wingbot 3.76.15 → 3.76.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wingbot",
-  "version": "3.76.15",
+  "version": "3.76.17",
   "description": "Enterprise Messaging Bot Conversation Engine",
   "main": "index.js",
   "type": "commonjs",

package/src/BotApp.js

@@ -418,7 +418,7 @@ class BotApp {
 
         const sender = new BotAppSender(options, senderId, message, this._senderLogger);
         const res = await this._processor
-            .processMessage(message, pageId, sender, { ...data, appId });
+            .processMessage(message, pageId, sender, { passPostbacks: true, ...data, appId });
 
         return res;
     }

package/src/LLMDispatcher.js

@@ -48,6 +48,7 @@ const BASE64_REGEX = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{
 /**
  * @typedef {object} DispatcherOptions
  * @prop {Logger} [log]
+ * @prop {boolean} [allowRefs]
  */
 
 /**
@@ -76,7 +77,8 @@ class LLMDispatcher {
                 actionList: [],
                 router: null,
                 byAction: new Map(),
-                routes: []
+                routes: [],
+                structuredOutput: null
             },
             locals: new Map()
         };
@@ -98,6 +100,16 @@ class LLMDispatcher {
         this._dispatched = false;
 
         this._overrideAction = null;
+
+        this._allowRefs = !!options.allowRefs;
+    }
+
+    /**
+     *
+     * @param {boolean} [allow]
+     */
+    allowRefs (allow = true) {
+        this._allowRefs = allow;
     }
 
     /**
@@ -137,7 +149,8 @@ class LLMDispatcher {
      */
     async _postbackAction (responder = null) {
         let res;
-        if (this._req.referral !== null && this._req.referral.ref) {
+        // @todo vypnout
+        if (this._allowRefs && this._req.referral !== null && this._req.referral.ref) {
             res = parseActionPayload({ payload: this._req.referral.ref });
         }
 
@@ -145,16 +158,24 @@ class LLMDispatcher {
             res = parseActionPayload(this._req.postback);
         }
 
-        if (!res && this._req.optin !== null && this._req.optin.ref) {
+        if (this._allowRefs && !res && this._req.optin !== null && this._req.optin.ref) {
             res = this._base64Ref(this._req.optin);
         }
 
-        if (!res && this._req.optin !== null && this._req.optin.payload) {
+        if (this._allowRefs && !res && this._req.optin !== null && this._req.optin.payload) {
             res = parseActionPayload(this._req.optin);
         }
 
         if (!res && this._req.message !== null && this._req.message.quick_reply) {
-            res = parseActionPayload(this._req.message.quick_reply);
+            const { payload, ...rest } = this._req.message.quick_reply;
+            const { _qrsPaylMap: payloadMap = {} } = this._req.state;
+
+            if (payload && payloadMap[payload]) {
+                res = parseActionPayload({
+                    ...rest,
+                    payload: payloadMap[payload]
+                });
+            }
         }
 
         /**

package/src/Processor.js

@@ -116,6 +116,8 @@ const LLMDispatcher = require('./LLMDispatcher');
  * @prop {number} [sessionDuration] - Session duration for analytic purposes
  * @prop {LLMGlobalConfig} [llm] - LLM model configuration
  * @prop {Preloader<R>} [preloader]
+ * @prop {string[]} [allowedPostBacks]
+ * @prop {boolean} [allowRefs]
  */
 
 /**
@@ -208,7 +210,9 @@ class Processor extends EventEmitter {
             autoSeen: false,
             redirectLimit: 20,
             nameFromState: NAME_FROM_STATE,
-            sessionDuration: 1800000 // 30 minutes
+            sessionDuration: 1800000, // 30 minutes,
+            allowedPostBacks: [],
+            allowRefs: false
         };
 
         Object.assign(this.options, options);
@@ -533,8 +537,9 @@ class Processor extends EventEmitter {
                 ? Request.text('none', text)
                 : text;
             // @ts-ignore
-            const dispatcher = new LLMDispatcher(Ai.ai, this.reducer.routing, {
-                log: this.options.log
+            const dispatcher = new LLMDispatcher(Ai.ai, this.reducer.routing, null, {
+                log: this.options.log,
+                allowRefs: this.options.allowRefs
             });
             const req = new Request(request, { lang }, pageId, dispatcher);
             await dispatcher.dispatch(req);
@@ -641,7 +646,8 @@ class Processor extends EventEmitter {
             }
 
             const dispatcher = new LLMDispatcher(Ai.ai, this.reducer.routing, llm, {
-                log: this.options.log
+                log: this.options.log,
+                allowRefs: this.options.allowRefs
             });
             req = new Request(
                 message,
@@ -657,6 +663,21 @@ class Processor extends EventEmitter {
                 configuration
             );
 
+            const reqActionNorm = req.action()?.replace(/^\/?/, '/');
+            if (req.isPostBack()
+                && fromEvent
+                && reqActionNorm
+                && !responderData.passPostbacks
+                && this.options.allowedPostBacks.length > 0
+                && !req.postBackHasObscuredPayload()
+                && !this.options.allowedPostBacks.some((pb) => {
+                    const norm = pb.replace(/^\/?/, '/');
+                    return norm === reqActionNorm;
+                })) {
+
+                throw Object.assign(new Error(`Invalid postback error "${req.action()}"`), { code: 400 });
+            }
+
             // process session
             if (fromEvent) {
                 let {

package/src/Request.js

@@ -175,7 +175,20 @@ class Request {
 
         this.message = event.message || null;
 
-        this.postback = event.postback || null;
+        let usePostBack;
+        if (!event.postback) {
+            usePostBack = null;
+        } else if (this.postBackHasObscuredPayload()) {
+            const { payload, ...rest } = event.postback;
+            usePostBack = {
+                payload: state[`_PB${event.postback.payload}`],
+                ...rest
+            };
+        } else {
+            usePostBack = event.postback;
+        }
+
+        this.postback = usePostBack;
 
         this.referral = (this.postback && this.postback.referral)
             || event.referral
@@ -292,6 +305,11 @@ class Request {
         this.configuration = configuration;
     }
 
+    postBackHasObscuredPayload () {
+        return typeof this._event.postback?.payload === 'string'
+            && this.state?.[`_PB${this._event.postback.payload}`];
+    }
+
     /**
      * @returns {LLMDispatcher}
      */
@@ -1532,10 +1550,12 @@ It looks like the bot isn't connected to class BotApp or the Processor is used w
             message: {
                 text: action,
                 quick_reply: {
-                    payload: JSON.stringify({
-                        action,
-                        data
-                    })
+                    payload: data === null
+                        ? action
+                        : JSON.stringify({
+                            action,
+                            data
+                        })
                 }
             }
         };

package/src/Responder.js

@@ -3,6 +3,7 @@
  */
 'use strict';
 
+const crypto = require('crypto');
 const Ai = require('./Ai');
 const ReceiptTemplate = require('./templates/ReceiptTemplate');
 const ButtonTemplate = require('./templates/ButtonTemplate');
@@ -944,17 +945,36 @@ class Responder {
             };
         }
 
-        if (qrs.length > 0) {
-            this.finalMessageSent = true;
-            Object.assign(messageData.message, {
-                quick_replies: qrs
-            });
-
-            this._addExpectedIntents(expectedKeywords);
-            this._quickReplyCollector = [];
+        if (qrs.length === 0) {
+            return qrs;
         }
 
-        return qrs;
+        const qrsPaylMap = {};
+
+        const mappedQrs = qrs.map((qr, i) => {
+            if (!qr.payload) {
+                return qr;
+            }
+            const payload = crypto.randomBytes(16).toString('hex') + (i % 36).toString(36);
+            qrsPaylMap[payload] = qr.payload;
+            return {
+                ...qr,
+                payload
+            };
+        });
+
+        this.setState({
+            _qrsPaylMap: qrsPaylMap
+        });
+
+        this.finalMessageSent = true;
+        Object.assign(messageData.message, {
+            quick_replies: mappedQrs
+        });
+
+        this._addExpectedIntents(expectedKeywords);
+        this._quickReplyCollector = [];
+        return mappedQrs;
     }
 
     /**
@@ -1697,7 +1717,8 @@ class Responder {
      */
     button (text) {
         const btn = new ButtonTemplate(
-            (payload) => {
+            (payload, setState) => {
+                this.setState(setState);
                 this._textResponses.push(text);
                 this.template(payload);
             },
@@ -1729,7 +1750,10 @@ class Responder {
      */
     genericTemplate (shareable = false, isSquare = false) {
         return new GenericTemplate(
-            (payload) => this.template(payload),
+            (payload, setState) => {
+                this.setState(setState);
+                this.template(payload);
+            },
             this._createContext(),
             shareable,
             isSquare

package/src/Tester.js

@@ -110,6 +110,7 @@ class Tester {
             llm: {
                 ...processorOptions.llm
             },
+            allowRefs: true,
             ...processorOptions
         }));
 
@@ -248,7 +249,9 @@ class Tester {
         messageSender.simulatesOptIn = true;
 
         const res = await this.processor
-            .processMessage(message, pageId, messageSender, { ...data, ...this.testData });
+            .processMessage(message, pageId, messageSender, {
+                passPostbacks: false, ...data, ...this.testData
+            });
         this._acquireResponseActions(res, messageSender);
 
         return res;
@@ -290,7 +293,7 @@ class Tester {
             assert.fail(`Response ${index} does not exists. There are ${this.responses.length} responses`);
         }
 
-        return new ResponseAssert(this.responses[index]);
+        return new ResponseAssert(this.responses[index], this.getState());
     }
 
     /**
@@ -301,7 +304,7 @@ class Tester {
      * @memberOf Tester
      */
     any () {
-        return new AnyResponseAssert(this.responses);
+        return new AnyResponseAssert(this.responses, this.getState());
     }
 
     /**
@@ -315,7 +318,7 @@ class Tester {
         if (this.responses.length === 0) {
             assert.fail('Theres no response');
         }
-        return new ResponseAssert(this.responses[this.responses.length - 1]);
+        return new ResponseAssert(this.responses[this.responses.length - 1], this.getState());
     }
 
     _actionMatches (botAction, path) {
@@ -612,7 +615,7 @@ class Tester {
     quickReply (action, data = {}) {
         if (this.responses.length !== 0) {
             const last = this.responses[this.responses.length - 1];
-            const quickReplys = asserts.getQuickReplies(last);
+            const quickReplys = asserts.getQuickReplies(last, this.getState());
             const res = quickReplys
                 .filter((reply) => {
                     const { action: route } = parseActionPayload(reply, true);
@@ -620,8 +623,10 @@ class Tester {
                 });
 
             if (res[0]) {
-                const { title, payload } = res[0];
-                return this.processMessage(Request.quickReplyText(this.senderId, title, payload));
+                const { title, payload, _origPayload: origPayload } = res[0];
+                return this.processMessage(
+                    Request.quickReplyText(this.senderId, title, origPayload || payload)
+                );
             }
         }
 

package/src/templates/BaseTemplate.js

@@ -38,6 +38,8 @@ class BaseTemplate {
         Object.assign(this.context, context);
 
         this._t = this.context.translator;
+
+        this._setState = {};
     }
 
     getTemplate () {
@@ -45,7 +47,7 @@ class BaseTemplate {
     }
 
     send () {
-        this.onDone(this.getTemplate());
+        this.onDone(this.getTemplate(), this._setState);
     }
 
     _imageUrl (image) {

package/src/templates/ButtonTemplate.js

@@ -3,6 +3,7 @@
  */
 'use strict';
 
+const crypto = require('crypto');
 const BaseTemplate = require('./BaseTemplate');
 const { makeAbsolute } = require('../utils');
 
@@ -138,7 +139,7 @@ class ButtonTemplate extends BaseTemplate {
     _createPayload (action, data, setState = null) {
         const hasSetState = setState && Object.keys(setState).length !== 0;
 
-        return JSON.stringify({
+        const actionData = JSON.stringify({
             action: makeAbsolute(action, this.context.path),
             data: {
                 _ca: this.context.currentAction,
@@ -146,6 +147,17 @@ class ButtonTemplate extends BaseTemplate {
             },
             ...(hasSetState ? { setState } : {})
         });
+
+        const payload = crypto
+            .createHash('shake256', { outputLength: 16 })
+            .update(actionData)
+            .digest('hex');
+
+        Object.assign(this._setState, {
+            [`_PB${payload}`]: actionData
+        });
+
+        return payload;
     }
 
     /**

package/src/templates/GenericTemplate.js

@@ -4,7 +4,6 @@
 'use strict';
 
 const ButtonTemplate = require('./ButtonTemplate');
-const { makeAbsolute } = require('../utils');
 
 /**
  * Generic template utility
@@ -84,19 +83,10 @@ class GenericTemplate extends ButtonTemplate {
      * @memberOf GenericTemplate
      */
     setElementActionPostback (action, data = {}, setState = null) {
-        const hasSetState = setState && Object.keys(setState).length !== 0;
-
         Object.assign(this._element, {
             default_action: {
                 type: 'postback',
-                payload: JSON.stringify({
-                    action: makeAbsolute(action, this.context.path),
-                    data: {
-                        _ca: this.context.currentAction,
-                        ...data
-                    },
-                    ...(hasSetState ? { setState } : {})
-                })
+                payload: this._createPayload(action, data, setState)
             }
         });
         return this;

package/src/testTools/AnyResponseAssert.js

@@ -15,8 +15,9 @@ const m = asserts.ex;
  */
 class AnyResponseAssert {
 
-    constructor (responses = []) {
+    constructor (responses = [], state = {}) {
         this.responses = responses;
+        this.state = state;
     }
 
     /**
@@ -69,10 +70,10 @@ class AnyResponseAssert {
      */
     quickReplyAction (action) {
         const ok = this.responses
-            .some((res) => asserts.quickReplyAction(res, action, false));
+            .some((res) => asserts.quickReplyAction(res, action, false, this.state));
         if (!ok) {
             const actual = this.responses
-                .map((res) => asserts.getQuickReplies(res))
+                .map((res) => asserts.getQuickReplies(res, this.state))
                 .filter((replies) => !!replies)
                 .reduce((a, replies) => {
                     for (const reply of replies) {
@@ -98,10 +99,10 @@ class AnyResponseAssert {
      */
     quickReplyTextContains (search) {
         const ok = this.responses
-            .some((res) => asserts.quickReplyText(res, search, false));
+            .some((res) => asserts.quickReplyText(res, search, false, this.state));
         if (!ok) {
             const actual = this.responses
-                .map((res) => asserts.getQuickReplies(res))
+                .map((res) => asserts.getQuickReplies(res, this.state))
                 .filter((replies) => !!replies)
                 .reduce((a, replies) => {
                     for (const { title } of replies) {

package/src/testTools/ResponseAssert.js

@@ -12,8 +12,9 @@ const asserts = require('./asserts');
  */
 class ResponseAssert {
 
-    constructor (response = {}) {
+    constructor (response = {}, state = {}) {
         this.response = response;
+        this.state = state;
     }
 
     waiting () {
@@ -43,7 +44,7 @@ class ResponseAssert {
      * @memberOf ResponseAssert
      */
     quickReplyAction (action) {
-        asserts.quickReplyAction(this.response, action);
+        asserts.quickReplyAction(this.response, action, undefined, this.state);
         return this;
     }
 

package/src/testTools/asserts.js

@@ -65,8 +65,20 @@ function getText (response) {
     return null;
 }
 
-function getQuickReplies (response) {
-    return (response.message && response.message.quick_replies) || [];
+function getQuickReplies (response, state = {}) {
+    const { state: { _qrsPaylMap: qrMap = {} } = {} } = state;
+    const qrs = (response.message && response.message.quick_replies) || [];
+    return qrs.map((qr) => {
+        // eslint-disable-next-line prefer-const
+        let { payload, ...rst } = qr;
+        if (!payload) return rst;
+        if (qrMap[payload]) payload = qrMap[payload];
+        return {
+            _origPayload: qr.payload,
+            ...rst,
+            payload
+        };
+    });
 }
 
 function getAttachment (response) {
@@ -187,10 +199,11 @@ function llmContains (llmMsg, search, message = 'Should contain a text') {
  * @param {object} response
  * @param {string} action
  * @param {string|false} [message='Should contain the action'] - use false for no asserts
+ * @param {{}} [state={}] - bot state to replace qrs
  * @returns {boolean}
  */
-function quickReplyAction (response, action, message = 'Should contain the action') {
-    const replies = getQuickReplies(response);
+function quickReplyAction (response, action, message = 'Should contain the action', state = {}) {
+    const replies = getQuickReplies(response, state);
     const hasItems = replies.length > 0;
     if (message === false && !hasItems) {
         return false;