@vielhuber/wahelper 1.6.3 → 1.6.5

package/README.md

@@ -53,7 +53,9 @@ npx wahelper \
 
     # fetch messages
     --action "fetch_messages" \
-    --limit 42
+    --filter '{"from":"491234567890","to":"491234567890","message":"meeting","date_from":"2026-01-01","date_until":"2026-12-31"}' \
+    --limit 42 \
+    --order "desc"
 
     # view a single message by id
     --action "view_message" \
@@ -62,13 +64,13 @@ npx wahelper \
     # send message to user
     --action "send_user" \
     --number "xxxxxxxxxxxx" \
-    --message "This is a test! 🚀"
+    --message "This is a test! 🚀" \
     --attachments "/full/path/to/file.pdf,/full/path/to/image.png"
 
     # send message to group
     --action "send_group" \
     --name "Group name" \
-    --message "This is a test! 🚀"
+    --message "This is a test! 🚀" \
     --attachments "/full/path/to/file.pdf,/full/path/to/image.png"
 ```
 
@@ -81,10 +83,24 @@ use vielhuber\wahelper\wahelper;
 $wahelper = new wahelper();
 
 // fetch messages
-$wahelper->fetchMessages(device: 'xxxxxxxxxxxx', limit: 42);
+$wahelper->fetchMessages(
+    device: 'xxxxxxxxxxxx',
+    filter: [
+        'from' => '491234567890',
+        'to' => '491234567890',
+        'message' => 'meeting',
+        'date_from' => '2026-01-01',
+        'date_until' => '2026-12-31'
+    ],
+    limit: 42,
+    order: 'desc'
+);
 
 // view a single message by id
-$wahelper->viewMessage(device: 'xxxxxxxxxxxx', id: 'ABCDEF1234567890');
+$wahelper->viewMessage(
+    device: 'xxxxxxxxxxxx',
+    id: 'ABCDEF1234567890'
+);
 
 // send message to user
 $wahelper->sendUser(

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@vielhuber/wahelper",
-    "version": "1.6.3",
+    "version": "1.6.5",
     "description": "Lightweight whatsapp integration layer.",
     "main": "wahelper.js",
     "files": [

package/wahelper-daemon.js

@@ -15,6 +15,7 @@ import { fileURLToPath } from 'url';
 import { dirname } from 'path';
 import fs from 'fs';
 import http from 'http';
+import crypto from 'crypto';
 import { DatabaseSync } from 'node:sqlite';
 
 export default class wahelperDaemon {
@@ -45,6 +46,7 @@ export default class wahelperDaemon {
             this.dbPath = 'whatsapp_' + this.device + '.sqlite';
             this.logPath = 'whatsapp_' + this.device + '.log';
             this.port = this.computePort(this.device);
+            this.authToken = this.getAuthToken();
         }
     }
 
@@ -100,6 +102,35 @@ export default class wahelperDaemon {
         return 29000 + (parseInt(device.slice(-5)) % 3000);
     }
 
+    getAuthToken() {
+        let path = this.dirname + '/whatsapp_' + this.device + '.token';
+        if (fs.existsSync(path)) {
+            let token = fs.readFileSync(path, 'utf8').trim();
+            if (token !== '') {
+                try {
+                    fs.chmodSync(path, 0o600);
+                } catch (_) {}
+                return token;
+            }
+        }
+        let token = crypto.randomBytes(32).toString('hex');
+        fs.writeFileSync(path, token, { mode: 0o600 });
+        return token;
+    }
+
+    isAuthorized(req) {
+        let token = req.headers['x-wahelper-token'];
+        if (Array.isArray(token)) {
+            token = token[0];
+        }
+        if (typeof token !== 'string' || token === '') {
+            return false;
+        }
+        let expected = Buffer.from(this.authToken);
+        let actual = Buffer.from(token);
+        return expected.length === actual.length && crypto.timingSafeEqual(expected, actual);
+    }
+
     formatNumber(number) {
         // replace leading zero with 49
         number = number.replace(/^0+/, '49');
@@ -708,8 +739,9 @@ export default class wahelperDaemon {
 
     startHttpServer() {
         this.httpServer = http.createServer(async (req, res) => {
-            // Unix socket — only local processes can connect, no IP check needed
-
+            // bound to 127.0.0.1 below — every request additionally has to
+            // carry the per-device auth token (X-Wahelper-Token header) so
+            // other local processes can't read pairing codes or send messages
             let body = '';
             req.on('data', chunk => {
                 body += chunk;
@@ -726,6 +758,10 @@ export default class wahelperDaemon {
 
                 try {
                     if (req.method === 'GET' && url === '/status') {
+                        if (!this.isAuthorized(req)) {
+                            this.sendJsonResponse(res, 403, { success: false, message: 'forbidden' });
+                            return;
+                        }
                         this.sendJsonResponse(res, 200, {
                             success: true,
                             connected: this.connected,
@@ -738,6 +774,10 @@ export default class wahelperDaemon {
                     }
 
                     if (req.method === 'POST' && url === '/send-user') {
+                        if (!this.isAuthorized(req)) {
+                            this.sendJsonResponse(res, 403, { success: false, message: 'forbidden' });
+                            return;
+                        }
                         if (!data.number || !data.message) {
                             this.sendJsonResponse(res, 400, { success: false, message: 'missing_parameters' });
                             return;
@@ -752,6 +792,10 @@ export default class wahelperDaemon {
                     }
 
                     if (req.method === 'POST' && url === '/send-group') {
+                        if (!this.isAuthorized(req)) {
+                            this.sendJsonResponse(res, 403, { success: false, message: 'forbidden' });
+                            return;
+                        }
                         if (!data.name || !data.message) {
                             this.sendJsonResponse(res, 400, { success: false, message: 'missing_parameters' });
                             return;
@@ -832,9 +876,21 @@ export default class wahelperDaemon {
 
     isAlreadyRunning() {
         return new Promise(resolve => {
-            let req = http.request({ host: '127.0.0.1', port: this.port, path: '/status', method: 'GET' }, res => {
-                resolve(res.statusCode === 200);
-            });
+            let req = http.request(
+                {
+                    host: '127.0.0.1',
+                    port: this.port,
+                    path: '/status',
+                    method: 'GET',
+                    headers: { 'X-Wahelper-Token': this.authToken }
+                },
+                res => {
+                    // any HTTP answer (even 403 from a token mismatch with a
+                    // stale token file we somehow lost) means another daemon
+                    // is bound to the port — we don't want to start a second one
+                    resolve(res.statusCode >= 200 && res.statusCode < 500);
+                }
+            );
             req.on('error', () => resolve(false));
             req.setTimeout(2000, () => {
                 req.destroy();

package/wahelper.js

@@ -4,6 +4,7 @@ import http from 'http';
 import { fileURLToPath } from 'url';
 import { dirname } from 'path';
 import fs from 'fs';
+import crypto from 'crypto';
 import { DatabaseSync } from 'node:sqlite';
 import qrcodeTerminal from 'qrcode-terminal';
 
@@ -25,6 +26,7 @@ export default class wahelper {
             this.logPath = 'whatsapp_' + this.formatNumber(this.args.device) + '.log';
             this.dataPath = 'whatsapp_' + this.formatNumber(this.args.device) + '.json';
             this.port = this.computePort(this.formatNumber(this.args.device));
+            this.authToken = this.getAuthToken();
         }
     }
 
@@ -109,7 +111,17 @@ export default class wahelper {
                 );
             } else {
                 if (this.args.action === 'fetch_messages') {
-                    response = await this.fetchMessages(this.args.limit);
+                    let filter = null;
+                    if (typeof this.args.filter === 'string' && this.args.filter !== '') {
+                        try {
+                            filter = JSON.parse(this.args.filter);
+                        } catch (_) {
+                            filter = null;
+                        }
+                    } else if (this.args.filter && typeof this.args.filter === 'object') {
+                        filter = this.args.filter;
+                    }
+                    response = await this.fetchMessages(filter, this.args.limit, this.args.order);
                 }
                 if (this.args.action === 'view_message') {
                     response = await this.viewMessage(this.args.id);
@@ -131,30 +143,46 @@ export default class wahelper {
         this.log('cli stop');
     }
 
-    async fetchMessages(limit = null) {
+    async fetchMessages(filter = null, limit = null, order = null) {
         // fetch directly from database — no connection to daemon needed
         try {
-            let messages = this.db
-                .prepare(
-                    `
-						SELECT id, \`from\`, \`to\`, content, media_filename, timestamp, \`read\`
-						FROM messages
-						ORDER BY timestamp DESC
-						${limit !== null ? 'LIMIT ' + limit : ''}
-					`
-                )
-                .all();
+            let where = [];
+            let params = [];
+            if (filter && typeof filter === 'object') {
+                if (filter.from) {
+                    where.push('`from` = ?');
+                    params.push(String(filter.from).replace(/^\+/, '').replace(/\D/g, ''));
+                }
+                if (filter.to) {
+                    where.push('`to` = ?');
+                    params.push(String(filter.to).replace(/^\+/, '').replace(/\D/g, ''));
+                }
+                if (filter.message) {
+                    where.push('content LIKE ?');
+                    params.push('%' + filter.message + '%');
+                }
+                if (filter.date_from !== undefined && filter.date_from !== null && filter.date_from !== '') {
+                    where.push('timestamp >= ?');
+                    params.push(this.toUnixSeconds(filter.date_from));
+                }
+                if (filter.date_until !== undefined && filter.date_until !== null && filter.date_until !== '') {
+                    where.push('timestamp <= ?');
+                    params.push(this.toUnixSeconds(filter.date_until, true));
+                }
+            }
+            let orderDir = order === 'asc' ? 'ASC' : 'DESC';
+            let sql =
+                'SELECT id, `from`, `to`, content, media_filename, timestamp, `read` FROM messages' +
+                (where.length > 0 ? ' WHERE ' + where.join(' AND ') : '') +
+                ' ORDER BY timestamp ' + orderDir +
+                (limit !== null ? ' LIMIT ' + parseInt(limit, 10) : '');
+            let messages = this.db.prepare(sql).all(...params);
             console.log(
                 'Fetched ' + messages.length + ' messages from database (' + this.dirname + '/' + this.dbPath + ').'
             );
             this.write({ success: true, message: 'messages_fetched', data: messages }, true);
             return {
-                content: [
-                    {
-                        type: 'text',
-                        text: 'Fetched ' + messages.length + ' messages from database'
-                    }
-                ],
+                content: [{ type: 'text', text: 'Fetched ' + messages.length + ' messages from database' }],
                 structuredContent: messages
             };
         } catch (error) {
@@ -163,6 +191,18 @@ export default class wahelper {
         return null;
     }
 
+    // accept either a unix timestamp (seconds) or a YYYY-MM-DD date string —
+    // pass `endOfDay=true` to bump a date-only value to 23:59:59
+    toUnixSeconds(value, endOfDay = false) {
+        let n = Number(value);
+        if (Number.isFinite(n) && n > 0) {
+            return Math.floor(n);
+        }
+        let s = String(value);
+        let d = new Date(s + (s.length === 10 ? (endOfDay ? 'T23:59:59Z' : 'T00:00:00Z') : ''));
+        return Math.floor(d.getTime() / 1000);
+    }
+
     async viewMessage(id = null) {
         // lookup directly from database — no connection to daemon needed
         try {
@@ -277,12 +317,29 @@ export default class wahelper {
         return 29000 + (parseInt(device.slice(-5)) % 3000);
     }
 
+    getAuthToken() {
+        let path = this.dirname + '/whatsapp_' + this.formatNumber(this.args.device) + '.token';
+        if (fs.existsSync(path)) {
+            let token = fs.readFileSync(path, 'utf8').trim();
+            if (token !== '') {
+                try {
+                    fs.chmodSync(path, 0o600);
+                } catch (_) {}
+                return token;
+            }
+        }
+        let token = crypto.randomBytes(32).toString('hex');
+        fs.writeFileSync(path, token, { mode: 0o600 });
+        return token;
+    }
+
     async callDaemon(method, path, body = null) {
         return new Promise(resolve => {
             let postData = body !== null ? JSON.stringify(body) : '';
             let headers = {
                 'Content-Type': 'application/json',
-                'Content-Length': Buffer.byteLength(postData)
+                'Content-Length': Buffer.byteLength(postData),
+                'X-Wahelper-Token': this.authToken
             };
             let options = { host: '127.0.0.1', port: this.port, path, method, headers };
             let req = http.request(options, res => {