mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-25 14:53:34 +00:00
19d9562b4f
* feat(extensions): unify auth and configure into single entrypoint Refactors the extension lifecycle to eliminate the divergence between chat and gateway paths that caused Telegram setup via chat to fail (missing webhook secret auto-generation, no token validation). Key changes: - Rename save_setup_secrets() → configure(): single entrypoint for providing secrets to any extension (WasmChannel, WasmTool, MCP). Validates, stores, auto-generates, and activates. - Add configure_token(): convenience wrapper for single-token callers (chat auth card, WebSocket, agent auth mode). - Refactor auth() to pure status check: remove token parameter, delete token-storing branches from auth_mcp/auth_wasm_tool, rename auth_wasm_channel → auth_wasm_channel_status. - Add ConfigureResult/MissingSecret types for structured responses. - Replace hardcoded Telegram token validation with generic validation_endpoint from capabilities.json. - Update all callers (9 files) to use the new interface. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * fix: use ValidationFailed error variant instead of string matching Replace brittle msg.contains("Invalid token") checks with a proper ExtensionError::ValidationFailed variant. configure() now returns this variant for token validation failures, and callers match on it directly instead of parsing error message strings. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * fix: address review — SSRF protection, error typing, missing-secret selection, WS auth 1. SSRF: call validate_fetch_url() before validation_endpoint HTTP request 2. Transport errors map to ExtensionError::Other (not ValidationFailed) 3. configure_token() picks first *missing* secret, not first non-optional 4. WebSocket error path re-emits AuthRequired on ValidationFailed Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * test: add regression tests for extension lifecycle refactoring - test_configure_token_picks_first_missing_secret: verifies multi-secret channels can be configured one secret at a time (commit ce106f4) - test_auth_is_read_only_for_wasm_channel: verifies auth() has no side effects and doesn't store secrets (commit 47f8eb6) - test_validation_failed_is_distinct_error_variant: verifies the typed error variant can be pattern-matched (commit a318161) Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address review comments — activation dispatch, dead code, caps consolidation - Fix configure() fallthrough bug: dispatch activation by ExtensionKind instead of unconditionally calling activate_wasm_channel() for all non-WasmTool types (MCP servers and channel relays now use their correct activation methods) - Remove dead MissingSecret struct and missing_secrets field (never populated, flagged by reviewer) - Consolidate capabilities file parsing in configure(): parse once and reuse for allowed names, validation_endpoint, and auto-generation - Fix auth() doc comment: note MCP OAuth side effects - Fix stale save_setup_secrets reference in server.rs comment - Add regression test for activation dispatch bug Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
73 lines
2.1 KiB
JSON
73 lines
2.1 KiB
JSON
{
|
|
"version": "0.2.2",
|
|
"wit_version": "0.3.0",
|
|
"type": "channel",
|
|
"name": "telegram",
|
|
"description": "Telegram Bot API channel for receiving and responding to Telegram messages",
|
|
"auth": {
|
|
"secret_name": "telegram_bot_token",
|
|
"display_name": "Telegram",
|
|
"instructions": "Get your bot token from @BotFather on Telegram (https://t.me/BotFather). Send /newbot or /token to get it.",
|
|
"setup_url": "https://t.me/BotFather",
|
|
"token_hint": "Looks like 123456789:AABBccDDeeFFgg...",
|
|
"env_var": "TELEGRAM_BOT_TOKEN"
|
|
},
|
|
"setup": {
|
|
"required_secrets": [
|
|
{
|
|
"name": "telegram_bot_token",
|
|
"prompt": "Enter your Telegram Bot API token (from @BotFather)",
|
|
"optional": false
|
|
}
|
|
],
|
|
"setup_url": "https://t.me/BotFather",
|
|
"validation_endpoint": "https://api.telegram.org/bot{telegram_bot_token}/getMe"
|
|
},
|
|
"capabilities": {
|
|
"http": {
|
|
"allowlist": [
|
|
{ "host": "api.telegram.org", "path_prefix": "/bot" },
|
|
{ "host": "api.telegram.org", "path_prefix": "/file/bot" }
|
|
],
|
|
"credentials": {
|
|
"telegram_bot": {
|
|
"secret_name": "telegram_bot_token",
|
|
"location": { "type": "url_path", "placeholder": "{TELEGRAM_BOT_TOKEN}" },
|
|
"host_patterns": ["api.telegram.org"]
|
|
}
|
|
},
|
|
"max_response_bytes": 52428800,
|
|
"rate_limit": {
|
|
"requests_per_minute": 30,
|
|
"requests_per_hour": 1000
|
|
}
|
|
},
|
|
"secrets": {
|
|
"allowed_names": ["telegram_*"]
|
|
},
|
|
"channel": {
|
|
"allowed_paths": ["/webhook/telegram"],
|
|
"allow_polling": true,
|
|
"min_poll_interval_ms": 30000,
|
|
"workspace_prefix": "channels/telegram/",
|
|
"emit_rate_limit": {
|
|
"messages_per_minute": 100,
|
|
"messages_per_hour": 5000
|
|
},
|
|
"webhook": {
|
|
"secret_header": "X-Telegram-Bot-Api-Secret-Token",
|
|
"secret_name": "telegram_webhook_secret"
|
|
}
|
|
}
|
|
},
|
|
"config": {
|
|
"bot_username": null,
|
|
"owner_id": null,
|
|
"respond_to_all_group_messages": false,
|
|
"polling_enabled": false,
|
|
"poll_interval_ms": 30000,
|
|
"dm_policy": "pairing",
|
|
"allow_from": []
|
|
}
|
|
}
|