levix-bot 2.0.0

package/src/domain/nginx.js

@@ -0,0 +1,138 @@
+// Adding one nginx site, and nothing else.
+//
+// The safety contract, in order:
+//
+//   1. write only a file named after Levix, in the directory this distro uses
+//   2. enable it the way this distro enables sites
+//   3. `nginx -t` — the whole configuration, not just ours
+//   4. if that fails: put back exactly what was there, print nginx's own words,
+//      do NOT reload
+//   5. only then reload (never restart: a restart drops every live connection
+//      on a server that may be serving somebody else's site)
+//
+// Running it twice with the same domain rewrites the same file. No timestamped
+// piles of backups, no second server block.
+
+import { nginxSitePath } from "./detect.js";
+
+/** The site itself. WebSocket upgrade included — socket.io needs it. */
+export function renderSite({ domain, port }) {
+  return `# Managed by Levix. Rewritten by \`levix domain ${domain}\`.
+# Delete this file to remove the site; nothing else here is Levix's.
+server {
+    listen 80;
+    listen [::]:80;
+    server_name ${domain};
+
+    location / {
+        proxy_pass http://127.0.0.1:${port};
+
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # The control panel pushes the pairing QR over socket.io.
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        # A QR can sit open for a while before it is scanned.
+        proxy_read_timeout 300s;
+    }
+}
+`;
+}
+
+/**
+ * Write, validate, and only then reload.
+ *
+ * @returns {{ ok: boolean, path: string, error?: string, reloaded: boolean }}
+ */
+export function applySite(system, { domain, port }) {
+  const path = nginxSitePath(domain, system);
+  const usesSitesAvailable = path.includes("/sites-available/");
+  const enabledPath = usesSitesAvailable
+    ? path.replace("/sites-available/", "/sites-enabled/")
+    : null;
+
+  // What was there before, so a failed `nginx -t` can be undone precisely.
+  const existed = system.exists(path);
+  const previous = existed ? system.readFile(path) : null;
+
+  const restore = () => {
+    if (existed) system.writeFile(path, previous);
+    else {
+      system.remove(path);
+      if (enabledPath) system.remove(enabledPath);
+    }
+  };
+
+  system.writeFile(path, renderSite({ domain, port }));
+  if (enabledPath) system.symlink(path, enabledPath);
+
+  const test = system.run("nginx", ["-t"]);
+  if (test.status !== 0) {
+    restore();
+    return {
+      ok: false,
+      path,
+      reloaded: false,
+      // nginx's own message names the file and the line. Ours would not.
+      error: (test.stderr || test.stdout || "nginx -t failed").trim(),
+    };
+  }
+
+  const reload = system.run("systemctl", ["reload", "nginx"]);
+  if (reload.status !== 0) {
+    // The configuration is valid, so leave it in place — but say plainly that
+    // it is not live yet.
+    return {
+      ok: false,
+      path,
+      reloaded: false,
+      error: `configuration is valid but nginx did not reload: ${(reload.stderr || "").trim()}`,
+    };
+  }
+
+  return { ok: true, path, reloaded: true };
+}
+
+/**
+ * Ask certbot for a certificate, if there isn't already a live one.
+ *
+ * @returns {{ ok: boolean, skipped?: string, error?: string }}
+ */
+export function ensureCertificate(system, { domain, email = null }) {
+  if (hasCertificate(system, domain)) {
+    return { ok: true, skipped: "a certificate for this domain already exists" };
+  }
+
+  const args = [
+    "--nginx",
+    "-d",
+    domain,
+    "--non-interactive",
+    "--agree-tos",
+    "--redirect",
+    ...(email ? ["-m", email] : ["--register-unsafely-without-email"]),
+  ];
+
+  const result = system.run("certbot", args, { timeoutMs: 180000 });
+  if (result.status !== 0) {
+    return { ok: false, error: (result.stderr || result.stdout || "certbot failed").trim() };
+  }
+  return { ok: true };
+}
+
+/** Is there already a certificate covering this domain? */
+export function hasCertificate(system, domain) {
+  if (system.exists(`/etc/letsencrypt/live/${domain}/fullchain.pem`)) return true;
+
+  // A certificate can live under a different lineage name while still covering
+  // the domain; certbot knows.
+  const listed = system.run("certbot", ["certificates"]);
+  if (listed.status !== 0) return false;
+  return new RegExp(`Domains:.*\\b${domain.replace(/\./g, "\\.")}\\b`).test(listed.stdout);
+}

package/src/domain/system.js

@@ -0,0 +1,148 @@
+// Everything the domain command needs from the machine it's running on,
+// behind one small interface.
+//
+// Two reasons it exists rather than calling child_process directly:
+//
+//   1. this code runs as root on servers with unrelated production sites on
+//      them, so every command it would run has to be visible in one place
+//   2. the tests must be able to describe a server — "nginx and certbot, port
+//      443 held by apache" — without that server existing
+//
+// The default implementation is the real one. Tests pass their own.
+
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import dns from "node:dns/promises";
+
+/**
+ * @typedef {object} System
+ * @property {(cmd: string, args?: string[], opts?: object) => {status: number, stdout: string, stderr: string}} run
+ * @property {(path: string) => boolean} exists
+ * @property {(path: string) => string} readFile
+ * @property {(path: string, content: string) => void} writeFile
+ * @property {(path: string) => void} mkdirp
+ * @property {(path: string) => void} remove
+ * @property {(from: string, to: string) => void} symlink
+ * @property {(command: string) => boolean} which
+ * @property {() => Array<{port: number, process: string}>} listeners
+ * @property {(hostname: string) => Promise<{v4: string[], v6: string[]}>} resolve
+ * @property {() => Promise<{v4: string|null, v6: string|null}>} publicIp
+ */
+
+export function createSystem(overrides = {}) {
+  const real = {
+    run(command, args = [], options = {}) {
+      const result = spawnSync(command, args, {
+        encoding: "utf8",
+        timeout: options.timeoutMs ?? 120000,
+        ...options,
+      });
+      return {
+        status: result.status ?? 1,
+        stdout: result.stdout || "",
+        stderr: result.stderr || (result.error ? String(result.error.message) : ""),
+      };
+    },
+
+    exists: (path) => fs.existsSync(path),
+    readFile: (path) => fs.readFileSync(path, "utf8"),
+
+    writeFile(path, content) {
+      fs.writeFileSync(path, content, "utf8");
+    },
+
+    mkdirp(path) {
+      fs.mkdirSync(path, { recursive: true });
+    },
+
+    remove(path) {
+      fs.rmSync(path, { force: true });
+    },
+
+    symlink(from, to) {
+      try {
+        fs.unlinkSync(to);
+      } catch {}
+      fs.symlinkSync(from, to);
+    },
+
+    which(command) {
+      const result = spawnSync("sh", ["-c", `command -v ${command}`], { encoding: "utf8" });
+      return (result.status ?? 1) === 0 && Boolean((result.stdout || "").trim());
+    },
+
+    /** What is listening on 80 and 443, and which program owns it. */
+    listeners() {
+      // `ss` on anything modern; `netstat` for the stragglers. Both need the
+      // process column, which needs root — without it we still learn that the
+      // port is taken, just not by whom, and the command treats an unknown
+      // owner as a reason to stop rather than guess.
+      const attempts = [
+        ["ss", ["-ltnpH"]],
+        ["netstat", ["-ltnp"]],
+      ];
+
+      for (const [command, args] of attempts) {
+        const result = spawnSync(command, args, { encoding: "utf8" });
+        if ((result.status ?? 1) !== 0 || !result.stdout) continue;
+        return parseListeners(result.stdout);
+      }
+      return [];
+    },
+
+    async resolve(hostname) {
+      const out = { v4: [], v6: [] };
+      try {
+        out.v4 = await dns.resolve4(hostname);
+      } catch {}
+      try {
+        out.v6 = await dns.resolve6(hostname);
+      } catch {}
+      return out;
+    },
+
+    async publicIp() {
+      const out = { v4: null, v6: null };
+      // One short call to a plain-text endpoint. If there is no network, or it
+      // is slow, we carry on without it: the DNS check just becomes advisory.
+      try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 4000);
+        const response = await fetch("https://api.ipify.org", { signal: controller.signal });
+        clearTimeout(timer);
+        if (response.ok) out.v4 = (await response.text()).trim() || null;
+      } catch {}
+      return out;
+    },
+  };
+
+  return { ...real, ...overrides };
+}
+
+/** Pull `{ port, process }` out of ss/netstat output. Exported to be tested. */
+export function parseListeners(output) {
+  const found = [];
+  for (const rawLine of output.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || /^(Netid|Proto|Active)/i.test(line)) continue;
+
+    // The local address column is the 4th on ss -ltnpH and netstat -ltnp.
+    const columns = line.split(/\s+/);
+    const local = columns.find((column) => /:\d+$/.test(column));
+    if (!local) continue;
+
+    const port = Number(local.slice(local.lastIndexOf(":") + 1));
+    if (!Number.isFinite(port)) continue;
+
+    // users:(("nginx",pid=123,fd=6))  |  123/nginx: master
+    const owner =
+      /users:\(\("([^"]+)"/.exec(line)?.[1] ||
+      /\d+\/([\w.-]+)/.exec(line)?.[1] ||
+      null;
+
+    found.push({ port, process: owner });
+  }
+  return found;
+}
+
+export default createSystem;

package/src/handlers/command.handler.js

@@ -0,0 +1,414 @@
+import { readdirSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+import { createRequire } from "module";
+import {
+  checkCommandPermission,
+  checkBotAdmin,
+} from "../middleware/permissions.middleware.js";
+import { sendBotMessage } from "../utils/sendBotMessage.esm.js";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const require = createRequire(import.meta.url);
+const logger = require("../utils/logger.cjs");
+const runtimeConfig = require("../config/runtime-config.cjs");
+
+// Commands collection (keyed by both names and aliases)
+const commands = new Map();
+// Track aliases separately so help.cjs can group them.
+const aliasIndex = new Map(); // alias -> canonicalName
+// Public reverse view exposed for help command listing
+const commandList = new Map(); // canonicalName -> command module
+
+// Commands whose output should stay a SEPARATE message (these answer a
+// question, generate content, or take free-form variables — editing the
+// trigger into the answer would read badly). Everything else gets the
+// "edit the original command message in place" behaviour requested by the
+// operator (e.g. `!group all hello` rewrites the trigger into the announcement
+// instead of posting a second message).
+const EDIT_IN_PLACE_EXCLUDE = new Set([
+  "gemini",
+  "prayer",
+  "tts",
+  "stt",
+  "weather",
+  "qr",
+  "status",
+  "help",
+  "ping",
+  "shortlink",
+  "score",
+  "debt",
+  "todo",
+  "notes",
+  "listschedules",
+  "mod",
+  "calc",
+  "loop",
+  "rand",
+  "poll",
+]);
+
+// Wrap a socket so commands reply nicely:
+//   * `editInPlace` commands: the FIRST plain-text send to the command's own
+//     chat edits the original command message (only possible when the message
+//     is from us — `fromMe`). Falls back to a normal send if the edit fails or
+//     isn't allowed. Subsequent sends behave normally.
+//   * everything else: `sock.sendMessage(jid, content)` automatically adds
+//     `quoted: msg` so the reply threads under the command.
+// Every other method (groupMetadata, etc.) is forwarded untouched.
+function wrapSockWithReply(sock, originalMsg, editInPlace = false) {
+  const chatJid = originalMsg.key.remoteJid;
+  let editUsed = false;
+
+  return new Proxy(sock, {
+    get(target, prop, receiver) {
+      if (prop === "sendMessage") {
+        return async function (jid, content, options) {
+          // Try to edit the trigger message in place for the first eligible
+          // text reply. We can only edit messages we sent ourselves.
+          const eligibleForEdit =
+            editInPlace &&
+            !editUsed &&
+            originalMsg.key.fromMe &&
+            jid === chatJid &&
+            content &&
+            typeof content === "object" &&
+            typeof content.text === "string" &&
+            !content.edit;
+
+          if (eligibleForEdit) {
+            editUsed = true;
+            try {
+              return await target.sendMessage.call(target, jid, {
+                ...content,
+                edit: originalMsg.key,
+              });
+            } catch {
+              // Editing failed (too old, not ours after all, …) — fall through
+              // to a normal quoted send so the user still gets a reply.
+            }
+          }
+
+          const opts = options ? { ...options } : {};
+          if (opts.quoted === undefined) {
+            opts.quoted = originalMsg;
+          }
+          return target.sendMessage.call(target, jid, content, opts);
+        };
+      }
+      const value = Reflect.get(target, prop, receiver);
+      return typeof value === "function" ? value.bind(target) : value;
+    },
+  });
+}
+
+/**
+ * Point every alias of `command` at it. The effective list is the dashboard
+ * override when there is one, otherwise what the command file declared.
+ */
+function indexAliases(command) {
+  const aliases = runtimeConfig.getAliases(
+    command.name,
+    command.__declaredAliases || []
+  );
+
+  for (const alias of aliases) {
+    const existing = commands.get(alias);
+    if (existing && existing.name !== command.name) {
+      logger.warn(
+        `[Commands] Alias conflict: ${alias} already maps to ${existing.name}, ignoring for ${command.name}`
+      );
+      continue;
+    }
+    commands.set(alias, command);
+    aliasIndex.set(alias, command.name);
+  }
+}
+
+/**
+ * Rebuild the name/alias lookup from the loaded commands. Call this after an
+ * alias override changes so the new trigger works on the next message instead
+ * of after a restart.
+ */
+export function rebuildCommandIndex() {
+  commands.clear();
+  aliasIndex.clear();
+  for (const command of commandList.values()) {
+    commands.set(command.name, command);
+  }
+  for (const command of commandList.values()) {
+    indexAliases(command);
+  }
+  logger.info(
+    `[Commands] Index rebuilt: ${commandList.size} commands, ${commands.size} entries`
+  );
+}
+
+/**
+ * Everything the dashboard needs to render (and edit) the command list.
+ *
+ * `permissionLocked` marks the commands whose level can't be lowered from the
+ * UI: they declare `userAdminRequired`, i.e. the code demands a real WhatsApp
+ * group admin no matter what the permission table says, so offering a
+ * "MEMBERS" switch for them would just be a lie.
+ */
+export function getCommandCatalog() {
+  const out = [];
+
+  for (const command of commandList.values()) {
+    const isGroupSub = command.__category === "group";
+    const key = isGroupSub ? `group:${command.name}` : command.name;
+
+    out.push({
+      name: command.name,
+      key,
+      category: command.__category || "general",
+      description: command.description || "",
+      usage: command.usage || null,
+      chat: command.chat || "all",
+      declaredAliases: command.__declaredAliases || [],
+      aliases: runtimeConfig.getAliases(command.name, command.__declaredAliases || []),
+      aliasesOverridden: runtimeConfig.hasAliasOverride(command.name),
+      permission: runtimeConfig.getPermission(key),
+      defaultPermission: runtimeConfig.defaultPermission(key),
+      permissionLocked: !!command.userAdminRequired,
+      userAdminRequired: !!command.userAdminRequired,
+      botAdminRequired: !!command.botAdminRequired,
+      enabled: !runtimeConfig.isDisabled(command.name),
+    });
+  }
+
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+// Load all command files (CommonJS .cjs files)
+export async function loadCommands() {
+  // A packaged build has no commands/ directory to scan — the build step writes
+  // a manifest that requires every command by name instead. When there is no
+  // manifest (a normal install) we read the directory, so dropping a new .cjs
+  // in there still Just Works.
+  const manifest = loadManifest();
+
+  if (manifest) {
+    for (const entry of manifest) {
+      registerCommand(entry.module, entry.label, entry.category);
+    }
+  } else {
+    const commandsPath = join(__dirname, "../commands");
+    for (const entry of readdirSync(commandsPath, { withFileTypes: true })) {
+      if (entry.isDirectory()) {
+        // Load commands from subdirectories (e.g., group/)
+        const subDirPath = join(commandsPath, entry.name);
+        const subFiles = readdirSync(subDirPath).filter((file) =>
+          file.endsWith(".cjs")
+        );
+
+        for (const file of subFiles) {
+          registerCommandFile(join(subDirPath, file), entry.name);
+        }
+      } else if (entry.name.endsWith(".cjs")) {
+        registerCommandFile(join(commandsPath, entry.name), null);
+      }
+    }
+  }
+
+  logger.info(
+    `[Commands] Loaded ${commandList.size} commands (${commands.size} entries with aliases)`
+  );
+}
+
+function loadManifest() {
+  try {
+    const manifest = require("../commands/_manifest.cjs");
+    return Array.isArray(manifest) ? manifest : null;
+  } catch (error) {
+    // MODULE_NOT_FOUND is the normal case: there is no manifest outside a
+    // packaged build. Anything else means the manifest exists and is broken,
+    // which is worth saying out loud before we fall back.
+    if (error?.code !== "MODULE_NOT_FOUND") {
+      logger.error({ err: error }, "[Commands] manifest failed to load");
+    }
+    return null;
+  }
+}
+
+function registerCommandFile(absPath, category) {
+  let command;
+  try {
+    command = require(absPath);
+  } catch (error) {
+    logger.error({ err: error, file: absPath }, "[Commands] failed to load");
+    return;
+  }
+  registerCommand(command, absPath, category);
+}
+
+function registerCommand(command, label, category) {
+  try {
+    if (!command?.name) return;
+
+    command.__category = category || "general";
+    // What the FILE declares, kept aside so a dashboard override can be
+    // cleared back to it later (command.aliases itself is what we index).
+    command.__declaredAliases = Array.isArray(command.aliases)
+      ? [...command.aliases]
+      : [];
+    commands.set(command.name, command);
+    commandList.set(command.name, command);
+    logger.info(
+      `[Commands] Loaded command: ${command.name}${category ? ` (from ${category}/)` : ""}`
+    );
+
+    indexAliases(command);
+  } catch (error) {
+    logger.error(`[Commands] Failed to load ${label}: ${error.message}`);
+    if (error.stack) logger.error(error.stack);
+  }
+}
+
+export function getLoadedCommands() {
+  return commandList;
+}
+
+export function getAliasIndex() {
+  return aliasIndex;
+}
+
+// Handle command execution
+export async function handleCommand(sock, msg, body) {
+  const isGroup = msg.key.remoteJid.endsWith("@g.us");
+
+  const prefix = runtimeConfig.getPrefix();
+  if (!body.startsWith(prefix)) return false;
+
+  const args = body.slice(prefix.length).trim().split(/ +/);
+  const invokedName = args.shift().toLowerCase();
+  const command = commands.get(invokedName);
+  if (!command) return false;
+
+  // Turned off from the dashboard. Answered rather than ignored so the user
+  // knows the command exists and isn't broken.
+  if (runtimeConfig.isDisabled(command.name)) {
+    await sendBotMessage(
+      sock,
+      msg.key.remoteJid,
+      { text: "⛔ الأمر ده متوقف حاليًا." },
+      { replyTo: msg }
+    );
+    return true;
+  }
+
+  try {
+    const groupMetadata = isGroup
+      ? await sock.groupMetadata(msg.key.remoteJid).catch(() => null)
+      : null;
+
+    if (command.name !== "group") {
+      // Enforce the `chat` constraint declared by the command. Until now this
+      // was advisory-only and group-only commands could happily run in DMs.
+      const chatScope = (command.chat || "all").toLowerCase();
+      if (chatScope === "group" && !isGroup) {
+        await sendBotMessage(
+          sock,
+          msg.key.remoteJid,
+          { text: "⚠️ هذا الأمر يعمل في المجموعات فقط." },
+          { replyTo: msg }
+        );
+        return true;
+      }
+      if (chatScope === "private" && isGroup) {
+        await sendBotMessage(
+          sock,
+          msg.key.remoteJid,
+          { text: "⚠️ هذا الأمر يعمل في المحادثات الخاصة فقط." },
+          { replyTo: msg }
+        );
+        return true;
+      }
+
+      // Group sub-commands are keyed "group:<name>" everywhere — defaults.cjs,
+      // the dashboard, and `!group kick`. Use the same key here so running
+      // `!kick` directly is gated exactly like running `!group kick`.
+      const permissionKey =
+        command.__category === "group" ? `group:${command.name}` : command.name;
+
+      const permissionCheck = checkCommandPermission(
+        permissionKey,
+        msg,
+        groupMetadata,
+        sock
+      );
+
+      if (!permissionCheck.hasPermission) {
+        await sendBotMessage(
+          sock,
+          msg.key.remoteJid,
+          { text: permissionCheck.reason },
+          { replyTo: msg }
+        );
+        return true;
+      }
+
+      if (command.userAdminRequired && !permissionCheck.isSenderAdmin) {
+        await sendBotMessage(
+          sock,
+          msg.key.remoteJid,
+          { text: "⚠️ هذا الأمر يتطلب أن تكون مشرفًا." },
+          { replyTo: msg }
+        );
+        return true;
+      }
+
+      if (command.botAdminRequired && !checkBotAdmin(groupMetadata, sock)) {
+        await sendBotMessage(
+          sock,
+          msg.key.remoteJid,
+          { text: "⚠️ يجب أن أكون مشرفًا لتنفيذ هذا الأمر." },
+          { replyTo: msg }
+        );
+        return true;
+      }
+    }
+
+    // Pass the invoked name + canonical name so commands like gemini can
+    // detect alias-driven sub-commands (`!del`, `!resetai`, `!generate`).
+    const ctx = {
+      invokedName,
+      canonicalName: command.name,
+      isAlias: invokedName !== command.name,
+      groupMetadata,
+    };
+
+    // Wrap the socket so legacy commands that still call sock.sendMessage
+    // directly automatically reply-quote the original command message. This
+    // matches the operator's "every bot message should reply to the command"
+    // requirement without having to migrate every single .cjs file at once.
+    // Action/confirmation commands additionally edit the trigger message in
+    // place instead of posting a second message (see EDIT_IN_PLACE_EXCLUDE).
+    const editInPlace = !EDIT_IN_PLACE_EXCLUDE.has(command.name);
+    const proxiedSock = wrapSockWithReply(sock, msg, editInPlace);
+    await command.execute(proxiedSock, msg, args, body, groupMetadata, ctx);
+    return true;
+  } catch (error) {
+    logger.error(
+      { err: error, command: invokedName },
+      "Error executing command"
+    );
+    // Surface the error name to the user instead of silently re-throwing.
+    try {
+      await sendBotMessage(
+        sock,
+        msg.key.remoteJid,
+        {
+          text: `❌ *فشل تنفيذ الأمر*\n\n*النوع:* \`${error.name || "Error"}\`\n*التفاصيل:* ${
+            error.message || "غير معروف"
+          }`,
+        },
+        { replyTo: msg }
+      );
+    } catch {}
+    throw error;
+  }
+}