessageCfgThreading(cfg);
-    expect(result).toEqual({
-      messageId: "12346",
-      roomToken: "abc123",
-      timestamp: 1_706_000_001,
-    });
-  });
-
-  it("fails hard for sendReaction when cfg is omitted", async () => {
-    fetchMock.mockResolvedValueOnce(new Response("{}", { status: 200 }));
-
-    await expect(
-      sendReactionNextcloudTalk("room:ops", "m-1", "👍", {
-        accountId: "default",
-      } as never),
-    ).rejects.toThrow("Nextcloud Talk send requires a resolved runtime config");
-
-    expect(hoisted.loadConfig).not.toHaveBeenCalled();
-    expect(hoisted.resolveNextcloudTalkAccount).not.toHaveBeenCalled();
-  });
-});

package/src/send.runtime.ts

@@ -1,8 +0,0 @@
-export { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
-export { resolveMarkdownTableMode } from "openclaw/plugin-sdk/markdown-table-runtime";
-export { ssrfPolicyFromPrivateNetworkOptIn } from "openclaw/plugin-sdk/ssrf-runtime";
-export { convertMarkdownTables } from "openclaw/plugin-sdk/text-runtime";
-export { fetchWithSsrFGuard } from "../runtime-api.js";
-export { resolveNextcloudTalkAccount } from "./accounts.js";
-export { getNextcloudTalkRuntime } from "./runtime.js";
-export { generateNextcloudTalkSignature } from "./signature.js";