@tencent-connect/openclaw-qqbot 1.7.2 → 2.0.0

package/src/transport/webhook-verify.ts

@@ -1,119 +0,0 @@
-/**
- * Webhook signature verification — Ed25519.
- *
- * QQ Open Platform uses Ed25519 for webhook callback verification:
- *   1. Bot secret is padded/truncated to 32 bytes as the Ed25519 seed.
- *   2. The public key verifies `timestamp + body` against `X-Signature-Ed25519`.
- *   3. For callback URL validation (op:13), signs `event_ts + plain_token`.
- *
- * Reference: https://bot.q.qq.com/wiki/develop/api-v2/dev-prepare/interface-framework/event-emit.html
- */
-
-import * as crypto from "node:crypto";
-
-// ============ Seed derivation ============
-
-/**
- * Derive an Ed25519 seed (32 bytes) from the bot secret.
- * QQ's spec: repeat the secret until >= 32 chars, then truncate to 32.
- */
-function deriveSeed(botSecret: string): Buffer {
-  let seed = botSecret;
-  while (seed.length < 32) {
-    seed = seed + seed;
-  }
-  return Buffer.from(seed.slice(0, 32), "utf-8");
-}
-
-/**
- * Generate Ed25519 key pair from bot secret.
- */
-function getKeyPair(botSecret: string): { privateKey: crypto.KeyObject; publicKey: crypto.KeyObject } {
-  const seed = deriveSeed(botSecret);
-  // Node.js Ed25519: create private key from raw 32-byte seed
-  const privateKey = crypto.createPrivateKey({
-    key: Buffer.concat([
-      // Ed25519 PKCS8 DER prefix for 32-byte seed
-      Buffer.from("302e020100300506032b657004220420", "hex"),
-      seed,
-    ]),
-    format: "der",
-    type: "pkcs8",
-  });
-  const publicKey = crypto.createPublicKey(privateKey);
-  return { privateKey, publicKey };
-}
-
-// ============ Signature generation ============
-
-/**
- * Sign a message using the bot's Ed25519 private key.
- * Returns hex-encoded signature.
- */
-export function ed25519Sign(botSecret: string, message: Buffer): string {
-  const { privateKey } = getKeyPair(botSecret);
-  const signature = crypto.sign(null, message, privateKey);
-  return signature.toString("hex");
-}
-
-// ============ Signature verification ============
-
-/**
- * Verify an Ed25519 signature from a QQ webhook callback request.
- *
- * @param params.body - Raw request body (Buffer)
- * @param params.timestamp - Value of `X-Signature-Timestamp` header
- * @param params.signature - Value of `X-Signature-Ed25519` header (hex string)
- * @param params.botSecret - The bot's AppSecret
- * @returns `true` if signature is valid
- */
-export function verifyWebhookSignature(params: {
-  body: Buffer;
-  timestamp: string;
-  signature: string;
-  botSecret: string;
-}): boolean {
-  const { body, timestamp, signature, botSecret } = params;
-
-  try {
-    const { publicKey } = getKeyPair(botSecret);
-    const message = Buffer.concat([
-      Buffer.from(timestamp, "utf-8"),
-      body,
-    ]);
-    const sigBuffer = Buffer.from(signature, "hex");
-    return crypto.verify(null, message, publicKey, sigBuffer);
-  } catch (err) {
-    console.warn(`[qqbot:webhook-verify] Ed25519 verification threw: ${err instanceof Error ? err.message : String(err)}`);
-    return false;
-  }
-}
-
-// ============ Callback URL validation (op:13) ============
-
-/**
- * Generate the response for callback URL validation (op:13).
- *
- * QQ sends `{ op: 13, d: { plain_token, event_ts } }` to verify
- * the callback URL. We must return `{ plain_token, signature }`.
- *
- * @param params.plainToken - The `plain_token` from the validation request
- * @param params.eventTs - The `event_ts` from the validation request
- * @param params.botSecret - The bot's AppSecret
- */
-export function signValidationResponse(params: {
-  plainToken: string;
-  eventTs: string;
-  botSecret: string;
-}): { plain_token: string; signature: string } {
-  const { plainToken, eventTs, botSecret } = params;
-
-  // Sign: event_ts + plain_token
-  const message = Buffer.from(eventTs + plainToken, "utf-8");
-  const signature = ed25519Sign(botSecret, message);
-
-  return {
-    plain_token: plainToken,
-    signature,
-  };
-}

package/src/typing-keepalive.ts

@@ -1,59 +0,0 @@
-/**
- * 输入状态自动续期
- * 在消息处理期间定时续发 "正在输入" 状态通知，确保用户持续看到 bot 在处理中。
- * 仅 C2C 私聊有效（QQ 群聊 API 不支持输入状态通知）。
- */
-
-import { sendC2CInputNotify } from "./api.js";
-
-// 每 50 秒续发一次（QQ API input_second=60，留 10s 余量）
-export const TYPING_INTERVAL_MS = 50_000;
-export const TYPING_INPUT_SECOND = 60;
-
-export class TypingKeepAlive {
-  private timer: ReturnType<typeof setInterval> | null = null;
-  private stopped = false;
-
-  constructor(
-    private readonly getToken: () => Promise<string>,
-    private readonly clearCache: () => void,
-    private readonly openid: string,
-    private readonly msgId: string | undefined,
-    private readonly log?: { info: (msg: string) => void; error: (msg: string) => void; debug?: (msg: string) => void },
-    private readonly logPrefix = "[qqbot]",
-  ) {}
-
-  /** 启动定时续期（首次发送由调用方自行处理，这里只负责后续续期） */
-  start(): void {
-    if (this.stopped) return;
-    this.timer = setInterval(() => {
-      if (this.stopped) { this.stop(); return; }
-      this.send().catch(() => {});
-    }, TYPING_INTERVAL_MS);
-  }
-
-  /** 停止续期 */
-  stop(): void {
-    this.stopped = true;
-    if (this.timer) {
-      clearInterval(this.timer);
-      this.timer = null;
-    }
-  }
-
-  private async send(): Promise<void> {
-    try {
-      const token = await this.getToken();
-      await sendC2CInputNotify(token, this.openid, this.msgId, TYPING_INPUT_SECOND);
-      this.log?.debug?.(`${this.logPrefix} Typing keep-alive sent to ${this.openid}`);
-    } catch (err) {
-      try {
-        this.clearCache();
-        const token = await this.getToken();
-        await sendC2CInputNotify(token, this.openid, this.msgId, TYPING_INPUT_SECOND);
-      } catch {
-        this.log?.debug?.(`${this.logPrefix} Typing keep-alive failed for ${this.openid}: ${err}`);
-      }
-    }
-  }
-}