agent-messenger 2.21.0 → 2.23.0

package/src/platforms/webex/listener.ts

@@ -0,0 +1,285 @@
+import { EventEmitter } from 'events'
+
+import { WebexMessageHandler } from 'webex-message-handler'
+import type {
+  AttachmentAction,
+  DecryptedMessage,
+  DeletedMessage,
+  HandlerStatus,
+  InjectedWebSocket,
+  MembershipActivity,
+  RoomActivity,
+  WebexMessageHandlerConfig,
+  WebexMessageHandlerEvents,
+} from 'webex-message-handler'
+import WebSocket from 'ws'
+
+import {
+  normalizeAttachmentAction,
+  normalizeDeletedMessage,
+  normalizeMembership,
+  normalizeMessage,
+  normalizeRoomActivity,
+} from './id-normalizer'
+import { createWdmRewriteFetch, discoverWdmDevicesUrl } from './wdm-discovery'
+
+type EventKey = keyof WebexListenerEventMap
+
+export interface WebexListenerClient {
+  getToken(): string
+}
+
+interface WebexMessageHandlerLike {
+  connect(): Promise<void>
+  disconnect(): Promise<void>
+  status(): HandlerStatus
+  get connected(): boolean
+  on<K extends keyof WebexMessageHandlerEvents>(event: K, listener: WebexMessageHandlerEvents[K]): this
+  off<K extends keyof WebexMessageHandlerEvents>(event: K, listener: WebexMessageHandlerEvents[K]): this
+  once<K extends keyof WebexMessageHandlerEvents>(event: K, listener: WebexMessageHandlerEvents[K]): this
+}
+
+export interface WebexListenerOptions {
+  ignoreSelfMessages?: boolean
+  pingInterval?: number
+  pongTimeout?: number
+  reconnectBackoffMax?: number
+  maxReconnectAttempts?: number
+  _handlerFactory?: (config: WebexMessageHandlerConfig) => WebexMessageHandlerLike
+}
+
+export interface WebexListenerEventMap {
+  message_created: [event: DecryptedMessage]
+  message_updated: [event: DecryptedMessage]
+  message_deleted: [event: DeletedMessage]
+  membership_created: [event: MembershipActivity]
+  attachment_action: [event: AttachmentAction]
+  room_created: [event: RoomActivity]
+  room_updated: [event: RoomActivity]
+  webex_event: [event: DecryptedMessage | DeletedMessage | MembershipActivity | AttachmentAction | RoomActivity]
+  connected: [info: { connected: boolean; status: HandlerStatus }]
+  reconnecting: [attempt: number]
+  disconnected: [reason: string]
+  error: [error: Error]
+}
+
+export class WebexListener {
+  private client: WebexListenerClient
+  private options: WebexListenerOptions
+  private running = false
+  private emitter = new EventEmitter()
+  private handler: WebexMessageHandlerLike | null = null
+  private generation = 0
+  private detachHandler: (() => void) | null = null
+  private startPromise: Promise<void> | null = null
+
+  constructor(client: WebexListenerClient, options: WebexListenerOptions = {}) {
+    this.client = client
+    this.options = options
+  }
+
+  async start(): Promise<void> {
+    if (this.startPromise) return this.startPromise
+    if (this.running) return
+
+    this.running = true
+    const generation = ++this.generation
+
+    let startPromise!: Promise<void>
+    startPromise = (async () => {
+      let handler: WebexMessageHandlerLike | null = null
+      try {
+        handler = await this.createHandler()
+
+        if (!this.running || this.generation !== generation) {
+          await handler.disconnect().catch(() => undefined)
+          return
+        }
+        this.handler = handler
+        this.detachHandler = this.wireHandler(handler, generation)
+
+        await handler.connect()
+
+        if (!this.running || this.handler !== handler || this.generation !== generation) {
+          await handler.disconnect().catch(() => undefined)
+          return
+        }
+      } catch (error) {
+        if (this.handler === handler && this.generation === generation) {
+          this.detachHandler?.()
+          this.detachHandler = null
+          this.handler = null
+        }
+        if (this.generation === generation) {
+          this.running = false
+        }
+        await handler?.disconnect().catch(() => undefined)
+        throw error
+      } finally {
+        if (this.startPromise === startPromise) {
+          this.startPromise = null
+        }
+      }
+    })()
+
+    this.startPromise = startPromise
+    return startPromise
+  }
+
+  async stop(): Promise<void> {
+    const pendingStart = this.startPromise
+    this.startPromise = null
+
+    this.running = false
+    this.generation++
+
+    const detach = this.detachHandler
+    this.detachHandler = null
+    detach?.()
+
+    const handler = this.handler
+    this.handler = null
+    if (handler) {
+      await handler.disconnect().catch(() => undefined)
+    }
+
+    if (pendingStart) {
+      await pendingStart.catch(() => undefined)
+    }
+  }
+
+  on<K extends EventKey>(event: K, listener: (...args: WebexListenerEventMap[K]) => void): this {
+    this.emitter.on(event, listener as (...args: unknown[]) => void)
+    return this
+  }
+
+  off<K extends EventKey>(event: K, listener: (...args: WebexListenerEventMap[K]) => void): this {
+    this.emitter.off(event, listener as (...args: unknown[]) => void)
+    return this
+  }
+
+  once<K extends EventKey>(event: K, listener: (...args: WebexListenerEventMap[K]) => void): this {
+    this.emitter.once(event, listener as (...args: unknown[]) => void)
+    return this
+  }
+
+  private isCurrent(handler: WebexMessageHandlerLike, generation: number): boolean {
+    return this.running && this.handler === handler && this.generation === generation
+  }
+
+  // Node's EventEmitter throws synchronously if an 'error' event is emitted with
+  // no registered listener. Guard it so SDK consumers that only subscribe to
+  // message events are never crashed by a transient connection error.
+  private emitError(error: Error): void {
+    if (this.emitter.listenerCount('error') > 0) {
+      this.emitter.emit('error', error)
+    }
+  }
+
+  private async createHandler(): Promise<WebexMessageHandlerLike> {
+    const token = this.client.getToken()
+    const config: WebexMessageHandlerConfig = { token }
+    if (this.options.ignoreSelfMessages !== undefined) config.ignoreSelfMessages = this.options.ignoreSelfMessages
+    if (this.options.pingInterval !== undefined) config.pingInterval = this.options.pingInterval
+    if (this.options.pongTimeout !== undefined) config.pongTimeout = this.options.pongTimeout
+    if (this.options.reconnectBackoffMax !== undefined) config.reconnectBackoffMax = this.options.reconnectBackoffMax
+    if (this.options.maxReconnectAttempts !== undefined) config.maxReconnectAttempts = this.options.maxReconnectAttempts
+
+    if (this.options._handlerFactory) {
+      return this.options._handlerFactory(config)
+    }
+
+    const wdmDevicesUrl = await discoverWdmDevicesUrl(token)
+    config.mode = 'injected'
+    config.fetch = createWdmRewriteFetch(wdmDevicesUrl)
+    config.webSocketFactory = (url: string) => new WebSocket(url) as unknown as InjectedWebSocket
+    return new WebexMessageHandler(config)
+  }
+
+  private wireHandler(handler: WebexMessageHandlerLike, generation: number): () => void {
+    const onMessageCreated = (event: DecryptedMessage) => {
+      if (!this.isCurrent(handler, generation)) return
+      const normalized = normalizeMessage(event)
+      this.emitter.emit('message_created', normalized)
+      this.emitter.emit('webex_event', normalized)
+    }
+    const onMessageUpdated = (event: DecryptedMessage) => {
+      if (!this.isCurrent(handler, generation)) return
+      const normalized = normalizeMessage(event)
+      this.emitter.emit('message_updated', normalized)
+      this.emitter.emit('webex_event', normalized)
+    }
+    const onMessageDeleted = (event: DeletedMessage) => {
+      if (!this.isCurrent(handler, generation)) return
+      const normalized = normalizeDeletedMessage(event)
+      this.emitter.emit('message_deleted', normalized)
+      this.emitter.emit('webex_event', normalized)
+    }
+    const onMembershipCreated = (event: MembershipActivity) => {
+      if (!this.isCurrent(handler, generation)) return
+      const normalized = normalizeMembership(event)
+      this.emitter.emit('membership_created', normalized)
+      this.emitter.emit('webex_event', normalized)
+    }
+    const onAttachmentAction = (event: AttachmentAction) => {
+      if (!this.isCurrent(handler, generation)) return
+      const normalized = normalizeAttachmentAction(event)
+      this.emitter.emit('attachment_action', normalized)
+      this.emitter.emit('webex_event', normalized)
+    }
+    const onRoomCreated = (event: RoomActivity) => {
+      if (!this.isCurrent(handler, generation)) return
+      const normalized = normalizeRoomActivity(event)
+      this.emitter.emit('room_created', normalized)
+      this.emitter.emit('webex_event', normalized)
+    }
+    const onRoomUpdated = (event: RoomActivity) => {
+      if (!this.isCurrent(handler, generation)) return
+      const normalized = normalizeRoomActivity(event)
+      this.emitter.emit('room_updated', normalized)
+      this.emitter.emit('webex_event', normalized)
+    }
+    const onConnected = () => {
+      if (!this.isCurrent(handler, generation)) return
+      this.emitter.emit('connected', { connected: handler.connected, status: handler.status() })
+    }
+    const onReconnecting = (attempt: number) => {
+      if (!this.isCurrent(handler, generation)) return
+      this.emitter.emit('reconnecting', attempt)
+    }
+    const onDisconnected = (reason: string) => {
+      if (!this.isCurrent(handler, generation)) return
+      this.emitter.emit('disconnected', reason)
+    }
+    const onError = (error: Error) => {
+      if (!this.isCurrent(handler, generation)) return
+      this.emitError(error)
+    }
+
+    handler.on('message:created', onMessageCreated)
+    handler.on('message:updated', onMessageUpdated)
+    handler.on('message:deleted', onMessageDeleted)
+    handler.on('membership:created', onMembershipCreated)
+    handler.on('attachmentAction:created', onAttachmentAction)
+    handler.on('room:created', onRoomCreated)
+    handler.on('room:updated', onRoomUpdated)
+    handler.on('connected', onConnected)
+    handler.on('reconnecting', onReconnecting)
+    handler.on('disconnected', onDisconnected)
+    handler.on('error', onError)
+
+    return () => {
+      handler.off('message:created', onMessageCreated)
+      handler.off('message:updated', onMessageUpdated)
+      handler.off('message:deleted', onMessageDeleted)
+      handler.off('membership:created', onMembershipCreated)
+      handler.off('attachmentAction:created', onAttachmentAction)
+      handler.off('room:created', onRoomCreated)
+      handler.off('room:updated', onRoomUpdated)
+      handler.off('connected', onConnected)
+      handler.off('reconnecting', onReconnecting)
+      handler.off('disconnected', onDisconnected)
+      handler.off('error', onError)
+    }
+  }
+}

package/src/platforms/webex/password-login.test.ts

@@ -0,0 +1,193 @@
+import { afterEach, describe, expect, it, mock } from 'bun:test'
+import { createHash } from 'node:crypto'
+
+import { createPkcePair, loginWithPassword } from './password-login'
+import { WebexError } from './types'
+
+const realFetch = globalThis.fetch
+
+describe('loginWithPassword', () => {
+  afterEach(() => {
+    globalThis.fetch = realFetch
+  })
+
+  it('exchanges email and password for tokens and registers a device', async () => {
+    const postedBodies: string[] = []
+
+    globalThis.fetch = mock((input: RequestInfo | URL, init?: RequestInit) => {
+      const url = toUrl(input)
+      if (typeof init?.body === 'string') postedBodies.push(init.body)
+
+      if (url.startsWith('https://u2c.svc.webex.com/')) {
+        return Promise.resolve(
+          jsonResponse({
+            serviceLinks: { idbroker: 'https://idbroker-test.webex.com', wdm: 'https://wdm-test.wbx2.com' },
+          }),
+        )
+      }
+
+      if (url.startsWith('https://idbroker-test.webex.com/idb/oauth2/v1/authorize')) {
+        return Promise.resolve(
+          new Response(
+            '<form><input type="hidden" name="SunQueryParamsString" value="one&amp;two=&#x40;"><input name="goto" value="https://web.webex.com"><input name="encoded" value="true"><input name="gx_charset" value="UTF-8"><input name="webAuthnEnabledFlow" value="false"><input name="webAuthnResponse" value=""><input name="isAudioCaptcha" value="false"></form>',
+            { status: 200, headers: { 'set-cookie': 'sid=abc; Path=/' } },
+          ),
+        )
+      }
+
+      if (url === 'https://idbroker-test.webex.com/idb/UI/Login') {
+        return Promise.resolve(
+          new Response('', { status: 302, headers: { location: 'https://web.webex.com/?code=TESTCODE' } }),
+        )
+      }
+
+      if (url === 'https://idbroker-test.webex.com/idb/oauth2/v1/access_token') {
+        return Promise.resolve(
+          jsonResponse({
+            access_token: 'fake-access-token',
+            refresh_token: 'fake-refresh-token',
+            expires_in: 3600,
+            refresh_token_expires_in: 7200,
+            scope: 'spark:kms',
+            token_type: 'Bearer',
+          }),
+        )
+      }
+
+      if (url === 'https://wdm-test.wbx2.com/wdm/api/v1/devices') {
+        return Promise.resolve(
+          jsonResponse({ url: 'https://wdm-test.wbx2.com/wdm/api/v1/devices/device-1', userId: 'user-1' }),
+        )
+      }
+
+      return Promise.resolve(new Response('', { status: 404 }))
+    }) as typeof fetch
+
+    const result = await loginWithPassword('user@example.com', 'test-password')
+    const loginBody = new URLSearchParams(postedBodies.find((body) => body.includes('IDToken2')))
+
+    expect(result.accessToken).toBe('fake-access-token')
+    expect(result.refreshToken).toBe('fake-refresh-token')
+    expect(result.expiresAt).toBeGreaterThan(Date.now())
+    expect(result.deviceUrl).toBe('https://wdm-test.wbx2.com/wdm/api/v1/devices/device-1')
+    expect(result.userId).toBe('user-1')
+    expect(loginBody.get('IDToken1')).toBe('user@example.com')
+    expect(loginBody.get('IDToken2')).toBe('test-password')
+    expect(loginBody.get('SunQueryParamsString')).toBe('one&two=@')
+  })
+
+  it('creates an S256 PKCE challenge from the verifier', () => {
+    const verifier = 'test-verifier'
+    const expectedChallenge = createHash('sha256')
+      .update(verifier)
+      .digest('base64')
+      .replace(/\+/g, '-')
+      .replace(/\//g, '_')
+      .replace(/=+$/, '')
+
+    expect(createPkcePair(verifier)).toEqual({ verifier, challenge: expectedChallenge })
+  })
+
+  it('rejects without persisting when WDM device registration fails', async () => {
+    globalThis.fetch = mock((input: RequestInfo | URL) => {
+      const url = toUrl(input)
+
+      if (url.startsWith('https://u2c.svc.webex.com/')) {
+        return Promise.resolve(
+          jsonResponse({
+            serviceLinks: { idbroker: 'https://idbroker-test.webex.com', wdm: 'https://wdm-test.wbx2.com' },
+          }),
+        )
+      }
+      if (url.startsWith('https://idbroker-test.webex.com/idb/oauth2/v1/authorize')) {
+        return Promise.resolve(
+          new Response('<input name="SunQueryParamsString" value="x">', {
+            status: 200,
+            headers: { 'set-cookie': 'sid=abc; Path=/' },
+          }),
+        )
+      }
+      if (url === 'https://idbroker-test.webex.com/idb/UI/Login') {
+        return Promise.resolve(
+          new Response('', { status: 302, headers: { location: 'https://web.webex.com/?code=TESTCODE' } }),
+        )
+      }
+      if (url === 'https://idbroker-test.webex.com/idb/oauth2/v1/access_token') {
+        return Promise.resolve(
+          jsonResponse({ access_token: 'fake-access-token', refresh_token: 'fake-refresh-token', expires_in: 3600 }),
+        )
+      }
+      if (url === 'https://wdm-test.wbx2.com/wdm/api/v1/devices') {
+        return Promise.resolve(new Response('', { status: 500 }))
+      }
+      return Promise.resolve(new Response('', { status: 404 }))
+    }) as typeof fetch
+
+    await expect(loginWithPassword('user@example.com', 'test-password')).rejects.toMatchObject({
+      name: 'WebexError',
+      code: 'device_registration_failed',
+    } satisfies Partial<WebexError>)
+  })
+
+  it('rejects as sso_required without posting credentials when authorize redirects to an external IdP', async () => {
+    const postedBodies: string[] = []
+    globalThis.fetch = mock((input: RequestInfo | URL, init?: RequestInit) => {
+      const url = toUrl(input)
+      if (typeof init?.body === 'string') postedBodies.push(init.body)
+
+      if (url.startsWith('https://u2c.svc.webex.com/')) {
+        return Promise.resolve(jsonResponse({ serviceLinks: { idbroker: 'https://idbroker-test.webex.com' } }))
+      }
+      if (url.startsWith('https://idbroker-test.webex.com/idb/oauth2/v1/authorize')) {
+        return Promise.resolve(
+          new Response('', { status: 302, headers: { location: 'https://idp.example.com/login' } }),
+        )
+      }
+      if (url.startsWith('https://idp.example.com/')) {
+        return Promise.resolve(new Response('<input name="IDToken1"><input name="IDToken2">', { status: 200 }))
+      }
+      return Promise.resolve(new Response('', { status: 404 }))
+    }) as typeof fetch
+
+    await expect(loginWithPassword('user@example.com', 'test-password')).rejects.toMatchObject({
+      name: 'WebexError',
+      code: 'sso_required',
+    } satisfies Partial<WebexError>)
+    expect(postedBodies.some((body) => body.includes('test-password'))).toBe(false)
+  })
+
+  it('throws mfa_required when login lands on an OTP step', async () => {
+    globalThis.fetch = mock((input: RequestInfo | URL) => {
+      const url = toUrl(input)
+
+      if (url.startsWith('https://u2c.svc.webex.com/')) {
+        return Promise.resolve(jsonResponse({ serviceLinks: { idbroker: 'https://idbroker-test.webex.com' } }))
+      }
+
+      if (url.startsWith('https://idbroker-test.webex.com/idb/oauth2/v1/authorize')) {
+        return Promise.resolve(new Response('<input name="SunQueryParamsString" value="x">', { status: 200 }))
+      }
+
+      if (url === 'https://idbroker-test.webex.com/idb/UI/Login') {
+        return Promise.resolve(new Response('<input name="IDToken1"><p>verification code</p>', { status: 200 }))
+      }
+
+      return Promise.resolve(new Response('', { status: 404 }))
+    }) as typeof fetch
+
+    await expect(loginWithPassword('user@example.com', 'test-password')).rejects.toMatchObject({
+      name: 'WebexError',
+      code: 'mfa_required',
+    } satisfies Partial<WebexError>)
+  })
+})
+
+function jsonResponse(body: unknown): Response {
+  return new Response(JSON.stringify(body), { status: 200, headers: { 'Content-Type': 'application/json' } })
+}
+
+function toUrl(input: RequestInfo | URL): string {
+  if (typeof input === 'string') return input
+  if (input instanceof URL) return input.toString()
+  return input.url
+}