@openclaw/zalo 2026.3.12 → 2026.5.1-beta.2

package/src/monitor.image.polling.test.ts

@@ -0,0 +1,110 @@
+import { createRuntimeEnv } from "openclaw/plugin-sdk/plugin-test-runtime";
+import { afterAll, beforeEach, describe, expect, it } from "vitest";
+import {
+  createImageLifecycleCore,
+  createImageUpdate,
+  createLifecycleMonitorSetup,
+  expectImageLifecycleDelivery,
+  settleAsyncWork,
+} from "./test-support/lifecycle-test-support.js";
+import {
+  getUpdatesMock,
+  getZaloRuntimeMock,
+  loadCachedLifecycleMonitorModule,
+  resetLifecycleTestState,
+  sendMessageMock,
+} from "./test-support/monitor-mocks-test-support.js";
+
+describe("Zalo polling image handling", () => {
+  const {
+    core,
+    finalizeInboundContextMock,
+    recordInboundSessionMock,
+    fetchRemoteMediaMock,
+    saveMediaBufferMock,
+  } = createImageLifecycleCore();
+
+  beforeEach(async () => {
+    await resetLifecycleTestState();
+    getZaloRuntimeMock.mockReturnValue(core);
+  });
+
+  afterAll(async () => {
+    await resetLifecycleTestState();
+  });
+
+  it("downloads inbound image media from photo_url and preserves display_name", async () => {
+    getUpdatesMock
+      .mockResolvedValueOnce({
+        ok: true,
+        result: createImageUpdate({ date: 1774084566880 }),
+      })
+      .mockImplementation(() => new Promise(() => {}));
+
+    const { monitorZaloProvider } = await loadCachedLifecycleMonitorModule("zalo-image-polling");
+    const abort = new AbortController();
+    const runtime = createRuntimeEnv();
+    const { account, config } = createLifecycleMonitorSetup({
+      accountId: "default",
+      dmPolicy: "open",
+    });
+    const run = monitorZaloProvider({
+      token: "zalo-token", // pragma: allowlist secret
+      account,
+      config,
+      runtime,
+      abortSignal: abort.signal,
+    });
+
+    await settleAsyncWork();
+    expect(fetchRemoteMediaMock).toHaveBeenCalledTimes(1);
+    expectImageLifecycleDelivery({
+      fetchRemoteMediaMock,
+      saveMediaBufferMock,
+      finalizeInboundContextMock,
+      recordInboundSessionMock,
+    });
+
+    abort.abort();
+    await run;
+  });
+
+  it("rejects unauthorized DM images before downloading media", async () => {
+    getUpdatesMock
+      .mockResolvedValueOnce({
+        ok: true,
+        result: createImageUpdate({
+          messageId: "msg-unauthorized-1",
+          userId: "user-unauthorized-1",
+          chatId: "chat-unauthorized-1",
+        }),
+      })
+      .mockImplementation(() => new Promise(() => {}));
+
+    const { monitorZaloProvider } = await loadCachedLifecycleMonitorModule("zalo-image-polling");
+    const abort = new AbortController();
+    const runtime = createRuntimeEnv();
+    const { account, config } = createLifecycleMonitorSetup({
+      accountId: "default",
+      dmPolicy: "pairing",
+      allowFrom: ["allowed-user"],
+    });
+    const run = monitorZaloProvider({
+      token: "zalo-token", // pragma: allowlist secret
+      account,
+      config,
+      runtime,
+      abortSignal: abort.signal,
+    });
+
+    await settleAsyncWork();
+    expect(sendMessageMock).toHaveBeenCalledTimes(1);
+    expect(fetchRemoteMediaMock).not.toHaveBeenCalled();
+    expect(saveMediaBufferMock).not.toHaveBeenCalled();
+    expect(finalizeInboundContextMock).not.toHaveBeenCalled();
+    expect(recordInboundSessionMock).not.toHaveBeenCalled();
+
+    abort.abort();
+    await run;
+  });
+});

package/src/monitor.lifecycle.test.ts

@@ -1,7 +1,10 @@
-import type { OpenClawConfig } from "openclaw/plugin-sdk/zalo";
+import {
+  createEmptyPluginRegistry,
+  createRuntimeEnv,
+  setActivePluginRegistry,
+} from "openclaw/plugin-sdk/plugin-test-runtime";
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { createEmptyPluginRegistry } from "../../../src/plugins/registry.js";
-import { setActivePluginRegistry } from "../../../src/plugins/runtime.js";
+import type { OpenClawConfig } from "../runtime-api.js";
 import type { ResolvedZaloAccount } from "./accounts.js";
 
 const getWebhookInfoMock = vi.fn(async () => ({ ok: true, result: { url: "" } }));
@@ -9,8 +12,8 @@ const deleteWebhookMock = vi.fn(async () => ({ ok: true, result: { url: "" } }))
 const getUpdatesMock = vi.fn(() => new Promise(() => {}));
 const setWebhookMock = vi.fn(async () => ({ ok: true, result: { url: "" } }));
 
-vi.mock("./api.js", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("./api.js")>();
+vi.mock("./api.js", async () => {
+  const actual = await vi.importActual<typeof import("./api.js")>("./api.js");
   return {
     ...actual,
     deleteWebhook: deleteWebhookMock,
@@ -28,8 +31,39 @@ vi.mock("./runtime.js", () => ({
   }),
 }));
 
-async function waitForPollingLoopStart(): Promise<void> {
-  await vi.waitFor(() => expect(getUpdatesMock).toHaveBeenCalledTimes(1));
+const TEST_ACCOUNT = {
+  accountId: "default",
+  config: {},
+} as unknown as ResolvedZaloAccount;
+
+const TEST_CONFIG = {} as OpenClawConfig;
+
+async function settleLifecycleWork(): Promise<void> {
+  for (let i = 0; i < 6; i += 1) {
+    await Promise.resolve();
+    await new Promise((resolve) => setImmediate(resolve));
+  }
+}
+
+async function startLifecycleMonitor(
+  options: {
+    useWebhook?: boolean;
+    webhookSecret?: string;
+    webhookUrl?: string;
+  } = {},
+) {
+  const { monitorZaloProvider } = await import("./monitor.js");
+  const abort = new AbortController();
+  const runtime = createRuntimeEnv();
+  const run = monitorZaloProvider({
+    token: "test-token",
+    account: TEST_ACCOUNT,
+    config: TEST_CONFIG,
+    runtime,
+    abortSignal: abort.signal,
+    ...options,
+  });
+  return { abort, runtime, run };
 }
 
 describe("monitorZaloProvider lifecycle", () => {
@@ -39,30 +73,14 @@ describe("monitorZaloProvider lifecycle", () => {
   });
 
   it("stays alive in polling mode until abort", async () => {
-    const { monitorZaloProvider } = await import("./monitor.js");
-    const abort = new AbortController();
-    const runtime = {
-      log: vi.fn<(message: string) => void>(),
-      error: vi.fn<(message: string) => void>(),
-    };
-    const account = {
-      accountId: "default",
-      config: {},
-    } as unknown as ResolvedZaloAccount;
-    const config = {} as OpenClawConfig;
-
     let settled = false;
-    const run = monitorZaloProvider({
-      token: "test-token",
-      account,
-      config,
-      runtime,
-      abortSignal: abort.signal,
-    }).then(() => {
+    const { abort, runtime, run } = await startLifecycleMonitor();
+    const monitoredRun = run.then(() => {
       settled = true;
     });
 
-    await waitForPollingLoopStart();
+    await settleLifecycleWork();
+    expect(getUpdatesMock).toHaveBeenCalledTimes(1);
 
     expect(getWebhookInfoMock).toHaveBeenCalledTimes(1);
     expect(deleteWebhookMock).not.toHaveBeenCalled();
@@ -70,7 +88,7 @@ describe("monitorZaloProvider lifecycle", () => {
     expect(settled).toBe(false);
 
     abort.abort();
-    await run;
+    await monitoredRun;
 
     expect(settled).toBe(true);
     expect(runtime.log).toHaveBeenCalledWith(
@@ -84,27 +102,10 @@ describe("monitorZaloProvider lifecycle", () => {
       result: { url: "https://example.com/hooks/zalo" },
     });
 
-    const { monitorZaloProvider } = await import("./monitor.js");
-    const abort = new AbortController();
-    const runtime = {
-      log: vi.fn<(message: string) => void>(),
-      error: vi.fn<(message: string) => void>(),
-    };
-    const account = {
-      accountId: "default",
-      config: {},
-    } as unknown as ResolvedZaloAccount;
-    const config = {} as OpenClawConfig;
-
-    const run = monitorZaloProvider({
-      token: "test-token",
-      account,
-      config,
-      runtime,
-      abortSignal: abort.signal,
-    });
+    const { abort, runtime, run } = await startLifecycleMonitor();
 
-    await waitForPollingLoopStart();
+    await settleLifecycleWork();
+    expect(getUpdatesMock).toHaveBeenCalledTimes(1);
 
     expect(getWebhookInfoMock).toHaveBeenCalledTimes(1);
     expect(deleteWebhookMock).toHaveBeenCalledTimes(1);
@@ -120,27 +121,10 @@ describe("monitorZaloProvider lifecycle", () => {
     const { ZaloApiError } = await import("./api.js");
     getWebhookInfoMock.mockRejectedValueOnce(new ZaloApiError("Not Found", 404, "Not Found"));
 
-    const { monitorZaloProvider } = await import("./monitor.js");
-    const abort = new AbortController();
-    const runtime = {
-      log: vi.fn<(message: string) => void>(),
-      error: vi.fn<(message: string) => void>(),
-    };
-    const account = {
-      accountId: "default",
-      config: {},
-    } as unknown as ResolvedZaloAccount;
-    const config = {} as OpenClawConfig;
-
-    const run = monitorZaloProvider({
-      token: "test-token",
-      account,
-      config,
-      runtime,
-      abortSignal: abort.signal,
-    });
+    const { abort, runtime, run } = await startLifecycleMonitor();
 
-    await waitForPollingLoopStart();
+    await settleLifecycleWork();
+    expect(getUpdatesMock).toHaveBeenCalledTimes(1);
 
     expect(getWebhookInfoMock).toHaveBeenCalledTimes(1);
     expect(deleteWebhookMock).not.toHaveBeenCalled();
@@ -157,52 +141,53 @@ describe("monitorZaloProvider lifecycle", () => {
     const registry = createEmptyPluginRegistry();
     setActivePluginRegistry(registry);
 
+    let resolveSetWebhookCalled: (() => void) | undefined;
+    const setWebhookCalled = new Promise<void>((resolve) => {
+      resolveSetWebhookCalled = resolve;
+    });
+    setWebhookMock.mockImplementationOnce(async () => {
+      resolveSetWebhookCalled?.();
+      return { ok: true, result: { url: "" } };
+    });
+
+    let resolveDeleteWebhookCalled: (() => void) | undefined;
+    const deleteWebhookCalled = new Promise<void>((resolve) => {
+      resolveDeleteWebhookCalled = resolve;
+    });
     let resolveDeleteWebhook: (() => void) | undefined;
     deleteWebhookMock.mockImplementationOnce(
       () =>
         new Promise((resolve) => {
+          resolveDeleteWebhookCalled?.();
           resolveDeleteWebhook = () => resolve({ ok: true, result: { url: "" } });
         }),
     );
 
-    const { monitorZaloProvider } = await import("./monitor.js");
-    const abort = new AbortController();
-    const runtime = {
-      log: vi.fn<(message: string) => void>(),
-      error: vi.fn<(message: string) => void>(),
-    };
-    const account = {
-      accountId: "default",
-      config: {},
-    } as unknown as ResolvedZaloAccount;
-    const config = {} as OpenClawConfig;
-
     let settled = false;
-    const run = monitorZaloProvider({
-      token: "test-token",
-      account,
-      config,
-      runtime,
-      abortSignal: abort.signal,
+    const { abort, runtime, run } = await startLifecycleMonitor({
       useWebhook: true,
       webhookUrl: "https://example.com/hooks/zalo",
       webhookSecret: "supersecret", // pragma: allowlist secret
-    }).then(() => {
+    });
+    const monitoredRun = run.then(() => {
       settled = true;
     });
 
-    await vi.waitFor(() => expect(setWebhookMock).toHaveBeenCalledTimes(1));
-    expect(registry.httpRoutes).toHaveLength(1);
+    await setWebhookCalled;
+    await settleLifecycleWork();
+    expect(setWebhookMock).toHaveBeenCalledTimes(1);
+    expect(registry.httpRoutes).toHaveLength(2);
 
     abort.abort();
 
-    await vi.waitFor(() => expect(deleteWebhookMock).toHaveBeenCalledTimes(1));
+    await deleteWebhookCalled;
+    expect(deleteWebhookMock).toHaveBeenCalledTimes(1);
     expect(deleteWebhookMock).toHaveBeenCalledWith("test-token", undefined, 5000);
     expect(settled).toBe(false);
-    expect(registry.httpRoutes).toHaveLength(1);
+    expect(registry.httpRoutes).toHaveLength(2);
 
     resolveDeleteWebhook?.();
-    await run;
+    await monitoredRun;
 
     expect(settled).toBe(true);
     expect(registry.httpRoutes).toHaveLength(0);

package/src/monitor.pairing.lifecycle.test.ts

@@ -0,0 +1,141 @@
+import { withServer } from "openclaw/plugin-sdk/test-env";
+import { afterAll, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  createLifecycleMonitorSetup,
+  createTextUpdate,
+  postWebhookReplay,
+  settleAsyncWork,
+} from "./test-support/lifecycle-test-support.js";
+import {
+  resetLifecycleTestState,
+  sendMessageMock,
+  setLifecycleRuntimeCore,
+  startWebhookLifecycleMonitor,
+} from "./test-support/monitor-mocks-test-support.js";
+
+describe("Zalo pairing lifecycle", () => {
+  const readAllowFromStoreMock = vi.fn(async () => [] as string[]);
+  const upsertPairingRequestMock = vi.fn(async () => ({ code: "PAIRCODE", created: true }));
+
+  beforeEach(async () => {
+    await resetLifecycleTestState();
+    setLifecycleRuntimeCore({
+      pairing: {
+        readAllowFromStore: readAllowFromStoreMock,
+        upsertPairingRequest: upsertPairingRequestMock,
+      },
+      commands: {
+        shouldComputeCommandAuthorized: vi.fn(() => false),
+        resolveCommandAuthorizedFromAuthorizers: vi.fn(() => false),
+      },
+    });
+  });
+
+  afterAll(async () => {
+    await resetLifecycleTestState();
+  });
+
+  function createPairingMonitorSetup() {
+    return createLifecycleMonitorSetup({
+      accountId: "acct-zalo-pairing",
+      dmPolicy: "pairing",
+      allowFrom: [],
+    });
+  }
+
+  it("emits one pairing reply across duplicate webhook replay and scopes reads and writes to accountId", async () => {
+    const monitor = await startWebhookLifecycleMonitor({
+      ...createPairingMonitorSetup(),
+      cacheKey: "zalo-pairing-lifecycle",
+    });
+
+    try {
+      await withServer(
+        (req, res) => monitor.route.handler(req, res),
+        async (baseUrl) => {
+          const { first, replay } = await postWebhookReplay({
+            baseUrl,
+            path: "/hooks/zalo",
+            secret: "supersecret",
+            payload: createTextUpdate({
+              messageId: `zalo-pairing-${Date.now()}`,
+              userId: "user-unauthorized",
+              userName: "Unauthorized User",
+              chatId: "dm-pairing-1",
+            }),
+          });
+
+          expect(first.status).toBe(200);
+          expect(replay.status).toBe(200);
+          await settleAsyncWork();
+        },
+      );
+
+      expect(readAllowFromStoreMock).toHaveBeenCalledTimes(1);
+      expect(readAllowFromStoreMock).toHaveBeenCalledWith(
+        expect.objectContaining({
+          channel: "zalo",
+          accountId: "acct-zalo-pairing",
+        }),
+      );
+      expect(upsertPairingRequestMock).toHaveBeenCalledTimes(1);
+      expect(upsertPairingRequestMock).toHaveBeenCalledWith(
+        expect.objectContaining({
+          channel: "zalo",
+          accountId: "acct-zalo-pairing",
+          id: "user-unauthorized",
+        }),
+      );
+      expect(sendMessageMock).toHaveBeenCalledTimes(1);
+      expect(sendMessageMock).toHaveBeenCalledWith(
+        "zalo-token",
+        expect.objectContaining({
+          chat_id: "dm-pairing-1",
+          text: expect.stringContaining("PAIRCODE"),
+        }),
+        undefined,
+      );
+    } finally {
+      await monitor.stop();
+    }
+  });
+
+  it("does not emit a second pairing reply when replay arrives after the first send fails", async () => {
+    sendMessageMock.mockRejectedValueOnce(new Error("pairing send failed"));
+
+    const monitor = await startWebhookLifecycleMonitor({
+      ...createPairingMonitorSetup(),
+      cacheKey: "zalo-pairing-lifecycle",
+    });
+
+    try {
+      await withServer(
+        (req, res) => monitor.route.handler(req, res),
+        async (baseUrl) => {
+          const { first, replay } = await postWebhookReplay({
+            baseUrl,
+            path: "/hooks/zalo",
+            secret: "supersecret",
+            payload: createTextUpdate({
+              messageId: `zalo-pairing-retry-${Date.now()}`,
+              userId: "user-unauthorized",
+              userName: "Unauthorized User",
+              chatId: "dm-pairing-1",
+            }),
+            settleBeforeReplay: true,
+          });
+
+          expect(first.status).toBe(200);
+          expect(replay.status).toBe(200);
+          await settleAsyncWork();
+        },
+      );
+
+      expect(upsertPairingRequestMock).toHaveBeenCalledTimes(1);
+      expect(sendMessageMock).toHaveBeenCalledTimes(1);
+      expect(monitor.runtime.error).not.toHaveBeenCalled();
+    } finally {
+      await monitor.stop();
+    }
+  });
+});