levix-bot 3.3.0-rc.2 → 4.0.0

package/src/routes/dashboard.api.esm.js

@@ -12,34 +12,33 @@
 //     src/config/ai-identity.cjs, which this file does not import and no route
 //     below returns. Neither is an editable field anywhere in the panel.
 
-import { Router } from "express";
-import { createRequire } from "module";
 import fs from "node:fs";
 import path from "node:path";
-
+import { Router } from "express";
+import { createRequire } from "module";
+import { groupMetadataCache } from "../core/socket.js";
+import { getCommandCatalog, rebuildCommandIndex } from "../handlers/command.handler.js";
+import { grantRole, listRoles, revokeRole } from "../utils/permissions.esm.js";
 import {
+  countDebts,
   countGroups,
-  countWarnings,
-  countTodos,
   countNotes,
-  countDebts,
+  countSchedules,
+  countTodos,
+  countWarnings,
+  getAllGroupDirectory,
   getAllGroupSettings,
-  getGroupSettings,
-  saveGroupSettings,
   getAllNotesFlat,
-  getAllWarnings,
   getAllTodos,
   getAllUsers,
+  getAllWarnings,
+  describePeer,
+  getGroupDirectory,
+  getGroupSettings,
   getRecentDebts,
-  countSchedules,
   getSchedules,
+  saveGroupSettings,
 } from "../utils/storage.esm.js";
-import {
-  getCommandCatalog,
-  rebuildCommandIndex,
-} from "../handlers/command.handler.js";
-import { groupMetadataCache } from "../core/socket.js";
-import { grantRole, revokeRole, listRoles } from "../utils/permissions.esm.js";
 
 const require = createRequire(import.meta.url);
 const logger = require("../utils/logger.cjs");
@@ -47,13 +46,25 @@ const runtimeConfig = require("../config/runtime-config.cjs");
 const settings = require("../config/settings.cjs");
 const memory = require("../utils/memory.cjs");
 const secrets = require("../config/secrets.cjs");
+const { clientAddress } = require("../utils/requestOrigin.cjs");
+const { blockedFor, recordFailure, clearAttempts } = require("../panel/login-throttle.cjs");
+const { stampPanelSession } = require("../panel/session-auth.cjs");
 const { DATA_DIR } = require("../config/paths.cjs");
+const { PERSONA_FILE, activeProviderKeySetting } = require("../services/aiAgent.cjs");
 const {
-  PERSONA_FILE,
-  activeProviderKeySetting,
-} = require("../services/aiAgent.cjs");
-const { deleteScheduledJob, retryScheduledJob } = require("../../scheduler.cjs");
+  deleteScheduledJob,
+  retryScheduledJob,
+  scheduleNewJob,
+  saveScheduledJob,
+} = require("../../scheduler.cjs");
 const { describeScheduledJob } = require("../utils/recurrence.cjs");
+const { discoverProviderModels, DiscoveryError } = require("../services/llmDiscovery.cjs");
+const {
+  invalidateDiscoveryCache,
+  applyCapabilityGuards,
+  resolveCapabilities,
+} = require("../services/modelRegistry.cjs");
+const cron = require("node-cron");
 
 const router = Router();
 
@@ -61,9 +72,16 @@ const router = Router();
 // it questions and give it orders; they never create or destroy a socket
 // themselves, and nothing a browser does to its websocket reaches it.
 let session = null;
+const DASHBOARD_START_COALESCE_MS = 500;
+let dashboardStartPromise = null;
+let dashboardStartSettledAt = 0;
+let dashboardStartKey = null;
 
 export function setSession(manager) {
   session = manager;
+  dashboardStartPromise = null;
+  dashboardStartSettledAt = 0;
+  dashboardStartKey = null;
 }
 
 /** The live socket, or null. Re-read every time — a reconnect replaces it. */
@@ -112,7 +130,7 @@ function badRequest(res, message) {
 function asyncRoute(handler) {
   return (req, res) => {
     Promise.resolve(handler(req, res)).catch((error) =>
-      fail(res, error, `${req.method} ${req.path} failed`)
+      fail(res, error, `${req.method} ${req.path} failed`),
     );
   };
 }
@@ -208,7 +226,7 @@ router.patch("/commands/:name", (req, res) => {
       if (command.permissionLocked) {
         return badRequest(
           res,
-          "This command always requires a WhatsApp group admin, so its permission is fixed."
+          "This command always requires a WhatsApp group admin, so its permission is fixed.",
         );
       }
       runtimeConfig.setPermission(command.key, permission || null);
@@ -229,12 +247,11 @@ router.patch("/commands/:name", (req, res) => {
           for (const alias of entry.aliases) taken.set(alias, entry.name);
         }
         for (const raw of aliases) {
-          const alias = String(raw ?? "").trim().toLowerCase();
+          const alias = String(raw ?? "")
+            .trim()
+            .toLowerCase();
           if (taken.has(alias)) {
-            return badRequest(
-              res,
-              `"${alias}" is already used by !${taken.get(alias)}`
-            );
+            return badRequest(res, `"${alias}" is already used by !${taken.get(alias)}`);
           }
         }
       }
@@ -253,9 +270,7 @@ router.patch("/commands/:name", (req, res) => {
   // Make the new triggers live now rather than after a restart.
   if (indexNeedsRebuild) rebuildCommandIndex();
 
-  const updated = getCommandCatalog().find(
-    (entry) => entry.name === command.name
-  );
+  const updated = getCommandCatalog().find((entry) => entry.name === command.name);
   res.json({ success: true, command: updated });
 });
 
@@ -276,7 +291,8 @@ router.get("/settings", (req, res) => {
 });
 
 router.patch("/settings", (req, res) => {
-  const { key, value } = req.body || {};
+  const { key } = req.body || {};
+  let { value } = req.body || {};
   if (typeof key !== "string" || !key) return badRequest(res, "key is required");
 
   try {
@@ -285,7 +301,63 @@ router.patch("/settings", (req, res) => {
       return res.json({ success: true, prefix });
     }
 
+    if (key === "ai_vision_enabled" || key === "ai_stt_enabled") {
+      const provider = String(settings.get("ai_provider") || "gemini");
+      const modelKey =
+        provider === "gemini"
+          ? "gemini_model"
+          : provider === "anthropic"
+            ? "anthropic_model"
+            : "openai_model";
+      const resolved = resolveCapabilities(provider, settings.get(modelKey));
+      const next = applyCapabilityGuards({
+        visionEnabled: key === "ai_vision_enabled" ? value : settings.get("ai_vision_enabled"),
+        sttEnabled: key === "ai_stt_enabled" ? value : settings.get("ai_stt_enabled"),
+        capabilities: resolved.capabilities,
+      });
+      if (key === "ai_vision_enabled") value = next.visionEnabled;
+      if (key === "ai_stt_enabled") value = next.sttEnabled;
+    }
+
     settings.set(key, value);
+    if (typeof key === "string" && (key.includes("api_key") || key.includes("base_url"))) {
+      const prov = key.startsWith("gemini")
+        ? "gemini"
+        : key.startsWith("anthropic")
+          ? "anthropic"
+          : key.startsWith("openai")
+            ? "openai"
+            : null;
+      if (prov) invalidateDiscoveryCache(prov);
+      else invalidateDiscoveryCache();
+    }
+    if (
+      key === "ai_provider" ||
+      key === "gemini_model" ||
+      key === "openai_model" ||
+      key === "anthropic_model"
+    ) {
+      const provider = key === "ai_provider" ? String(value || "gemini") : key.split("_")[0];
+      const modelKey =
+        provider === "gemini"
+          ? "gemini_model"
+          : provider === "anthropic"
+            ? "anthropic_model"
+            : "openai_model";
+      const modelId = key.endsWith("_model") ? value : settings.get(modelKey);
+      const resolved = resolveCapabilities(provider, modelId);
+      const next = applyCapabilityGuards({
+        visionEnabled: settings.get("ai_vision_enabled"),
+        sttEnabled: settings.get("ai_stt_enabled"),
+        capabilities: resolved.capabilities,
+      });
+      if (Boolean(settings.get("ai_vision_enabled")) !== next.visionEnabled) {
+        settings.set("ai_vision_enabled", next.visionEnabled);
+      }
+      if (Boolean(settings.get("ai_stt_enabled")) !== next.sttEnabled) {
+        settings.set("ai_stt_enabled", next.sttEnabled);
+      }
+    }
     return res.json({
       success: true,
       // Never echo a value back: for a secret that would hand it to anyone who
@@ -317,9 +389,7 @@ function splitPersona(raw) {
 
 router.get("/ai/persona", (req, res) => {
   try {
-    const raw = fs.existsSync(PERSONA_FILE)
-      ? fs.readFileSync(PERSONA_FILE, "utf8")
-      : "";
+    const raw = fs.existsSync(PERSONA_FILE) ? fs.readFileSync(PERSONA_FILE, "utf8") : "";
     const { header, body } = splitPersona(raw);
     res.json({
       success: true,
@@ -336,9 +406,7 @@ router.put("/ai/persona", (req, res) => {
   if (body.length > 20000) return badRequest(res, "Persona is too long (20k max)");
 
   try {
-    const raw = fs.existsSync(PERSONA_FILE)
-      ? fs.readFileSync(PERSONA_FILE, "utf8")
-      : "";
+    const raw = fs.existsSync(PERSONA_FILE) ? fs.readFileSync(PERSONA_FILE, "utf8") : "";
     const { header } = splitPersona(raw);
     const next = `${header}\n${PERSONA_SEPARATOR}\n${body.trim()}\n`;
     fs.writeFileSync(PERSONA_FILE, next, "utf8");
@@ -349,14 +417,81 @@ router.put("/ai/persona", (req, res) => {
   }
 });
 
+router.post(
+  "/ai/models",
+  asyncRoute(async (req, res) => {
+    const {
+      provider = settings.get("ai_provider") || "gemini",
+      apiKey,
+      baseUrl,
+      refresh = false,
+    } = req.body || {};
+
+    const provKey = String(provider || "gemini").toLowerCase();
+    const activeKeySetting =
+      provKey === "gemini"
+        ? "gemini_api_key"
+        : provKey === "anthropic"
+          ? "anthropic_api_key"
+          : "openai_api_key";
+    const activeBaseUrlSetting =
+      provKey === "gemini"
+        ? "gemini_base_url"
+        : provKey === "anthropic"
+          ? "anthropic_base_url"
+          : "openai_base_url";
+
+    const offeredKey = typeof apiKey === "string" ? apiKey.trim() : "";
+    const effectiveKey = offeredKey || settings.get(activeKeySetting) || "";
+    const effectiveBaseUrl = baseUrl || settings.get(activeBaseUrlSetting) || "";
+
+    try {
+      const result = await discoverProviderModels({
+        provider: provKey,
+        apiKey: effectiveKey,
+        baseUrl: effectiveBaseUrl,
+        refresh: Boolean(refresh),
+      });
+
+      return res.json(result);
+    } catch (err) {
+      if (err instanceof DiscoveryError) {
+        return res.json({
+          success: false,
+          live: false,
+          fallback: true,
+          provider: provKey,
+          error: {
+            code: err.code,
+            type: err.type,
+            message: err.message,
+          },
+          models: [],
+        });
+      }
+
+      logger.warn({ provider: provKey }, "[Dashboard API] Live model fetch failed");
+      return res.json({
+        success: false,
+        live: false,
+        fallback: true,
+        provider: provKey,
+        error: {
+          code: 500,
+          type: "server_error",
+          message: "An unexpected error occurred while discovering models.",
+        },
+        models: [],
+      });
+    }
+  }),
+);
+
 // Memory files: `global`, or one chat. The scope is turned into a path by
 // memory.cjs and then re-checked against the memory root, so a crafted scope
 // can't walk out of it.
 function memoryPathFor(scope) {
-  const filePath =
-    scope === "global"
-      ? memory.GLOBAL_FILE
-      : memory.memoryFilePath("chat", scope);
+  const filePath = scope === "global" ? memory.GLOBAL_FILE : memory.memoryFilePath("chat", scope);
   const resolved = path.resolve(filePath);
   if (!resolved.startsWith(path.resolve(memory.ROOT) + path.sep)) {
     throw new Error("Refusing to touch a file outside the memory folder");
@@ -403,9 +538,7 @@ router.get("/ai/memory", (req, res) => {
 router.get("/ai/memory/:scope", (req, res) => {
   try {
     const filePath = memoryPathFor(req.params.scope);
-    const content = fs.existsSync(filePath)
-      ? fs.readFileSync(filePath, "utf8")
-      : "";
+    const content = fs.existsSync(filePath) ? fs.readFileSync(filePath, "utf8") : "";
     res.json({ success: true, scope: req.params.scope, content });
   } catch (error) {
     return badRequest(res, error.message);
@@ -444,13 +577,26 @@ router.delete("/ai/memory/:scope", (req, res) => {
 // ===========================================================================
 
 function groupView(groupId, stored) {
-  const metadata = groupMetadataCache.get(groupId) || null;
+  const live = groupMetadataCache.get(groupId) || null;
+  const directory = getGroupDirectory(groupId) || null;
   const config = stored || {};
+  const subject = live?.subject || directory?.subject || null;
+  const memberCount =
+    live?.participants?.length ?? directory?.participant_count ?? null;
+  const mediaEnabled = !!config.media_control?.enabled;
+  const blocked = config.media_control?.blocked_types || [];
+  const mediaRestriction = !mediaEnabled
+    ? "none"
+    : blocked.length >= 4
+      ? "block_all"
+      : "custom";
 
   return {
     id: groupId,
-    subject: metadata?.subject || null,
-    participants: metadata?.participants?.length ?? null,
+    jid: groupId,
+    subject,
+    participants: memberCount,
+    memberCount,
     antilink: {
       enabled: !!config.antilink?.enabled,
       mode: config.antilink?.mode || "ALL",
@@ -479,19 +625,21 @@ function groupView(groupId, stored) {
     },
     rules: config.rules || "",
     blacklist: config.blacklist || [],
+    antilinkEnabled: !!config.antilink?.enabled,
+    welcomeEnabled: !!config.welcome_system?.enabled,
+    mediaRestriction,
   };
 }
 
 router.get("/groups", (req, res) => {
   try {
-    const stored = new Map(
-      getAllGroupSettings().map((row) => [row.group_id, row.settings || {}])
-    );
+    const stored = new Map(getAllGroupSettings().map((row) => [row.group_id, row.settings || {}]));
 
     // Groups the bot is in but that have no settings row yet still belong in
     // the list — that's exactly where the operator goes to configure them.
     const ids = new Set(stored.keys());
     for (const jid of groupMetadataCache.keys()) ids.add(jid);
+    for (const row of getAllGroupDirectory()) ids.add(row.group_id);
 
     const groups = [...ids]
       .map((id) => groupView(id, stored.get(id)))
@@ -511,6 +659,19 @@ router.patch("/groups/:id", (req, res) => {
   if (!groupId.endsWith("@g.us")) return badRequest(res, "Not a group id");
 
   const patch = req.body || {};
+  if (typeof patch.antilink === "boolean") {
+    patch.antilink = { enabled: patch.antilink };
+  }
+  if (patch.welcomeEnabled !== undefined && !patch.welcome_system) {
+    patch.welcome_system = { enabled: !!patch.welcomeEnabled };
+  }
+  if (patch.mediaRestriction && !patch.media_control) {
+    if (patch.mediaRestriction === "none") {
+      patch.media_control = { enabled: false, blocked_types: [] };
+    } else if (patch.mediaRestriction === "block_all") {
+      patch.media_control = { enabled: true, blocked_types: [...MEDIA_TYPES] };
+    }
+  }
   const current = getGroupSettings(groupId) || {};
 
   try {
@@ -575,9 +736,7 @@ router.patch("/groups/:id", (req, res) => {
         if (!Array.isArray(patch.media_control.blocked_types)) {
           throw new Error("blocked_types must be a list");
         }
-        const types = patch.media_control.blocked_types.map((type) =>
-          String(type).toLowerCase()
-        );
+        const types = patch.media_control.blocked_types.map((type) => String(type).toLowerCase());
         for (const type of types) {
           if (!MEDIA_TYPES.includes(type)) throw new Error(`Unknown media type: ${type}`);
         }
@@ -673,9 +832,7 @@ router.get("/notes", (req, res) => {
 
 router.get("/warnings", (req, res) => {
   try {
-    const warnings = getAllWarnings().sort((a, b) =>
-      a.group_id.localeCompare(b.group_id)
-    );
+    const warnings = getAllWarnings().sort((a, b) => a.group_id.localeCompare(b.group_id));
     res.json({ success: true, warnings });
   } catch (error) {
     fail(res, error, "Error fetching warnings");
@@ -741,13 +898,109 @@ router.post("/roles", (req, res) => {
 function scheduleView(job) {
   if (!job) return null;
   const timezone = settings.get("bot_timezone");
-  return { ...job, when: describeScheduledJob(job, timezone) };
+  const peer = describePeer(job.targetJid);
+  return {
+    ...job,
+    when: describeScheduledJob(job, timezone),
+    targetLabel: peer.label,
+    targetKind: peer.kind,
+    targetPhone: peer.phone,
+  };
 }
 
 function scheduleViews() {
   return getSchedules().map(scheduleView);
 }
 
+router.get("/recipients", (req, res) => {
+  try {
+    const recipients = [];
+    const seen = new Set();
+
+    const addGroup = (gid) => {
+      if (!gid || seen.has(gid)) return;
+      seen.add(gid);
+      const live = groupMetadataCache.get(gid);
+      const peer = describePeer(gid);
+      recipients.push({
+        id: gid,
+        name: live?.subject || peer.label,
+        type: "group",
+        memberCount: live?.participants?.length ?? peer.memberCount,
+      });
+    };
+
+    for (const g of getAllGroupSettings() || []) addGroup(g.group_id);
+    for (const row of getAllGroupDirectory()) addGroup(row.group_id);
+    for (const gid of groupMetadataCache.keys()) addGroup(gid);
+
+    const users = getAllUsers() || [];
+    users.sort((a, b) => (b.lastSeen || 0) - (a.lastSeen || 0));
+    for (const u of users.slice(0, 80)) {
+      const jid = u.jid;
+      if (!jid || seen.has(jid) || String(jid).endsWith("@g.us")) continue;
+      seen.add(jid);
+      const peer = describePeer(jid);
+      recipients.push({
+        id: jid,
+        name: peer.label,
+        phone: peer.phone,
+        type: "contact",
+      });
+    }
+
+    res.json({ success: true, recipients });
+  } catch (error) {
+    fail(res, error, "Error fetching recipients");
+  }
+});
+
+router.post(
+  "/schedules",
+  asyncRoute(async (req, res) => {
+    const existing = getSchedules();
+    if (existing.length >= 3) {
+      return badRequest(res, "Maximum 3 scheduled messages reached");
+    }
+
+    const { targetJid, message, type, cronString, scheduledTime } = req.body || {};
+    if (!targetJid || !message) {
+      return badRequest(res, "Recipient and message are required");
+    }
+
+    const id = Date.now().toString();
+    const job = {
+      id,
+      type: type === "once" ? "once" : "recurring",
+      targetJid: String(targetJid).trim(),
+      message: String(message).trim(),
+      creatorJid: "dashboard@levix",
+      status: "active",
+    };
+
+    if (job.type === "recurring") {
+      if (!cronString || !cron.validate(cronString)) {
+        return badRequest(res, "Invalid cron expression");
+      }
+      job.cron = cronString;
+    } else {
+      const timeMs = Number(scheduledTime);
+      if (!timeMs || timeMs <= Date.now()) {
+        return badRequest(res, "Scheduled time must be in the future");
+      }
+      job.date = new Date(timeMs).toISOString();
+    }
+
+    saveScheduledJob(job);
+    const sock = currentSocket();
+    if (sock) {
+      scheduleNewJob(sock, job);
+    }
+
+    res.json({ success: true, schedule: scheduleView(job) });
+  }),
+);
+
 router.get("/schedules", (req, res) => {
   try {
     res.json({
@@ -810,7 +1063,7 @@ router.post(
     }
 
     res.json({ success: true, schedule: scheduleView(result.job) });
-  })
+  }),
 );
 
 // ===========================================================================
@@ -819,10 +1072,17 @@ router.post(
 
 router.post("/security/password", (req, res) => {
   const { current, next } = req.body || {};
+  const peer = clientAddress(req);
+  const retryAfter = blockedFor(peer);
+  if (retryAfter) {
+    res.set("Retry-After", String(retryAfter));
+    return res.status(429).json({ success: false, error: "Too many attempts. Try again later." });
+  }
 
   // Being signed in isn't enough: an unattended browser shouldn't be able to
   // lock the real operator out.
   if (!secrets.verifyDashboardPassword(current)) {
+    recordFailure(peer);
     return res.status(401).json({ success: false, error: "Current password is wrong" });
   }
 
@@ -832,7 +1092,16 @@ router.post("/security/password", (req, res) => {
     return badRequest(res, error.message);
   }
 
-  res.json({ success: true });
+  clearAttempts(peer);
+  stampPanelSession(req.session);
+  req.session.save((err) => {
+    if (err) return res.status(500).json({ success: false, error: "Could not refresh the session" });
+    try {
+      const { disconnectInvalidPanelSockets } = require("../../app.cjs");
+      disconnectInvalidPanelSockets();
+    } catch {}
+    res.json({ success: true });
+  });
 });
 
 // ===========================================================================
@@ -858,9 +1127,10 @@ router.get("/bot/session", (req, res) => {
   });
 });
 
-// Idempotent by construction: the manager returns the state it is already in
-// when a socket exists or is being made, so a double-click, two operators and a
-// retry firing at the same moment all end up with exactly one socket.
+// Coalesce repeated browser requests as well as relying on the manager's own
+// in-flight guard. A socket can fail before three concurrent HTTP requests have
+// all reached this handler; the short settled-request window prevents a late
+// duplicate from immediately creating a replacement socket.
 router.post(
   "/bot/session/start",
   asyncRoute(async (req, res) => {
@@ -869,18 +1139,34 @@ router.post(
     }
     let state;
     try {
-      state = await session.start({
-        reason: "dashboard",
-        method: req.body?.method,
-        phone: req.body?.phone,
-      });
+      const method = req.body?.method;
+      const phone = req.body?.phone;
+      const requestKey = JSON.stringify([method ?? null, phone ?? null]);
+      const isDuplicate =
+        requestKey === dashboardStartKey &&
+        Date.now() - dashboardStartSettledAt < DASHBOARD_START_COALESCE_MS;
+
+      if (dashboardStartPromise) {
+        state = await dashboardStartPromise;
+      } else if (isDuplicate) {
+        state = sessionState();
+      } else {
+        dashboardStartKey = requestKey;
+        dashboardStartPromise = session.start({ reason: "dashboard", method, phone });
+        try {
+          state = await dashboardStartPromise;
+        } finally {
+          dashboardStartSettledAt = Date.now();
+          dashboardStartPromise = null;
+        }
+      }
     } catch (error) {
       if (error.code === "PAIRING_PHONE") return badRequest(res, error.message);
       throw error;
     }
     logger.info(`[Dashboard] Start session requested — now ${state.state}`);
     res.json({ success: true, session: state });
-  })
+  }),
 );
 
 // Apply configuration that only a new socket can pick up — the proxy, today.
@@ -895,7 +1181,7 @@ router.post(
     const state = await session.reconnect({ reason: "dashboard" });
     logger.info(`[Dashboard] Reconnect requested — now ${state.state}`);
     res.json({ success: true, session: state });
-  })
+  }),
 );
 
 // Stop talking to WhatsApp but keep the pairing. No retry follows a manual
@@ -909,7 +1195,7 @@ router.post(
     const state = await session.stop({ reason: "dashboard" });
     logger.warn("[Dashboard] WhatsApp session stopped from the dashboard");
     res.json({ success: true, session: state });
-  })
+  }),
 );
 
 router.post(
@@ -924,7 +1210,7 @@ router.post(
     }
     const state = await session.setInternetOnline(online);
     res.json({ success: true, session: state });
-  })
+  }),
 );
 
 // Unlink the WhatsApp account: WhatsApp drops the companion device and the
@@ -946,7 +1232,7 @@ router.post(
     const state = await session.logout();
     logger.warn("[Dashboard] WhatsApp account unlinked from the dashboard");
     res.json({ success: true, session: state });
-  })
+  }),
 );
 
 // Only useful under a supervisor (pm2 / systemd / docker restart:always) —
@@ -965,4 +1251,40 @@ router.post("/bot/restart", (req, res) => {
   setTimeout(() => process.kill(process.pid, "SIGTERM"), 500).unref();
 });
 
+// --- Aliases for frontend API client compatibility -------------------------
+router.get("/session", (req, res) => {
+  res.json({
+    success: true,
+    status: sessionState(),
+    session: sessionState(),
+    qr: session?.qr ?? null,
+    pairingCode: session?.pairingCode ?? null,
+  });
+});
+
+router.post("/session/start", (req, res, next) => {
+  req.url = "/bot/session/start";
+  router.handle(req, res, next);
+});
+
+router.post("/session/reconnect", (req, res, next) => {
+  req.url = "/bot/session/reconnect";
+  router.handle(req, res, next);
+});
+
+router.post("/session/stop", (req, res, next) => {
+  req.url = "/bot/session/stop";
+  router.handle(req, res, next);
+});
+
+router.post("/session/unlink", (req, res, next) => {
+  req.url = "/bot/logout";
+  router.handle(req, res, next);
+});
+
+router.post("/session/restart", (req, res, next) => {
+  req.url = "/bot/restart";
+  router.handle(req, res, next);
+});
+
 export default router;