@stage-labs/metro 0.1.0-beta.97 → 0.1.0-beta.99

package/runtime/node_modules/@metro-labs/threema/src/format.ts

@@ -0,0 +1,123 @@
+import { emit, mintId } from '@metro-labs/core/stations/station-runtime';
+import { RECEIPT_ACK, RECEIPT_DECLINE, unquote } from './crypto.js';
+
+const SELF_URI = process.env.METRO_SELF_URI ?? '';
+
+const REACTION_OF: Record<number, string> = {
+  [RECEIPT_ACK]: '👍',
+  [RECEIPT_DECLINE]: '👎',
+};
+
+export const lineOf = (accountId: string, threemaId: string): string =>
+  `metro://threema/${accountId}/${threemaId}`;
+
+const userOf = (accountId: string, threemaId: string): string =>
+  `metro://threema/${accountId}/user/${threemaId}`;
+
+export interface InboundMeta {
+  from: string;
+  to: string;
+  messageId: string;
+  date: string;
+  nickname?: string;
+}
+
+function tsOf(date: string): string {
+  const seconds = Number(date);
+  return Number.isFinite(seconds) && seconds > 0
+    ? new Date(seconds * 1000).toISOString()
+    : new Date().toISOString();
+}
+
+function base(
+  accountId: string,
+  m: InboundMeta,
+  type: string,
+): Record<string, unknown> {
+  return {
+    kind: 'inbound',
+    id: mintId(),
+    ts: tsOf(m.date),
+    station: 'threema',
+    line: lineOf(accountId, m.from),
+    line_name: m.nickname ?? m.from,
+    from: userOf(accountId, m.from),
+    from_name: m.nickname,
+    from_display_name: m.nickname,
+    is_private: true,
+    payload: { from: m.from, to: m.to, nickname: m.nickname ?? null, type },
+  };
+}
+
+export function textEnvelope(
+  accountId: string,
+  m: InboundMeta,
+  raw: string,
+  sentByUs: (messageId: string) => boolean,
+): Record<string, unknown> {
+  const { replyTo, text } = unquote(raw);
+  return {
+    ...base(accountId, m, 'text'),
+    message_id: m.messageId,
+    text,
+    ...(replyTo === undefined
+      ? {}
+      : {
+          reply_to: replyTo,
+          event: { type: 'reply', replyTo },
+          reply_to_self: sentByUs(replyTo),
+        }),
+  };
+}
+
+export function receiptEnvelope(
+  accountId: string,
+  m: InboundMeta,
+  status: number,
+  targetId: string,
+): Record<string, unknown> | null {
+  const emoji = REACTION_OF[status];
+  if (emoji === undefined) return null;
+  return {
+    ...base(accountId, m, 'receipt'),
+    message_id: `${m.messageId}:${targetId}`,
+    emoji,
+    event: { type: 'react', emoji, targetId },
+  };
+}
+
+export function emitInbound(
+  accountId: string,
+  owner: string | undefined,
+  env: Record<string, unknown>,
+): void {
+  const payload = {
+    ...(env.payload as Record<string, unknown> | undefined),
+    account: accountId,
+  };
+  emit({ ...env, ...(owner ? { to: owner } : {}), account: accountId, payload });
+}
+
+export function emitOutbound(
+  accountId: string,
+  line: string,
+  messageId: string,
+  text: string,
+  replyTo?: string,
+): void {
+  emit({
+    kind: 'outbound',
+    id: mintId(),
+    ts: new Date().toISOString(),
+    station: 'threema',
+    line,
+    from: SELF_URI,
+    to: line,
+    message_id: messageId,
+    text,
+    reply_to: replyTo,
+    ...(replyTo ? { event: { type: 'reply', replyTo } } : {}),
+    account: accountId,
+    payload: { account: accountId },
+  });
+}

package/runtime/node_modules/@metro-labs/threema/src/ids.ts

@@ -0,0 +1,21 @@
+export const GATEWAY_API = (
+  process.env.THREEMA_GATEWAY_URL ?? 'https://msgapi.threema.ch'
+).replace(/\/+$/, '');
+
+const THREEMA_ID_RE = /^(?:[A-Z0-9]{8}|\*[A-Z0-9]{7})$/;
+const KEY_HEX_RE = /^[0-9a-f]{64}$/;
+
+export const MESSAGE_ID_RE = /^[0-9a-f]{16}$/;
+
+export const isThreemaId = (raw: string): boolean => THREEMA_ID_RE.test(raw);
+
+export const isGatewayId = (raw: string): boolean =>
+  raw.startsWith('*') && isThreemaId(raw);
+
+export const normalizeThreemaId = (raw: string): string =>
+  raw.trim().toUpperCase();
+
+export function parsePrivateKey(raw: string): string | null {
+  const text = raw.trim().replace(/^private:/i, '').trim().toLowerCase();
+  return KEY_HEX_RE.test(text) ? text : null;
+}

package/runtime/node_modules/@metro-labs/threema/src/index.ts

@@ -0,0 +1,29 @@
+import { errMsg } from '@metro-labs/core/log';
+import { readCalls } from '@metro-labs/core/trains/protocol';
+import { accounts, bootAccount, loadAccounts } from './accounts.js';
+import { handleCall } from './actions.js';
+import { fetchCredits } from './api.js';
+
+readCalls('threema', handleCall);
+
+for (const cfg of loadAccounts()) accounts.set(cfg.id, bootAccount(cfg));
+if (accounts.size === 0) {
+  process.stderr.write('threema: no accounts booted, exiting\n');
+  process.exit(2);
+}
+process.stderr.write(
+  `threema train ready — ${accounts.size} account(s): ${[...accounts.keys()].join(', ')}\n`,
+);
+
+for (const acct of accounts.values())
+  fetchCredits(acct.cfg)
+    .then((credits) => {
+      process.stderr.write(
+        `threema[${acct.cfg.id}] ${acct.cfg.gatewayId}: ${credits} credits left\n`,
+      );
+    })
+    .catch((err: unknown) => {
+      process.stderr.write(
+        `threema[${acct.cfg.id}] credits check failed: ${errMsg(err)}\n`,
+      );
+    });

package/runtime/node_modules/@metro-labs/threema/src/station.ts

@@ -0,0 +1,10 @@
+import type { Station, Verb } from '@metro-labs/core/stations/types';
+
+export const threemaStation: Station = {
+  name: 'threema',
+  hasAccounts: true,
+  hasTrain: true,
+  messageVerbs: new Set<Verb>(['send', 'reply']),
+  attachmentMode: 'none',
+  tools: [],
+};

package/runtime/node_modules/@metro-labs/threema/src/verify.ts

@@ -0,0 +1,117 @@
+import { createPrivateKey, createPublicKey } from 'node:crypto';
+import {
+  GATEWAY_API,
+  isGatewayId,
+  normalizeThreemaId,
+  parsePrivateKey,
+} from './ids.js';
+
+export { parsePrivateKey } from './ids.js';
+
+export class ThreemaGatewayError extends Error {}
+
+export interface ThreemaCredentials {
+  gatewayId: string;
+  secret: string;
+  privateKey: string;
+}
+
+export interface ThreemaGatewayIdentity {
+  gatewayId: string;
+  publicKey: string;
+  credits: number;
+}
+
+const PKCS8_X25519_PREFIX = Buffer.from(
+  '302e020100300506032b656e04220420',
+  'hex',
+);
+const TIMEOUT_MS = 10_000;
+const PUBLIC_KEY_RE = /^[0-9a-f]{64}$/;
+
+export function publicKeyOf(privateKeyHex: string): string {
+  const der = Buffer.concat([
+    PKCS8_X25519_PREFIX,
+    Buffer.from(privateKeyHex, 'hex'),
+  ]);
+  const key = createPrivateKey({ key: der, format: 'der', type: 'pkcs8' });
+  const jwk = createPublicKey(key).export({ format: 'jwk' });
+  return Buffer.from(String(jwk.x), 'base64url').toString('hex');
+}
+
+async function gatewayGet(
+  path: string,
+  gatewayId: string,
+  secret: string,
+): Promise<Response> {
+  const query = new URLSearchParams({ from: gatewayId, secret });
+  try {
+    return await fetch(`${GATEWAY_API}${path}?${query.toString()}`, {
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+  } catch {
+    throw new ThreemaGatewayError(
+      'could not reach the Threema Gateway to check those credentials',
+    );
+  }
+}
+
+function refused(res: Response, what: string): ThreemaGatewayError {
+  if (res.status === 401)
+    return new ThreemaGatewayError(
+      'Threema rejected that Gateway ID or API secret',
+    );
+  if (res.status === 404)
+    return new ThreemaGatewayError(`Threema does not know ${what}`);
+  return new ThreemaGatewayError(
+    `the Threema Gateway answered ${res.status} while checking ${what}`,
+  );
+}
+
+async function fetchCredits(gatewayId: string, secret: string): Promise<number> {
+  const res = await gatewayGet('/credits', gatewayId, secret);
+  if (!res.ok) throw refused(res, 'the credit balance');
+  const credits = Number((await res.text()).trim());
+  if (!Number.isInteger(credits))
+    throw new ThreemaGatewayError(
+      'the Threema Gateway gave an unexpected answer for the credit balance',
+    );
+  return credits;
+}
+
+async function fetchPublicKey(gatewayId: string, secret: string): Promise<string> {
+  const res = await gatewayGet(
+    `/pubkeys/${encodeURIComponent(gatewayId)}`,
+    gatewayId,
+    secret,
+  );
+  if (!res.ok) throw refused(res, `the public key of ${gatewayId}`);
+  const hex = (await res.text()).trim().toLowerCase();
+  if (!PUBLIC_KEY_RE.test(hex))
+    throw new ThreemaGatewayError(
+      'the Threema Gateway gave an unexpected answer for the public key',
+    );
+  return hex;
+}
+
+export async function verifyThreemaGateway(
+  input: ThreemaCredentials,
+): Promise<ThreemaGatewayIdentity> {
+  const gatewayId = normalizeThreemaId(input.gatewayId);
+  if (!isGatewayId(gatewayId))
+    throw new ThreemaGatewayError(
+      'a Threema Gateway ID is a * followed by 7 letters or digits, as in *ABCDEFG',
+    );
+  const privateKey = parsePrivateKey(input.privateKey);
+  if (privateKey === null)
+    throw new ThreemaGatewayError(
+      'the private key is the 64 hex characters from the key file Threema gave you, with or without its private: prefix',
+    );
+  const credits = await fetchCredits(gatewayId, input.secret);
+  const registered = await fetchPublicKey(gatewayId, input.secret);
+  if (registered !== publicKeyOf(privateKey))
+    throw new ThreemaGatewayError(
+      `that private key does not belong to ${gatewayId}: the Gateway holds a different public key for it`,
+    );
+  return { gatewayId, publicKey: registered, credits };
+}

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.97"
+  "version": "0.1.0-beta.99"
 }

package/runtime/stations.json

@@ -31,6 +31,9 @@
     "whatsapp": {
       "baileys": "7.0.0-rc14"
     },
+    "threema": {
+      "tweetnacl": "^1.0.3"
+    },
     "webhook": {}
   }
 }