@yanhaidao/wecom 2.4.160 → 2.5.110

package/src/context-store.ts

@@ -1,297 +0,0 @@
-/**
- * Context store for WeCom Bot WS proactive push.
- *
- * Similar to Weixin's contextToken mechanism, we need to track:
- * - Which accountId has active sessions with which peerId
- * - The contextToken for routing outbound messages
- */
-
-import { randomUUID } from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-
-// Simple logger
-const logger = {
-  info: (...args: unknown[]) => console.log('[wecom-context]', ...args),
-  warn: (...args: unknown[]) => console.warn('[wecom-context]', ...args),
-  debug: (...args: unknown[]) => process.env.DEBUG && console.log('[wecom-context]', ...args),
-};
-
-type PeerKind = "direct" | "group";
-
-type StoredPeerContext = {
-  contextToken: string;
-  peerKind: PeerKind;
-  lastSeen: number;
-  upstreamCorpId?: string;
-};
-
-type ResolvedPeerContext = StoredPeerContext & {
-  accountId: string;
-  peerId: string;
-};
-
-// In-memory store: accountId -> peerId -> context info
-const peerContextStore = new Map<string, Map<string, StoredPeerContext>>();
-
-// Reverse lookup: peerId -> accountId (for routing outbound)
-const peerToAccountMap = new Map<string, string>();
-const contextTokenToPeerMap = new Map<string, ResolvedPeerContext>();
-
-function resolveStateDir(): string {
-  return process.env.OPENCLAW_STATE_DIR || path.join(process.env.HOME || "/tmp", ".openclaw");
-}
-
-function resolveContextFilePath(accountId: string): string {
-  return path.join(
-    resolveStateDir(),
-    "wecom",
-    "context",
-    `${accountId}.json`
-  );
-}
-
-/** Persist peer contexts for an account to disk */
-function persistContexts(accountId: string): void {
-  const peerMap = peerContextStore.get(accountId);
-  if (!peerMap) return;
-
-  const data: Record<string, StoredPeerContext> = {};
-  for (const [peerId, info] of peerMap) {
-    data[peerId] = info;
-  }
-
-  const filePath = resolveContextFilePath(accountId);
-  try {
-    const dir = path.dirname(filePath);
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(filePath, JSON.stringify(data, null, 0), "utf-8");
-  } catch (err) {
-    logger.warn?.(`persistContexts: failed to write ${filePath}: ${String(err)}`);
-  }
-}
-
-function normalizeContextToken(value: unknown): string | undefined {
-  const token = typeof value === "string" ? value.trim() : "";
-  return token || undefined;
-}
-
-function normalizePeerKind(value: unknown): PeerKind {
-  return value === "group" ? "group" : "direct";
-}
-
-function normalizeOptional(value: unknown): string | undefined {
-  const normalized = typeof value === "string" ? value.trim() : "";
-  return normalized || undefined;
-}
-
-function findStoredPeerContext(accountId: string, peerId: string): StoredPeerContext | undefined {
-  const peerMap = peerContextStore.get(accountId);
-  if (!peerMap) return undefined;
-
-  const exact = peerMap.get(peerId);
-  if (exact) return exact;
-
-  const normalizedPeerId = peerId.trim().toLowerCase();
-  for (const [storedPeerId, info] of peerMap) {
-    if (storedPeerId.trim().toLowerCase() === normalizedPeerId) {
-      return info;
-    }
-  }
-
-  return undefined;
-}
-
-function registerPeerContext(accountId: string, peerId: string, info: StoredPeerContext): void {
-  let peerMap = peerContextStore.get(accountId);
-  if (!peerMap) {
-    peerMap = new Map();
-    peerContextStore.set(accountId, peerMap);
-  }
-
-  const previous = peerMap.get(peerId);
-  if (previous?.contextToken && previous.contextToken !== info.contextToken) {
-    contextTokenToPeerMap.delete(previous.contextToken);
-  }
-
-  peerMap.set(peerId, info);
-  peerToAccountMap.set(peerId, accountId);
-  contextTokenToPeerMap.set(info.contextToken, {
-    accountId,
-    peerId,
-    ...info,
-  });
-}
-
-function resolveStoredPeerContext(
-  accountId: string,
-  peerId: string,
-  params: {
-    contextToken?: string;
-    peerKind?: PeerKind;
-    lastSeen?: number;
-    upstreamCorpId?: string;
-  },
-): StoredPeerContext {
-  const existing = findStoredPeerContext(accountId, peerId);
-  return {
-    contextToken:
-      normalizeContextToken(params.contextToken) ??
-      existing?.contextToken ??
-      randomUUID(),
-    peerKind: params.peerKind ?? existing?.peerKind ?? "direct",
-    lastSeen: params.lastSeen ?? Date.now(),
-    ...(normalizeOptional(params.upstreamCorpId) || existing?.upstreamCorpId
-      ? { upstreamCorpId: normalizeOptional(params.upstreamCorpId) ?? existing?.upstreamCorpId }
-      : {}),
-  };
-}
-
-/** Restore persisted peer contexts for an account */
-export function restorePeerContexts(accountId: string): void {
-  const filePath = resolveContextFilePath(accountId);
-  try {
-    if (!fs.existsSync(filePath)) return;
-    const raw = fs.readFileSync(filePath, "utf-8");
-    const data = JSON.parse(raw) as Record<
-      string,
-      {
-        contextToken?: string;
-        peerKind?: string;
-        lastSeen?: number;
-        upstreamCorpId?: string;
-      }
-    >;
-
-    const peerMap = new Map<string, StoredPeerContext>();
-    let count = 0;
-    let mutated = false;
-    for (const [peerId, info] of Object.entries(data)) {
-      const normalized: StoredPeerContext = {
-        contextToken: normalizeContextToken(info?.contextToken) ?? randomUUID(),
-        peerKind: normalizePeerKind(info?.peerKind),
-        lastSeen:
-          typeof info?.lastSeen === "number" && Number.isFinite(info.lastSeen)
-            ? info.lastSeen
-            : Date.now(),
-        ...(normalizeOptional(info?.upstreamCorpId)
-          ? { upstreamCorpId: normalizeOptional(info?.upstreamCorpId) }
-          : {}),
-      };
-      peerMap.set(peerId, normalized);
-      peerToAccountMap.set(peerId, accountId);
-      contextTokenToPeerMap.set(normalized.contextToken, {
-        accountId,
-        peerId,
-        ...normalized,
-      });
-      if (
-        normalized.contextToken !== info?.contextToken ||
-        normalized.peerKind !== info?.peerKind ||
-        normalized.lastSeen !== info?.lastSeen ||
-        normalized.upstreamCorpId !== normalizeOptional(info?.upstreamCorpId)
-      ) {
-        mutated = true;
-      }
-      count++;
-    }
-    peerContextStore.set(accountId, peerMap);
-    if (mutated) {
-      persistContexts(accountId);
-    }
-    logger.info?.(`restorePeerContexts: restored ${count} peers for account=${accountId}`);
-  } catch (err) {
-    logger.warn?.(`restorePeerContexts: failed to read ${filePath}: ${String(err)}`);
-  }
-}
-
-/** Store context for a peer (called on inbound message) */
-export function setPeerContext(
-  accountId: string,
-  peerId: string,
-  options?: {
-    contextToken?: string;
-    peerKind?: PeerKind;
-    lastSeen?: number;
-    upstreamCorpId?: string;
-  },
-): string {
-  const resolved = resolveStoredPeerContext(accountId, peerId, options ?? {});
-  registerPeerContext(accountId, peerId, resolved);
-
-  // Persist to disk (debounced would be better, but simple for now)
-  persistContexts(accountId);
-
-  logger.debug?.(
-    `setPeerContext: accountId=${accountId} peerId=${peerId} token=${resolved.contextToken} kind=${resolved.peerKind}`,
-  );
-  return resolved.contextToken;
-}
-
-/** Get the accountId that has an active session with a peer */
-export function getAccountIdByPeer(peerId: string): string | undefined {
-  return peerToAccountMap.get(peerId);
-}
-
-/** Get the most recent peerId for an account (for proactive push) */
-export function getRecentPeerForAccount(accountId: string, maxAgeMs = 30 * 60 * 1000): string | undefined {
-  const peerMap = peerContextStore.get(accountId);
-  if (!peerMap) return undefined;
-
-  let mostRecent: { peerId: string; lastSeen: number } | undefined;
-
-  for (const [peerId, info] of peerMap) {
-    if (Date.now() - info.lastSeen > maxAgeMs) continue;
-    if (!mostRecent || info.lastSeen > mostRecent.lastSeen) {
-      mostRecent = { peerId, lastSeen: info.lastSeen };
-    }
-  }
-
-  return mostRecent?.peerId;
-}
-
-/** Get context token for a peer */
-export function getPeerContextToken(accountId: string, peerId: string): string | undefined {
-  return findStoredPeerContext(accountId, peerId)?.contextToken;
-}
-
-export function getPeerUpstreamCorpId(accountId: string, peerId: string): string | undefined {
-  return findStoredPeerContext(accountId, peerId)?.upstreamCorpId;
-}
-
-/** Resolve a peer context from a context token. */
-export function getPeerContextByToken(contextToken: string): ResolvedPeerContext | undefined {
-  return contextTokenToPeerMap.get(contextToken);
-}
-
-/** Resolve accountId from a context token. */
-export function getAccountIdByContextToken(contextToken: string): string | undefined {
-  return contextTokenToPeerMap.get(contextToken)?.accountId;
-}
-
-/** Check if we have an active session for routing */
-export function hasActiveSession(accountId: string, peerId: string, maxAgeMs = 30 * 60 * 1000): boolean {
-  const info = findStoredPeerContext(accountId, peerId);
-  if (!info) return false;
-
-  return Date.now() - info.lastSeen < maxAgeMs;
-}
-
-/** Clear all contexts for an account */
-export function clearPeerContexts(accountId: string): void {
-  const peerMap = peerContextStore.get(accountId);
-  if (peerMap) {
-    for (const [peerId, info] of peerMap) {
-      peerToAccountMap.delete(peerId);
-      contextTokenToPeerMap.delete(info.contextToken);
-    }
-  }
-  peerContextStore.delete(accountId);
-
-  const filePath = resolveContextFilePath(accountId);
-  try {
-    if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
-  } catch (err) {
-    logger.warn?.(`clearPeerContexts: failed to remove ${filePath}`);
-  }
-}

package/src/crypto/index.ts

@@ -1,24 +0,0 @@
-/**
- * WeCom 加解密模块导出
- */
-
-// AES 加解密
-export {
-    decodeEncodingAESKey,
-    pkcs7Unpad,
-    decryptWecomEncrypted,
-    encryptWecomPlaintext,
-} from "./aes.js";
-
-// 签名验证
-export {
-    computeWecomMsgSignature,
-    verifyWecomSignature,
-} from "./signature.js";
-
-// XML 辅助
-export {
-    extractEncryptFromXml,
-    extractToUserNameFromXml,
-    buildEncryptedXmlResponse,
-} from "./xml.js";

package/src/crypto.test.ts

@@ -1,32 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { computeWecomMsgSignature, decryptWecomEncrypted, encryptWecomPlaintext } from "./crypto.js";
-
-describe("wecom crypto", () => {
-  it("round-trips plaintext", () => {
-    const encodingAESKey = "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG"; // 43 chars base64 (plus '=' padding)
-    const plaintext = JSON.stringify({ hello: "world" });
-    const encrypt = encryptWecomPlaintext({ encodingAESKey, receiveId: "", plaintext });
-    const decrypted = decryptWecomEncrypted({ encodingAESKey, receiveId: "", encrypt });
-    expect(decrypted).toBe(plaintext);
-  });
-
-  it("pads correctly when raw length is a multiple of 32", () => {
-    const encodingAESKey = "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG";
-    // raw length = 20 + plaintext.length + receiveId.length; choose plaintext length % 32 === 12
-    const plaintext = "x".repeat(12);
-    const encrypt = encryptWecomPlaintext({ encodingAESKey, receiveId: "", plaintext });
-    const decrypted = decryptWecomEncrypted({ encodingAESKey, receiveId: "", encrypt });
-    expect(decrypted).toBe(plaintext);
-  });
-
-  it("computes sha1 msg signature", () => {
-    const sig = computeWecomMsgSignature({
-      token: "token",
-      timestamp: "123",
-      nonce: "456",
-      encrypt: "ENCRYPT",
-    });
-    expect(sig).toMatch(/^[a-f0-9]{40}$/);
-  });
-});

package/src/crypto.ts

@@ -1,176 +0,0 @@
-import crypto from "node:crypto";
-
-/**
- * **decodeEncodingAESKey (解码 AES Key)**
- * 
- * 将企业微信配置的 Base64 编码的 AES Key 解码为 Buffer。
- * 包含补全 Padding 和长度校验 (必须32字节)。
- */
-export function decodeEncodingAESKey(encodingAESKey: string): Buffer {
-  const trimmed = encodingAESKey.trim();
-  if (!trimmed) throw new Error("encodingAESKey missing");
-  const withPadding = trimmed.endsWith("=") ? trimmed : `${trimmed}=`;
-  const key = Buffer.from(withPadding, "base64");
-  if (key.length !== 32) {
-    throw new Error(`invalid encodingAESKey (expected 32 bytes after base64 decode, got ${key.length})`);
-  }
-  return key;
-}
-
-// WeCom uses PKCS#7 padding with a block size of 32 bytes (not AES's 16-byte block).
-// This is compatible with AES-CBC as 32 is a multiple of 16, but it requires manual padding/unpadding.
-export const WECOM_PKCS7_BLOCK_SIZE = 32;
-
-function pkcs7Pad(buf: Buffer, blockSize: number): Buffer {
-  const mod = buf.length % blockSize;
-  const pad = mod === 0 ? blockSize : blockSize - mod;
-  const padByte = Buffer.from([pad]);
-  return Buffer.concat([buf, Buffer.alloc(pad, padByte[0]!)]);
-}
-
-/**
- * **pkcs7Unpad (去除 PKCS#7 填充)**
- * 
- * 移除 AES 解密后的 PKCS#7 填充字节。
- * 包含填充合法性校验。
- */
-export function pkcs7Unpad(buf: Buffer, blockSize: number): Buffer {
-  if (buf.length === 0) throw new Error("invalid pkcs7 payload");
-  const pad = buf[buf.length - 1]!;
-  if (pad < 1 || pad > blockSize) {
-    throw new Error("invalid pkcs7 padding");
-  }
-  if (pad > buf.length) {
-    throw new Error("invalid pkcs7 payload");
-  }
-  // Best-effort validation (all padding bytes equal).
-  for (let i = 0; i < pad; i += 1) {
-    if (buf[buf.length - 1 - i] !== pad) {
-      throw new Error("invalid pkcs7 padding");
-    }
-  }
-  return buf.subarray(0, buf.length - pad);
-}
-
-function sha1Hex(input: string): string {
-  return crypto.createHash("sha1").update(input).digest("hex");
-}
-
-/**
- * **computeWecomMsgSignature (计算消息签名)**
- * 
- * 算法：sha1(sort(token, timestamp, nonce, encrypt_msg))
- */
-export function computeWecomMsgSignature(params: {
-  token: string;
-  timestamp: string;
-  nonce: string;
-  encrypt: string;
-}): string {
-  const parts = [params.token, params.timestamp, params.nonce, params.encrypt]
-    .map((v) => String(v ?? ""))
-    .sort();
-  return sha1Hex(parts.join(""));
-}
-
-/**
- * **verifyWecomSignature (验证消息签名)**
- * 
- * 比较计算出的签名与企业微信传入的签名是否一致。
- */
-export function verifyWecomSignature(params: {
-  token: string;
-  timestamp: string;
-  nonce: string;
-  encrypt: string;
-  signature: string;
-}): boolean {
-  const expected = computeWecomMsgSignature({
-    token: params.token,
-    timestamp: params.timestamp,
-    nonce: params.nonce,
-    encrypt: params.encrypt,
-  });
-  return expected === params.signature;
-}
-
-/**
- * **decryptWecomEncrypted (解密企业微信消息)**
- * 
- * 将企业微信的 AES 加密包解密为明文。
- * 流程：
- * 1. Base64 解码 AESKey 并获取 IV (前16字节)。
- * 2. AES-CBC 解密。
- * 3. 去除 PKCS#7 填充。
- * 4. 拆解协议包结构: [16字节随机串][4字节长度][消息体][接收者ID]。
- * 5. 校验接收者ID (ReceiveId)。
- */
-export function decryptWecomEncrypted(params: {
-  encodingAESKey: string;
-  receiveId?: string;
-  encrypt: string;
-}): string {
-  const aesKey = decodeEncodingAESKey(params.encodingAESKey);
-  const iv = aesKey.subarray(0, 16);
-  const decipher = crypto.createDecipheriv("aes-256-cbc", aesKey, iv);
-  decipher.setAutoPadding(false);
-  const decryptedPadded = Buffer.concat([
-    decipher.update(Buffer.from(params.encrypt, "base64")),
-    decipher.final(),
-  ]);
-  const decrypted = pkcs7Unpad(decryptedPadded, WECOM_PKCS7_BLOCK_SIZE);
-
-  if (decrypted.length < 20) {
-    throw new Error(`invalid decrypted payload (expected at least 20 bytes, got ${decrypted.length})`);
-  }
-
-  // 16 bytes random + 4 bytes network-order length + msg + receiveId (optional)
-  const msgLen = decrypted.readUInt32BE(16);
-  const msgStart = 20;
-  const msgEnd = msgStart + msgLen;
-  if (msgEnd > decrypted.length) {
-    throw new Error(`invalid decrypted msg length (msgEnd=${msgEnd}, payloadLength=${decrypted.length})`);
-  }
-  const msg = decrypted.subarray(msgStart, msgEnd).toString("utf8");
-
-  const receiveId = params.receiveId ?? "";
-  if (receiveId) {
-    const trailing = decrypted.subarray(msgEnd).toString("utf8");
-    if (trailing !== receiveId) {
-      throw new Error(`receiveId mismatch (expected "${receiveId}", got "${trailing}")`);
-    }
-  }
-
-  return msg;
-}
-
-/**
- * **encryptWecomPlaintext (加密回复消息)**
- * 
- * 将明文消息打包为企业微信的加密格式。
- * 流程：
- * 1. 构造协议包: [16字节随机串][4字节长度][消息体][接收者ID]。
- * 2. PKCS#7 填充。
- * 3. AES-CBC 加密。
- * 4. 转 Base64。
- */
-export function encryptWecomPlaintext(params: {
-  encodingAESKey: string;
-  receiveId?: string;
-  plaintext: string;
-}): string {
-  const aesKey = decodeEncodingAESKey(params.encodingAESKey);
-  const iv = aesKey.subarray(0, 16);
-  const random16 = crypto.randomBytes(16);
-  const msg = Buffer.from(params.plaintext ?? "", "utf8");
-  const msgLen = Buffer.alloc(4);
-  msgLen.writeUInt32BE(msg.length, 0);
-  const receiveId = Buffer.from(params.receiveId ?? "", "utf8");
-
-  const raw = Buffer.concat([random16, msgLen, msg, receiveId]);
-  const padded = pkcs7Pad(raw, WECOM_PKCS7_BLOCK_SIZE);
-  const cipher = crypto.createCipheriv("aes-256-cbc", aesKey, iv);
-  cipher.setAutoPadding(false);
-  const encrypted = Buffer.concat([cipher.update(padded), cipher.final()]);
-  return encrypted.toString("base64");
-}

package/src/domain/models.ts

@@ -1,7 +0,0 @@
-import type { DeliveryTask, RawFrameReference, ReplyContext, TransportSessionSnapshot, UnifiedInboundEvent } from "../types/index.js";
-
-export type WecomConversation = UnifiedInboundEvent["conversation"];
-export type WecomRawEnvelope = RawFrameReference;
-export type WecomReplyContext = ReplyContext;
-export type WecomTransportSession = TransportSessionSnapshot;
-export type WecomDeliveryTask = DeliveryTask;

package/src/domain/policies.ts

@@ -1,36 +0,0 @@
-import type { ResolvedBotAccount, UnifiedInboundEvent } from "../types/index.js";
-
-export function assertBotPrimaryTransport(account: ResolvedBotAccount): void {
-  if (account.primaryTransport === "ws" && !account.wsConfigured) {
-    throw new Error(`WeCom bot account "${account.accountId}" is missing bot.ws credentials.`);
-  }
-  if (account.primaryTransport === "webhook" && !account.webhookConfigured) {
-    throw new Error(`WeCom bot account "${account.accountId}" is missing bot.webhook credentials.`);
-  }
-}
-
-export function buildDedupKey(event: UnifiedInboundEvent): string {
-  return `${event.accountId}:${event.transport}:${event.messageId}`;
-}
-
-export function resolveConversationKey(event: UnifiedInboundEvent): string {
-  const conversation = event.conversation;
-  return [event.accountId, conversation.peerKind, conversation.peerId, conversation.senderId].join(":");
-}
-
-export function normalizeWecomAllowFromEntry(raw: string): string {
-  return raw
-    .trim()
-    .toLowerCase()
-    .replace(/^wecom:/, "")
-    .replace(/^user:/, "")
-    .replace(/^userid:/, "");
-}
-
-export function isWecomSenderAllowed(senderUserId: string, allowFrom: string[]): boolean {
-  const list = allowFrom.map((entry) => normalizeWecomAllowFromEntry(entry)).filter(Boolean);
-  if (list.includes("*")) return true;
-  const normalizedSender = normalizeWecomAllowFromEntry(senderUserId);
-  if (!normalizedSender) return false;
-  return list.includes(normalizedSender);
-}

package/src/dynamic-agent.account-scope.test.ts

@@ -1,17 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { generateAgentId } from "./dynamic-agent.js";
-
-describe("generateAgentId account scoping", () => {
-  it("generates different ids for same peer across accounts", () => {
-    const a = generateAgentId("dm", "zhangsan", "acct-a");
-    const b = generateAgentId("dm", "zhangsan", "acct-b");
-    expect(a).toBe("wecom-acct-a-dm-zhangsan");
-    expect(b).toBe("wecom-acct-b-dm-zhangsan");
-    expect(a).not.toBe(b);
-  });
-
-  it("falls back to default account scope when accountId is omitted", () => {
-    expect(generateAgentId("group", "wr123456")).toBe("wecom-default-group-wr123456");
-  });
-});