agent-messenger 1.14.0 → 2.0.0

package/src/platforms/channeltalk/index.test.ts

@@ -0,0 +1,114 @@
+import { expect, test } from 'bun:test'
+
+import {
+  BlockInlineAttrsSchema,
+  BlockInlineSchema,
+  ChannelAccountSchema,
+  ChannelBotSchema,
+  ChannelClient,
+  ChannelConfigSchema,
+  ChannelCredentialManager,
+  ChannelCredentialsSchema,
+  ChannelDirectChatSchema,
+  ChannelError,
+  ChannelGroupSchema,
+  ChannelManagerSchema,
+  ChannelMessageSchema,
+  ChannelSchema,
+  ChannelSearchHighlightSchema,
+  ChannelSearchHitSchema,
+  ChannelSearchResponseSchema,
+  ChannelSessionSchema,
+  ChannelUserChatSchema,
+  ChannelWorkspaceEntrySchema,
+  ExtractedChannelTokenSchema,
+  MessageBlockSchema,
+} from '@/platforms/channeltalk/index'
+
+test('ChannelClient is exported from barrel', () => {
+  expect(typeof ChannelClient).toBe('function')
+})
+
+test('ChannelError is exported from barrel', () => {
+  expect(typeof ChannelError).toBe('function')
+})
+
+test('ChannelCredentialManager is exported from barrel', () => {
+  expect(typeof ChannelCredentialManager).toBe('function')
+})
+
+test('ChannelSchema is exported from barrel', () => {
+  expect(typeof ChannelSchema.parse).toBe('function')
+})
+
+test('ChannelAccountSchema is exported from barrel', () => {
+  expect(typeof ChannelAccountSchema.parse).toBe('function')
+})
+
+test('ChannelBotSchema is exported from barrel', () => {
+  expect(typeof ChannelBotSchema.parse).toBe('function')
+})
+
+test('ChannelConfigSchema is exported from barrel', () => {
+  expect(typeof ChannelConfigSchema.parse).toBe('function')
+})
+
+test('ChannelCredentialsSchema is exported from barrel', () => {
+  expect(typeof ChannelCredentialsSchema.parse).toBe('function')
+})
+
+test('ChannelDirectChatSchema is exported from barrel', () => {
+  expect(typeof ChannelDirectChatSchema.parse).toBe('function')
+})
+
+test('ChannelGroupSchema is exported from barrel', () => {
+  expect(typeof ChannelGroupSchema.parse).toBe('function')
+})
+
+test('ChannelManagerSchema is exported from barrel', () => {
+  expect(typeof ChannelManagerSchema.parse).toBe('function')
+})
+
+test('ChannelMessageSchema is exported from barrel', () => {
+  expect(typeof ChannelMessageSchema.parse).toBe('function')
+})
+
+test('ChannelSessionSchema is exported from barrel', () => {
+  expect(typeof ChannelSessionSchema.parse).toBe('function')
+})
+
+test('ChannelUserChatSchema is exported from barrel', () => {
+  expect(typeof ChannelUserChatSchema.parse).toBe('function')
+})
+
+test('ChannelWorkspaceEntrySchema is exported from barrel', () => {
+  expect(typeof ChannelWorkspaceEntrySchema.parse).toBe('function')
+})
+
+test('ChannelSearchHighlightSchema is exported from barrel', () => {
+  expect(typeof ChannelSearchHighlightSchema.parse).toBe('function')
+})
+
+test('ChannelSearchHitSchema is exported from barrel', () => {
+  expect(typeof ChannelSearchHitSchema.parse).toBe('function')
+})
+
+test('ChannelSearchResponseSchema is exported from barrel', () => {
+  expect(typeof ChannelSearchResponseSchema.parse).toBe('function')
+})
+
+test('ExtractedChannelTokenSchema is exported from barrel', () => {
+  expect(typeof ExtractedChannelTokenSchema.parse).toBe('function')
+})
+
+test('MessageBlockSchema is exported from barrel', () => {
+  expect(typeof MessageBlockSchema.parse).toBe('function')
+})
+
+test('BlockInlineSchema is exported from barrel', () => {
+  expect(typeof BlockInlineSchema.parse).toBe('function')
+})
+
+test('BlockInlineAttrsSchema is exported from barrel', () => {
+  expect(typeof BlockInlineAttrsSchema.parse).toBe('function')
+})

package/src/platforms/channeltalk/index.ts

@@ -1,34 +1,47 @@
 export { ChannelClient } from './client'
 export { ChannelCredentialManager } from './credential-manager'
-export { ChannelTokenExtractor } from './token-extractor'
-export {
+export type {
+  BlockInline,
+  BlockInlineAttrs,
   Channel,
+  ChannelTalkChannel,
   ChannelAccount,
-  ChannelAccountSchema,
   ChannelBot,
-  ChannelBotSchema,
   ChannelConfig,
-  ChannelConfigSchema,
   ChannelCredentials,
-  ChannelCredentialsSchema,
   ChannelDirectChat,
+  ChannelGroup,
+  ChannelManager,
+  ChannelMessage,
+  ChannelSearchHighlight,
+  ChannelSearchHit,
+  ChannelSearchResponse,
+  ChannelSession,
+  ChannelUserChat,
+  ChannelWorkspaceEntry,
+  ExtractedChannelToken,
+  MessageBlock,
+} from './types'
+export {
+  BlockInlineAttrsSchema,
+  BlockInlineSchema,
+  ChannelAccountSchema,
+  ChannelBotSchema,
+  ChannelConfigSchema,
+  ChannelCredentialsSchema,
   ChannelDirectChatSchema,
   ChannelError,
-  ChannelGroup,
   ChannelGroupSchema,
-  ChannelManager,
   ChannelManagerSchema,
-  ChannelMessage,
   ChannelMessageSchema,
   ChannelSchema,
-  ChannelSession,
+  ChannelSearchHighlightSchema,
+  ChannelSearchHitSchema,
+  ChannelSearchResponseSchema,
   ChannelSessionSchema,
-  ChannelUserChat,
   ChannelUserChatSchema,
-  ChannelWorkspaceEntry,
   ChannelWorkspaceEntrySchema,
-  ExtractedChannelToken,
   ExtractedChannelTokenSchema,
-  MessageBlock,
   MessageBlockSchema,
 } from './types'
+

package/src/platforms/channeltalk/token-extractor.test.ts

@@ -1,5 +1,6 @@
 import { afterEach, describe, expect, test } from 'bun:test'
-import { existsSync, mkdtempSync, rmSync } from 'node:fs'
+import { createCipheriv, randomBytes } from 'node:crypto'
+import { existsSync, mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 
@@ -16,103 +17,264 @@ describe('ChannelTokenExtractor', () => {
     }
   })
 
-  test('returns null when cookies path does not exist', async () => {
-    class MissingPathExtractor extends ChannelTokenExtractor {
-      override getCookiesPath(): string | null {
-        return null
+  describe('getAppDataDir', () => {
+    test('returns null for unsupported platform', () => {
+      const extractor = new ChannelTokenExtractor('freebsd' as NodeJS.Platform)
+      expect(extractor.getAppDataDir()).toBeNull()
+    })
+  })
+
+  describe('getCookiesPath', () => {
+    test('returns null for unsupported platform', () => {
+      const extractor = new ChannelTokenExtractor('freebsd' as NodeJS.Platform)
+      expect(extractor.getCookiesPath()).toBeNull()
+    })
+
+    test('returns win32 path under AppData/Roaming/Channel Talk/Network', () => {
+      // given
+      const tempDir = mkdtempSync(join(tmpdir(), 'channel-win-'))
+      tempDirs.push(tempDir)
+      const networkDir = join(tempDir, 'Channel Talk', 'Network')
+      mkdirSync(networkDir, { recursive: true })
+      writeFileSync(join(networkDir, 'Cookies'), '')
+
+      class WinExtractor extends ChannelTokenExtractor {
+        constructor() {
+          super('win32')
+        }
+
+        override getAppDataDir(): string | null {
+          return join(tempDir, 'Channel Talk')
+        }
       }
-    }
 
-    const extractor = new MissingPathExtractor('darwin')
+      // when
+      const extractor = new WinExtractor()
+      const path = extractor.getCookiesPath()
 
-    expect(await extractor.extract()).toBeNull()
+      // then
+      expect(path).toBe(join(networkDir, 'Cookies'))
+    })
   })
 
-  test('extracts plaintext cookies from a real sqlite database', async () => {
-    const tempDir = mkdtempSync(join(tmpdir(), 'channel-cookie-db-'))
-    tempDirs.push(tempDir)
-    const dbPath = join(tempDir, 'Cookies')
-    await createCookieDatabase(dbPath, [
-      { name: 'x-account', value: 'account-jwt', host_key: '.desk.channel.io' },
-      { name: 'ch-session-1', value: 'session-jwt', host_key: '.desk.channel.io' },
-      { name: 'other', value: 'ignore-me', host_key: '.channel.io' },
-    ])
-
-    class TestExtractor extends ChannelTokenExtractor {
-      constructor(private dbPath: string) {
-        super('darwin')
+  describe('extract', () => {
+    test('returns null when cookies path does not exist', async () => {
+      class MissingPathExtractor extends ChannelTokenExtractor {
+        override getCookiesPath(): string | null {
+          return null
+        }
       }
 
-      override getCookiesPath(): string | null {
-        return this.dbPath
+      const extractor = new MissingPathExtractor('darwin')
+
+      expect(await extractor.extract()).toBeNull()
+    })
+
+    test('extracts plaintext cookies from a real sqlite database', async () => {
+      const tempDir = mkdtempSync(join(tmpdir(), 'channel-cookie-db-'))
+      tempDirs.push(tempDir)
+      const dbPath = join(tempDir, 'Cookies')
+      await createCookieDatabase(dbPath, [
+        { name: 'x-account', value: 'account-jwt', encrypted_value: Buffer.alloc(0), host_key: '.desk.channel.io' },
+        { name: 'ch-session-1', value: 'session-jwt', encrypted_value: Buffer.alloc(0), host_key: '.desk.channel.io' },
+        { name: 'other', value: 'ignore-me', encrypted_value: Buffer.alloc(0), host_key: '.channel.io' },
+      ])
+
+      class TestExtractor extends ChannelTokenExtractor {
+        constructor(private dbPath: string) {
+          super('darwin')
+        }
+
+        override getCookiesPath(): string | null {
+          return this.dbPath
+        }
       }
-    }
 
-    const extractor = new TestExtractor(dbPath)
+      const extractor = new TestExtractor(dbPath)
 
-    expect(await extractor.extract()).toEqual({
-      accountCookie: 'account-jwt',
-      sessionCookie: 'session-jwt',
+      expect(await extractor.extract()).toEqual({
+        accountCookie: 'account-jwt',
+        sessionCookie: 'session-jwt',
+      })
     })
-  })
 
-  test('returns token with undefined sessionCookie when only x-account is present', async () => {
-    const tempDir = mkdtempSync(join(tmpdir(), 'channel-cookie-db-'))
-    tempDirs.push(tempDir)
-    const dbPath = join(tempDir, 'Cookies')
-    await createCookieDatabase(dbPath, [{ name: 'x-account', value: 'account-jwt', host_key: '.channel.io' }])
+    test('returns token with undefined sessionCookie when only x-account is present', async () => {
+      const tempDir = mkdtempSync(join(tmpdir(), 'channel-cookie-db-'))
+      tempDirs.push(tempDir)
+      const dbPath = join(tempDir, 'Cookies')
+      await createCookieDatabase(dbPath, [
+        { name: 'x-account', value: 'account-jwt', encrypted_value: Buffer.alloc(0), host_key: '.channel.io' },
+      ])
+
+      class TestExtractor extends ChannelTokenExtractor {
+        constructor(private dbPath: string) {
+          super('darwin')
+        }
 
-    class TestExtractor extends ChannelTokenExtractor {
-      constructor(private dbPath: string) {
-        super('darwin')
+        override getCookiesPath(): string | null {
+          return this.dbPath
+        }
       }
 
-      override getCookiesPath(): string | null {
-        return this.dbPath
+      const extractor = new TestExtractor(dbPath)
+      const result = await extractor.extract()
+
+      expect(result).not.toBeNull()
+      expect(result?.accountCookie).toBe('account-jwt')
+      expect(result?.sessionCookie).toBeUndefined()
+    })
+
+    test('returns null when x-account is missing', async () => {
+      const tempDir = mkdtempSync(join(tmpdir(), 'channel-cookie-db-'))
+      tempDirs.push(tempDir)
+      const dbPath = join(tempDir, 'Cookies')
+      await createCookieDatabase(dbPath, [
+        { name: 'ch-session-1', value: 'session-jwt', encrypted_value: Buffer.alloc(0), host_key: '.channel.io' },
+      ])
+
+      class TestExtractor extends ChannelTokenExtractor {
+        constructor(private dbPath: string) {
+          super('darwin')
+        }
+
+        override getCookiesPath(): string | null {
+          return this.dbPath
+        }
       }
-    }
 
-    const extractor = new TestExtractor(dbPath)
-    const result = await extractor.extract()
+      const extractor = new TestExtractor(dbPath)
 
-    expect(result).not.toBeNull()
-    expect(result?.accountCookie).toBe('account-jwt')
-    expect(result?.sessionCookie).toBeUndefined()
-  })
+      expect(await extractor.extract()).toBeNull()
+    })
+
+    test('decrypts AES-256-GCM encrypted cookies using master key', async () => {
+      // given — known master key and AES-256-GCM encrypted cookie
+      const masterKey = randomBytes(32)
+      const accountValue = 'encrypted-account-jwt'
+      const sessionValue = 'encrypted-session-jwt'
+
+      const encryptAccount = encryptAESGCM(accountValue, masterKey)
+      const encryptSession = encryptAESGCM(sessionValue, masterKey)
+
+      const tempDir = mkdtempSync(join(tmpdir(), 'channel-cookie-db-'))
+      tempDirs.push(tempDir)
+      const dbPath = join(tempDir, 'Cookies')
+      await createCookieDatabase(dbPath, [
+        { name: 'x-account', value: '', encrypted_value: encryptAccount, host_key: '.channel.io' },
+        { name: 'ch-session-1', value: '', encrypted_value: encryptSession, host_key: '.channel.io' },
+      ])
+
+      // when — extractor uses the master key (bypassing DPAPI)
+      class TestWinExtractor extends ChannelTokenExtractor {
+        constructor(
+          private dbPath: string,
+          private masterKey: Buffer,
+        ) {
+          super('win32')
+        }
+
+        override getCookiesPath(): string | null {
+          return this.dbPath
+        }
 
-  test('returns null when x-account is missing', async () => {
-    const tempDir = mkdtempSync(join(tmpdir(), 'channel-cookie-db-'))
-    tempDirs.push(tempDir)
-    const dbPath = join(tempDir, 'Cookies')
-    await createCookieDatabase(dbPath, [{ name: 'ch-session-1', value: 'session-jwt', host_key: '.channel.io' }])
+        override decryptDPAPI(_encryptedBlob: Buffer): Buffer | null {
+          return this.masterKey
+        }
 
-    class TestExtractor extends ChannelTokenExtractor {
-      constructor(private dbPath: string) {
-        super('darwin')
+        override getAppDataDir(): string | null {
+          return tempDir
+        }
       }
 
-      override getCookiesPath(): string | null {
-        return this.dbPath
+      const localStatePath = join(tempDir, 'Local State')
+      const fakeEncryptedKey = Buffer.concat([Buffer.from('DPAPI'), randomBytes(32)])
+      writeFileSync(localStatePath, JSON.stringify({ os_crypt: { encrypted_key: fakeEncryptedKey.toString('base64') } }))
+
+      const extractor = new TestWinExtractor(dbPath, masterKey)
+      const result = await extractor.extract()
+
+      // then
+      expect(result).not.toBeNull()
+      expect(result?.accountCookie).toBe('encrypted-account-jwt')
+      expect(result?.sessionCookie).toBe('encrypted-session-jwt')
+    })
+
+    test('returns null when DPAPI decryption fails', async () => {
+      // given
+      const masterKey = randomBytes(32)
+      const encryptAccount = encryptAESGCM('account-jwt', masterKey)
+
+      const tempDir = mkdtempSync(join(tmpdir(), 'channel-cookie-db-'))
+      tempDirs.push(tempDir)
+      const dbPath = join(tempDir, 'Cookies')
+      await createCookieDatabase(dbPath, [
+        { name: 'x-account', value: '', encrypted_value: encryptAccount, host_key: '.channel.io' },
+      ])
+
+      // when — DPAPI fails
+      class FailingDPAPIExtractor extends ChannelTokenExtractor {
+        constructor(private dbPath: string) {
+          super('win32')
+        }
+
+        override getCookiesPath(): string | null {
+          return this.dbPath
+        }
+
+        override decryptDPAPI(_encryptedBlob: Buffer): Buffer | null {
+          return null
+        }
+
+        override getAppDataDir(): string | null {
+          return tempDir
+        }
       }
-    }
 
-    const extractor = new TestExtractor(dbPath)
+      const localStatePath = join(tempDir, 'Local State')
+      const fakeEncryptedKey = Buffer.concat([Buffer.from('DPAPI'), randomBytes(32)])
+      writeFileSync(localStatePath, JSON.stringify({ os_crypt: { encrypted_key: fakeEncryptedKey.toString('base64') } }))
+
+      const extractor = new FailingDPAPIExtractor(dbPath)
+      const result = await extractor.extract()
 
-    expect(await extractor.extract()).toBeNull()
+      // then
+      expect(result).toBeNull()
+    })
+  })
+
+  describe('decryptDPAPI', () => {
+    test('returns null on non-win32 platform', () => {
+      const extractor = new ChannelTokenExtractor('darwin')
+      expect(extractor.decryptDPAPI(Buffer.from('test'))).toBeNull()
+    })
   })
 })
 
+function encryptAESGCM(plaintext: string, key: Buffer): Buffer {
+  const nonce = randomBytes(12)
+  const cipher = createCipheriv('aes-256-gcm', key, nonce)
+  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()])
+  const authTag = cipher.getAuthTag()
+  // v10 prefix (3 bytes) + IV (12 bytes) + ciphertext + auth tag (16 bytes)
+  return Buffer.concat([Buffer.from('v10'), nonce, encrypted, authTag])
+}
+
 async function createCookieDatabase(
   dbPath: string,
-  rows: Array<{ name: string; value: string; host_key: string }>,
+  rows: Array<{ name: string; value: string; encrypted_value: Buffer; host_key: string }>,
 ): Promise<void> {
   if (typeof globalThis.Bun !== 'undefined') {
     const { Database } = await import('bun:sqlite')
     const db = new Database(dbPath)
     db.run('PRAGMA journal_mode = DELETE')
-    db.run('CREATE TABLE cookies (name TEXT, value TEXT, host_key TEXT)')
+    db.run('CREATE TABLE cookies (name TEXT, value TEXT, encrypted_value BLOB, host_key TEXT)')
     for (const row of rows) {
-      db.run('INSERT INTO cookies (name, value, host_key) VALUES (?, ?, ?)', [row.name, row.value, row.host_key])
+      db.run('INSERT INTO cookies (name, value, encrypted_value, host_key) VALUES (?, ?, ?, ?)', [
+        row.name,
+        row.value,
+        row.encrypted_value,
+        row.host_key,
+      ])
     }
     db.close()
     return
@@ -122,10 +284,10 @@ async function createCookieDatabase(
   const req = createRequire(import.meta.url)
   const Database = req('better-sqlite3')
   const db = new Database(dbPath)
-  db.exec('CREATE TABLE cookies (name TEXT, value TEXT, host_key TEXT)')
-  const statement = db.prepare('INSERT INTO cookies (name, value, host_key) VALUES (?, ?, ?)')
+  db.exec('CREATE TABLE cookies (name TEXT, value TEXT, encrypted_value BLOB, host_key TEXT)')
+  const statement = db.prepare('INSERT INTO cookies (name, value, encrypted_value, host_key) VALUES (?, ?, ?, ?)')
   for (const row of rows) {
-    statement.run(row.name, row.value, row.host_key)
+    statement.run(row.name, row.value, row.encrypted_value, row.host_key)
   }
   db.close()
 }