@zhin.js/adapter-dingtalk 4.0.1 → 4.0.3

package/src/endpoint.ts

@@ -1,533 +1,262 @@
 /**
- * 钉钉 Endpoint 实现
+ * DingTalkEndpoint — lifecycle, outbound, admit, OpenAPI helpers for agent tools.
  */
-import { formatCompact, Endpoint, Message, MessageSegment, segment, SendContent, SendOptions, expandInteractiveSegmentsInContent,} from 'zhin.js';
-import { registerFetchRoute, type Router, type RouterContext } from "@zhin.js/host-router/router";
-import { createHmac } from "crypto";
-import type {
-  DingTalkEndpointConfig,
-  DingTalkMessage,
-  DingTalkEvent,
-  AccessToken,
-} from "./types.js";
-import type { DingTalkAdapter } from "./adapter.js";
-import { normalizeDingtalkSenderForPermit } from "./platform-permit.js";
-import { fromCanonicalSegments, toCanonicalSegments } from './segment-mapper.js';
+import type { EndpointInstance } from '@zhin.js/adapter';
+import type { MessageGateway } from '@zhin.js/core/runtime';
+import type { HttpHost, HttpRouteRegistration } from '@zhin.js/host-http';
+import { formatCompact, getLogger } from '@zhin.js/logger';
+import type { CapabilityId } from '@zhin.js/plugin-runtime';
+import { registerDingtalkAgentEndpoint } from './dingtalk-agent-deps.js';
+import { normalizeDingtalkSenderForPermit } from './platform-permit.js';
+import {
+  formatInboundContent,
+  formatOutboundBody,
+  generateMessageId,
+  isDingtalkBotMentioned,
+  resolveChatType,
+  resolveSender,
+  resolveTarget,
+  type AccessToken,
+  type DingTalkApiResponse,
+  type DingTalkEvent,
+  type DingTalkMessage,
+  type DingTalkSendBody,
+  type ResolvedDingTalkConfig,
+} from './protocol.js';
+import { registerDingTalkWebhookRoutes } from './webhook.js';
 
-export class DingTalkEndpoint implements Endpoint<DingTalkEndpointConfig, DingTalkMessage> {
-  $connected: boolean;
-  private router: any;
-  private accessToken: AccessToken;
-  private baseURL: string;
-  private sessionWebhooks: Map<string, string> = new Map();
+const logger = getLogger('dingtalk');
 
-  get $id() {
-    return this.$config.name;
-  }
+export type DingTalkFetch = (
+  url: string,
+  init?: {
+    readonly method?: string;
+    readonly headers?: Record<string, string>;
+    readonly body?: string;
+  },
+) => Promise<{
+  readonly ok: boolean;
+  readonly status: number;
+  text(): Promise<string>;
+  json(): Promise<unknown>;
+}>;
 
-  get logger() {
-    return this.adapter.plugin.logger;
-  }
+export interface DingTalkEndpointOptions {
+  readonly id: CapabilityId;
+  readonly gateway: MessageGateway;
+  readonly http: HttpHost;
+  readonly config: ResolvedDingTalkConfig;
+  readonly fetch?: DingTalkFetch;
+}
 
-  constructor(
-    public adapter: DingTalkAdapter,
-    router: any,
-    public $config: DingTalkEndpointConfig
-  ) {
-    this.router = router;
-    this.$connected = false;
-    this.accessToken = { token: "", expires_in: 0, timestamp: 0 };
-    this.baseURL = $config.apiBaseUrl || "https://oapi.dingtalk.com";
-    this.setupWebhookRoute();
-  }
+export class DingTalkEndpoint implements EndpointInstance {
+  readonly #options: DingTalkEndpointOptions;
+  readonly #fetch: DingTalkFetch;
+  #routeReleases: HttpRouteRegistration[] = [];
+  #accessToken: AccessToken = { token: '', expires_in: 0, timestamp: 0 };
+  #refreshPromise: Promise<string> | null = null;
+  #sessionWebhooks = new Map<string, string>();
+  #open = false;
+  #started = false;
+  #unregisterAgent?: () => void;
 
-  private async request(
-    path: string,
-    options: {
-      method?: "GET" | "POST";
-      params?: Record<string, any>;
-      body?: any;
-    } = {}
-  ): Promise<any> {
-    await this.ensureAccessToken();
-    const { method = "GET", params = {}, body } = options;
-    const urlParams = new URLSearchParams({
-      ...params,
-      access_token: this.accessToken.token,
-    });
-    const url = `${this.baseURL}${path}?${urlParams.toString()}`;
-    const fetchOptions: RequestInit = {
-      method,
-      headers: {
-        "Content-Type": "application/json; charset=utf-8",
-      },
-    };
-    if (body && method === "POST") {
-      fetchOptions.body = JSON.stringify(body);
-    }
-    const response = await fetch(url, fetchOptions);
-    return await response.json();
+  constructor(options: DingTalkEndpointOptions) {
+    this.#options = options;
+    this.#fetch = options.fetch ?? globalThis.fetch;
   }
 
-  private setupWebhookRoute(): void {
-    registerFetchRoute(this.router, "POST", this.$config.webhookPath, (ctx: RouterContext) => {
-      void this.handleWebhook(ctx);
-    });
+  /** Used by webhook handler. */
+  get isOpen(): boolean {
+    return this.#open;
   }
 
-  private async handleWebhook(ctx: RouterContext): Promise<void> {
-    try {
-      const body = ctx.request.body;
-      const timestamp = ctx.get("timestamp");
-      const sign = ctx.get("sign");
-      if (timestamp && sign) {
-        if (!this.verifySignature(timestamp, sign)) {
-          this.logger.warn(formatCompact( { op: "webhook", ok: false, error: "invalid signature" }));
-          ctx.status = 403;
-          ctx.body = { code: -1, msg: "Forbidden" };
-          return;
-        }
-      }
-      const event = body as DingTalkEvent;
-      if (event.msgtype) {
-        await this.handleEvent(event);
-      }
-      ctx.status = 200;
-      ctx.body = { code: 0, msg: "success" };
-    } catch (error) {
-      this.logger.error("Webhook error:", error);
-      ctx.status = 500;
-      ctx.body = { code: -1, msg: "Internal Server Error" };
-    }
+  get config(): ResolvedDingTalkConfig {
+    return this.#options.config;
   }
 
-  private verifySignature(timestamp: string, sign: string): boolean {
+  async start(): Promise<void> {
+    if (this.#started) return;
+    this.#started = true;
     try {
-      const stringToSign = `${timestamp}\n${this.$config.appSecret}`;
-      const hmac = createHmac("sha256", this.$config.appSecret);
-      hmac.update(stringToSign);
-      const calculatedSign = hmac.digest("base64");
-      return calculatedSign === sign;
+      await this.#refreshAccessToken();
+      this.#unregisterAgent = registerDingtalkAgentEndpoint(this.#options.config.name, this);
+      this.#routeReleases.push(...registerDingTalkWebhookRoutes(this.#options.http, this));
+      logger.debug(formatCompact({
+        endpoint: this.#options.config.name,
+        op: 'webhook',
+        path: this.#options.config.webhookPath,
+      }));
     } catch (error) {
-      this.logger.error("Signature verification error:", error);
-      return false;
-    }
-  }
-
-  private async handleEvent(event: DingTalkEvent): Promise<void> {
-    if (event.sessionWebhook && event.conversationId) {
-      this.sessionWebhooks.set(event.conversationId, event.sessionWebhook);
-    }
-    const message = this.$formatMessage(event as any);
-    this.adapter.emit("message.receive", message);
-    this.logger.debug(formatCompact( {
-      op: "recv",
-      endpoint: this.$config.name,
-      channel: message.$channel.type,
-      id: message.$channel.id,
-      len: segment.raw(message.$content).length,
-    }));
-  }
-
-  private async ensureAccessToken(): Promise<void> {
-    const now = Date.now();
-    if (
-      this.accessToken.token &&
-      now <
-        this.accessToken.timestamp +
-          (this.accessToken.expires_in - 300) * 1000
-    ) {
-      return;
+      await this.stop();
+      logger.error('Failed to connect DingTalk endpoint:', error);
+      throw error;
     }
-    await this.refreshAccessToken();
   }
 
-  private async refreshAccessToken(): Promise<void> {
-    try {
-      const baseURL =
-        this.$config.apiBaseUrl || "https://oapi.dingtalk.com";
-      const params = new URLSearchParams({
-        appkey: this.$config.appKey,
-        appsecret: this.$config.appSecret,
-      });
-      const url = `${baseURL}/gettoken?${params.toString()}`;
-      const response = await fetch(url);
-      const data = await response.json();
-      if (data.errcode === 0) {
-        this.accessToken = {
-          token: data.access_token,
-          expires_in: data.expires_in,
-          timestamp: Date.now(),
-        };
-        this.logger.debug("Access token refreshed successfully");
-      } else {
-        throw new Error(`Failed to get access token: ${data.errmsg}`);
-      }
-    } catch (error) {
-      this.logger.error("Failed to refresh access token:", error);
-      throw error;
-    }
+  open(): void {
+    this.#open = true;
   }
 
-  $formatMessage(msg: DingTalkMessage): Message<DingTalkMessage> {
-    const wire = this.parseMessageContent(msg);
-    const content = toCanonicalSegments(wire);
-    const chatType = msg.conversationType === "2" ? "group" : "private";
-    const permit = normalizeDingtalkSenderForPermit({ isAdmin: msg.isAdmin === true });
-    return Message.from(msg, {
-      $id: msg.msgId || Date.now().toString(),
-      $adapter: "dingtalk",
-      $endpoint: this.$config.name,
-      $sender: {
-        id: msg.senderId || msg.senderStaffId || "unknown",
-        name: msg.senderNick || msg.senderId || "Unknown User",
-        role: permit.role,
-        permissions: permit.permissions,
-      },
-      $channel: {
-        id: msg.conversationId || "unknown",
-        type: chatType as any,
-      },
-      $content: content,
-      $raw: JSON.stringify(msg),
-      $timestamp: msg.createAt || Date.now(),
-      $recall: async () => {
-        await this.$recallMessage(msg.msgId || "");
-      },
-      $reply: async (content: SendContent): Promise<string> => {
-        return await this.adapter.sendMessage({
-          context: "dingtalk",
-          endpoint: this.$config.name,
-          id: msg.conversationId || msg.senderId || "unknown",
-          type: chatType,
-          content: content,
-        });
-      },
-    });
+  close(): void {
+    this.#open = false;
   }
 
-  private parseMessageContent(msg: DingTalkMessage): MessageSegment[] {
-    const content: MessageSegment[] = [];
-    if (!msg.msgtype) return content;
-    try {
-      switch (msg.msgtype) {
-        case "text":
-          if (msg.text?.content) {
-            content.push(segment("text", { content: msg.text.content }));
-            if (msg.atUsers && msg.atUsers.length > 0) {
-              for (const atUser of msg.atUsers) {
-                content.push(
-                  segment("at", {
-                    id: atUser.dingtalkId || atUser.staffId,
-                    name: atUser.dingtalkId || atUser.staffId,
-                  })
-                );
-              }
-            }
-          }
-          break;
-        case "picture":
-          if (msg.content) {
-            content.push(
-              segment("image", {
-                url:
-                  msg.content.downloadCode ||
-                  msg.content.pictureDownloadCode,
-                file:
-                  msg.content.downloadCode ||
-                  msg.content.pictureDownloadCode,
-              })
-            );
-          }
-          break;
-        case "file":
-          if (msg.content) {
-            content.push(
-              segment("file", {
-                file: msg.content.downloadCode,
-                name: msg.content.fileName,
-                size: msg.content.fileSize,
-              })
-            );
-          }
-          break;
-        case "audio":
-          if (msg.content) {
-            content.push(
-              segment("audio", {
-                file: msg.content.downloadCode,
-                duration: msg.content.duration,
-              })
-            );
-          }
-          break;
-        case "video":
-          if (msg.content) {
-            content.push(
-              segment("video", {
-                file: msg.content.downloadCode,
-                duration: msg.content.duration,
-                size: msg.content.videoSize,
-              })
-            );
-          }
-          break;
-        case "richText":
-          if (msg.content?.richText) {
-            for (const item of msg.content.richText) {
-              if (item.text) {
-                content.push(segment("text", { content: item.text }));
-              }
-            }
-          }
-          break;
-        case "markdown":
-          if (msg.content?.text) {
-            content.push(
-              segment("markdown", {
-                content: msg.content.text,
-                title: msg.content.title,
-              })
-            );
-          }
-          break;
-        default:
-          content.push(
-            segment("text", {
-              content: `[不支持的消息类型: ${msg.msgtype}]`,
-            })
-          );
-          break;
-      }
-    } catch (error) {
-      this.logger.error("Failed to parse message content:", error);
-      content.push(segment("text", { content: "[消息解析失败]" }));
-    }
-    return content;
+  async stop(): Promise<void> {
+    this.#open = false;
+    this.#sessionWebhooks.clear();
+    for (const release of this.#routeReleases.splice(0)) release();
+    this.#unregisterAgent?.();
+    this.#unregisterAgent = undefined;
+    this.#started = false;
+    logger.debug(formatCompact({ op: 'disconnect', endpoint: this.#options.config.name }));
   }
 
-  async $sendMessage(options: SendOptions): Promise<string> {
-    const conversationId = options.id;
-    const canonical = expandInteractiveSegmentsInContent(options.content);
-    const wire = fromCanonicalSegments(canonical);
-    const content = this.formatSendContent(wire);
-    try {
-      const sessionWebhook = this.sessionWebhooks.get(conversationId);
-      if (sessionWebhook) {
-        const response = await fetch(sessionWebhook, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json; charset=utf-8",
-          },
-          body: JSON.stringify(content),
-        });
-        const data = await response.json();
-        if (data.errcode !== 0) {
-          throw new Error(
-            `Failed to send message via session webhook: ${data.errmsg}`
-          );
-        }
-        this.logger.debug("Message sent via session webhook");
-        return data.msgId || Date.now().toString();
-      }
-      const data = await this.request("/robot/send", {
-        method: "POST",
-        body: {
-          ...content,
-          robotCode: this.$config.robotCode,
-        },
+  async send({ target, payload }: { readonly target: string; readonly payload: unknown }): Promise<string> {
+    const content = formatOutboundBody(payload);
+    const sessionWebhook = this.#sessionWebhooks.get(target);
+    if (sessionWebhook) {
+      const response = await this.#fetch(sessionWebhook, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json; charset=utf-8' },
+        body: JSON.stringify(content),
       });
+      const data = await response.json() as DingTalkApiResponse;
       if (data.errcode !== 0) {
-        throw new Error(`Failed to send message: ${data.errmsg}`);
-      }
-      this.logger.debug("Message sent successfully");
-      return data.msgId || Date.now().toString();
-    } catch (error) {
-      this.logger.error("Failed to send message:", error);
-      throw error;
-    }
-  }
-
-  async $recallMessage(id: string): Promise<void> {
-    this.logger.warn(formatCompact( { op: "recall", ok: false, error: "not supported" }));
-  }
-
-  private formatSendContent(content: SendContent): any {
-    if (typeof content === "string") {
-      return { msgtype: "text", text: { content } };
-    }
-    if (Array.isArray(content)) {
-      const textParts: string[] = [];
-      const atUserIds: string[] = [];
-      let hasMedia = false;
-      let mediaContent: any = null;
-      for (const item of content) {
-        if (typeof item === "string") {
-          textParts.push(item);
-        } else {
-          const seg = item as MessageSegment;
-          switch (seg.type) {
-            case "text":
-              textParts.push(seg.data.content || seg.data.text || "");
-              break;
-            case "at":
-              const userId = seg.data.id || seg.data.userId;
-              if (userId) {
-                atUserIds.push(userId);
-                textParts.push(`@${seg.data.name || userId} `);
-              }
-              break;
-            case "image":
-              if (!hasMedia) {
-                hasMedia = true;
-                mediaContent = {
-                  msgtype: "picture",
-                  picture: {
-                    picURL: seg.data.url || seg.data.file,
-                  },
-                };
-              }
-              break;
-            case "markdown":
-              if (!hasMedia) {
-                hasMedia = true;
-                mediaContent = {
-                  msgtype: "markdown",
-                  markdown: {
-                    title: seg.data.title || "消息",
-                    text: seg.data.content || seg.data.text,
-                  },
-                };
-              }
-              break;
-            case "link":
-              if (!hasMedia) {
-                hasMedia = true;
-                mediaContent = {
-                  msgtype: "link",
-                  link: {
-                    title: seg.data.title || "链接",
-                    text: seg.data.text || seg.data.content || "",
-                    messageUrl: seg.data.url,
-                    picUrl: seg.data.picUrl,
-                  },
-                };
-              }
-              break;
-          }
-        }
+        throw new Error(`Failed to send message via session webhook: ${data.errmsg}`);
       }
-      if (hasMedia && mediaContent) return mediaContent;
-      const result: any = {
-        msgtype: "text",
-        text: { content: textParts.join("") },
-      };
-      if (atUserIds.length > 0) {
-        result.at = { atUserIds, isAtAll: false };
-      }
-      return result;
+      logger.debug(formatCompact({
+        op: 'send',
+        endpoint: this.#options.config.name,
+        via: 'sessionWebhook',
+        to: target,
+      }));
+      return (data.msgId as string) || `${Date.now()}`;
     }
-    return { msgtype: "text", text: { content: String(content) } };
-  }
 
-  async $connect(): Promise<void> {
-    try {
-      await this.refreshAccessToken();
-      this.$connected = true;
-      this.logger.info(formatCompact({ endpoint: this.$config.name }));
-      this.logger.info(formatCompact( { op: "webhook", path: this.$config.webhookPath }));
-    } catch (error) {
-      this.logger.error("Failed to connect DingTalk bot:", error);
-      throw error;
+    const body: DingTalkSendBody = {
+      ...content,
+      ...(this.#options.config.robotCode
+        ? { robotCode: this.#options.config.robotCode }
+        : {}),
+    };
+    const data = await this.#request('/robot/send', {
+      method: 'POST',
+      body: body as unknown as Record<string, unknown>,
+    });
+    if (data.errcode !== 0) {
+      throw new Error(`Failed to send message: ${data.errmsg}`);
     }
+    logger.debug(formatCompact({ op: 'send', endpoint: this.#options.config.name, to: target }));
+    return (data.msgId as string) || `${Date.now()}`;
   }
 
-  async $disconnect(): Promise<void> {
-    try {
-      this.sessionWebhooks.clear();
-      this.$connected = false;
-      this.logger.info(formatCompact( { op: "disconnect", endpoint: this.$config.name }));
-    } catch (error) {
-      this.logger.error("Error disconnecting DingTalk bot:", error);
+  /** Test / internal: admit a parsed event when open (non-webhook path). */
+  admit(event: DingTalkEvent | DingTalkMessage): void {
+    if (!this.#open) return;
+    if (event.sessionWebhook && event.conversationId) {
+      this.#sessionWebhooks.set(event.conversationId, event.sessionWebhook);
     }
+    const target = resolveTarget(event);
+    const chatType = resolveChatType(event.conversationType);
+    const permit = normalizeDingtalkSenderForPermit({ isAdmin: event.isAdmin === true });
+    void this.#options.gateway.receive({
+      adapter: this.#options.id,
+      target,
+      content: formatInboundContent(event),
+      sender: resolveSender(event),
+      id: generateMessageId(event),
+      metadata: Object.freeze({
+        msgtype: event.msgtype,
+        chatType,
+        endpoint: this.#options.config.name,
+        senderNick: event.senderNick,
+        role: permit.role,
+        permissions: permit.permissions,
+        conversationType: event.conversationType,
+        ...(isDingtalkBotMentioned(event, this.#options.config.robotCode) ? { mentioned: true } : {}),
+      }),
+    }).catch((err) => {
+      logger.warn(formatCompact({
+        op: 'dingtalk_gateway_receive_failed',
+        target,
+        error: err instanceof Error ? err.message : String(err),
+      }));
+    });
   }
 
-  async getUserInfo(userId: string): Promise<any> {
+  async getUserInfo(userId: string): Promise<unknown> {
     try {
-      const data = await this.request("/topapi/v2/user/get", {
-        method: "POST",
+      const data = await this.#request('/topapi/v2/user/get', {
+        method: 'POST',
         body: { userid: userId },
       });
       if (data.errcode === 0) return data.result;
       throw new Error(`Failed to get user info: ${data.errmsg}`);
     } catch (error) {
-      this.logger.error("Failed to get user info:", error);
+      logger.error('Failed to get user info:', error);
       return null;
     }
   }
 
-  async getDepartmentUsers(deptId: number): Promise<any[]> {
+  async getDepartmentUsers(deptId: number): Promise<unknown[]> {
     try {
-      const data = await this.request("/topapi/user/listid", {
-        method: "POST",
+      const data = await this.#request('/topapi/user/listid', {
+        method: 'POST',
         body: { dept_id: deptId },
       });
-      if (data.errcode === 0) return data.result.userid_list || [];
+      if (data.errcode === 0) {
+        const result = data.result as { userid_list?: unknown[] } | undefined;
+        return result?.userid_list || [];
+      }
       throw new Error(`Failed to get department users: ${data.errmsg}`);
     } catch (error) {
-      this.logger.error("Failed to get department users:", error);
+      logger.error('Failed to get department users:', error);
       return [];
     }
   }
 
-  async sendWorkNotice(userIdList: string[], content: any): Promise<boolean> {
+  async sendWorkNotice(userIdList: string[], content: unknown): Promise<boolean> {
     try {
-      const data = await this.request(
-        "/topapi/message/corpconversation/asyncsend_v2",
-        {
-          method: "POST",
-          body: {
-            agent_id: this.$config.robotCode,
-            userid_list: userIdList.join(","),
-            msg: content,
-          },
-        }
-      );
-      if (data.errcode === 0) {
-        this.logger.debug("Work notice sent successfully");
-        return true;
-      }
+      const data = await this.#request('/topapi/message/corpconversation/asyncsend_v2', {
+        method: 'POST',
+        body: {
+          agent_id: this.#options.config.robotCode,
+          userid_list: userIdList.join(','),
+          msg: content,
+        },
+      });
+      if (data.errcode === 0) return true;
       throw new Error(`Failed to send work notice: ${data.errmsg}`);
     } catch (error) {
-      this.logger.error("Failed to send work notice:", error);
+      logger.error('Failed to send work notice:', error);
       return false;
     }
   }
 
-  async getDepartmentList(deptId: number = 1): Promise<any[]> {
+  async getDepartmentList(deptId: number = 1): Promise<unknown[]> {
     try {
-      const data = await this.request("/topapi/v2/department/listsub", {
-        method: "POST",
+      const data = await this.#request('/topapi/v2/department/listsub', {
+        method: 'POST',
         body: { dept_id: deptId },
       });
-      if (data.errcode === 0) return data.result || [];
+      if (data.errcode === 0) return (data.result as unknown[]) || [];
       throw new Error(`Failed to get department list: ${data.errmsg}`);
     } catch (error) {
-      this.logger.error("Failed to get department list:", error);
+      logger.error('Failed to get department list:', error);
       return [];
     }
   }
 
-  async getDepartmentInfo(deptId: number): Promise<any> {
+  async getDepartmentInfo(deptId: number): Promise<unknown> {
     try {
-      const data = await this.request("/topapi/v2/department/get", {
-        method: "POST",
+      const data = await this.#request('/topapi/v2/department/get', {
+        method: 'POST',
         body: { dept_id: deptId },
       });
       if (data.errcode === 0) return data.result;
       throw new Error(`Failed to get department info: ${data.errmsg}`);
     } catch (error) {
-      this.logger.error("Failed to get department info:", error);
+      logger.error('Failed to get department info:', error);
       return null;
     }
   }
@@ -535,38 +264,31 @@ export class DingTalkEndpoint implements Endpoint<DingTalkEndpointConfig, DingTa
   async createChat(
     name: string,
     ownerUserId: string,
-    userIdList: string[]
+    userIdList: string[],
   ): Promise<string | null> {
     try {
-      const data = await this.request("/topapi/chat/create", {
-        method: "POST",
-        body: {
-          name,
-          owner: ownerUserId,
-          useridlist: userIdList,
-        },
+      const data = await this.#request('/topapi/chat/create', {
+        method: 'POST',
+        body: { name, owner: ownerUserId, useridlist: userIdList },
       });
-      if (data.errcode === 0) {
-        this.logger.debug(formatCompact( { op: "create_chat", chat: data.chatid }));
-        return data.chatid;
-      }
+      if (data.errcode === 0) return (data.chatid as string) || null;
       throw new Error(`Failed to create chat: ${data.errmsg}`);
     } catch (error) {
-      this.logger.error("Failed to create chat:", error);
+      logger.error('Failed to create chat:', error);
       return null;
     }
   }
 
-  async getChatInfo(chatId: string): Promise<any> {
+  async getChatInfo(chatId: string): Promise<unknown> {
     try {
-      const data = await this.request("/topapi/chat/get", {
-        method: "POST",
+      const data = await this.#request('/topapi/chat/get', {
+        method: 'POST',
         body: { chatid: chatId },
       });
       if (data.errcode === 0) return data.chat_info;
       throw new Error(`Failed to get chat info: ${data.errmsg}`);
     } catch (error) {
-      this.logger.error("Failed to get chat info:", error);
+      logger.error('Failed to get chat info:', error);
       return null;
     }
   }
@@ -578,21 +300,83 @@ export class DingTalkEndpoint implements Endpoint<DingTalkEndpointConfig, DingTa
       owner?: string;
       add_useridlist?: string[];
       del_useridlist?: string[];
-    }
+    },
   ): Promise<boolean> {
     try {
-      const data = await this.request("/topapi/chat/update", {
-        method: "POST",
+      const data = await this.#request('/topapi/chat/update', {
+        method: 'POST',
         body: { chatid: chatId, ...options },
       });
-      if (data.errcode === 0) {
-        this.logger.debug(formatCompact( { op: "update_chat", chat: chatId }));
-        return true;
-      }
+      if (data.errcode === 0) return true;
       throw new Error(`Failed to update chat: ${data.errmsg}`);
     } catch (error) {
-      this.logger.error("Failed to update chat:", error);
+      logger.error('Failed to update chat:', error);
       return false;
     }
   }
+
+  async #request(
+    path: string,
+    options: {
+      method?: 'GET' | 'POST';
+      params?: Record<string, string | number>;
+      body?: Record<string, unknown>;
+    } = {},
+  ): Promise<DingTalkApiResponse> {
+    await this.#ensureAccessToken();
+    const { method = 'GET', params = {}, body } = options;
+    const urlParams = new URLSearchParams({
+      ...Object.fromEntries(
+        Object.entries(params).map(([key, value]) => [key, String(value)]),
+      ),
+      access_token: this.#accessToken.token,
+    });
+    const url = `${this.#options.config.apiBaseUrl}${path}?${urlParams.toString()}`;
+    const response = await this.#fetch(url, {
+      method,
+      headers: { 'Content-Type': 'application/json; charset=utf-8' },
+      body: body && method === 'POST' ? JSON.stringify(body) : undefined,
+    });
+    if (!response.ok) {
+      const text = await response.text().catch(() => '');
+      throw new Error(`DingTalk API error ${response.status}: ${text}`);
+    }
+    return await response.json() as DingTalkApiResponse;
+  }
+
+  async #ensureAccessToken(): Promise<void> {
+    const now = Date.now();
+    if (
+      this.#accessToken.token
+      && now < this.#accessToken.timestamp + (this.#accessToken.expires_in - 300) * 1000
+    ) {
+      return;
+    }
+    if (this.#refreshPromise) {
+      await this.#refreshPromise;
+      return;
+    }
+    this.#refreshPromise = this.#refreshAccessToken()
+      .then(() => this.#accessToken.token)
+      .finally(() => { this.#refreshPromise = null; });
+    await this.#refreshPromise;
+  }
+
+  async #refreshAccessToken(): Promise<void> {
+    const { appKey, appSecret, apiBaseUrl } = this.#options.config;
+    const params = new URLSearchParams({ appkey: appKey, appsecret: appSecret });
+    const url = `${apiBaseUrl}/gettoken?${params.toString()}`;
+    const response = await this.#fetch(url);
+    const data = await response.json() as DingTalkApiResponse;
+    if (data.errcode === 0 && data.access_token) {
+      this.#accessToken = {
+        token: data.access_token,
+        expires_in: data.expires_in ?? 7200,
+        timestamp: Date.now(),
+      };
+      logger.debug('Access token refreshed successfully');
+      return;
+    }
+    throw new Error(`Failed to get access token: ${data.errmsg} (${data.errcode})`);
+  }
 }