pi-roundtable-line 0.13.0 → 0.14.1

package/CHANGELOG.md

@@ -5,6 +5,21 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.14.1] - 2026-10-14
+
+- Release in lockstep with pi-roundtable 0.14.1; no package-specific behavior changes. The core peer range stays `>=0.14.0 <0.15.0`.
+
+## [0.14.0] - 2026-10-14
+
+### Added
+
+- `LINE.health().webhooks.rejected.signatureForBot` counts the requests that failed the signature check and whose body names this bot's user id as its `destination`; they are still counted in `rejected.signature` as well. A scanner does not know the bot's id, so this counter rising while `accepted` stays flat means a wrong channel secret or URL. The body is read only within the existing size limit and is neither logged nor kept; before the plugin knows the bot's id the count stays zero.
+
+### Changed
+
+- `WebhookHealth.rejected` has the new required field `signatureForBot`, so a caller that built a `WebhookHealth` or a `LineBridgePort` of its own must add it.
+- Release in lockstep with pi-roundtable 0.14.0. The core peer range moves to `>=0.14.0 <0.15.0`.
+
 ## [0.13.0] - 2026-10-13
 
 ### Added

package/README.md

@@ -11,7 +11,7 @@ It covers intake (the credentials and token source, the webhook, the allowlist o
 
 ## Requirements
 
-- Bun 1.3 or later, and pi-roundtable `>=0.13.0 <0.14.0` as a peer dependency.
+- Bun 1.3 or later, and pi-roundtable `>=0.14.0 <0.15.0` as a peer dependency.
 - PostgreSQL, which the host already needs.
 - An HTTP listener on the host that LINE can reach over HTTPS (the webhook URL is set in the channel's settings).
 - A Messaging API channel: its channel id and channel secret.
@@ -90,6 +90,7 @@ webhooks: {
 	accepted: number; // answered 200, a Verify included
 	rejected: {
 		signature: number; // 401: the signature is missing or wrong
+		signatureForBot: number; // of those, the body names this bot as its destination
 		destination: number; // 403: signed, but for another bot
 		malformed: number; // 400 and 413: not a LINE events object, or over 1 MiB
 	};
@@ -100,7 +101,9 @@ webhooks: {
 
 They are counts and times only: no body, address or signature is kept, and a request adds one to a counter and nothing else.
 A `405` and a `500` (the database could not store the events) are in no counter.
-A host that watches for a channel whose webhook URL or secret has drifted can alarm on `rejected.signature` growing while `accepted` does not.
+A host that watches for a channel whose webhook URL or secret has drifted can alarm on `rejected.signatureForBot` growing while `accepted` does not: a scanner that finds the URL does not know the bot's user id, so a request that fails its signature yet names this bot as its `destination` is far more likely LINE with a wrong channel secret (or a rotated one) than noise.
+To tell, the handler reads the `destination` of a body that failed its signature, only within the 1 MiB limit, and never logs or keeps it; `signatureForBot` also counts in `signature`.
+Until the plugin knows the bot's user id it cannot tell, and `signatureForBot` stays at zero.
 
 ## Chats and the allowlist
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable-line",
-	"version": "0.13.0",
+	"version": "0.14.1",
 	"description": "A LINE Messaging API transport for pi-roundtable: a signed webhook that persists events before it answers, a durable inbox worker, and an allowlist of the groups and chats it mirrors",
 	"type": "module",
 	"license": "MIT",
@@ -33,14 +33,14 @@
 		"test": "bun test"
 	},
 	"peerDependencies": {
-		"pi-roundtable": ">=0.13.0 <0.14.0"
+		"pi-roundtable": ">=0.14.0 <0.15.0"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "2.5.15",
 		"@earendil-works/pi-ai": ">=1.0.0 <2",
 		"@earendil-works/pi-coding-agent": ">=1.0.0 <2",
 		"@types/bun": "1.4.2",
-		"pi-roundtable": "0.13.0",
+		"pi-roundtable": "0.14.1",
 		"typebox": "1.3.34",
 		"typescript": "7.0.2"
 	}

package/src/webhook.ts

@@ -13,10 +13,18 @@ export interface WebhookHealth {
 	/** Requests with a valid signature for this bot that were answered `200` (an empty Verify included). */
 	accepted: number;
 	/**
-	 * Requests turned away: `signature` is a missing or wrong `x-line-signature`, `destination` is a
-	 * signed webhook for another bot, `malformed` is a body that is too large or not a webhook.
+	 * Requests turned away: `signature` is a missing or wrong `x-line-signature`, `signatureForBot`
+	 * is the part of those whose body names this bot as its `destination` (a scanner does not know
+	 * the bot's id, so it rising while `accepted` stays flat means a wrong channel secret or URL),
+	 * `destination` is a signed webhook for another bot, `malformed` is a body that is too large or
+	 * not a webhook.
 	 */
-	rejected: { signature: number; destination: number; malformed: number };
+	rejected: {
+		signature: number;
+		signatureForBot: number;
+		destination: number;
+		malformed: number;
+	};
 	/** When the last request was accepted, as an ISO time; left out until one was. */
 	lastAcceptedAt?: string;
 	/** When the last request was rejected, as an ISO time; left out until one was. */
@@ -26,7 +34,12 @@ export interface WebhookHealth {
 /** The webhook's counters: each request adds to one of them and nothing else is kept. */
 export class WebhookStats {
 	#accepted = 0;
-	#rejected = { signature: 0, destination: 0, malformed: 0 };
+	#rejected = {
+		signature: 0,
+		signatureForBot: 0,
+		destination: 0,
+		malformed: 0,
+	};
 	#acceptedAt: string | undefined;
 	#rejectedAt: string | undefined;
 
@@ -35,11 +48,20 @@ export class WebhookStats {
 		this.#acceptedAt = at.toISOString();
 	}
 
-	reject(reason: keyof WebhookHealth["rejected"], at: Date): void {
+	reject(
+		reason: Exclude<keyof WebhookHealth["rejected"], "signatureForBot">,
+		at: Date,
+	): void {
 		this.#rejected[reason]++;
 		this.#rejectedAt = at.toISOString();
 	}
 
+	/** A refused signature; `forBot` when the body names this bot, which counts in `signatureForBot` too. */
+	rejectSignature(forBot: boolean, at: Date): void {
+		this.reject("signature", at);
+		if (forBot) this.#rejected.signatureForBot++;
+	}
+
 	health(): WebhookHealth {
 		return {
 			accepted: this.#accepted,
@@ -100,6 +122,24 @@ async function readCapped(
 	return body;
 }
 
+/**
+ * The `destination` a body that failed its signature claims, only to tell a request meant for this
+ * bot from a scan. The body is already within the size limit; it is neither logged nor kept, and a
+ * body that is not JSON, or has no text `destination`, names nobody.
+ */
+function claimedDestination(body: Uint8Array): string | undefined {
+	try {
+		const value: unknown = JSON.parse(
+			new TextDecoder("utf-8", { fatal: true }).decode(body),
+		);
+		if (typeof value !== "object" || value === null) return undefined;
+		const destination = (value as { destination?: unknown }).destination;
+		return typeof destination === "string" ? destination : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
 /**
  * LINE's webhook: the raw body is verified against `x-line-signature` before anything is parsed,
  * every event is stored in one transaction, and only then does it answer `200`. A database that
@@ -121,7 +161,11 @@ export function webhookHandler(
 		}
 		const signature = request.headers.get("x-line-signature");
 		if (!signature || !options.tokens.verifies(body, signature)) {
-			stats.reject("signature", options.now());
+			const bot = options.botUserId();
+			stats.rejectSignature(
+				bot !== undefined && claimedDestination(body) === bot,
+				options.now(),
+			);
 			options.logger.warn("a LINE webhook was refused: bad signature");
 			return reply(401, "Unauthorized");
 		}