levix-bot 2.0.0

package/src/config/settings.cjs

@@ -0,0 +1,386 @@
+// Runtime settings — everything that used to live in a .env file.
+//
+// There is no .env file any more. A setting resolves in exactly two steps:
+//
+//   1. the value the operator saved from the dashboard (`setting:*` in the
+//      bot_settings table)
+//   2. the default baked in here
+//
+// So a fresh install runs with no configuration at all, and the control panel
+// is the only place a value is ever changed. Consumers must read through
+// `get()` at CALL time (not once at import) or a change wouldn't take effect
+// until a restart — the few settings that genuinely can't apply live are
+// marked `restart: true` and the dashboard says so next to the field.
+//
+// Secrets (API keys) are stored the same way but never leave the server: the
+// dashboard only ever learns whether one is configured.
+
+const logger = require("../utils/logger.cjs");
+
+const SETTINGS = [
+  // --- General -----------------------------------------------------------
+  {
+    key: "bot_timezone",
+    type: "string",
+    default: "Africa/Cairo",
+    group: "general",
+    label: "Timezone",
+    hint: "IANA name, e.g. Africa/Cairo. Used by the AI, !prayer and the scheduler.",
+  },
+  {
+    key: "bot_min_delay_ms",
+    type: "int",
+    default: 400,
+    min: 0,
+    max: 10000,
+    group: "general",
+    label: "Min reply delay (ms)",
+    hint: "Small human-looking pause before the bot answers.",
+  },
+  {
+    key: "bot_max_delay_ms",
+    type: "int",
+    default: 900,
+    min: 0,
+    max: 30000,
+    group: "general",
+    label: "Max reply delay (ms)",
+  },
+
+  // --- AI ----------------------------------------------------------------
+  {
+    key: "gemini_api_key",
+    type: "secret",
+    default: "",
+    group: "ai",
+    label: "Gemini API key",
+    hint: "Free key from aistudio.google.com/apikey — without it the AI commands stay off.",
+  },
+  {
+    key: "gemini_model",
+    type: "string",
+    default: "gemini-2.5-flash",
+    group: "ai",
+    label: "Gemini model",
+  },
+  {
+    key: "ai_agent",
+    type: "bool",
+    default: true,
+    group: "ai",
+    label: "Tool use (agent mode)",
+    hint: "Off = the AI answers from the prompt only, no search / page reading / memory writes.",
+  },
+  {
+    key: "ai_max_tool_steps",
+    type: "int",
+    default: 6,
+    min: 1,
+    max: 20,
+    group: "ai",
+    label: "Max tool rounds",
+  },
+  {
+    key: "ai_tool_timeout_ms",
+    type: "int",
+    default: 30000,
+    min: 1000,
+    max: 120000,
+    group: "ai",
+    label: "Tool timeout (ms)",
+  },
+  {
+    key: "ai_max_history",
+    type: "int",
+    default: 24,
+    min: 2,
+    max: 200,
+    group: "ai",
+    label: "Conversation turns kept",
+  },
+  {
+    key: "memory_context_chars",
+    type: "int",
+    default: 6000,
+    min: 500,
+    max: 40000,
+    group: "ai",
+    label: "Memory injected (chars)",
+    hint: "How much of the long-term memory files goes into every prompt.",
+  },
+  {
+    key: "groq_api_key",
+    type: "secret",
+    default: "",
+    group: "ai",
+    label: "Groq API key (fallback)",
+    hint: "Used only when Gemini is out of quota.",
+  },
+  {
+    key: "groq_model",
+    type: "string",
+    default: "llama-3.3-70b-versatile",
+    group: "ai",
+    label: "Groq model",
+  },
+  {
+    key: "google_search_api_key",
+    type: "secret",
+    default: "",
+    group: "ai",
+    label: "Google Search API key",
+    hint: "Optional. Without it the search tool uses DuckDuckGo.",
+  },
+  {
+    key: "google_search_cx",
+    type: "string",
+    default: "",
+    group: "ai",
+    label: "Google Search engine ID (cx)",
+  },
+
+  // --- Integrations ------------------------------------------------------
+  {
+    key: "openweathermap_api_key",
+    type: "secret",
+    default: "",
+    group: "integrations",
+    label: "OpenWeatherMap API key",
+    hint: "Needed by !weather.",
+  },
+
+  // --- Media -------------------------------------------------------------
+  {
+    key: "thumbnail_remote",
+    type: "bool",
+    default: true,
+    group: "media",
+    label: "Previews for remote media",
+    hint: "Download media sent by URL to build a thumbnail before forwarding it.",
+  },
+  {
+    key: "thumbnail_remote_max_mb",
+    type: "int",
+    default: 20,
+    min: 1,
+    max: 200,
+    group: "media",
+    label: "Max remote media (MB)",
+  },
+  {
+    key: "thumbnail_remote_timeout_ms",
+    type: "int",
+    default: 20000,
+    min: 1000,
+    max: 120000,
+    group: "media",
+    label: "Remote media timeout (ms)",
+  },
+  {
+    key: "ffmpeg_path",
+    type: "string",
+    default: "",
+    group: "media",
+    label: "ffmpeg path",
+    hint: "Only if the bundled ffmpeg-static binary can't run on this machine.",
+  },
+
+  // --- Server ------------------------------------------------------------
+  {
+    key: "port",
+    type: "int",
+    default: 3001,
+    min: 1,
+    max: 65535,
+    group: "server",
+    label: "Control panel port",
+    hint: "Takes effect on the next start — and only inside the bot. Under Docker or behind a reverse proxy, change the mapping there instead.",
+    restart: true,
+  },
+  {
+    key: "trust_proxy",
+    type: "string",
+    default: "",
+    group: "server",
+    label: "Proxy hops in front",
+    hint: 'Number of proxies (nginx = "1"). Leave empty when the panel is reachable directly — a wrong value lets a client forge its address.',
+    restart: true,
+  },
+  {
+    key: "public_domain",
+    type: "string",
+    default: "",
+    group: "server",
+    label: "Public domain",
+    hint: "Set by `levix domain`. When present it is the address the bot prints and the panel calls home.",
+  },
+  {
+    key: "bind_address",
+    type: "string",
+    default: "",
+    group: "server",
+    label: "Bind address",
+    hint: "Empty = every interface. `levix domain` sets 127.0.0.1 once a reverse proxy is in front, so nobody can reach the panel past the certificate.",
+    restart: true,
+  },
+  {
+    key: "dashboard_origin",
+    type: "string",
+    default: "",
+    group: "server",
+    label: "Extra allowed origin",
+    hint: "Only if you open the panel from a different domain, e.g. https://bot.example.com.",
+  },
+  {
+    key: "forward_score_ttl_days",
+    type: "int",
+    default: 30,
+    min: 1,
+    max: 365,
+    group: "server",
+    label: "Forward counters kept (days)",
+    hint: "How long the !score counters survive. They gain a row per forwarded message.",
+  },
+];
+
+const BY_KEY = new Map(SETTINGS.map((definition) => [definition.key, definition]));
+
+const GROUP_LABELS = {
+  general: "General",
+  ai: "AI",
+  integrations: "Integrations",
+  media: "Media",
+  server: "Server",
+};
+
+// This module is required by files that load before the database is opened in
+// a few edge paths (a command file pulled in by a script, say), so a read that
+// comes too early falls back to the default instead of throwing.
+function storedValue(key) {
+  try {
+    const value = require("../utils/storage.cjs").getBotSetting(
+      `setting:${key}`,
+      undefined
+    );
+    return value === undefined || value === null ? undefined : value;
+  } catch {
+    return undefined;
+  }
+}
+
+function coerce(definition, raw) {
+  switch (definition.type) {
+    case "int": {
+      const number = Number(raw);
+      if (!Number.isFinite(number)) return definition.default;
+      return Math.trunc(number);
+    }
+    case "bool": {
+      if (typeof raw === "boolean") return raw;
+      const text = String(raw).trim().toLowerCase();
+      if (["false", "off", "0", "no"].includes(text)) return false;
+      if (["true", "on", "1", "yes"].includes(text)) return true;
+      return definition.default;
+    }
+    default:
+      return String(raw);
+  }
+}
+
+/** The value in force for `key`: what the dashboard saved, else the default. */
+function get(key) {
+  const definition = BY_KEY.get(key);
+  if (!definition) throw new Error(`Unknown setting: ${key}`);
+
+  const stored = storedValue(key);
+  if (stored !== undefined && stored !== "") return coerce(definition, stored);
+
+  return definition.default;
+}
+
+/** Where the value in force came from — shown next to each field in the UI. */
+function sourceOf(key) {
+  const stored = storedValue(key);
+  return stored !== undefined && stored !== "" ? "dashboard" : "default";
+}
+
+function validate(definition, value) {
+  if (definition.type === "int") {
+    const number = Number(value);
+    if (!Number.isFinite(number)) throw new Error(`${definition.label} must be a number`);
+    if (definition.min !== undefined && number < definition.min) {
+      throw new Error(`${definition.label} must be ${definition.min} or more`);
+    }
+    if (definition.max !== undefined && number > definition.max) {
+      throw new Error(`${definition.label} must be ${definition.max} or less`);
+    }
+    return Math.trunc(number);
+  }
+
+  if (definition.type === "bool") return coerce(definition, value);
+
+  const text = String(value ?? "");
+  if (text.length > 500) throw new Error(`${definition.label} is too long`);
+  if (definition.key === "bot_timezone" && text) {
+    try {
+      new Intl.DateTimeFormat("en", { timeZone: text });
+    } catch {
+      throw new Error(`"${text}" is not a valid timezone`);
+    }
+  }
+  return text;
+}
+
+/**
+ * Save one setting. An empty string clears the override, so the value falls
+ * back to the default again.
+ * @throws {Error} on an unknown key or a value that fails validation.
+ */
+function set(key, value) {
+  const definition = BY_KEY.get(key);
+  if (!definition) throw new Error(`Unknown setting: ${key}`);
+
+  const storage = require("../utils/storage.cjs");
+
+  if (value === null || value === "" || value === undefined) {
+    storage.deleteBotSetting(`setting:${key}`);
+    logger.info(`[settings] ${key} cleared (back to the default)`);
+    return get(key);
+  }
+
+  const clean = validate(definition, value);
+  storage.saveBotSetting(`setting:${key}`, clean);
+  // Never log the value of a secret.
+  logger.info(
+    `[settings] ${key} -> ${definition.type === "secret" ? "(updated)" : clean}`
+  );
+  return get(key);
+}
+
+/**
+ * Everything the settings screen renders. Secrets report only whether they are
+ * configured and where they came from — the value itself never goes out.
+ */
+function describe() {
+  return SETTINGS.map((definition) => {
+    const base = {
+      key: definition.key,
+      type: definition.type,
+      group: definition.group,
+      groupLabel: GROUP_LABELS[definition.group] || definition.group,
+      label: definition.label,
+      hint: definition.hint || null,
+      min: definition.min ?? null,
+      max: definition.max ?? null,
+      restart: definition.restart === true,
+      source: sourceOf(definition.key),
+    };
+
+    if (definition.type === "secret") {
+      return { ...base, configured: !!get(definition.key), value: null };
+    }
+    return { ...base, value: get(definition.key), default: definition.default };
+  });
+}
+
+module.exports = { get, set, describe, sourceOf, SETTING_KEYS: [...BY_KEY.keys()] };

package/src/core/connection.js

@@ -0,0 +1,199 @@
+import { delay, DisconnectReason } from "@whiskeysockets/baileys";
+import qrcode from "qrcode-terminal";
+import { createRequire } from "module";
+import { MAX_RETRIES, RETRY_DELAY_MS } from "../config/constants.js";
+import { groupMetadataCache } from "./socket.js";
+import {
+  saveQrCode,
+  deleteQrCode,
+  saveUserMetadata,
+  getAllOwners,
+  getAllBotAdmins,
+} from "../utils/storage.esm.js";
+import {
+  bootstrapOwners,
+  bootstrapAdmins,
+} from "../utils/permissions.esm.js";
+
+const require = createRequire(import.meta.url);
+const logger = require("../utils/logger.cjs");
+const { primePermissions } = require("../utils/permissions.cjs");
+
+let retryCount = 0;
+
+// Handle connection updates
+export async function handleConnectionUpdate(
+  update,
+  sock,
+  clearAll,
+  io,
+  initializeScheduledJobs
+) {
+  const { connection, lastDisconnect, qr } = update;
+
+  if (qr) {
+    logger.info("Scan the QR code below:");
+    saveQrCode(qr);
+    io.emit("qr", qr);
+    io.emit("status_update", { status: "QR Code Received" });
+    qrcode.generate(qr, { small: true });
+  }
+
+  if (connection === "close") {
+    const statusCode = lastDisconnect?.error?.output?.statusCode;
+    const reason =
+      lastDisconnect?.error?.output?.payload?.error ||
+      lastDisconnect?.error?.message ||
+      "Unknown";
+
+    // Define which status codes should trigger reconnection
+    // 515: QR timeout, 500/503: Server errors, 404: Not found, etc.
+    const noReconnectCodes = [401, 403, DisconnectReason.loggedOut];
+    const shouldReconnect = !noReconnectCodes.includes(statusCode);
+
+    io.emit("status_update", { status: "Disconnected" });
+
+    // Log full disconnect info for debugging
+    logger.debug(
+      { lastDisconnect, statusCode, reason },
+      "[Connection] Disconnect details"
+    );
+
+    if (shouldReconnect && retryCount < MAX_RETRIES) {
+      retryCount++;
+      const delayMs = RETRY_DELAY_MS * retryCount; // Exponential backoff: 5s, 10s, 15s, 20s, 25s
+
+      // Special message for QR timeout
+      const messagePrefix =
+        statusCode === 515 ? "🔄 QR code expired" : "🔌 Connection closed";
+
+      logger.warn(
+        `${messagePrefix}. Reason: ${statusCode || reason}. Retrying in ${
+          delayMs / 1000
+        }s... (Attempt ${retryCount}/${MAX_RETRIES})`
+      );
+
+      await delay(delayMs);
+      return { shouldReconnect: true };
+    } else if (!shouldReconnect) {
+      if (statusCode === DisconnectReason.loggedOut) {
+        logger.error(
+          "❌ Connection closed permanently. Logged out. Clearing auth data from database."
+        );
+
+        // Clear authentication data from database
+        if (clearAll) {
+          await clearAll();
+          logger.info("[Auth] Authentication data cleared from database");
+        }
+
+        // Reset retry count and trigger reconnection for new QR
+        retryCount = 0;
+        return { shouldReconnect: true };
+      } else {
+        logger.error(
+          `❌ Connection closed with non-recoverable error: ${statusCode}. Not retrying.`
+        );
+      }
+    } else {
+      logger.error(`❌ Max retries (${MAX_RETRIES}) reached. Exiting.`);
+
+      process.exit(1);
+    }
+  } else if (connection === "open") {
+    logger.info("✅ Connection opened successfully!");
+    deleteQrCode();
+
+    retryCount = 0;
+    io.emit("status_update", { status: "Connected" });
+
+    // The paired account is always an owner — that's the whole bootstrap.
+    // Everyone else is granted from the dashboard (Roles) or with `!perm`, and
+    // is already a row in user_metadata by the time we get here.
+    await saveBotOwnerMetadata(sock);
+
+    const botPn = sock.user?.id
+      ? `${sock.user.id.split(":")[0].split("@")[0]}@s.whatsapp.net`
+      : null;
+    const botLid = sock.user?.lid
+      ? `${sock.user.lid.split(":")[0].split("@")[0]}@lid`
+      : null;
+
+    // Both rosters are seeded from the database so a permission check never
+    // has to hit it on the hot path.
+    const ownersRoster = [
+      botPn,
+      botLid,
+      ...getAllOwners().flatMap((user) => [user.jid, user.lid]),
+    ].filter(Boolean);
+    const adminsRoster = getAllBotAdmins()
+      .flatMap((user) => [user.jid, user.lid])
+      .filter(Boolean);
+
+    bootstrapOwners(ownersRoster);
+    bootstrapAdmins(adminsRoster);
+
+    await primePermissions();
+    logger.info(
+      `[Permissions] Owner roster: ${ownersRoster.length} entries; ` +
+        `admin roster: ${adminsRoster.length} entries`
+    );
+
+    // Initialize scheduled jobs
+    initializeScheduledJobs(sock);
+
+    // Cache all groups
+    await cacheAllGroups(sock);
+  }
+
+  return { shouldReconnect: false };
+}
+
+// Record the paired WhatsApp account as the bot's first owner. Whoever scanned
+// the QR owns the bot — there is no owner list to configure anywhere.
+async function saveBotOwnerMetadata(sock) {
+  try {
+    logger.info("[User Metadata] Saving bot owner metadata...");
+
+    const phoneNumber = sock.user?.id?.split(":")[0]?.split("@")[0];
+    const userJid = phoneNumber ? `${phoneNumber}@s.whatsapp.net` : null;
+    const userLid = sock.user?.lid
+      ? `${sock.user.lid.split(":")[0].split("@")[0]}@lid`
+      : null;
+    const displayName = sock.user?.name || sock.user?.verifiedName || null;
+
+    if (userJid) {
+      saveUserMetadata({
+        jid: userJid,
+        lid: userLid,
+        phone: phoneNumber,
+        isOwner: true,
+        displayName,
+      });
+      logger.info(
+        `[User Metadata] Saved bot owner: ${phoneNumber} (JID: ${userJid}, LID: ${userLid})`
+      );
+    }
+  } catch (err) {
+    logger.error({ err }, "[Error] Failed to save bot owner metadata");
+  }
+}
+
+// Cache all group metadata
+async function cacheAllGroups(sock) {
+  logger.info("[Cache] Fetching and caching metadata for all groups...");
+
+  try {
+    const groups = await sock.groupFetchAllParticipating();
+    let cachedCount = 0;
+
+    for (const jid in groups) {
+      groupMetadataCache.set(jid, groups[jid]);
+      cachedCount++;
+    }
+
+    logger.info(`[Cache] Successfully cached ${cachedCount} groups.`);
+  } catch (err) {
+    logger.error("[Error] Failed to fetch and cache groups:", err);
+  }
+}

package/src/core/events.js

@@ -0,0 +1,61 @@
+import { createRequire } from 'module';
+import { handleConnectionUpdate } from './connection.js';
+import { handleIncomingMessage } from '../handlers/message.handler.js';
+import { handleGroupParticipantsUpdate, handleGroupJoinRequests } from '../handlers/group.handler.js';
+import { groupMetadataCache } from './socket.js';
+import { storeLidPnMapping, storeLidPnMappings } from '../utils/storage.esm.js';
+
+const require = createRequire(import.meta.url);
+const logger = require('../utils/logger.cjs');
+
+// Setup all event listeners for WhatsApp socket
+export function setupEventListeners(sock, saveCreds, clearAll, io, initializeScheduledJobs, reconnectCallback) {
+  // Connection updates
+  sock.ev.on('connection.update', async (update) => {
+    const result = await handleConnectionUpdate(update, sock, clearAll, io, initializeScheduledJobs);
+    if (result?.shouldReconnect && reconnectCallback) {
+      // Trigger reconnection
+      await reconnectCallback();
+    }
+  });
+
+  // Save credentials
+  sock.ev.on('creds.update', saveCreds);
+
+  // V7: LID mapping updates
+  sock.ev.on('lid-mapping.update', (updates) => {
+    logger.info(`[LID] Received ${Object.keys(updates).length} LID mapping updates`);
+    const mappings = [];
+    for (const [lid, pn] of Object.entries(updates)) {
+      if (lid && pn) {
+        mappings.push({ lid, pn, deviceIndex: 0 });
+      }
+    }
+    if (mappings.length > 0) {
+      storeLidPnMappings(mappings);
+    }
+  });
+
+  // Group metadata updates
+  sock.ev.on('groups.upsert', (updates) => {
+    for (const group of updates) {
+      logger.info(`[Cache] Caching metadata for group: ${group.id}`);
+      groupMetadataCache.set(group.id, group);
+    }
+  });
+
+  // Incoming messages
+  sock.ev.on('messages.upsert', async (m) => {
+    await handleIncomingMessage(sock, m);
+  });
+
+  // Group participant updates
+  sock.ev.on('group-participants.update', async (update) => {
+    await handleGroupParticipantsUpdate(sock, update);
+  });
+
+  // Group join requests
+  sock.ev.on('group-requests.update', async (events) => {
+    await handleGroupJoinRequests(sock, events);
+  });
+}

package/src/core/socket.js

@@ -0,0 +1,64 @@
+import { makeWASocket } from '@whiskeysockets/baileys';
+import NodeCache from 'node-cache';
+import {
+  getBaileysConfig,
+  setRecentMessageGetter,
+} from '../config/baileys.config.js';
+import { CACHE_CONFIG } from '../config/constants.js';
+import { useDatabaseAuthState } from '../auth/use-database-auth-state.js';
+import { getMessageFromRecent } from '../utils/recentMessageCache.esm.js';
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
+const logger = require('../utils/logger.cjs');
+const { withMediaThumbnail } = require('../utils/thumbnail.cjs');
+
+// Group metadata cache
+export const groupMetadataCache = new NodeCache(CACHE_CONFIG);
+
+// Wire the recent-message cache into Baileys' getMessage hook so retries can
+// recover (rc10 enableAutoSessionRecreation needs this).
+setRecentMessageGetter(getMessageFromRecent);
+
+/**
+ * Baileys can't generate media previews in this install (no sharp/jimp, and its
+ * video path shells out to a bare `ffmpeg` that isn't on the PATH), so every
+ * image/video we sent went out with a blank thumbnail. Patch sendMessage once,
+ * at the socket level, so EVERY caller gets a preview — commands that use
+ * sendBotMessage and the handful of legacy commands still calling
+ * sock.sendMessage directly.
+ */
+function withThumbnailSupport(sock) {
+  const original = sock.sendMessage.bind(sock);
+
+  sock.sendMessage = async function sendMessageWithThumbnail(jid, content, options) {
+    let payload = content;
+    try {
+      payload = await withMediaThumbnail(content);
+    } catch (err) {
+      logger.debug({ err: err?.message }, '[Socket] thumbnail step skipped');
+      payload = content;
+    }
+    return original(jid, payload, options);
+  };
+
+  return sock;
+}
+
+// Create and configure WhatsApp socket
+export async function createWhatsAppSocket() {
+  logger.info('[Socket] Initializing WhatsApp socket with database auth');
+
+  const { state, saveCreds, clearAll } = await useDatabaseAuthState();
+
+  const cachedGroupMetadata = (jid) => groupMetadataCache.get(jid);
+
+  const sock = withThumbnailSupport(
+    makeWASocket({
+      auth: state,
+      ...getBaileysConfig(cachedGroupMetadata),
+    })
+  );
+
+  return { sock, saveCreds, clearAll };
+}