@zhin.js/adapter-lark 1.1.25 → 1.1.27

package/src/webhook.ts

@@ -1,13 +1,13 @@
 /**
- * Lark/Feishu webhook HTTP: verification → signature → challenge/event → admit.
+ * Lark/Feishu webhook HTTP: signature → decrypt → verification token → challenge/event → admit.
  */
 import type { LarkCardAction } from './cards.js';
-import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { HttpHost, HttpRouteRegistration } from '@zhin.js/host-http';
+import { readTextBody } from '@zhin.js/host-http-contract';
 import { formatCompact, getLogger } from '@zhin.js/logger';
 import {
+  decryptLarkEvent,
   headerValue,
-  readTextBody,
   verifySignature,
   verifyToken,
   type LarkEventBody,
@@ -31,17 +31,14 @@ export function registerLarkWebhookRoutes(
 ): HttpRouteRegistration[] {
   const path = handler.config.webhookPath;
   return [
-    http.route('POST', path, async (request, response) => {
-      await handleLarkWebhookRequest(request, response, handler);
-    }, { summary: 'Lark/Feishu event webhook', tags: ['lark'] }),
+    http.route('POST', path, (request) => handleLarkWebhookRequest(request, handler), { summary: 'Lark/Feishu event webhook', tags: ['lark'] }),
   ];
 }
 
 export async function handleLarkWebhookRequest(
-  request: IncomingMessage,
-  response: ServerResponse,
+  request: Request,
   handler: LarkWebhookHandler,
-): Promise<void> {
+): Promise<Response> {
   try {
     const rawBody = await readTextBody(request);
 
@@ -49,22 +46,10 @@ export async function handleLarkWebhookRequest(
     try {
       event = JSON.parse(rawBody) as LarkEventBody;
     } catch {
-      response.writeHead(200, { 'Content-Type': 'application/json' });
-      response.end(JSON.stringify({ code: 0, msg: 'success' }));
-      return;
-    }
-
-    if (handler.config.verificationToken) {
-      const bodyToken = (event as LarkEventBody & { header?: { token?: unknown } }).header?.token ?? event.token;
-      const token = typeof bodyToken === 'string' ? bodyToken : headerValue(request.headers, 'x-lark-request-token');
-      if (!verifyToken(token, handler.config.verificationToken)) {
-        logger.warn(formatCompact({ op: 'webhook', ok: false, error: 'invalid verification token' }));
-        response.writeHead(403, { 'Content-Type': 'text/plain' });
-        response.end('Forbidden');
-        return;
-      }
+      return new Response(JSON.stringify({ code: 0, msg: 'success' }), { status: 200, headers: { 'Content-Type': 'application/json' } });
     }
 
+    // Signature first: it covers the raw (possibly encrypted) body.
     if (handler.config.encryptKey) {
       const timestamp = headerValue(request.headers, 'x-lark-request-timestamp');
       const nonce = headerValue(request.headers, 'x-lark-request-nonce');
@@ -76,12 +61,36 @@ export async function handleLarkWebhookRequest(
         || !verifySignature(handler.config.encryptKey, timestamp, nonce, rawBody, signature)
       ) {
         logger.warn(formatCompact({ op: 'webhook', ok: false, error: 'invalid signature' }));
-        response.writeHead(403, { 'Content-Type': 'text/plain' });
-        response.end('Forbidden');
-        return;
+        return new Response('Forbidden', { status: 403, headers: { 'Content-Type': 'text/plain' } });
       }
     }
 
+    if (typeof event?.encrypt === 'string') {
+      if (!handler.config.encryptKey) {
+        logger.warn(formatCompact({ op: 'webhook', ok: false, error: 'encrypted event received but encryptKey is not configured' }));
+        return new Response(JSON.stringify({ code: -1, msg: 'Encrypt key is not configured' }), { status: 400, headers: { 'Content-Type': 'application/json' } });
+      }
+      try {
+        event = JSON.parse(decryptLarkEvent(handler.config.encryptKey, event.encrypt)) as LarkEventBody;
+      } catch {
+        logger.warn(formatCompact({ op: 'webhook', ok: false, error: 'event decryption failed' }));
+        return new Response(JSON.stringify({ code: -1, msg: 'Decryption failed' }), { status: 400, headers: { 'Content-Type': 'application/json' } });
+      }
+    }
+
+    if (!event || typeof event !== 'object') {
+      return new Response(JSON.stringify({ code: 0, msg: 'success' }), { status: 200, headers: { 'Content-Type': 'application/json' } });
+    }
+
+    // Token and challenge live inside the decrypted event.
+    if (handler.config.verificationToken) {
+      const bodyToken = (event as LarkEventBody & { header?: { token?: unknown } }).header?.token ?? event.token;
+      const token = typeof bodyToken === 'string' ? bodyToken : headerValue(request.headers, 'x-lark-request-token');
+      if (!verifyToken(token, handler.config.verificationToken)) {
+        logger.warn(formatCompact({ op: 'webhook', ok: false, error: 'invalid verification token' }));
+        return new Response('Forbidden', { status: 403, headers: { 'Content-Type': 'text/plain' } });
+      }
+    }
 
     if (handler.isOpen) {
       const eventName = event.type === 'event_callback'
@@ -91,9 +100,7 @@ export async function handleLarkWebhookRequest(
     }
 
     if (event.type === 'url_verification') {
-      response.writeHead(200, { 'Content-Type': 'application/json' });
-      response.end(JSON.stringify({ challenge: event.challenge }));
-      return;
+      return new Response(JSON.stringify({ challenge: event.challenge }), { status: 200, headers: { 'Content-Type': 'application/json' } });
     }
 
     const headerEventType = (event as LarkEventBody & { header?: { event_type?: string } }).header?.event_type;
@@ -107,11 +114,9 @@ export async function handleLarkWebhookRequest(
       handler.admit(message, event);
     }
 
-    response.writeHead(200, { 'Content-Type': 'application/json' });
-    response.end(JSON.stringify({ code: 0, msg: 'success' }));
+    return new Response(JSON.stringify({ code: 0, msg: 'success' }), { status: 200, headers: { 'Content-Type': 'application/json' } });
   } catch (error) {
     logger.error('Webhook error:', error);
-    response.writeHead(500, { 'Content-Type': 'application/json' });
-    response.end(JSON.stringify({ code: -1, msg: 'Internal Server Error' }));
+    return new Response(JSON.stringify({ code: -1, msg: 'Internal Server Error' }), { status: 500, headers: { 'Content-Type': 'application/json' } });
   }
 }