openclaw-groupme 0.4.2 → 0.4.3

package/dist/src/rate-limit.js

@@ -0,0 +1,95 @@
+const DEFAULT_MAX_TRACKED_KEYS = 10_000;
+function allowInWindow(params) {
+    const { state, key, limit, windowMs, now } = params;
+    const current = state.get(key) ?? [];
+    const minTs = now - windowMs;
+    const retained = current.filter((ts) => ts > minTs);
+    if (retained.length >= limit) {
+        state.set(key, retained);
+        return false;
+    }
+    retained.push(now);
+    state.set(key, retained);
+    return true;
+}
+export class GroupMeRateLimiter {
+    windowMs;
+    maxRequestsPerIp;
+    maxRequestsPerSender;
+    maxConcurrent;
+    maxTrackedKeys;
+    byIp = new Map();
+    bySender = new Map();
+    inFlight = 0;
+    constructor(params) {
+        this.windowMs = Math.max(1, Math.floor(params.windowMs));
+        this.maxRequestsPerIp = Math.max(1, Math.floor(params.maxRequestsPerIp));
+        this.maxRequestsPerSender = Math.max(1, Math.floor(params.maxRequestsPerSender));
+        this.maxConcurrent = Math.max(1, Math.floor(params.maxConcurrent));
+        this.maxTrackedKeys = DEFAULT_MAX_TRACKED_KEYS;
+    }
+    evaluate(params, now = Date.now()) {
+        const ipKey = params.ip.trim() || "unknown";
+        const senderKey = params.senderId.trim() || "unknown";
+        this.pruneState(this.byIp, now);
+        this.pruneState(this.bySender, now);
+        this.capStateSize(this.byIp);
+        this.capStateSize(this.bySender);
+        if (this.inFlight >= this.maxConcurrent) {
+            return { kind: "rejected", scope: "concurrency" };
+        }
+        if (!allowInWindow({
+            state: this.byIp,
+            key: ipKey,
+            limit: this.maxRequestsPerIp,
+            windowMs: this.windowMs,
+            now,
+        })) {
+            return { kind: "rejected", scope: "ip" };
+        }
+        if (!allowInWindow({
+            state: this.bySender,
+            key: senderKey,
+            limit: this.maxRequestsPerSender,
+            windowMs: this.windowMs,
+            now,
+        })) {
+            return { kind: "rejected", scope: "sender" };
+        }
+        this.inFlight += 1;
+        let released = false;
+        return {
+            kind: "accepted",
+            release: () => {
+                if (released) {
+                    return;
+                }
+                released = true;
+                this.inFlight = Math.max(0, this.inFlight - 1);
+            },
+        };
+    }
+    inflightCount() {
+        return this.inFlight;
+    }
+    pruneState(state, now) {
+        const minTs = now - this.windowMs;
+        for (const [key, timestamps] of state) {
+            const retained = timestamps.filter((ts) => ts > minTs);
+            if (retained.length === 0) {
+                state.delete(key);
+                continue;
+            }
+            state.set(key, retained);
+        }
+    }
+    capStateSize(state) {
+        while (state.size > this.maxTrackedKeys) {
+            const oldest = state.keys().next().value;
+            if (!oldest) {
+                return;
+            }
+            state.delete(oldest);
+        }
+    }
+}

package/dist/src/replay-cache.js

@@ -0,0 +1,55 @@
+import { createHash } from "node:crypto";
+export class GroupMeReplayCache {
+    ttlMs;
+    maxEntries;
+    entries = new Map();
+    constructor(params) {
+        this.ttlMs = Math.max(1, Math.floor(params.ttlSeconds * 1000));
+        this.maxEntries = Math.max(1, Math.floor(params.maxEntries));
+    }
+    checkAndRemember(key, now = Date.now()) {
+        this.pruneExpired(now);
+        const existing = this.entries.get(key);
+        if (existing && existing.expiresAt > now) {
+            return { kind: "duplicate", key };
+        }
+        this.entries.delete(key);
+        this.entries.set(key, { expiresAt: now + this.ttlMs });
+        this.evictOverflow();
+        return { kind: "accepted", key };
+    }
+    size() {
+        return this.entries.size;
+    }
+    pruneExpired(now) {
+        for (const [key, entry] of this.entries) {
+            if (entry.expiresAt > now) {
+                continue;
+            }
+            this.entries.delete(key);
+        }
+    }
+    evictOverflow() {
+        while (this.entries.size > this.maxEntries) {
+            const oldest = this.entries.keys().next().value;
+            if (!oldest) {
+                return;
+            }
+            this.entries.delete(oldest);
+        }
+    }
+}
+export function buildReplayKey(message) {
+    const id = message.id.trim();
+    if (id) {
+        return `id:${id}`;
+    }
+    const sourceGuid = message.sourceGuid.trim();
+    if (sourceGuid) {
+        return `source_guid:${sourceGuid}`;
+    }
+    const fallback = createHash("sha256")
+        .update(`${message.groupId}\u0000${message.senderId}\u0000${message.createdAt}\u0000${message.text}`)
+        .digest("hex");
+    return `fallback:${fallback}`;
+}

package/dist/src/runtime.js

@@ -0,0 +1,10 @@
+let runtime = null;
+export function setGroupMeRuntime(next) {
+    runtime = next;
+}
+export function getGroupMeRuntime() {
+    if (!runtime) {
+        throw new Error("GroupMe runtime not initialized");
+    }
+    return runtime;
+}

package/dist/src/security.js

@@ -0,0 +1,332 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { BlockList, isIP } from "node:net";
+import { readTrimmed } from "./accounts.js";
+const IPV4_MAX_CIDR_PREFIX = 32;
+const IPV6_MAX_CIDR_PREFIX = 128;
+function positiveIntOrDefault(value, fallback) {
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+        return Math.floor(value);
+    }
+    return fallback;
+}
+function normalizeIpCandidate(raw) {
+    let value = raw.trim();
+    if (!value) {
+        return "";
+    }
+    if (value.includes(",")) {
+        value = value.split(",")[0]?.trim() ?? "";
+    }
+    if (value.startsWith("[")) {
+        const endIndex = value.indexOf("]");
+        if (endIndex > 0) {
+            value = value.slice(1, endIndex);
+        }
+    }
+    const zoneIndex = value.indexOf("%");
+    if (zoneIndex > 0) {
+        value = value.slice(0, zoneIndex);
+    }
+    if (value.startsWith("::ffff:")) {
+        const mapped = value.slice("::ffff:".length);
+        if (isIP(mapped) === 4) {
+            value = mapped;
+        }
+    }
+    if (isIP(value) === 0) {
+        const maybeWithPort = value.split(":");
+        if (maybeWithPort.length === 2 &&
+            /^\d+$/.test(maybeWithPort[1] ?? "") &&
+            isIP(maybeWithPort[0] ?? "") === 4) {
+            value = maybeWithPort[0] ?? "";
+        }
+    }
+    return isIP(value) === 0 ? "" : value;
+}
+function getHeaderValue(headers, key) {
+    const raw = headers[key];
+    if (typeof raw === "string") {
+        return raw.trim();
+    }
+    if (Array.isArray(raw)) {
+        return raw[0]?.trim() ?? "";
+    }
+    return "";
+}
+function normalizeHost(value) {
+    let host = value.trim().toLowerCase();
+    if (!host) {
+        return "";
+    }
+    if (host.includes(",")) {
+        host = host.split(",")[0]?.trim() ?? "";
+    }
+    if (!host) {
+        return "";
+    }
+    if (host.startsWith("[")) {
+        const endBracket = host.indexOf("]");
+        if (endBracket <= 0) {
+            return "";
+        }
+        return host.slice(1, endBracket);
+    }
+    if (host.includes("@")) {
+        return "";
+    }
+    const maybeWithoutPort = host.split(":");
+    if (maybeWithoutPort.length === 2 &&
+        /^\d+$/.test(maybeWithoutPort[1] ?? "")) {
+        host = maybeWithoutPort[0] ?? "";
+    }
+    return host.trim();
+}
+function parseProxyRules(entries) {
+    const rules = [];
+    for (const entry of entries) {
+        const raw = entry.trim();
+        if (!raw) {
+            continue;
+        }
+        if (raw.includes("/")) {
+            const [network, prefixRaw] = raw.split("/");
+            const normalizedNetwork = normalizeIpCandidate(network ?? "");
+            const ipVersion = isIP(normalizedNetwork);
+            if (!ipVersion) {
+                continue;
+            }
+            const prefix = Number(prefixRaw);
+            const maxPrefix = ipVersion === 4 ? IPV4_MAX_CIDR_PREFIX : IPV6_MAX_CIDR_PREFIX;
+            if (!Number.isInteger(prefix) || prefix < 0 || prefix > maxPrefix) {
+                continue;
+            }
+            rules.push({ kind: "cidr", value: `${normalizedNetwork}/${prefix}` });
+            continue;
+        }
+        const normalizedIp = normalizeIpCandidate(raw);
+        if (normalizedIp) {
+            rules.push({ kind: "ip", value: normalizedIp });
+        }
+    }
+    return rules;
+}
+function createTrustedProxyMatcher(entries) {
+    const rules = parseProxyRules(entries);
+    if (rules.length === 0) {
+        return () => false;
+    }
+    const blockList = new BlockList();
+    for (const rule of rules) {
+        if (rule.kind === "ip") {
+            const version = isIP(rule.value);
+            if (version === 4) {
+                blockList.addAddress(rule.value, "ipv4");
+            }
+            else if (version === 6) {
+                blockList.addAddress(rule.value, "ipv6");
+            }
+            continue;
+        }
+        const [network, prefixRaw] = rule.value.split("/");
+        const prefix = Number(prefixRaw);
+        const version = isIP(network);
+        if (version === 4) {
+            blockList.addSubnet(network, prefix, "ipv4");
+        }
+        else if (version === 6) {
+            blockList.addSubnet(network, prefix, "ipv6");
+        }
+    }
+    return (ip) => {
+        const normalized = normalizeIpCandidate(ip);
+        if (!normalized) {
+            return false;
+        }
+        if (isIP(normalized) === 4) {
+            return blockList.check(normalized, "ipv4");
+        }
+        return blockList.check(normalized, "ipv6");
+    };
+}
+function extractCallbackToken(callbackUrl) {
+    const raw = callbackUrl?.trim() ?? "";
+    if (!raw) {
+        return "";
+    }
+    try {
+        const parsed = new URL(raw, "http://localhost");
+        return parsed.searchParams.get("k")?.trim() ?? "";
+    }
+    catch {
+        throw new Error(`Invalid callbackUrl: unable to parse "${raw}"`);
+    }
+}
+export function resolveGroupMeSecurity(accountConfig) {
+    const security = (accountConfig.security ?? {});
+    const callbackToken = extractCallbackToken(accountConfig.callbackUrl);
+    const groupId = readTrimmed(accountConfig.groupId) ?? "";
+    const allowedMimePrefixes = Array.isArray(security.media?.allowedMimePrefixes)
+        ? security.media.allowedMimePrefixes
+            .map((prefix) => readTrimmed(prefix))
+            .filter((entry) => Boolean(entry))
+        : ["image/"];
+    const trustedProxyCidrs = Array.isArray(security.proxy?.trustedProxyCidrs)
+        ? security.proxy.trustedProxyCidrs
+            .map((entry) => readTrimmed(entry))
+            .filter((entry) => Boolean(entry))
+        : [];
+    const allowedPublicHosts = Array.isArray(security.proxy?.allowedPublicHosts)
+        ? security.proxy.allowedPublicHosts
+            .map((entry) => normalizeHost(readTrimmed(entry) ?? ""))
+            .filter(Boolean)
+        : [];
+    return {
+        callbackToken,
+        callbackRejectStatus: 404,
+        groupId,
+        replay: {
+            enabled: true,
+            ttlSeconds: positiveIntOrDefault(security.replay?.ttlSeconds, 600),
+            maxEntries: positiveIntOrDefault(security.replay?.maxEntries, 10_000),
+        },
+        rateLimit: {
+            enabled: true,
+            windowMs: positiveIntOrDefault(security.rateLimit?.windowMs, 60_000),
+            maxRequestsPerIp: positiveIntOrDefault(security.rateLimit?.maxRequestsPerIp, 120),
+            maxRequestsPerSender: positiveIntOrDefault(security.rateLimit?.maxRequestsPerSender, 60),
+            maxConcurrent: positiveIntOrDefault(security.rateLimit?.maxConcurrent, 8),
+        },
+        media: {
+            allowPrivateNetworks: security.media?.allowPrivateNetworks === true,
+            maxDownloadBytes: positiveIntOrDefault(security.media?.maxDownloadBytes, 15 * 1024 * 1024),
+            requestTimeoutMs: positiveIntOrDefault(security.media?.requestTimeoutMs, 10_000),
+            allowedMimePrefixes: allowedMimePrefixes.length > 0 ? allowedMimePrefixes : ["image/"],
+        },
+        logging: {
+            redactSecrets: security.logging?.redactSecrets !== false,
+            logRejectedRequests: security.logging?.logRejectedRequests !== false,
+        },
+        commandBypass: {
+            requireAllowFrom: security.commandBypass?.requireAllowFrom !== false,
+            requireMentionForCommands: security.commandBypass?.requireMentionForCommands === true,
+        },
+        proxy: {
+            enabled: security.proxy != null,
+            trustedProxyCidrs,
+            allowedPublicHosts,
+            requireHttpsProto: security.proxy?.requireHttpsProto === true,
+            rejectStatus: security.proxy?.rejectStatus ?? 403,
+            isTrustedProxy: createTrustedProxyMatcher(trustedProxyCidrs),
+        },
+    };
+}
+function safeEqualToken(left, right) {
+    const leftHash = createHash("sha256").update(left).digest();
+    const rightHash = createHash("sha256").update(right).digest();
+    return timingSafeEqual(leftHash, rightHash);
+}
+export function verifyCallbackAuth(params) {
+    const expectedToken = params.security.callbackToken;
+    if (!expectedToken) {
+        return { ok: false, reason: "disabled" };
+    }
+    const inboundToken = params.url.searchParams.get("k")?.trim() ?? "";
+    if (!inboundToken) {
+        return { ok: false, reason: "missing" };
+    }
+    if (safeEqualToken(inboundToken, expectedToken)) {
+        return { ok: true, tokenId: "active" };
+    }
+    return { ok: false, reason: "mismatch" };
+}
+export function checkGroupBinding(params) {
+    if (params.groupId !== params.inboundGroupId) {
+        return { ok: false, reason: "mismatch" };
+    }
+    return { ok: true };
+}
+export function redactCallbackUrl(raw, security) {
+    if (!security.callbackToken) {
+        return raw;
+    }
+    try {
+        const parsed = new URL(raw, "http://localhost");
+        if (parsed.searchParams.has("k")) {
+            parsed.searchParams.set("k", "[redacted]");
+        }
+        const serialized = `${parsed.pathname}${parsed.search}${parsed.hash}`;
+        return (serialized || raw).replaceAll("%5Bredacted%5D", "[redacted]");
+    }
+    catch {
+        return raw.replaceAll(security.callbackToken, "[redacted]");
+    }
+}
+export function validateProxyRequest(params) {
+    const remoteIp = normalizeIpCandidate(params.remoteAddress) || "unknown";
+    const proxyConfig = params.security.proxy;
+    const defaultProto = params.socketEncrypted
+        ? "https"
+        : "http";
+    const hostHeader = normalizeHost(getHeaderValue(params.headers, "host"));
+    if (!proxyConfig.enabled) {
+        return {
+            ok: true,
+            context: {
+                remoteIp,
+                clientIp: remoteIp,
+                host: hostHeader,
+                proto: defaultProto,
+                fromTrustedProxy: false,
+                usingForwardedHeaders: false,
+            },
+        };
+    }
+    const fromTrustedProxy = proxyConfig.trustedProxyCidrs.length > 0 &&
+        proxyConfig.isTrustedProxy(remoteIp);
+    const forwardedFor = normalizeIpCandidate(getHeaderValue(params.headers, "x-forwarded-for"));
+    const forwardedHost = normalizeHost(getHeaderValue(params.headers, "x-forwarded-host"));
+    const forwardedProtoRaw = getHeaderValue(params.headers, "x-forwarded-proto")
+        .split(",")[0]
+        ?.trim()
+        .toLowerCase();
+    const forwardedProto = forwardedProtoRaw === "http" || forwardedProtoRaw === "https"
+        ? forwardedProtoRaw
+        : null;
+    const usingForwardedHeaders = fromTrustedProxy && Boolean(forwardedFor || forwardedHost || forwardedProto);
+    const effectiveClientIp = usingForwardedHeaders && forwardedFor ? forwardedFor : remoteIp;
+    const effectiveHost = usingForwardedHeaders && forwardedHost ? forwardedHost : hostHeader;
+    const effectiveProto = usingForwardedHeaders && forwardedProto ? forwardedProto : defaultProto;
+    if (!effectiveHost) {
+        return {
+            ok: false,
+            reason: "missing_host",
+            status: proxyConfig.rejectStatus,
+        };
+    }
+    if (proxyConfig.allowedPublicHosts.length > 0 &&
+        !proxyConfig.allowedPublicHosts.includes(effectiveHost)) {
+        return {
+            ok: false,
+            reason: "host_not_allowed",
+            status: proxyConfig.rejectStatus,
+        };
+    }
+    if (proxyConfig.requireHttpsProto && effectiveProto !== "https") {
+        return {
+            ok: false,
+            reason: "proto_not_https",
+            status: proxyConfig.rejectStatus,
+        };
+    }
+    return {
+        ok: true,
+        context: {
+            remoteIp,
+            clientIp: effectiveClientIp || "unknown",
+            host: effectiveHost,
+            proto: effectiveProto,
+            fromTrustedProxy,
+            usingForwardedHeaders,
+        },
+    };
+}