mirror of
https://github.com/tiennm99/goclaw.git
synced 2026-09-05 02:19:44 +00:00
* feat(webhooks): HTTP webhooks to trigger agents with HMAC auth and durable callbacks
Add multi-tenant HTTP webhook endpoints for agent triggering:
- /v1/webhooks/message: send messages to channels
- /v1/webhooks/llm: sync/async LLM prompts with HMAC-signed callbacks
- HMAC-256 + bearer token authentication
- Rate limiting and tenant isolation
- Durable callback worker with exponential backoff
- PG 000056 + SQLite schema v25 migrations
- Unit + integration tests, P0 tenant isolation invariants
- Channel media capability helpers for attachment routing
- Comprehensive webhook documentation and i18n strings
* fix(webhooks): address post-review findings (K1-K10)
Comprehensive post-merge fixes addressing 10 blocking code review issues
and 2 adversarial re-audit findings in webhook-agent-triggering feature:
K1: Fix auth middleware tenant context lookup sequencing — move
tenant context injection before authenticate() call to prevent
unscoped secret lookups.
K2: Canonicalize JSON payload format for jsonb compatibility across
PostgreSQL and SQLite — ensure consistent serialization without
whitespace variance to prevent hash mismatches.
K3: Add fail-closed JSON parsing in body hash extraction with explicit
error handling for malformed payloads before HMAC verification.
K4: Fix worker queue wedge by properly draining slot reservations
when delivery succeeds, preventing permanent slot occupancy.
K5: Implement lease-token optimistic concurrency control to prevent
duplicate webhook delivery under high concurrency or retry storms.
K6: Add AES-256-GCM encrypted secret storage at rest with fail-fast
skip-mount when GOCLAW_ENCRYPTION_KEY environment variable unset.
K7: Implement IP allowlist enforcement supporting both CIDR ranges
and exact IP matching with proper X-Forwarded-For parsing.
K8: Add HMAC replay nonce cache (5min expiry, non-blocking async flush)
to prevent request replay attacks on webhook handler.
K9: Fix invariant test schema selection — replace hardcoded assumption
with explicit schema name from config to support multi-schema testing.
K10: Consolidate rate limiters into single shared instance to prevent
per-endpoint limiter starvation and ensure fair rate limiting.
New database migrations:
- 000057: webhook_calls.lease_token for optimistic concurrency
- 000058: webhooks.encrypted_secret_key for AES-256-GCM encryption
New i18n keys: MsgWebhookIPDenied, MsgWebhookEncryptionUnavailable
(with English, Vietnamese, Chinese translations).
New modules:
- internal/http/webhooks_payload.go: JSON canonicalization + body hash
- internal/http/webhooks_nonce.go: Replay nonce cache implementation
- internal/http/webhooks_idempotency_test.go: Integration tests
Documentation updates:
- docs/webhooks.md: §13-14 security sections, encryption flow
- docs/00-architecture-overview.md: webhook subsystem security overview
- docs/codebase-summary.md: webhook security patterns
- docs/project-changelog.md: webhook fixes changelog
Test coverage: 53 webhook tests + 4 P0 invariant tests all passing.
No tenant isolation violations. All security gates enforced.
* docs(journals): webhook feature ship + fix cycle entries
* fix(webhooks): address Claude review findings
- webhooks_llm.go: remove misleading ptr() helper; use &completedAt
pattern for error-path audit rows (matches success path)
- webhooks_auth.go: wrap TouchLastUsed context in WithoutCancel so
background DB update isn't cancelled when HTTP response completes
- store GetByIDUnscoped (PG+SQLite): add NOT revoked / revoked = 0
filter for defense-in-depth parity with GetByHashUnscoped
- webhooks/sign.go: fix package doc — HMAC key is raw plaintext
secret bytes, not hex-decoded SHA-256
- webhooks_admin.go: check auth before encKey guard to avoid leaking
config state to unauthenticated callers
- webhooks_ratelimit.go: two-phase Load→LoadOrStore to avoid per-call
entry allocation on the hot path
* docs(webhooks): fix Sign() function doc to match actual key input
Function-level comment still referenced hex-decoded SecretHash after
the package-level doc was corrected. Align with actual caller usage
([]byte(rawSecret)).
* fix(webhooks): use WithoutCancel for worker execute DB updates
Terminal status writes in execute() ran through the worker main-loop
ctx, which is cancelled on graceful shutdown. If the outbound send
completed but the status update raced with shutdown, the row stayed
in 'running' and got re-delivered via reclaimStale. WithoutCancel
lets the DB write survive worker cancellation while preserving
propagated values (tenant ID, etc.).
* fix(webhooks): move tctx init before panic defer in worker execute
Panic recovery called updateRetry with raw ctx (no tenant ID), making
requireTenantID fail and the reset-to-retry DB write silently drop.
Row stayed 'running' until reclaimStale (~90s delay). Init tctx first
so defer closure captures tenant-scoped non-cancellable context.
* fix(webhooks): pass tenant-scoped tctx to invokeAgent in worker
execute() was passing the raw worker-loop ctx (no tenant ID) to
invokeAgent → router.Get → PGAgentStore.GetByID. GetByID reads
TenantIDFromContext which returned uuid.Nil, making every lookup
return 'agent not found'. Async LLM webhook calls silently failed
all retries. Pass tctx (already tenant-scoped + WithoutCancel) so
the router resolves the agent correctly.
* fix(tests): resolve integration test compile errors
- Remove duplicate contains() in mcp_grant_revoke_test.go (already
defined in tts_gemini_live_test.go)
- Update webhooks_admin_test.go RotateSecret call to match current
5-arg signature (newSecretHash, newPrefix, newEncryptedSecret)
* fix(webhooks): default nil scopes/ip_allowlist to empty slice in Create
PG columns are NOT NULL DEFAULT '{}'. Explicit NULL from pqStringArray(nil)
violated the constraint, breaking TestWebhookAdminCRUD/TenantIsolation.
Coerce nil slices to empty []string{} so the default applies at the DB layer.
* chore: trigger CI on digitopvn/goclaw fork
* ci: retrigger workflows
* fix(webhooks): renumber migrations to 000059-000061 for merge train
162 lines
4.4 KiB
Go
162 lines
4.4 KiB
Go
package channels
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/nextlevelbuilder/goclaw/internal/bus"
|
|
)
|
|
|
|
// --- IsMediaCapable ---
|
|
|
|
func TestIsMediaCapable_KnownCapableTypes(t *testing.T) {
|
|
t.Parallel()
|
|
capable := []string{
|
|
TypeTelegram, TypeDiscord, TypeWhatsApp, TypeFeishu,
|
|
TypeSlack, TypeZaloPersonal, TypePancake, TypeFacebook,
|
|
}
|
|
for _, ct := range capable {
|
|
if !IsMediaCapable(ct) {
|
|
t.Errorf("IsMediaCapable(%q) = false, want true", ct)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestIsMediaCapable_UnsupportedTypes(t *testing.T) {
|
|
t.Parallel()
|
|
unsupported := []string{
|
|
TypeZaloOA, "unknown", "", "cli", "system",
|
|
}
|
|
for _, ct := range unsupported {
|
|
if IsMediaCapable(ct) {
|
|
t.Errorf("IsMediaCapable(%q) = true, want false", ct)
|
|
}
|
|
}
|
|
}
|
|
|
|
// --- SendMediaToChannel ---
|
|
|
|
// mockChannel implements Channel for testing SendMediaToChannel.
|
|
type mockChannel struct {
|
|
BaseChannel
|
|
channelType string
|
|
lastMsg bus.OutboundMessage
|
|
sendErr error
|
|
}
|
|
|
|
func newMockChannel(name, channelType string) *mockChannel {
|
|
mc := &mockChannel{channelType: channelType}
|
|
mc.BaseChannel = BaseChannel{name: name}
|
|
return mc
|
|
}
|
|
|
|
func (m *mockChannel) Type() string { return m.channelType }
|
|
func (m *mockChannel) Start(_ context.Context) error { return nil }
|
|
func (m *mockChannel) Stop(_ context.Context) error { return nil }
|
|
func (m *mockChannel) IsRunning() bool { return true }
|
|
func (m *mockChannel) IsAllowed(_ string) bool { return true }
|
|
func (m *mockChannel) Send(_ context.Context, msg bus.OutboundMessage) error {
|
|
m.lastMsg = msg
|
|
return m.sendErr
|
|
}
|
|
|
|
func TestSendMediaToChannel_PassesMediaToAdapter(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
mb := bus.New()
|
|
mgr := NewManager(mb)
|
|
|
|
ch := newMockChannel("telegram-test", TypeTelegram)
|
|
mgr.channels["telegram-test"] = ch
|
|
|
|
media := []bus.MediaAttachment{
|
|
{URL: "/tmp/test.jpg", ContentType: "image/jpeg", Caption: "hello"},
|
|
}
|
|
|
|
err := mgr.SendMediaToChannel(context.Background(), "telegram-test", "chat123", "text", media)
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
if len(ch.lastMsg.Media) != 1 {
|
|
t.Fatalf("expected 1 media attachment, got %d", len(ch.lastMsg.Media))
|
|
}
|
|
if ch.lastMsg.Media[0].URL != "/tmp/test.jpg" {
|
|
t.Errorf("media URL mismatch: got %q", ch.lastMsg.Media[0].URL)
|
|
}
|
|
if ch.lastMsg.Content != "text" {
|
|
t.Errorf("content mismatch: got %q", ch.lastMsg.Content)
|
|
}
|
|
if ch.lastMsg.ChatID != "chat123" {
|
|
t.Errorf("chatID mismatch: got %q", ch.lastMsg.ChatID)
|
|
}
|
|
}
|
|
|
|
func TestSendMediaToChannel_ReturnsErrMediaUnsupported_ForZaloOA(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
mb := bus.New()
|
|
mgr := NewManager(mb)
|
|
|
|
ch := newMockChannel("zalo-oa-test", TypeZaloOA)
|
|
mgr.channels["zalo-oa-test"] = ch
|
|
|
|
media := []bus.MediaAttachment{{URL: "/tmp/img.png", ContentType: "image/png"}}
|
|
err := mgr.SendMediaToChannel(context.Background(), "zalo-oa-test", "chat1", "", media)
|
|
if err == nil {
|
|
t.Fatal("expected error, got nil")
|
|
}
|
|
if !errors.Is(err, ErrMediaUnsupported) {
|
|
t.Errorf("expected ErrMediaUnsupported, got: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestSendMediaToChannel_ErrorOnEmptyMedia(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
mb := bus.New()
|
|
mgr := NewManager(mb)
|
|
|
|
ch := newMockChannel("telegram-test", TypeTelegram)
|
|
mgr.channels["telegram-test"] = ch
|
|
|
|
err := mgr.SendMediaToChannel(context.Background(), "telegram-test", "chat1", "text", nil)
|
|
if err == nil {
|
|
t.Fatal("expected error for empty media, got nil")
|
|
}
|
|
}
|
|
|
|
func TestSendMediaToChannel_ErrorOnChannelNotFound(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
mb := bus.New()
|
|
mgr := NewManager(mb)
|
|
|
|
media := []bus.MediaAttachment{{URL: "/tmp/img.jpg", ContentType: "image/jpeg"}}
|
|
err := mgr.SendMediaToChannel(context.Background(), "nonexistent", "chat1", "", media)
|
|
if err == nil {
|
|
t.Fatal("expected error for unknown channel, got nil")
|
|
}
|
|
}
|
|
|
|
func TestSendToChannel_UnchangedByNewMethod(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
mb := bus.New()
|
|
mgr := NewManager(mb)
|
|
|
|
ch := newMockChannel("telegram-test", TypeTelegram)
|
|
mgr.channels["telegram-test"] = ch
|
|
|
|
err := mgr.SendToChannel(context.Background(), "telegram-test", "chat1", "hello world")
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
if ch.lastMsg.Content != "hello world" {
|
|
t.Errorf("content mismatch: got %q", ch.lastMsg.Content)
|
|
}
|
|
if len(ch.lastMsg.Media) != 0 {
|
|
t.Errorf("expected no media, got %d attachments", len(ch.lastMsg.Media))
|
|
}
|
|
}
|