@openclaw/zalouser 2026.5.2 → 2026.5.3-beta.2

package/src/probe.test.ts

@@ -1,60 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { probeZalouser } from "./probe.js";
-import { getZaloUserInfo } from "./zalo-js.js";
-
-vi.mock("./zalo-js.js", () => ({
-  getZaloUserInfo: vi.fn(),
-}));
-
-const mockGetUserInfo = vi.mocked(getZaloUserInfo);
-
-describe("probeZalouser", () => {
-  beforeEach(() => {
-    mockGetUserInfo.mockReset();
-  });
-
-  afterEach(() => {
-    vi.useRealTimers();
-  });
-
-  it("returns ok=true with user when authenticated", async () => {
-    mockGetUserInfo.mockResolvedValueOnce({
-      userId: "123",
-      displayName: "Alice",
-    });
-
-    await expect(probeZalouser("default")).resolves.toEqual({
-      ok: true,
-      user: { userId: "123", displayName: "Alice" },
-    });
-  });
-
-  it("returns not authenticated when no user info is returned", async () => {
-    mockGetUserInfo.mockResolvedValueOnce(null);
-    await expect(probeZalouser("default")).resolves.toEqual({
-      ok: false,
-      error: "Not authenticated",
-    });
-  });
-
-  it("returns error when user lookup throws", async () => {
-    mockGetUserInfo.mockRejectedValueOnce(new Error("network down"));
-    await expect(probeZalouser("default")).resolves.toEqual({
-      ok: false,
-      error: "network down",
-    });
-  });
-
-  it("times out when lookup takes too long", async () => {
-    vi.useFakeTimers();
-    mockGetUserInfo.mockReturnValueOnce(new Promise(() => undefined));
-
-    const pending = probeZalouser("default", 10);
-    await vi.advanceTimersByTimeAsync(1000);
-
-    await expect(pending).resolves.toEqual({
-      ok: false,
-      error: "Not authenticated",
-    });
-  });
-});

package/src/probe.ts

@@ -1,35 +0,0 @@
-import type { BaseProbeResult } from "openclaw/plugin-sdk/channel-contract";
-import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
-import type { ZcaUserInfo } from "./types.js";
-import { getZaloUserInfo } from "./zalo-js.js";
-
-export type ZalouserProbeResult = BaseProbeResult<string> & {
-  user?: ZcaUserInfo;
-};
-
-export async function probeZalouser(
-  profile: string,
-  timeoutMs?: number,
-): Promise<ZalouserProbeResult> {
-  try {
-    const user = timeoutMs
-      ? await Promise.race([
-          getZaloUserInfo(profile),
-          new Promise<null>((resolve) =>
-            setTimeout(() => resolve(null), Math.max(timeoutMs, 1000)),
-          ),
-        ])
-      : await getZaloUserInfo(profile);
-
-    if (!user) {
-      return { ok: false, error: "Not authenticated" };
-    }
-
-    return { ok: true, user };
-  } catch (error) {
-    return {
-      ok: false,
-      error: formatErrorMessage(error),
-    };
-  }
-}

package/src/qr-temp-file.ts

@@ -1,22 +0,0 @@
-import fsp from "node:fs/promises";
-import path from "node:path";
-import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/temp-path";
-
-export async function writeQrDataUrlToTempFile(
-  qrDataUrl: string,
-  profile: string,
-): Promise<string | null> {
-  const trimmed = qrDataUrl.trim();
-  const match = trimmed.match(/^data:image\/png;base64,(.+)$/i);
-  const base64 = (match?.[1] ?? "").trim();
-  if (!base64) {
-    return null;
-  }
-  const safeProfile = profile.replace(/[^a-zA-Z0-9_-]+/g, "-") || "default";
-  const filePath = path.join(
-    resolvePreferredOpenClawTmpDir(),
-    `openclaw-zalouser-qr-${safeProfile}.png`,
-  );
-  await fsp.writeFile(filePath, Buffer.from(base64, "base64"));
-  return filePath;
-}

package/src/reaction.test.ts

@@ -1,19 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { normalizeZaloReactionIcon } from "./reaction.js";
-
-describe("zalouser reaction alias normalization", () => {
-  it("maps common aliases", () => {
-    expect(normalizeZaloReactionIcon("like")).toBe("/-strong");
-    expect(normalizeZaloReactionIcon("👍")).toBe("/-strong");
-    expect(normalizeZaloReactionIcon("heart")).toBe("/-heart");
-    expect(normalizeZaloReactionIcon("😂")).toBe(":>");
-  });
-
-  it("defaults empty icon to like", () => {
-    expect(normalizeZaloReactionIcon("")).toBe("/-strong");
-  });
-
-  it("passes through unknown custom reactions", () => {
-    expect(normalizeZaloReactionIcon("/custom")).toBe("/custom");
-  });
-});

package/src/reaction.ts

@@ -1,32 +0,0 @@
-import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
-import { Reactions } from "./zca-constants.js";
-
-const REACTION_ALIAS_MAP = new Map<string, string>([
-  ["like", Reactions.LIKE],
-  ["👍", Reactions.LIKE],
-  [":+1:", Reactions.LIKE],
-  ["heart", Reactions.HEART],
-  ["❤️", Reactions.HEART],
-  ["<3", Reactions.HEART],
-  ["haha", Reactions.HAHA],
-  ["laugh", Reactions.HAHA],
-  ["😂", Reactions.HAHA],
-  ["wow", Reactions.WOW],
-  ["😮", Reactions.WOW],
-  ["cry", Reactions.CRY],
-  ["😢", Reactions.CRY],
-  ["angry", Reactions.ANGRY],
-  ["😡", Reactions.ANGRY],
-]);
-
-export function normalizeZaloReactionIcon(raw: string): string {
-  const trimmed = raw.trim();
-  if (!trimmed) {
-    return Reactions.LIKE;
-  }
-  return (
-    REACTION_ALIAS_MAP.get(normalizeLowercaseStringOrEmpty(trimmed)) ??
-    REACTION_ALIAS_MAP.get(trimmed) ??
-    trimmed
-  );
-}

package/src/runtime.ts

@@ -1,9 +0,0 @@
-import type { PluginRuntime } from "openclaw/plugin-sdk/core";
-import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
-
-const { setRuntime: setZalouserRuntime, getRuntime: getZalouserRuntime } =
-  createPluginRuntimeStore<PluginRuntime>({
-    pluginId: "zalouser",
-    errorMessage: "Zalouser runtime not initialized",
-  });
-export { getZalouserRuntime, setZalouserRuntime };

package/src/security-audit.test.ts

@@ -1,80 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { collectZalouserSecurityAuditFindings } from "./security-audit.js";
-import type { ResolvedZalouserAccount, ZalouserAccountConfig } from "./types.js";
-
-function createAccount(config: ZalouserAccountConfig): ResolvedZalouserAccount {
-  return {
-    accountId: "default",
-    enabled: true,
-    profile: "default",
-    authenticated: true,
-    config,
-  };
-}
-
-describe("Zalouser security audit findings", () => {
-  const cases: Array<{
-    name: string;
-    config: ZalouserAccountConfig;
-    expectedSeverity: "info" | "warn";
-    detailIncludes: string[];
-    detailExcludes?: string[];
-    expectFindingMatch?: { checkId: string; severity: "info" | "warn" };
-  }> = [
-    {
-      name: "warns when group routing contains mutable group entries",
-      config: {
-        enabled: true,
-        groups: {
-          "Ops Room": { enabled: true },
-          "group:g-123": { enabled: true },
-        },
-      } satisfies ZalouserAccountConfig,
-      expectedSeverity: "warn",
-      detailIncludes: ["channels.zalouser.groups:Ops Room"],
-      detailExcludes: ["group:g-123"],
-    },
-    {
-      name: "marks mutable group routing as break-glass when dangerous matching is enabled",
-      config: {
-        enabled: true,
-        dangerouslyAllowNameMatching: true,
-        groups: {
-          "Ops Room": { enabled: true },
-        },
-      } satisfies ZalouserAccountConfig,
-      expectedSeverity: "info",
-      detailIncludes: ["out-of-scope"],
-      expectFindingMatch: {
-        checkId: "channels.zalouser.groups.mutable_entries",
-        severity: "info",
-      },
-    },
-  ];
-
-  it.each(cases)("$name", (testCase) => {
-    const findings = collectZalouserSecurityAuditFindings({
-      account: createAccount(testCase.config),
-      accountId: "default",
-      orderedAccountIds: ["default"],
-      hasExplicitAccountPath: false,
-    });
-    const finding = findings.find(
-      (entry) => entry.checkId === "channels.zalouser.groups.mutable_entries",
-    );
-
-    expect(finding).toBeDefined();
-    expect(finding?.severity).toBe(testCase.expectedSeverity);
-    for (const snippet of testCase.detailIncludes) {
-      expect(finding?.detail).toContain(snippet);
-    }
-    for (const snippet of testCase.detailExcludes ?? []) {
-      expect(finding?.detail).not.toContain(snippet);
-    }
-    if (testCase.expectFindingMatch) {
-      expect(findings).toEqual(
-        expect.arrayContaining([expect.objectContaining(testCase.expectFindingMatch)]),
-      );
-    }
-  });
-});

package/src/security-audit.ts

@@ -1,71 +0,0 @@
-import { isDangerousNameMatchingEnabled } from "openclaw/plugin-sdk/dangerous-name-runtime";
-import type { ResolvedZalouserAccount } from "./accounts.js";
-
-export function isZalouserMutableGroupEntry(raw: string): boolean {
-  const text = raw.trim();
-  if (!text || text === "*") {
-    return false;
-  }
-  const normalized = text
-    .replace(/^(zalouser|zlu):/i, "")
-    .replace(/^group:/i, "")
-    .trim();
-  if (!normalized) {
-    return false;
-  }
-  if (/^\d+$/.test(normalized)) {
-    return false;
-  }
-  return !/^g-\S+$/i.test(normalized);
-}
-
-export function collectZalouserSecurityAuditFindings(params: {
-  accountId?: string | null;
-  account: ResolvedZalouserAccount;
-  orderedAccountIds: string[];
-  hasExplicitAccountPath: boolean;
-}) {
-  const zalouserCfg = params.account.config ?? {};
-  const accountId = params.accountId?.trim() || params.account.accountId || "default";
-  const dangerousNameMatchingEnabled = isDangerousNameMatchingEnabled(zalouserCfg);
-  const zalouserPathPrefix =
-    params.orderedAccountIds.length > 1 || params.hasExplicitAccountPath
-      ? `channels.zalouser.accounts.${accountId}`
-      : "channels.zalouser";
-  const mutableGroupEntries = new Set<string>();
-  const groups = zalouserCfg.groups;
-  if (groups && typeof groups === "object" && !Array.isArray(groups)) {
-    for (const key of Object.keys(groups as Record<string, unknown>)) {
-      if (!isZalouserMutableGroupEntry(key)) {
-        continue;
-      }
-      mutableGroupEntries.add(`${zalouserPathPrefix}.groups:${key}`);
-    }
-  }
-  if (mutableGroupEntries.size === 0) {
-    return [];
-  }
-  const examples = Array.from(mutableGroupEntries).slice(0, 5);
-  const more =
-    mutableGroupEntries.size > examples.length
-      ? ` (+${mutableGroupEntries.size - examples.length} more)`
-      : "";
-  const severity: "info" | "warn" = dangerousNameMatchingEnabled ? "info" : "warn";
-  return [
-    {
-      checkId: "channels.zalouser.groups.mutable_entries",
-      severity,
-      title: dangerousNameMatchingEnabled
-        ? "Zalouser group routing uses break-glass name matching"
-        : "Zalouser group routing contains mutable group entries",
-      detail: dangerousNameMatchingEnabled
-        ? "Zalouser group-name routing is explicitly enabled via dangerouslyAllowNameMatching. This mutable-identity mode is operator-selected break-glass behavior and out-of-scope for vulnerability reports by itself. " +
-          `Found: ${examples.join(", ")}${more}.`
-        : "Zalouser group auth is ID-only by default, so unresolved group-name or slug entries are ignored for auth and can drift from the intended trusted group. " +
-          `Found: ${examples.join(", ")}${more}.`,
-      remediation: dangerousNameMatchingEnabled
-        ? "Prefer stable Zalo group IDs (for example group:<id> or provider-native g- ids), then disable dangerouslyAllowNameMatching."
-        : "Prefer stable Zalo group IDs in channels.zalouser.groups, or explicitly opt in with dangerouslyAllowNameMatching=true if you accept mutable group-name matching.",
-    },
-  ];
-}