@openclaw/synology-chat 2026.2.22 → 2026.5.1-beta.1

package/src/client.test.ts

@@ -1,21 +1,57 @@
 import { EventEmitter } from "node:events";
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import type { ClientRequest, IncomingMessage, RequestOptions } from "node:http";
+import { describe, it, expect, vi, beforeAll, beforeEach, afterEach } from "vitest";
+
+const ssrfMocks = {
+  resolvePinnedHostnameWithPolicy: vi.fn(),
+};
 
 // Mock http and https modules before importing the client
 vi.mock("node:https", () => {
-  const mockRequest = vi.fn();
-  return { default: { request: mockRequest }, request: mockRequest };
+  const httpsRequest = vi.fn();
+  const httpsGet = vi.fn();
+  const httpsModule = { request: httpsRequest, get: httpsGet };
+  return { default: httpsModule, request: httpsRequest, get: httpsGet };
 });
 
 vi.mock("node:http", () => {
-  const mockRequest = vi.fn();
-  return { default: { request: mockRequest }, request: mockRequest };
+  const httpRequest = vi.fn();
+  const httpGet = vi.fn();
+  return { default: { request: httpRequest, get: httpGet }, request: httpRequest, get: httpGet };
 });
 
-// Import after mocks are set up
-const { sendMessage, sendFileUrl } = await import("./client.js");
+vi.mock("openclaw/plugin-sdk/ssrf-runtime", () => ({
+  formatErrorMessage: (err: unknown) => (err instanceof Error ? err.message : String(err)),
+  resolvePinnedHostnameWithPolicy: ssrfMocks.resolvePinnedHostnameWithPolicy,
+}));
+
 const https = await import("node:https");
 let fakeNowMs = 1_700_000_000_000;
+let sendMessage: typeof import("./client.js").sendMessage;
+let sendFileUrl: typeof import("./client.js").sendFileUrl;
+let fetchChatUsers: typeof import("./client.js").fetchChatUsers;
+let resolveLegacyWebhookNameToChatUserId: typeof import("./client.js").resolveLegacyWebhookNameToChatUserId;
+
+type RequestCallback = (res: IncomingMessage) => void;
+type MockRequestHandler = (
+  url: string | URL,
+  options: RequestOptions,
+  callback?: RequestCallback,
+) => ClientRequest;
+
+function createMockResponseEmitter(statusCode: number): IncomingMessage {
+  const res = new EventEmitter() as Partial<IncomingMessage>;
+  res.statusCode = statusCode;
+  return res as unknown as IncomingMessage;
+}
+
+function createMockRequestEmitter(): ClientRequest {
+  const req = new EventEmitter() as Partial<ClientRequest>;
+  req.write = vi.fn() as ClientRequest["write"];
+  req.end = vi.fn() as ClientRequest["end"];
+  req.destroy = vi.fn() as ClientRequest["destroy"];
+  return req as unknown as ClientRequest;
+}
 
 async function settleTimers<T>(promise: Promise<T>): Promise<T> {
   await Promise.resolve();
@@ -23,53 +59,52 @@ async function settleTimers<T>(promise: Promise<T>): Promise<T> {
   return promise;
 }
 
-function mockSuccessResponse() {
+function mockResponse(statusCode: number, body: string) {
   const httpsRequest = vi.mocked(https.request);
-  httpsRequest.mockImplementation((_url: any, _opts: any, callback: any) => {
-    const res = new EventEmitter() as any;
-    res.statusCode = 200;
+  httpsRequest.mockImplementation(((...args) => {
+    const callback = args[2];
+    const res = createMockResponseEmitter(statusCode);
     process.nextTick(() => {
-      callback(res);
-      res.emit("data", Buffer.from('{"success":true}'));
+      callback?.(res);
+      res.emit("data", Buffer.from(body));
       res.emit("end");
     });
-    const req = new EventEmitter() as any;
-    req.write = vi.fn();
-    req.end = vi.fn();
-    req.destroy = vi.fn();
-    return req;
-  });
+    return createMockRequestEmitter();
+  }) as MockRequestHandler);
+}
+
+function mockSuccessResponse() {
+  mockResponse(200, '{"success":true}');
 }
 
 function mockFailureResponse(statusCode = 500) {
-  const httpsRequest = vi.mocked(https.request);
-  httpsRequest.mockImplementation((_url: any, _opts: any, callback: any) => {
-    const res = new EventEmitter() as any;
-    res.statusCode = statusCode;
-    process.nextTick(() => {
-      callback(res);
-      res.emit("data", Buffer.from("error"));
-      res.emit("end");
-    });
-    const req = new EventEmitter() as any;
-    req.write = vi.fn();
-    req.end = vi.fn();
-    req.destroy = vi.fn();
-    return req;
-  });
+  mockResponse(statusCode, "error");
 }
 
-describe("sendMessage", () => {
+function installFakeTimerHarness() {
+  beforeAll(async () => {
+    ({ sendMessage, sendFileUrl, fetchChatUsers, resolveLegacyWebhookNameToChatUserId } =
+      await import("./client.js"));
+  });
+
   beforeEach(() => {
     vi.clearAllMocks();
     vi.useFakeTimers();
     fakeNowMs += 10_000;
     vi.setSystemTime(fakeNowMs);
+    ssrfMocks.resolvePinnedHostnameWithPolicy.mockResolvedValue({
+      hostname: "example.com",
+      addresses: ["93.184.216.34"],
+    });
   });
 
   afterEach(() => {
     vi.useRealTimers();
   });
+}
+
+describe("sendMessage", () => {
+  installFakeTimerHarness();
 
   it("returns true on successful send", async () => {
     mockSuccessResponse();
@@ -91,19 +126,24 @@ describe("sendMessage", () => {
     const callArgs = httpsRequest.mock.calls[0];
     expect(callArgs[0]).toBe("https://nas.example.com/incoming");
   });
-});
 
-describe("sendFileUrl", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    vi.useFakeTimers();
-    fakeNowMs += 10_000;
-    vi.setSystemTime(fakeNowMs);
+  it("verifies TLS by default", async () => {
+    mockSuccessResponse();
+    await settleTimers(sendMessage("https://nas.example.com/incoming", "Hello"));
+    const httpsRequest = vi.mocked(https.request);
+    expect(httpsRequest.mock.calls[0]?.[1]).toMatchObject({ rejectUnauthorized: true });
   });
 
-  afterEach(() => {
-    vi.useRealTimers();
+  it("only disables TLS verification when explicitly requested", async () => {
+    mockSuccessResponse();
+    await settleTimers(sendMessage("https://nas.example.com/incoming", "Hello", undefined, true));
+    const httpsRequest = vi.mocked(https.request);
+    expect(httpsRequest.mock.calls[0]?.[1]).toMatchObject({ rejectUnauthorized: false });
   });
+});
+
+describe("sendFileUrl", () => {
+  installFakeTimerHarness();
 
   it("returns true on success", async () => {
     mockSuccessResponse();
@@ -120,4 +160,216 @@ describe("sendFileUrl", () => {
     );
     expect(result).toBe(false);
   });
+
+  it("verifies TLS by default", async () => {
+    mockSuccessResponse();
+    await settleTimers(
+      sendFileUrl("https://nas.example.com/incoming", "https://example.com/file.png"),
+    );
+    const httpsRequest = vi.mocked(https.request);
+    expect(httpsRequest.mock.calls[0]?.[1]).toMatchObject({ rejectUnauthorized: true });
+  });
+
+  it("respects the shared send interval before posting a file URL", async () => {
+    mockSuccessResponse();
+    await settleTimers(sendMessage("https://nas.example.com/incoming", "hello"));
+    vi.mocked(https.request).mockClear();
+
+    const promise = sendFileUrl("https://nas.example.com/incoming", "https://example.com/file.png");
+    await Promise.resolve();
+    expect(vi.mocked(https.request)).not.toHaveBeenCalled();
+
+    await vi.advanceTimersByTimeAsync(499);
+    expect(vi.mocked(https.request)).not.toHaveBeenCalled();
+
+    await vi.advanceTimersByTimeAsync(1);
+    await promise;
+    expect(vi.mocked(https.request)).toHaveBeenCalledTimes(1);
+  });
+
+  it("rejects malformed file URLs before making a request", async () => {
+    const result = await settleTimers(sendFileUrl("https://nas.example.com/incoming", "not-a-url"));
+    expect(result).toBe(false);
+    expect(ssrfMocks.resolvePinnedHostnameWithPolicy).not.toHaveBeenCalled();
+    expect(vi.mocked(https.request)).not.toHaveBeenCalled();
+  });
+
+  it("rejects non-http file URLs before making a request", async () => {
+    const result = await settleTimers(
+      sendFileUrl("https://nas.example.com/incoming", "file:///tmp/secret.txt"),
+    );
+    expect(result).toBe(false);
+    expect(ssrfMocks.resolvePinnedHostnameWithPolicy).not.toHaveBeenCalled();
+    expect(vi.mocked(https.request)).not.toHaveBeenCalled();
+  });
+
+  it("rejects SSRF-blocked hosts before making a request", async () => {
+    ssrfMocks.resolvePinnedHostnameWithPolicy.mockRejectedValueOnce(
+      new Error("Blocked private network target"),
+    );
+    const result = await settleTimers(
+      sendFileUrl("https://nas.example.com/incoming", "http://169.254.169.254/latest/meta-data"),
+    );
+    expect(result).toBe(false);
+    expect(ssrfMocks.resolvePinnedHostnameWithPolicy).toHaveBeenCalledWith("169.254.169.254");
+    expect(vi.mocked(https.request)).not.toHaveBeenCalled();
+  });
+});
+
+// Helper to mock the user_list API response for fetchChatUsers / resolveLegacyWebhookNameToChatUserId
+function mockUserListResponse(users: Array<Record<string, unknown>>) {
+  mockUserListResponseImpl(users, false);
+}
+
+function mockUserListResponseOnce(users: Array<Record<string, unknown>>) {
+  mockUserListResponseImpl(users, true);
+}
+
+function mockUserListResponseImpl(users: Array<Record<string, unknown>>, once: boolean) {
+  const httpsGet = vi.mocked(https.get);
+  const impl: MockRequestHandler = (_url, _opts, callback) => {
+    const res = createMockResponseEmitter(200);
+    process.nextTick(() => {
+      callback?.(res);
+      res.emit("data", Buffer.from(JSON.stringify({ success: true, data: { users } })));
+      res.emit("end");
+    });
+    return createMockRequestEmitter();
+  };
+  if (once) {
+    httpsGet.mockImplementationOnce(impl);
+    return;
+  }
+  httpsGet.mockImplementation(impl);
+}
+
+describe("resolveLegacyWebhookNameToChatUserId", () => {
+  const baseUrl =
+    "https://nas.example.com/webapi/entry.cgi?api=SYNO.Chat.External&method=chatbot&version=2&token=%22test%22";
+  const baseUrl2 =
+    "https://nas2.example.com/webapi/entry.cgi?api=SYNO.Chat.External&method=chatbot&version=2&token=%22test-2%22";
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.useFakeTimers();
+    // Advance time to invalidate any cached user list from previous tests
+    fakeNowMs += 10 * 60 * 1000;
+    vi.setSystemTime(fakeNowMs);
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it("resolves user by nickname (webhook username = Chat nickname)", async () => {
+    mockUserListResponse([
+      { user_id: 4, username: "jmn67", nickname: "jmn" },
+      { user_id: 7, username: "she67", nickname: "sarah" },
+    ]);
+    const result = await resolveLegacyWebhookNameToChatUserId({
+      incomingUrl: baseUrl,
+      mutableWebhookUsername: "jmn",
+    });
+    expect(result).toBe(4);
+  });
+
+  it("resolves user by username when nickname does not match", async () => {
+    mockUserListResponse([
+      { user_id: 4, username: "jmn67", nickname: "" },
+      { user_id: 7, username: "she67", nickname: "sarah" },
+    ]);
+    // Advance time to invalidate cache
+    fakeNowMs += 10 * 60 * 1000;
+    vi.setSystemTime(fakeNowMs);
+    const result = await resolveLegacyWebhookNameToChatUserId({
+      incomingUrl: baseUrl,
+      mutableWebhookUsername: "jmn67",
+    });
+    expect(result).toBe(4);
+  });
+
+  it("is case-insensitive", async () => {
+    mockUserListResponse([{ user_id: 4, username: "JMN67", nickname: "JMN" }]);
+    fakeNowMs += 10 * 60 * 1000;
+    vi.setSystemTime(fakeNowMs);
+    const result = await resolveLegacyWebhookNameToChatUserId({
+      incomingUrl: baseUrl,
+      mutableWebhookUsername: "jmn",
+    });
+    expect(result).toBe(4);
+  });
+
+  it("returns undefined when user is not found", async () => {
+    mockUserListResponse([{ user_id: 4, username: "jmn67", nickname: "jmn" }]);
+    fakeNowMs += 10 * 60 * 1000;
+    vi.setSystemTime(fakeNowMs);
+    const result = await resolveLegacyWebhookNameToChatUserId({
+      incomingUrl: baseUrl,
+      mutableWebhookUsername: "unknown_user",
+    });
+    expect(result).toBeUndefined();
+  });
+
+  it("uses method=user_list instead of method=chatbot in the API URL", async () => {
+    mockUserListResponse([]);
+    fakeNowMs += 10 * 60 * 1000;
+    vi.setSystemTime(fakeNowMs);
+    await resolveLegacyWebhookNameToChatUserId({
+      incomingUrl: baseUrl,
+      mutableWebhookUsername: "anyone",
+    });
+    const httpsGet = vi.mocked(https.get);
+    expect(httpsGet).toHaveBeenCalledWith(
+      expect.stringContaining("method=user_list"),
+      expect.any(Object),
+      expect.any(Function),
+    );
+  });
+
+  it("keeps user cache scoped per incoming URL", async () => {
+    mockUserListResponseOnce([{ user_id: 4, username: "jmn67", nickname: "jmn" }]);
+    mockUserListResponseOnce([{ user_id: 9, username: "jmn67", nickname: "jmn" }]);
+
+    const result1 = await resolveLegacyWebhookNameToChatUserId({
+      incomingUrl: baseUrl,
+      mutableWebhookUsername: "jmn",
+    });
+    const result2 = await resolveLegacyWebhookNameToChatUserId({
+      incomingUrl: baseUrl2,
+      mutableWebhookUsername: "jmn",
+    });
+
+    expect(result1).toBe(4);
+    expect(result2).toBe(9);
+    const httpsGet = vi.mocked(https.get);
+    expect(httpsGet).toHaveBeenCalledTimes(2);
+  });
+});
+
+describe("fetchChatUsers", () => {
+  installFakeTimerHarness();
+
+  it("filters malformed user entries while keeping valid ones", async () => {
+    mockUserListResponse([
+      { user_id: 4, username: "jmn67", nickname: "jmn" },
+      { user_id: "bad", username: "broken" },
+    ]);
+
+    const users = await fetchChatUsers(
+      "https://nas.example.com/webapi/entry.cgi?api=SYNO.Chat.External&method=chatbot&version=2&token=%22test%22",
+    );
+
+    expect(users).toEqual([{ user_id: 4, username: "jmn67", nickname: "jmn" }]);
+  });
+
+  it("verifies TLS by default for user_list lookups", async () => {
+    mockUserListResponse([{ user_id: 4, username: "jmn67", nickname: "jmn" }]);
+    const freshUrl =
+      "https://fresh-nas.example.com/webapi/entry.cgi?api=SYNO.Chat.External&method=chatbot&version=2&token=%22fresh%22";
+
+    await fetchChatUsers(freshUrl);
+
+    const httpsGet = vi.mocked(https.get);
+    expect(httpsGet.mock.calls[0]?.[1]).toMatchObject({ rejectUnauthorized: true });
+  });
 });

package/src/client.ts

@@ -5,10 +5,79 @@
 
 import * as http from "node:http";
 import * as https from "node:https";
+import { safeParseJsonWithSchema, safeParseWithSchema } from "openclaw/plugin-sdk/extension-shared";
+import {
+  formatErrorMessage,
+  resolvePinnedHostnameWithPolicy,
+} from "openclaw/plugin-sdk/ssrf-runtime";
+import { z } from "zod";
 
 const MIN_SEND_INTERVAL_MS = 500;
 let lastSendTime = 0;
 
+function normalizeLowercaseStringOrEmpty(value: unknown): string {
+  return typeof value === "string" ? value.trim().toLowerCase() : "";
+}
+
+// --- Chat user_id resolution ---
+// Synology Chat uses two different user_id spaces:
+//   - Outgoing webhook user_id: per-integration sequential ID (e.g. 1)
+//   - Chat API user_id: global internal ID (e.g. 4)
+// The chatbot API (method=chatbot) requires the Chat API user_id in the
+// user_ids array. We resolve via the user_list API and cache the result.
+
+interface ChatUser {
+  user_id: number;
+  username: string;
+  nickname: string;
+}
+
+type ChatUserCacheEntry = {
+  users: ChatUser[];
+  cachedAt: number;
+};
+
+type ChatWebhookPayload = {
+  text?: string;
+  file_url?: string;
+  user_ids?: number[];
+};
+
+const ChatUserSchema = z
+  .object({
+    user_id: z.number(),
+    username: z.string().optional(),
+    nickname: z.string().optional(),
+  })
+  .transform(
+    (user): ChatUser => ({
+      user_id: user.user_id,
+      username: user.username ?? "",
+      nickname: user.nickname ?? "",
+    }),
+  );
+
+const ChatUserListResponseSchema = z.object({
+  success: z.boolean(),
+  data: z
+    .object({
+      users: z
+        .array(z.unknown())
+        .optional()
+        .transform((users) =>
+          (users ?? []).flatMap((user) => {
+            const parsed = safeParseWithSchema(ChatUserSchema, user);
+            return parsed ? [parsed] : [];
+          }),
+        ),
+    })
+    .optional(),
+});
+
+// Cache user lists per bot endpoint to avoid cross-account bleed.
+const chatUserCache = new Map<string, ChatUserCacheEntry>();
+const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
 /**
  * Send a text message to Synology Chat via the incoming webhook.
  *
@@ -21,20 +90,11 @@ export async function sendMessage(
   incomingUrl: string,
   text: string,
   userId?: string | number,
-  allowInsecureSsl = true,
+  allowInsecureSsl = false,
 ): Promise<boolean> {
   // Synology Chat API requires user_ids (numeric) to specify the recipient
   // The @mention is optional but user_ids is mandatory
-  const payloadObj: Record<string, any> = { text };
-  if (userId) {
-    // userId can be numeric ID or username - if numeric, add to user_ids
-    const numericId = typeof userId === "number" ? userId : parseInt(userId, 10);
-    if (!isNaN(numericId)) {
-      payloadObj.user_ids = [numericId];
-    }
-  }
-  const payload = JSON.stringify(payloadObj);
-  const body = `payload=${encodeURIComponent(payload)}`;
+  const body = buildWebhookBody({ text }, userId);
 
   // Internal rate limit: min 500ms between sends
   const now = Date.now();
@@ -51,13 +111,15 @@ export async function sendMessage(
     try {
       const ok = await doPost(incomingUrl, body, allowInsecureSsl);
       lastSendTime = Date.now();
-      if (ok) return true;
+      if (ok) {
+        return true;
+      }
     } catch {
       // will retry
     }
 
     if (attempt < maxRetries - 1) {
-      await sleep(baseDelay * Math.pow(2, attempt));
+      await sleep(baseDelay * 2 ** attempt);
     }
   }
 
@@ -71,19 +133,18 @@ export async function sendFileUrl(
   incomingUrl: string,
   fileUrl: string,
   userId?: string | number,
-  allowInsecureSsl = true,
+  allowInsecureSsl = false,
 ): Promise<boolean> {
-  const payloadObj: Record<string, any> = { file_url: fileUrl };
-  if (userId) {
-    const numericId = typeof userId === "number" ? userId : parseInt(userId, 10);
-    if (!isNaN(numericId)) {
-      payloadObj.user_ids = [numericId];
+  try {
+    const safeFileUrl = await assertSafeWebhookFileUrl(fileUrl);
+    const body = buildWebhookBody({ file_url: safeFileUrl }, userId);
+
+    const now = Date.now();
+    const elapsed = now - lastSendTime;
+    if (elapsed < MIN_SEND_INTERVAL_MS) {
+      await sleep(MIN_SEND_INTERVAL_MS - elapsed);
     }
-  }
-  const payload = JSON.stringify(payloadObj);
-  const body = `payload=${encodeURIComponent(payload)}`;
 
-  try {
     const ok = await doPost(incomingUrl, body, allowInsecureSsl);
     lastSendTime = Date.now();
     return ok;
@@ -92,7 +153,139 @@ export async function sendFileUrl(
   }
 }
 
-function doPost(url: string, body: string, allowInsecureSsl = true): Promise<boolean> {
+/**
+ * Fetch the list of Chat users visible to this bot via the user_list API.
+ * Results are cached for CACHE_TTL_MS to avoid excessive API calls.
+ *
+ * The user_list endpoint uses the same base URL as the chatbot API but
+ * with method=user_list instead of method=chatbot.
+ */
+export async function fetchChatUsers(
+  incomingUrl: string,
+  allowInsecureSsl = false,
+  log?: { warn: (...args: unknown[]) => void },
+): Promise<ChatUser[]> {
+  const now = Date.now();
+  const listUrl = incomingUrl.replace(/method=\w+/, "method=user_list");
+  const cached = chatUserCache.get(listUrl);
+  if (cached && now - cached.cachedAt < CACHE_TTL_MS) {
+    return cached.users;
+  }
+
+  return new Promise((resolve) => {
+    let parsedUrl: URL;
+    try {
+      parsedUrl = new URL(listUrl);
+    } catch {
+      log?.warn("fetchChatUsers: invalid user_list URL, using cached data");
+      resolve(cached?.users ?? []);
+      return;
+    }
+    const transport = parsedUrl.protocol === "https:" ? https : http;
+    const requestOptions: http.RequestOptions | https.RequestOptions =
+      parsedUrl.protocol === "https:" ? { rejectUnauthorized: !allowInsecureSsl } : {};
+
+    transport
+      .get(listUrl, requestOptions, (res) => {
+        let data = "";
+        res.on("data", (c: Buffer) => {
+          data += c.toString();
+        });
+        res.on("end", () => {
+          const result = safeParseJsonWithSchema(ChatUserListResponseSchema, data);
+          if (!result) {
+            log?.warn("fetchChatUsers: failed to parse user_list response");
+            resolve(cached?.users ?? []);
+            return;
+          }
+
+          if (result.success) {
+            const users = result.data?.users ?? [];
+            chatUserCache.set(listUrl, {
+              users,
+              cachedAt: now,
+            });
+            resolve(users);
+            return;
+          }
+
+          log?.warn(`fetchChatUsers: API returned success=${result.success}, using cached data`);
+          resolve(cached?.users ?? []);
+        });
+      })
+      .on("error", (err) => {
+        log?.warn(`fetchChatUsers: HTTP error — ${err instanceof Error ? err.message : err}`);
+        resolve(cached?.users ?? []);
+      });
+  });
+}
+
+async function assertSafeWebhookFileUrl(fileUrl: string): Promise<string> {
+  let parsed: URL;
+  try {
+    parsed = new URL(fileUrl);
+  } catch (err) {
+    throw new Error(`Invalid Synology Chat file URL: ${formatErrorMessage(err)}`, { cause: err });
+  }
+
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error("Synology Chat file URL must use HTTP or HTTPS");
+  }
+
+  await resolvePinnedHostnameWithPolicy(parsed.hostname);
+  return parsed.toString();
+}
+
+/**
+ * Resolve a mutable webhook username/nickname to the correct Chat API user_id.
+ *
+ * Synology Chat outgoing webhooks send a user_id that may NOT match the
+ * Chat-internal user_id needed by the chatbot API (method=chatbot).
+ * The webhook's "username" field corresponds to the Chat user's "nickname".
+ *
+ * @returns The correct Chat user_id, or undefined if not found
+ */
+export async function resolveLegacyWebhookNameToChatUserId(params: {
+  incomingUrl: string;
+  mutableWebhookUsername: string;
+  allowInsecureSsl?: boolean;
+  log?: { warn: (...args: unknown[]) => void };
+}): Promise<number | undefined> {
+  const users = await fetchChatUsers(params.incomingUrl, params.allowInsecureSsl, params.log);
+  const lower = normalizeLowercaseStringOrEmpty(params.mutableWebhookUsername);
+
+  // Match by nickname first (webhook "username" field = Chat "nickname")
+  const byNickname = users.find((u) => normalizeLowercaseStringOrEmpty(u.nickname) === lower);
+  if (byNickname) {
+    return byNickname.user_id;
+  }
+
+  // Then by username
+  const byUsername = users.find((u) => normalizeLowercaseStringOrEmpty(u.username) === lower);
+  if (byUsername) {
+    return byUsername.user_id;
+  }
+
+  return undefined;
+}
+
+function buildWebhookBody(payload: ChatWebhookPayload, userId?: string | number): string {
+  const numericId = parseNumericUserId(userId);
+  if (numericId !== undefined) {
+    payload.user_ids = [numericId];
+  }
+  return `payload=${encodeURIComponent(JSON.stringify(payload))}`;
+}
+
+function parseNumericUserId(userId?: string | number): number | undefined {
+  if (userId === undefined) {
+    return undefined;
+  }
+  const numericId = typeof userId === "number" ? userId : Number.parseInt(userId, 10);
+  return Number.isNaN(numericId) ? undefined : numericId;
+}
+
+function doPost(url: string, body: string, allowInsecureSsl = false): Promise<boolean> {
   return new Promise((resolve, reject) => {
     let parsedUrl: URL;
     try {

package/src/config-schema.ts

@@ -0,0 +1,11 @@
+import { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-schema";
+import { z } from "openclaw/plugin-sdk/zod";
+
+export const SynologyChatChannelConfigSchema = buildChannelConfigSchema(
+  z
+    .object({
+      dangerouslyAllowNameMatching: z.boolean().optional(),
+      dangerouslyAllowInheritedWebhookPath: z.boolean().optional(),
+    })
+    .passthrough(),
+);