@openclaw/whatsapp 2026.5.1-beta.1

package/src/inbound-policy.ts

@@ -0,0 +1,231 @@
+import {
+  resolveChannelGroupPolicy,
+  resolveChannelGroupRequireMention,
+} from "openclaw/plugin-sdk/channel-policy";
+import type {
+  ChannelGroupPolicy,
+  DmPolicy,
+  GroupPolicy,
+  OpenClawConfig,
+} from "openclaw/plugin-sdk/config-types";
+import { resolveDefaultGroupPolicy } from "openclaw/plugin-sdk/runtime-group-policy";
+import {
+  expandAllowFromWithAccessGroups,
+  readStoreAllowFromForDmPolicy,
+  resolveEffectiveAllowFromLists,
+  resolveDmGroupAccessWithCommandGate,
+} from "openclaw/plugin-sdk/security-runtime";
+import { resolveGroupSessionKey } from "openclaw/plugin-sdk/session-store-runtime";
+import { resolveWhatsAppAccount, type ResolvedWhatsAppAccount } from "./accounts.js";
+import { getSelfIdentity, getSenderIdentity } from "./identity.js";
+import type { WebInboundMessage } from "./inbound/types.js";
+import { resolveWhatsAppRuntimeGroupPolicy } from "./runtime-group-policy.js";
+import { isSelfChatMode, normalizeE164 } from "./text-runtime.js";
+
+export type ResolvedWhatsAppInboundPolicy = {
+  account: ResolvedWhatsAppAccount;
+  dmPolicy: DmPolicy;
+  groupPolicy: GroupPolicy;
+  configuredAllowFrom: string[];
+  dmAllowFrom: string[];
+  groupAllowFrom: string[];
+  isSelfChat: boolean;
+  providerMissingFallbackApplied: boolean;
+  shouldReadStorePairingApprovals: boolean;
+  isSamePhone: (value?: string | null) => boolean;
+  isDmSenderAllowed: (allowEntries: string[], sender?: string | null) => boolean;
+  isGroupSenderAllowed: (allowEntries: string[], sender?: string | null) => boolean;
+  resolveConversationGroupPolicy: (conversationId: string) => ChannelGroupPolicy;
+  resolveConversationRequireMention: (conversationId: string) => boolean;
+};
+
+function resolveGroupConversationId(conversationId: string): string {
+  return (
+    resolveGroupSessionKey({
+      From: conversationId,
+      ChatType: "group",
+      Provider: "whatsapp",
+    })?.id ?? conversationId
+  );
+}
+
+function isNormalizedSenderAllowed(allowEntries: string[], sender?: string | null): boolean {
+  if (allowEntries.includes("*")) {
+    return true;
+  }
+  const normalizedSender = normalizeE164(sender ?? "");
+  if (!normalizedSender) {
+    return false;
+  }
+  const normalizedEntrySet = new Set(
+    allowEntries
+      .map((entry) => normalizeE164(entry))
+      .filter((entry): entry is string => Boolean(entry)),
+  );
+  return normalizedEntrySet.has(normalizedSender);
+}
+
+function buildResolvedWhatsAppGroupConfig(params: {
+  groupPolicy: GroupPolicy;
+  groups: ResolvedWhatsAppAccount["groups"];
+}): OpenClawConfig {
+  return {
+    channels: {
+      whatsapp: {
+        groupPolicy: params.groupPolicy,
+        groups: params.groups,
+      },
+    },
+  } as OpenClawConfig;
+}
+
+export function resolveWhatsAppInboundPolicy(params: {
+  cfg: OpenClawConfig;
+  accountId?: string | null;
+  selfE164?: string | null;
+}): ResolvedWhatsAppInboundPolicy {
+  const account = resolveWhatsAppAccount({
+    cfg: params.cfg,
+    accountId: params.accountId,
+  });
+  const configuredAllowFrom = account.allowFrom ?? [];
+  const dmPolicy = account.dmPolicy ?? "pairing";
+  const dmAllowFrom =
+    configuredAllowFrom.length > 0 ? configuredAllowFrom : params.selfE164 ? [params.selfE164] : [];
+  const groupAllowFrom =
+    account.groupAllowFrom ??
+    (configuredAllowFrom.length > 0 ? configuredAllowFrom : undefined) ??
+    [];
+  const { effectiveGroupAllowFrom } = resolveEffectiveAllowFromLists({
+    allowFrom: configuredAllowFrom,
+    groupAllowFrom,
+  });
+  const defaultGroupPolicy = resolveDefaultGroupPolicy(params.cfg);
+  const { groupPolicy, providerMissingFallbackApplied } = resolveWhatsAppRuntimeGroupPolicy({
+    providerConfigPresent: params.cfg.channels?.whatsapp !== undefined,
+    groupPolicy: account.groupPolicy,
+    defaultGroupPolicy,
+  });
+  const resolvedGroupCfg = buildResolvedWhatsAppGroupConfig({
+    groupPolicy,
+    groups: account.groups,
+  });
+  const isSamePhone = (value?: string | null) =>
+    typeof value === "string" && typeof params.selfE164 === "string" && value === params.selfE164;
+  return {
+    account,
+    dmPolicy,
+    groupPolicy,
+    configuredAllowFrom,
+    dmAllowFrom,
+    groupAllowFrom,
+    isSelfChat: account.selfChatMode ?? isSelfChatMode(params.selfE164, configuredAllowFrom),
+    providerMissingFallbackApplied,
+    shouldReadStorePairingApprovals: dmPolicy !== "allowlist",
+    isSamePhone,
+    isDmSenderAllowed: (allowEntries, sender) =>
+      isSamePhone(sender) || isNormalizedSenderAllowed(allowEntries, sender),
+    isGroupSenderAllowed: (allowEntries, sender) => isNormalizedSenderAllowed(allowEntries, sender),
+    resolveConversationGroupPolicy: (conversationId) =>
+      resolveChannelGroupPolicy({
+        cfg: resolvedGroupCfg,
+        channel: "whatsapp",
+        groupId: resolveGroupConversationId(conversationId),
+        hasGroupAllowFrom: effectiveGroupAllowFrom.length > 0,
+      }),
+    resolveConversationRequireMention: (conversationId) =>
+      resolveChannelGroupRequireMention({
+        cfg: resolvedGroupCfg,
+        channel: "whatsapp",
+        groupId: resolveGroupConversationId(conversationId),
+      }),
+  };
+}
+
+export async function resolveWhatsAppCommandAuthorized(params: {
+  cfg: OpenClawConfig;
+  msg: WebInboundMessage;
+  policy?: ResolvedWhatsAppInboundPolicy;
+}): Promise<boolean> {
+  const useAccessGroups = params.cfg.commands?.useAccessGroups !== false;
+  if (!useAccessGroups) {
+    return true;
+  }
+
+  const self = getSelfIdentity(params.msg);
+  const policy =
+    params.policy ??
+    resolveWhatsAppInboundPolicy({
+      cfg: params.cfg,
+      accountId: params.msg.accountId,
+      selfE164: self.e164 ?? null,
+    });
+  const isGroup = params.msg.chatType === "group";
+  const sender = getSenderIdentity(params.msg);
+  const dmSender = sender.e164 ?? params.msg.from ?? "";
+  const groupSender = sender.e164 ?? "";
+  const normalizedSender = normalizeE164(isGroup ? groupSender : dmSender);
+  if (!normalizedSender) {
+    return false;
+  }
+
+  const storeAllowFrom =
+    isGroup || !policy.shouldReadStorePairingApprovals
+      ? []
+      : await readStoreAllowFromForDmPolicy({
+          provider: "whatsapp",
+          accountId: policy.account.accountId,
+          dmPolicy: policy.dmPolicy,
+          shouldRead: policy.shouldReadStorePairingApprovals,
+        });
+  const isSenderAllowed = (senderId: string, allowEntries: string[]) =>
+    isGroup
+      ? policy.isGroupSenderAllowed(allowEntries, senderId)
+      : policy.isDmSenderAllowed(allowEntries, senderId);
+  const [allowFrom, groupAllowFrom] = await Promise.all([
+    expandAllowFromWithAccessGroups({
+      cfg: params.cfg,
+      allowFrom: policy.dmAllowFrom,
+      channel: "whatsapp",
+      accountId: policy.account.accountId,
+      senderId: normalizedSender,
+      isSenderAllowed,
+    }),
+    expandAllowFromWithAccessGroups({
+      cfg: params.cfg,
+      allowFrom: policy.groupAllowFrom,
+      channel: "whatsapp",
+      accountId: policy.account.accountId,
+      senderId: normalizedSender,
+      isSenderAllowed,
+    }),
+  ]);
+  const dmStoreAllowFrom = isGroup
+    ? []
+    : await expandAllowFromWithAccessGroups({
+        cfg: params.cfg,
+        allowFrom: storeAllowFrom,
+        channel: "whatsapp",
+        accountId: policy.account.accountId,
+        senderId: normalizedSender,
+        isSenderAllowed,
+      });
+  const access = resolveDmGroupAccessWithCommandGate({
+    isGroup,
+    dmPolicy: policy.dmPolicy,
+    groupPolicy: policy.groupPolicy,
+    allowFrom,
+    groupAllowFrom,
+    storeAllowFrom: dmStoreAllowFrom,
+    isSenderAllowed: (allowEntries) =>
+      isGroup
+        ? policy.isGroupSenderAllowed(allowEntries, groupSender)
+        : policy.isDmSenderAllowed(allowEntries, dmSender),
+    command: {
+      useAccessGroups,
+      allowTextCommands: true,
+      hasControlCommand: true,
+    },
+  });
+  return access.commandAuthorized;
+}

package/src/inbound.media.test.ts

@@ -0,0 +1,320 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  mockExtractMessageContent,
+  mockGetContentType,
+  mockIsJidGroup,
+  mockNormalizeMessageContent,
+} from "../../../test/mocks/baileys.js";
+
+type MockMessageInput = Parameters<typeof mockNormalizeMessageContent>[0];
+
+const readAllowFromStoreMock = vi.fn().mockResolvedValue([]);
+const upsertPairingRequestMock = vi.fn().mockResolvedValue({ code: "PAIRCODE", created: true });
+const saveMediaBufferSpy = vi.fn();
+let currentMockSocket:
+  | {
+      ev: import("node:events").EventEmitter;
+      ws: { close: ReturnType<typeof vi.fn> };
+      sendPresenceUpdate: ReturnType<typeof vi.fn>;
+      sendMessage: ReturnType<typeof vi.fn>;
+      readMessages: ReturnType<typeof vi.fn>;
+      groupFetchAllParticipating: ReturnType<typeof vi.fn>;
+      updateMediaMessage: ReturnType<typeof vi.fn>;
+      logger: Record<string, never>;
+      user: { id: string };
+    }
+  | undefined;
+
+vi.mock("openclaw/plugin-sdk/runtime-config-snapshot", async () => {
+  const actual = await vi.importActual<
+    typeof import("openclaw/plugin-sdk/runtime-config-snapshot")
+  >("openclaw/plugin-sdk/runtime-config-snapshot");
+  return {
+    ...actual,
+    getRuntimeConfig: vi.fn().mockReturnValue({
+      channels: {
+        whatsapp: {
+          allowFrom: ["*"], // Allow all in tests
+        },
+      },
+      messages: {
+        messagePrefix: undefined,
+        responsePrefix: undefined,
+      },
+    }),
+  };
+});
+
+vi.mock("openclaw/plugin-sdk/conversation-runtime", async () => {
+  const actual = await vi.importActual<typeof import("openclaw/plugin-sdk/conversation-runtime")>(
+    "openclaw/plugin-sdk/conversation-runtime",
+  );
+  return {
+    ...actual,
+    readChannelAllowFromStore(...args: unknown[]) {
+      return readAllowFromStoreMock(...args);
+    },
+    upsertChannelPairingRequest(...args: unknown[]) {
+      return upsertPairingRequestMock(...args);
+    },
+  };
+});
+
+vi.mock("openclaw/plugin-sdk/channel-pairing", async () => {
+  const actual = await vi.importActual<typeof import("openclaw/plugin-sdk/channel-pairing")>(
+    "openclaw/plugin-sdk/channel-pairing",
+  );
+  return {
+    ...actual,
+    readChannelAllowFromStore(...args: unknown[]) {
+      return readAllowFromStoreMock(...args);
+    },
+  };
+});
+
+vi.mock("openclaw/plugin-sdk/media-store", async () => {
+  const actual = await vi.importActual<typeof import("openclaw/plugin-sdk/media-store")>(
+    "openclaw/plugin-sdk/media-store",
+  );
+  return {
+    ...actual,
+    saveMediaBuffer: vi.fn(async (...args: Parameters<typeof actual.saveMediaBuffer>) => {
+      saveMediaBufferSpy(...args);
+      return actual.saveMediaBuffer(...args);
+    }),
+  };
+});
+
+const HOME = path.join(os.tmpdir(), `openclaw-inbound-media-${crypto.randomUUID()}`);
+process.env.HOME = HOME;
+
+vi.mock("@whiskeysockets/baileys", async () => {
+  const actual =
+    await vi.importActual<typeof import("@whiskeysockets/baileys")>("@whiskeysockets/baileys");
+  const jpegBuffer = Buffer.from([
+    0xff, 0xd8, 0xff, 0xdb, 0x00, 0x43, 0x00, 0x03, 0x02, 0x02, 0x02, 0x02, 0x02, 0x03, 0x02, 0x02,
+    0x02, 0x03, 0x03, 0x03, 0x03, 0x04, 0x06, 0x04, 0x04, 0x04, 0x04, 0x04, 0x08, 0x06, 0x06, 0x05,
+    0x06, 0x09, 0x08, 0x0a, 0x0a, 0x09, 0x08, 0x09, 0x09, 0x0a, 0x0c, 0x0f, 0x0c, 0x0a, 0x0b, 0x0e,
+    0x0b, 0x09, 0x09, 0x0d, 0x11, 0x0d, 0x0e, 0x0f, 0x10, 0x10, 0x11, 0x10, 0x0a, 0x0c, 0x12, 0x13,
+    0x12, 0x10, 0x13, 0x0f, 0x10, 0x10, 0x10, 0xff, 0xc0, 0x00, 0x11, 0x08, 0x00, 0x01, 0x00, 0x01,
+    0x03, 0x01, 0x11, 0x00, 0x02, 0x11, 0x01, 0x03, 0x11, 0x01, 0xff, 0xc4, 0x00, 0x14, 0x00, 0x01,
+    0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff,
+    0xc4, 0x00, 0x14, 0x10, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0xff, 0xda, 0x00, 0x0c, 0x03, 0x01, 0x00, 0x02, 0x11, 0x03, 0x11, 0x00, 0x3f, 0x00,
+    0xff, 0xd9,
+  ]);
+  return {
+    ...actual,
+    DisconnectReason: actual.DisconnectReason ?? { loggedOut: 401 },
+    downloadMediaMessage: vi.fn().mockResolvedValue(jpegBuffer),
+    extractMessageContent: vi.fn((message: MockMessageInput) => mockExtractMessageContent(message)),
+    getContentType: vi.fn((message: MockMessageInput) => mockGetContentType(message)),
+    isJidGroup: vi.fn((jid: string | undefined | null) => mockIsJidGroup(jid)),
+    normalizeMessageContent: vi.fn((message: MockMessageInput) =>
+      mockNormalizeMessageContent(message),
+    ),
+  };
+});
+
+vi.mock("./session.js", async () => {
+  const actual = await vi.importActual<typeof import("./session.js")>("./session.js");
+  const { EventEmitter } = require("node:events");
+  return {
+    ...actual,
+    createWaSocket: vi.fn().mockImplementation(async () => {
+      currentMockSocket ??= {
+        ev: new EventEmitter(),
+        ws: { close: vi.fn() },
+        sendPresenceUpdate: vi.fn().mockResolvedValue(undefined),
+        sendMessage: vi.fn().mockResolvedValue(undefined),
+        readMessages: vi.fn().mockResolvedValue(undefined),
+        groupFetchAllParticipating: vi.fn().mockResolvedValue({}),
+        updateMediaMessage: vi.fn(),
+        logger: {},
+        user: { id: "me@s.whatsapp.net" },
+      };
+      return currentMockSocket;
+    }),
+    waitForWaConnection: vi.fn().mockResolvedValue(undefined),
+    getStatusCode: vi.fn(() => 200),
+  };
+});
+
+let monitorWebInbox: typeof import("./inbound.js").monitorWebInbox;
+let resetWebInboundDedupe: typeof import("./inbound.js").resetWebInboundDedupe;
+let createWaSocket: typeof import("./session.js").createWaSocket;
+
+async function waitForMessage(onMessage: ReturnType<typeof vi.fn>) {
+  await vi.waitFor(() => expect(onMessage).toHaveBeenCalledTimes(1), {
+    interval: 1,
+    timeout: 250,
+  });
+  return onMessage.mock.calls[0][0];
+}
+
+describe("web inbound media saves with extension", () => {
+  async function getMockSocket() {
+    return (await createWaSocket(false, false)) as unknown as {
+      ev: import("node:events").EventEmitter;
+    };
+  }
+
+  beforeEach(() => {
+    vi.useRealTimers();
+    currentMockSocket = undefined;
+    saveMediaBufferSpy.mockClear();
+    resetWebInboundDedupe();
+  });
+
+  beforeAll(async () => {
+    await fs.rm(HOME, { recursive: true, force: true });
+    ({ monitorWebInbox, resetWebInboundDedupe } = await import("./inbound.js"));
+    ({ createWaSocket } = await import("./session.js"));
+  });
+
+  afterAll(async () => {
+    await fs.rm(HOME, { recursive: true, force: true });
+  });
+
+  it("stores image extension and keeps document filename", async () => {
+    const onMessage = vi.fn();
+    const listener = await monitorWebInbox({
+      cfg: {
+        channels: { whatsapp: { allowFrom: ["*"] } },
+        messages: { messagePrefix: undefined, responsePrefix: undefined },
+      } as never,
+      verbose: false,
+      onMessage,
+      accountId: "default",
+      authDir: path.join(HOME, "wa-auth"),
+    });
+    const realSock = await getMockSocket();
+
+    realSock.ev.emit("messages.upsert", {
+      type: "notify",
+      messages: [
+        {
+          key: { id: "img1", fromMe: false, remoteJid: "111@s.whatsapp.net" },
+          message: { imageMessage: { mimetype: "image/jpeg" } },
+          messageTimestamp: 1_700_000_001,
+        },
+      ],
+    });
+
+    const first = await waitForMessage(onMessage);
+    const mediaPath = first.mediaPath;
+    expect(mediaPath).toBeDefined();
+    expect(path.extname(mediaPath as string)).toBe(".jpg");
+    const stat = await fs.stat(mediaPath as string);
+    expect(stat.size).toBeGreaterThan(0);
+
+    onMessage.mockClear();
+    const fileName = "invoice.pdf";
+    realSock.ev.emit("messages.upsert", {
+      type: "notify",
+      messages: [
+        {
+          key: { id: "doc1", fromMe: false, remoteJid: "333@s.whatsapp.net" },
+          message: { documentMessage: { mimetype: "application/pdf", fileName } },
+          messageTimestamp: 1_700_000_004,
+        },
+      ],
+    });
+
+    const second = await waitForMessage(onMessage);
+    expect(second.mediaFileName).toBe(fileName);
+    expect(saveMediaBufferSpy).toHaveBeenCalled();
+    const lastCall = saveMediaBufferSpy.mock.calls.at(-1);
+    expect(lastCall?.[4]).toBe(fileName);
+
+    await listener.close();
+  });
+
+  it("stores quoted image media from reply context", async () => {
+    const onMessage = vi.fn();
+    const listener = await monitorWebInbox({
+      cfg: {
+        channels: { whatsapp: { allowFrom: ["*"] } },
+        messages: { messagePrefix: undefined, responsePrefix: undefined },
+      } as never,
+      verbose: false,
+      onMessage,
+      accountId: "default",
+      authDir: path.join(HOME, "wa-auth"),
+    });
+    const realSock = await getMockSocket();
+
+    realSock.ev.emit("messages.upsert", {
+      type: "notify",
+      messages: [
+        {
+          key: { id: "quote-img-reply", fromMe: false, remoteJid: "111@g.us" },
+          message: {
+            extendedTextMessage: {
+              text: "@bot what is this?",
+              contextInfo: {
+                stanzaId: "quoted-image",
+                participant: "222@s.whatsapp.net",
+                mentionedJid: ["me@s.whatsapp.net"],
+                quotedMessage: {
+                  imageMessage: { mimetype: "image/jpeg" },
+                },
+              },
+            },
+          },
+          messageTimestamp: 1_700_000_005,
+        },
+      ],
+    });
+
+    const inbound = await waitForMessage(onMessage);
+    expect(inbound.replyToBody).toBe("<media:image>");
+    expect(inbound.mediaPath).toBeDefined();
+    expect(path.extname(inbound.mediaPath as string)).toBe(".jpg");
+    expect(saveMediaBufferSpy).toHaveBeenCalled();
+    const lastCall = saveMediaBufferSpy.mock.calls.at(-1);
+    expect(lastCall?.[1]).toBe("image/jpeg");
+
+    await listener.close();
+  });
+
+  it("passes mediaMaxMb to saveMediaBuffer", async () => {
+    const onMessage = vi.fn();
+    const listener = await monitorWebInbox({
+      cfg: {
+        channels: { whatsapp: { allowFrom: ["*"] } },
+        messages: { messagePrefix: undefined, responsePrefix: undefined },
+      } as never,
+      verbose: false,
+      onMessage,
+      mediaMaxMb: 1,
+      accountId: "default",
+      authDir: path.join(HOME, "wa-auth"),
+    });
+    const realSock = await getMockSocket();
+
+    const upsert = {
+      type: "notify",
+      messages: [
+        {
+          key: { id: "img3", fromMe: false, remoteJid: "222@s.whatsapp.net" },
+          message: { imageMessage: { mimetype: "image/jpeg" } },
+          messageTimestamp: 1_700_000_003,
+        },
+      ],
+    };
+
+    realSock.ev.emit("messages.upsert", upsert);
+
+    await waitForMessage(onMessage);
+    expect(saveMediaBufferSpy).toHaveBeenCalled();
+    const lastCall = saveMediaBufferSpy.mock.calls.at(-1);
+    expect(lastCall?.[3]).toBe(1 * 1024 * 1024);
+
+    await listener.close();
+  });
+});