@workclaw/openclaw-workchat 1.0.0 → 1.0.3

package/src/auth/accounts.ts

@@ -1,290 +1,290 @@
-import fs from "node:fs";
-import path from "node:path";
-
-import type { OpenClawConfig } from "openclaw/plugin-sdk";
-
-import { DEFAULT_BASE_URL } from "../api/types.js";
-import { resolveStateDir } from "../storage/state-dir.js";
-import { logger } from "../util/logger.js";
-
-// ---------------------------------------------------------------------------
-// Account index (persistent list of bound account IDs)
-// ---------------------------------------------------------------------------
-
-function resolveWorkChatStateDir(): string {
-  return path.join(resolveStateDir(), "openclaw-workchat");
-}
-
-function resolveAccountIndexPath(): string {
-  return path.join(resolveWorkChatStateDir(), "accounts.json");
-}
-
-/** Returns all accountIds registered via binding QR. */
-export function listIndexedWorkChatAccountIds(): string[] {
-  const filePath = resolveAccountIndexPath();
-  try {
-    if (!fs.existsSync(filePath)) return [];
-    const parsed = JSON.parse(fs.readFileSync(filePath, "utf-8"));
-    if (!Array.isArray(parsed)) return [];
-    return parsed.filter((id): id is string => typeof id === "string" && id.trim() !== "");
-  } catch {
-    return [];
-  }
-}
-
-/** Add accountId to the persistent index (no-op if already present). */
-export function registerWorkChatAccountId(accountId: string): void {
-  const dir = resolveWorkChatStateDir();
-  fs.mkdirSync(dir, { recursive: true });
-  const existing = listIndexedWorkChatAccountIds();
-  if (existing.includes(accountId)) return;
-  fs.writeFileSync(resolveAccountIndexPath(), JSON.stringify([...existing, accountId], null, 2), "utf-8");
-}
-
-/** Remove accountId from the persistent index. */
-export function unregisterWorkChatAccountId(accountId: string): void {
-  const existing = listIndexedWorkChatAccountIds();
-  const updated = existing.filter(id => id !== accountId);
-  if (updated.length !== existing.length) {
-    fs.writeFileSync(resolveAccountIndexPath(), JSON.stringify(updated, null, 2), "utf-8");
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Account store (per-account data files)
-// ---------------------------------------------------------------------------
-
-/** Unified per-account data: agent/user ids discovered at binding time. */
-export type WorkChatAccountData = {
-  agentId?: string;
-  userId?: string;
-  savedAt?: string;
-  baseUrl?: string;
-};
-
-function resolveAccountsDir(): string {
-  return path.join(resolveWorkChatStateDir(), "accounts");
-}
-
-function resolveAccountPath(accountId: string): string {
-  return path.join(resolveAccountsDir(), `${accountId}.json`);
-}
-
-function readAccountFile(filePath: string): WorkChatAccountData | null {
-  try {
-    if (fs.existsSync(filePath)) {
-      return JSON.parse(fs.readFileSync(filePath, "utf-8")) as WorkChatAccountData;
-    }
-  } catch {
-    // ignore
-  }
-  return null;
-}
-
-/** Load account data by ID. */
-export function loadWorkChatAccount(accountId: string): WorkChatAccountData | null {
-  return readAccountFile(resolveAccountPath(accountId));
-}
-
-/**
- * Persist account data after binding (merges into existing file).
- * agentId/userId are the WorkChat cloud ids discovered via AGENT_CREATED /
- * INIT_AGENT events or the binding QR poll.
- */
-export function saveWorkChatAccount(
-  accountId: string,
-  update: { agentId?: string; userId?: string; baseUrl?: string },
-): void {
-  const dir = resolveAccountsDir();
-  fs.mkdirSync(dir, { recursive: true });
-
-  const existing = loadWorkChatAccount(accountId) ?? {};
-  const data: WorkChatAccountData = {
-    agentId: update.agentId?.trim() || existing.agentId,
-    userId: update.userId?.trim() || existing.userId,
-    baseUrl: update.baseUrl?.trim() || existing.baseUrl,
-    savedAt: new Date().toISOString(),
-  };
-  const filePath = resolveAccountPath(accountId);
-  fs.writeFileSync(filePath, JSON.stringify(data, null, 2), "utf-8");
-  try {
-    fs.chmodSync(filePath, 0o600);
-  } catch {
-    // best-effort
-  }
-}
-
-/** Remove all files associated with an account. */
-export function clearWorkChatAccount(accountId: string): void {
-  const filePath = resolveAccountPath(accountId);
-  try {
-    if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
-  } catch (err) {
-    logger.warn(`clearWorkChatAccount: failed to remove ${filePath}: ${String(err)}`);
-  }
-  unregisterWorkChatAccountId(accountId);
-}
-
-/**
- * Fully remove an account binding: state file, index entry, allowFrom store
- * and the `channels.openclaw-workchat.accounts` routing entry in openclaw.json.
- * Used when a re-scan replaces the previously bound agent (rebind semantics:
- * one active agent per host) and when the platform reports AGENT_DELETED.
- */
-export async function removeWorkChatAccountBinding(accountId: string): Promise<void> {
-  clearWorkChatAccount(accountId);
-
-  try {
-    const { clearFrameworkAllowFromList } = await import("./pairing.js");
-    clearFrameworkAllowFromList(accountId);
-  } catch (err) {
-    logger.warn(`removeWorkChatAccountBinding: allowFrom cleanup failed: ${String(err)}`);
-  }
-
-  try {
-    const { loadConfig, writeConfigFile } = await import("openclaw/plugin-sdk/config-runtime");
-    const cfg = loadConfig();
-    const channels = (cfg.channels ?? {}) as Record<string, any>;
-    const section = channels["openclaw-workchat"];
-    if (section?.accounts?.[accountId] !== undefined) {
-      const accounts = { ...(section.accounts ?? {}) };
-      delete accounts[accountId];
-      await writeConfigFile({
-        ...cfg,
-        channels: {
-          ...channels,
-          "openclaw-workchat": { ...section, accounts },
-        },
-      } as import("openclaw/plugin-sdk").OpenClawConfig);
-    }
-  } catch (err) {
-    logger.warn(`removeWorkChatAccountBinding: config cleanup failed: ${String(err)}`);
-  }
-}
-
-/**
- * Remove every registered account whose stored agentId differs from
- * `keepAgentId` (rebind cleanup). Returns the removed accountIds.
- * `default` is normalized: if it holds a foreign agentId it is removed too;
- * the surviving binding keeps whatever account key it was registered under.
- */
-export async function pruneStaleWorkChatAccounts(keepAgentId: string): Promise<string[]> {
-  const removed: string[] = [];
-  for (const accountId of listIndexedWorkChatAccountIds()) {
-    const data = loadWorkChatAccount(accountId);
-    const storedAgentId = data?.agentId?.trim();
-    if (storedAgentId && storedAgentId !== keepAgentId) {
-      await removeWorkChatAccountBinding(accountId);
-      removed.push(accountId);
-      logger.info(
-        `pruneStaleWorkChatAccounts: removed account=${accountId} agent=${storedAgentId} (superseded by agent=${keepAgentId})`,
-      );
-    }
-  }
-  return removed;
-}
-
-// ---------------------------------------------------------------------------
-// Account resolution (merge config + stored ids)
-// ---------------------------------------------------------------------------
-
-export type ResolvedWorkChatAccount = {
-  accountId: string;
-  baseUrl: string;
-  appKey?: string;
-  appSecret?: string;
-  agentId?: string;
-  userId?: string;
-  enabled: boolean;
-  /** true when appKey + appSecret are available (via ${WORKCHAT_*} env placeholders). */
-  configured: boolean;
-  name?: string;
-  allowInsecureTls?: boolean;
-  requestTimeout?: number;
-};
-
-type WorkChatAccountConfig = {
-  name?: string;
-  enabled?: boolean;
-  agentId?: string | number;
-  userId?: string | number;
-};
-
-type WorkChatSectionConfig = WorkChatAccountConfig & {
-  baseUrl?: string;
-  websocketUrl?: string;
-  appKey?: string;
-  appSecret?: string;
-  allowInsecureTls?: boolean;
-  requestTimeout?: number;
-  accounts?: Record<string, WorkChatAccountConfig>;
-  /** Written on each successful binding; see triggerWorkChatChannelReload. */
-  channelConfigUpdatedAt?: string;
-};
-
-/** List accountIds from the index file (written at binding). */
-export function listWorkChatAccountIds(_cfg: OpenClawConfig): string[] {
-  return listIndexedWorkChatAccountIds();
-}
-
-/** Resolve a workchat account by ID, merging config and stored ids. */
-export function resolveWorkChatAccount(
-  cfg: OpenClawConfig,
-  accountId?: string | null,
-): ResolvedWorkChatAccount {
-  const raw = accountId?.trim();
-  if (!raw) {
-    throw new Error("workchat: accountId is required (no default account)");
-  }
-  const section = cfg.channels?.["openclaw-workchat"] as WorkChatSectionConfig | undefined;
-  const accountCfg: WorkChatAccountConfig = section?.accounts?.[raw] ?? section ?? {};
-
-  const accountData = loadWorkChatAccount(raw);
-  const appKey = section?.appKey?.trim() || undefined;
-  const appSecret = section?.appSecret?.trim() || undefined;
-
-  return {
-    accountId: raw,
-    baseUrl: section?.baseUrl?.trim() || DEFAULT_BASE_URL,
-    appKey,
-    appSecret,
-    agentId: String(accountCfg.agentId ?? "") || accountData?.agentId,
-    userId: String(accountCfg.userId ?? "") || accountData?.userId,
-    enabled: accountCfg.enabled !== false,
-    configured: Boolean(appKey && appSecret),
-    name: accountCfg.name?.trim() || undefined,
-    allowInsecureTls: section?.allowInsecureTls,
-    requestTimeout: section?.requestTimeout,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Config reload trigger
-// ---------------------------------------------------------------------------
-
-/**
- * Bump `channels.openclaw-workchat.channelConfigUpdatedAt` in openclaw.json on
- * each successful binding so the gateway reloads config from disk.
- */
-export async function triggerWorkChatChannelReload(): Promise<void> {
-  try {
-    const { loadConfig, writeConfigFile } = await import("openclaw/plugin-sdk/config-runtime");
-    const cfg = loadConfig();
-    const channels = (cfg.channels ?? {}) as Record<string, unknown>;
-    const existing = (channels["openclaw-workchat"] as Record<string, unknown> | undefined) ?? {};
-    const updated: OpenClawConfig = {
-      ...cfg,
-      channels: {
-        ...channels,
-        "openclaw-workchat": {
-          ...existing,
-          channelConfigUpdatedAt: new Date().toISOString(),
-        },
-      },
-    };
-    await writeConfigFile(updated);
-    logger.info("triggerWorkChatChannelReload: wrote channel config to openclaw.json");
-  } catch (err) {
-    logger.warn(`triggerWorkChatChannelReload: failed to update config: ${String(err)}`);
-  }
-}
+import fs from "node:fs";
+import path from "node:path";
+
+import type { OpenClawConfig } from "openclaw/plugin-sdk";
+
+import { DEFAULT_BASE_URL } from "../api/types.js";
+import { resolveStateDir } from "../storage/state-dir.js";
+import { logger } from "../util/logger.js";
+
+// ---------------------------------------------------------------------------
+// Account index (persistent list of bound account IDs)
+// ---------------------------------------------------------------------------
+
+function resolveWorkChatStateDir(): string {
+  return path.join(resolveStateDir(), "openclaw-workchat");
+}
+
+function resolveAccountIndexPath(): string {
+  return path.join(resolveWorkChatStateDir(), "accounts.json");
+}
+
+/** Returns all accountIds registered via binding QR. */
+export function listIndexedWorkChatAccountIds(): string[] {
+  const filePath = resolveAccountIndexPath();
+  try {
+    if (!fs.existsSync(filePath)) return [];
+    const parsed = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter((id): id is string => typeof id === "string" && id.trim() !== "");
+  } catch {
+    return [];
+  }
+}
+
+/** Add accountId to the persistent index (no-op if already present). */
+export function registerWorkChatAccountId(accountId: string): void {
+  const dir = resolveWorkChatStateDir();
+  fs.mkdirSync(dir, { recursive: true });
+  const existing = listIndexedWorkChatAccountIds();
+  if (existing.includes(accountId)) return;
+  fs.writeFileSync(resolveAccountIndexPath(), JSON.stringify([...existing, accountId], null, 2), "utf-8");
+}
+
+/** Remove accountId from the persistent index. */
+export function unregisterWorkChatAccountId(accountId: string): void {
+  const existing = listIndexedWorkChatAccountIds();
+  const updated = existing.filter(id => id !== accountId);
+  if (updated.length !== existing.length) {
+    fs.writeFileSync(resolveAccountIndexPath(), JSON.stringify(updated, null, 2), "utf-8");
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Account store (per-account data files)
+// ---------------------------------------------------------------------------
+
+/** Unified per-account data: agent/user ids discovered at binding time. */
+export type WorkChatAccountData = {
+  agentId?: string;
+  userId?: string;
+  savedAt?: string;
+  baseUrl?: string;
+};
+
+function resolveAccountsDir(): string {
+  return path.join(resolveWorkChatStateDir(), "accounts");
+}
+
+function resolveAccountPath(accountId: string): string {
+  return path.join(resolveAccountsDir(), `${accountId}.json`);
+}
+
+function readAccountFile(filePath: string): WorkChatAccountData | null {
+  try {
+    if (fs.existsSync(filePath)) {
+      return JSON.parse(fs.readFileSync(filePath, "utf-8")) as WorkChatAccountData;
+    }
+  } catch {
+    // ignore
+  }
+  return null;
+}
+
+/** Load account data by ID. */
+export function loadWorkChatAccount(accountId: string): WorkChatAccountData | null {
+  return readAccountFile(resolveAccountPath(accountId));
+}
+
+/**
+ * Persist account data after binding (merges into existing file).
+ * agentId/userId are the WorkChat cloud ids discovered via AGENT_CREATED /
+ * INIT_AGENT events or the binding QR poll.
+ */
+export function saveWorkChatAccount(
+  accountId: string,
+  update: { agentId?: string; userId?: string; baseUrl?: string },
+): void {
+  const dir = resolveAccountsDir();
+  fs.mkdirSync(dir, { recursive: true });
+
+  const existing = loadWorkChatAccount(accountId) ?? {};
+  const data: WorkChatAccountData = {
+    agentId: update.agentId?.trim() || existing.agentId,
+    userId: update.userId?.trim() || existing.userId,
+    baseUrl: update.baseUrl?.trim() || existing.baseUrl,
+    savedAt: new Date().toISOString(),
+  };
+  const filePath = resolveAccountPath(accountId);
+  fs.writeFileSync(filePath, JSON.stringify(data, null, 2), "utf-8");
+  try {
+    fs.chmodSync(filePath, 0o600);
+  } catch {
+    // best-effort
+  }
+}
+
+/** Remove all files associated with an account. */
+export function clearWorkChatAccount(accountId: string): void {
+  const filePath = resolveAccountPath(accountId);
+  try {
+    if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
+  } catch (err) {
+    logger.warn(`clearWorkChatAccount: failed to remove ${filePath}: ${String(err)}`);
+  }
+  unregisterWorkChatAccountId(accountId);
+}
+
+/**
+ * Fully remove an account binding: state file, index entry, allowFrom store
+ * and the `channels.openclaw-workchat.accounts` routing entry in openclaw.json.
+ * Used when a re-scan replaces the previously bound agent (rebind semantics:
+ * one active agent per host) and when the platform reports AGENT_DELETED.
+ */
+export async function removeWorkChatAccountBinding(accountId: string): Promise<void> {
+  clearWorkChatAccount(accountId);
+
+  try {
+    const { clearFrameworkAllowFromList } = await import("./pairing.js");
+    clearFrameworkAllowFromList(accountId);
+  } catch (err) {
+    logger.warn(`removeWorkChatAccountBinding: allowFrom cleanup failed: ${String(err)}`);
+  }
+
+  try {
+    const { loadConfig, writeConfigFile } = await import("openclaw/plugin-sdk/config-runtime");
+    const cfg = loadConfig();
+    const channels = (cfg.channels ?? {}) as Record<string, any>;
+    const section = channels["openclaw-workchat"];
+    if (section?.accounts?.[accountId] !== undefined) {
+      const accounts = { ...(section.accounts ?? {}) };
+      delete accounts[accountId];
+      await writeConfigFile({
+        ...cfg,
+        channels: {
+          ...channels,
+          "openclaw-workchat": { ...section, accounts },
+        },
+      } as import("openclaw/plugin-sdk").OpenClawConfig);
+    }
+  } catch (err) {
+    logger.warn(`removeWorkChatAccountBinding: config cleanup failed: ${String(err)}`);
+  }
+}
+
+/**
+ * Remove every registered account whose stored agentId differs from
+ * `keepAgentId` (rebind cleanup). Returns the removed accountIds.
+ * `default` is normalized: if it holds a foreign agentId it is removed too;
+ * the surviving binding keeps whatever account key it was registered under.
+ */
+export async function pruneStaleWorkChatAccounts(keepAgentId: string): Promise<string[]> {
+  const removed: string[] = [];
+  for (const accountId of listIndexedWorkChatAccountIds()) {
+    const data = loadWorkChatAccount(accountId);
+    const storedAgentId = data?.agentId?.trim();
+    if (storedAgentId && storedAgentId !== keepAgentId) {
+      await removeWorkChatAccountBinding(accountId);
+      removed.push(accountId);
+      logger.info(
+        `pruneStaleWorkChatAccounts: removed account=${accountId} agent=${storedAgentId} (superseded by agent=${keepAgentId})`,
+      );
+    }
+  }
+  return removed;
+}
+
+// ---------------------------------------------------------------------------
+// Account resolution (merge config + stored ids)
+// ---------------------------------------------------------------------------
+
+export type ResolvedWorkChatAccount = {
+  accountId: string;
+  baseUrl: string;
+  appKey?: string;
+  appSecret?: string;
+  agentId?: string;
+  userId?: string;
+  enabled: boolean;
+  /** true when appKey + appSecret are available (via ${WORKCHAT_*} env placeholders). */
+  configured: boolean;
+  name?: string;
+  allowInsecureTls?: boolean;
+  requestTimeout?: number;
+};
+
+type WorkChatAccountConfig = {
+  name?: string;
+  enabled?: boolean;
+  agentId?: string | number;
+  userId?: string | number;
+};
+
+type WorkChatSectionConfig = WorkChatAccountConfig & {
+  baseUrl?: string;
+  websocketUrl?: string;
+  appKey?: string;
+  appSecret?: string;
+  allowInsecureTls?: boolean;
+  requestTimeout?: number;
+  accounts?: Record<string, WorkChatAccountConfig>;
+  /** Written on each successful binding; see triggerWorkChatChannelReload. */
+  channelConfigUpdatedAt?: string;
+};
+
+/** List accountIds from the index file (written at binding). */
+export function listWorkChatAccountIds(_cfg: OpenClawConfig): string[] {
+  return listIndexedWorkChatAccountIds();
+}
+
+/** Resolve a workchat account by ID, merging config and stored ids. */
+export function resolveWorkChatAccount(
+  cfg: OpenClawConfig,
+  accountId?: string | null,
+): ResolvedWorkChatAccount {
+  const raw = accountId?.trim();
+  if (!raw) {
+    throw new Error("workchat: accountId is required (no default account)");
+  }
+  const section = cfg.channels?.["openclaw-workchat"] as WorkChatSectionConfig | undefined;
+  const accountCfg: WorkChatAccountConfig = section?.accounts?.[raw] ?? section ?? {};
+
+  const accountData = loadWorkChatAccount(raw);
+  const appKey = section?.appKey?.trim() || undefined;
+  const appSecret = section?.appSecret?.trim() || undefined;
+
+  return {
+    accountId: raw,
+    baseUrl: section?.baseUrl?.trim() || DEFAULT_BASE_URL,
+    appKey,
+    appSecret,
+    agentId: String(accountCfg.agentId ?? "") || accountData?.agentId,
+    userId: String(accountCfg.userId ?? "") || accountData?.userId,
+    enabled: accountCfg.enabled !== false,
+    configured: Boolean(appKey && appSecret),
+    name: accountCfg.name?.trim() || undefined,
+    allowInsecureTls: section?.allowInsecureTls,
+    requestTimeout: section?.requestTimeout,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Config reload trigger
+// ---------------------------------------------------------------------------
+
+/**
+ * Bump `channels.openclaw-workchat.channelConfigUpdatedAt` in openclaw.json on
+ * each successful binding so the gateway reloads config from disk.
+ */
+export async function triggerWorkChatChannelReload(): Promise<void> {
+  try {
+    const { loadConfig, writeConfigFile } = await import("openclaw/plugin-sdk/config-runtime");
+    const cfg = loadConfig();
+    const channels = (cfg.channels ?? {}) as Record<string, unknown>;
+    const existing = (channels["openclaw-workchat"] as Record<string, unknown> | undefined) ?? {};
+    const updated: OpenClawConfig = {
+      ...cfg,
+      channels: {
+        ...channels,
+        "openclaw-workchat": {
+          ...existing,
+          channelConfigUpdatedAt: new Date().toISOString(),
+        },
+      },
+    };
+    await writeConfigFile(updated);
+    logger.info("triggerWorkChatChannelReload: wrote channel config to openclaw.json");
+  } catch (err) {
+    logger.warn(`triggerWorkChatChannelReload: failed to update config: ${String(err)}`);
+  }
+}