Files
bd5adc61c8 feat(bitrix24): imbot.v2 migration, 2-way media, openline sender-tag echo, and hardening (#1236)
* refactor(bitrix24): rename "Path B" framing to maintainer-specified naming [B24:2794]

Per maintainer hard rule #10 (no generic "Path A/B" framing) from PR #1061
review. The Bitrix24 MCP auto-onboard flow is Bitrix-specific glue
("Bitrix24 OAuth -> existing mcp_user_credentials bridge"), NOT a generic
MCP architecture pattern.

Naming convention applied consistently:
- First mention per file: full "Bitrix24 OAuth -> existing
  mcp_user_credentials bridge" (matches maintainer comment verbatim).
- Subsequent mentions in same file: shortened "mcp_user_credentials bridge".
- Test/log context referencing literal endpoint /api/auto-onboard: keep
  "auto-onboard" reference (it's the actual API endpoint name).

Changes are documentation-only:
- Rename in code comments + test descriptions + plan docs.
- Clarify framing in mcp_client.go + provisioner.go doc comments to
  emphasize Bitrix-specific glue (not generic MCP infra).
- Reuse existing mcp_user_credentials table + MCPServerStore methods
  (no schema / store / abstraction change).

Files:
- cmd/gateway.go (factory registration doc)
- internal/channels/bitrix24/{channel,factory,mcp_client,provisioner}.go
- internal/channels/bitrix24/{mcp_client,provisioner}_test.go
- plan/goclaw-mcp-integration.md (21 occurrences)

Verified: go build + MCP-related tests pass (TestProvision*,
TestInitMCPProvisioner*, TestMCPClient*).

Phase 1 of Path C execution per
plans/reports/decision-log-260519-1555-bitrix24-pr-fork-decision.md.

* fix: confine outbound media paths to agent workspace [B24:2794]

Tool MEDIA:<path> output reached channel file-upload sinks (Bitrix
imbot.v2.File.upload, Telegram sendDocument, etc.) verbatim via
parseMediaResult, with no workspace-boundary check. A malicious or buggy
tool emitting MEDIA:/etc/passwd could exfiltrate arbitrary files to chat.

Extract the EvalSymlinks+Rel containment from extractMediaFromContent into
a shared confineToWorkspace helper and apply it at the parseMediaResult
sink in processToolResult. Fixing at the source/egress boundary protects
every channel at once rather than per-channel. Paths that escape the
workspace are dropped and logged (security.media_path_rejected).

Add TestConfineToWorkspace (boundary unit) and
TestParseMediaResultConfinedToWorkspace (sink regression for H2).

* feat(bitrix24): support inbound + outbound media via imbot.v2 File API [B24:2794]

Bitrix24 channel was text-only; attachments were parsed but dropped.
- Inbound: download chat files via imbot.v2.File.download (one-time URL),
  forward to the agent with MIME preserved (internal/channels/bitrix24/download.go).
- Outbound: upload agent media to the chat via imbot.v2.File.upload
  (internal/channels/bitrix24/send_media.go).
- Add BaseChannel.HandleMessageMedia to preserve MIME/filename through the bus.
- Per-channel media_max_mb cap (default 20) applies to both directions.

Tests: 92 pass (internal/channels/bitrix24 + internal/channels), go vet clean (PG + sqliteonly).

* refactor(bitrix24): migrate messaging/bot-list/unregister to imbot v2 API [B24:2794]

Move outbound REST calls to the imbot v2 family (keeps register on v1):
- imbot.message.add -> imbot.v2.Chat.Message.send (fields.message shape, live-verified)
- imbot.bot.list (+ legacy imbot.list fallback) -> imbot.v2.Bot.list; add botListRows
  to normalize the v2 {bots:[...]} envelope, legacy array, and id-keyed map forms
- imbot.unregister -> imbot.v2.Bot.unregister

Bot registration stays on v1 imbot.register: v2 imbot.v2.Bot.register changes the
event-delivery model (per-event handler URLs -> eventMode), which would require
rewriting the inbound event parser. No user-facing behavior change.

Tests: bitrix24 package green; go vet ./... clean.

* feat(bitrix24): route whisper via v1 SKIP_CONNECTOR + add v2 replyId [B24:2794]

Bot was leaking HiddenMessage (whisper) replies to the external Zalo
connector because every outbound call went through imbot.v2.Chat.Message.send,
which has no equivalent of the v1 SKIP_CONNECTOR flag. Branch the outbound
path on inbound visibility:

  whisper → imbot.message.add + SKIP_CONNECTOR=Y  (v1, send_v1.go)
  public  → imbot.v2.Chat.Message.send + fields.replyId  (v2, send_v2.go)

Pipeline:
  events.go        parse data[PARAMS][PARAMS][COMPONENT_ID]=HiddenMessage
                   into EventParams.IsHiddenMessage (form + JSON variants)
  handle.go        set bitrix_visibility on InboundMessage.Metadata
  consumer         forward visibility + message_id into OutboundMessage
  send.go          resolveSendOptions + sendChunk dispatcher +
                   shared callWithRateLimitRetry helper
  metadata_keys.go single source of truth for the keys + values

Defaults preserve pre-refactor behaviour: callers that don't populate
bitrix_visibility still go through v2 public, and replyId is omitted
unless a numeric bitrix_message_id arrives in metadata.

Tests:
  TestParseEvent_FormURLEncoded_IsHiddenMessage  (3 cases)
  TestParseEvent_JSON_IsHiddenMessage             (3 cases)
  TestResolveSendOptions                          (8 cases)
  TestSend_BranchesOnVisibility                   (4 cases)

* feat(bitrix24): openline sender-tag echo on replies [B24:2794]

Openline sender-tag echo (this change):
- Capture the connector sender tag ("[name #id]:" or "[name] #id:") from
  inbound openline group messages, strip it from the body the agent sees,
  and re-prepend the canonical "[name] #id:" form to the reply so the Open
  Channel connector routes the answer back to the right external user.
- New sender_prefix.go helper (+ test) accepts both inbound layouts and
  emits one canonical form; scoped to messages carrying the tag, so plain
  chats are unaffected.
- metadata_keys.go: MetaKeySenderPrefix; handle.go capture/strip/stash;
  gateway_consumer_normal.go forwards the key; send.go prepends it on the
  first chunk before chunking.

Bundled bitrix24 channel-core work already on this branch:
- handle.go: @mention is the sole trigger for both staff and connector
  customers; unmentioned traffic is dropped (was: drop all connector msgs).
- isGroupMessageType: treat SONET_GROUP "B" as a group.
- handle_test.go, mcp_client_test.go: cover the above.

* feat(bitrix24): accept colon-less openline sender tag, echo [name] #id [B24:2794]

The Open Channel connector dropped the trailing colon from its sender tag:
inbound now arrives as "[Name] #id <msg>" (was "[Name] #id: <msg>"). The
id-bearing patterns required the colon, so the tag fell through to the
name-only branch and the reply echoed "[Name]" — dropping the #id the
connector needs to route the answer back.

- sender_prefix.go: make the trailing ":" optional on both id layouts
  ([name #id] / [name] #id, with or without colon) and echo the canonical
  "[name] #id" (no colon) to match the connector's current format. Bare
  "[name]" (no id) still echoes "[name]" for Open Channel only.
- handle.go: gate the bare name-only layout to Open Channel (isOpenChannel)
  so ordinary group chats starting with "[x] ..." are left untouched.
- sender_prefix_test.go: cover colon/no-colon x id-inside/id-outside, the
  name-only openline case, and the non-openline no-op.

* fix: security and robustness fixes from the bitrix24 channel review [B24:2794]

- download.go: block redirect-based SSRF on inbound media. CheckRedirect
  re-validates each hop (http(s) only, reject private/loopback/link-local
  hosts, cap hops); the initial portal-domain pin is no longer bypassable
  via a 3xx to an internal service. Public-host redirects still allowed.
- handle.go: extract/echo the openline sender tag only for Open Channel
  sessions (was: any group chat), removing bogus prefixes in CRM group
  chats and narrowing the forged-tag misroute surface.
- loop_tools.go + loop_media.go: confine result.Media to the agent / team /
  tenant-allowed roots (new confineToAnyRoot) before a channel uploads it,
  so a prompt-injected out-of-workspace path (e.g. /etc/passwd) cannot
  exfiltrate, while legitimate cross-workspace media (team files, delegatee
  output) still flows.
- send_media.go: bounded outbound read via io.LimitReader replaces the
  os.Stat + os.ReadFile pair, closing the TOCTOU size-cap bypass; cap a
  single message's outbound attachments at 10 (mirrors inbound).
- register.go: paginate imbot.v2.Bot.list (limit/offset + hasNextPage,
  capped at 40 pages) so verify/lookup see bots past the first 50.
- mcp_client.go: redact access_token / refresh_token / client_secret from an
  echoed MCP error body before it is logged or returned (+ test).

* fix(security): validate resolved dial IP on Bitrix media redirects [B24:2794]

The inbound media download redirect guard only string-checked the redirect
hostname (isPrivateOrLoopback on req.URL.Hostname()), so a redirect to a public
hostname that resolves to 127.0.0.1 / 169.254.169.254 / an RFC1918 address — or a
DNS-rebinding swap between check and dial — still passed the guard and the client
would connect. Reported in PR review.

Add security.NewRedirectFollowingSafeClient: it follows redirects but validates
the RESOLVED destination IP of every hop at dial time via net.Dialer.Control,
reusing the existing blocked-CIDR list. The IP it checks is the IP actually
dialed, so both redirect-to-internal and DNS rebinding are refused, while
legitimate public CDN redirects still succeed. download.go now uses it instead of
the hostname-string guard.

Tests: deterministic dial-control table (loopback / link-local / private /
multicast / unspecified / public, v4 + v6), malformed/non-IP addr, test bypass,
loopback-dial-blocked client wiring, and redirect cap + scheme checks.

* feat(bitrix24): per-participant Zalo openline identity from 3-token sender tag [B24:2794]

Parse the connector's "[Name] #uid #msgId" sender tag so each external
customer in a shared Open Channel group gets its own contact + USER.md
instead of collapsing onto the connector proxy id. Identity minting is
gated on IS_CONNECTOR=Y to reject operator forged tags. Echo back the
msgId only ("#msgId") on replies; keep the legacy single-number and
name-only layouts unchanged. Zero DB migration.

- sender_prefix.go: parseOpenlineSenderTag() classifies 3-token / legacy / name-only
- handle.go: synthetic senderID "openlines:{instance}:{chat}:{uid}" + participant_user_id metadata, gated on FromIsConnector
- gateway_consumer_normal.go: deriveGroupUserID() routes participant -> per-person scope, group fallback otherwise
- send.go: buildAddressMention numeric-id guard so synthetic ids don't emit invalid [USER=...] BBCode
- MetaKeyMessageID kept as Bitrix MESSAGE_ID (drives v2 fields.replyId); connector msgId surfaced only via echo prefix

---------

Co-authored-by: DangTinh311 <dangtinh31193@gmail.com>
Co-authored-by: Chinh Dang <chinhdang@192.168.68.104>
2026-06-22 14:23:34 +07:00

566 lines
17 KiB
Go

package bitrix24
import (
"context"
"errors"
"strings"
"testing"
"unicode/utf8"
"github.com/nextlevelbuilder/goclaw/internal/bus"
)
func TestChunkText_ShortStaysOneChunk(t *testing.T) {
got := chunkText("hello world", 100)
if len(got) != 1 || got[0] != "hello world" {
t.Errorf("short text should not be split: %v", got)
}
}
func TestChunkText_EmptyReturnsNil(t *testing.T) {
if got := chunkText("", 100); got != nil {
t.Errorf("empty input should return nil, got %v", got)
}
if got := chunkText(" \t\n ", 100); got != nil {
t.Errorf("whitespace-only should return nil, got %v", got)
}
}
func TestChunkText_PrefersNewlineBoundary(t *testing.T) {
text := "line1\nline2\nline3-longer"
got := chunkText(text, 10)
if len(got) < 2 {
t.Fatalf("expected at least 2 chunks, got %v", got)
}
// First chunk must end at a line boundary — never mid-word.
if strings.Contains(got[0], "line3") {
t.Errorf("first chunk overflowed past boundary: %q", got[0])
}
}
func TestChunkText_PrefersWhitespaceWhenNoNewline(t *testing.T) {
text := "one two three four five"
got := chunkText(text, 8)
if len(got) < 2 {
t.Fatalf("expected multi-chunk, got %v", got)
}
// Rejoin without losing characters.
rejoined := strings.Join(got, " ")
// Allow whitespace shifting but every non-space rune from input must survive.
origLetters := strings.ReplaceAll(text, " ", "")
gotLetters := strings.ReplaceAll(rejoined, " ", "")
if origLetters != gotLetters {
t.Errorf("chunking lost characters: %q → %q", text, rejoined)
}
}
func TestChunkText_HardBreakForLongWord(t *testing.T) {
// No newline, no whitespace — must hard-break on rune boundary.
text := strings.Repeat("a", 50)
got := chunkText(text, 10)
if len(got) < 5 {
t.Fatalf("expected at least 5 chunks, got %d: %v", len(got), got)
}
for i, c := range got {
if utf8.RuneCountInString(c) > 10 {
t.Errorf("chunk %d exceeds limit (%d runes): %q", i, utf8.RuneCountInString(c), c)
}
}
}
func TestChunkText_UnicodeSafe(t *testing.T) {
// Vietnamese text — each character takes 2-3 bytes in UTF-8. The byte-
// length is > limit but the rune-count should stay within.
text := "Xin chào tôi là trợ lý AI đây là tin nhắn siêu dài"
got := chunkText(text, 10)
for i, c := range got {
if utf8.RuneCountInString(c) > 10 {
t.Errorf("chunk %d has %d runes, limit 10: %q", i, utf8.RuneCountInString(c), c)
}
if !utf8.ValidString(c) {
t.Errorf("chunk %d is not valid UTF-8", i)
}
}
}
func TestChunkText_LimitZeroUsesDefault(t *testing.T) {
// When limit is <= 0 we should fall back to 4000 — so a short string
// stays in one chunk.
got := chunkText("hi", 0)
if len(got) != 1 || got[0] != "hi" {
t.Errorf("zero limit: got %v", got)
}
}
func TestSliceRunes(t *testing.T) {
h, tail := sliceRunes("abcdef", 3)
if h != "abc" || tail != "def" {
t.Errorf("sliceRunes(abcdef, 3) = (%q, %q); want (abc, def)", h, tail)
}
// n >= rune count → whole string returned as head.
h, tail = sliceRunes("abc", 10)
if h != "abc" || tail != "" {
t.Errorf("sliceRunes(abc, 10) = (%q, %q); want (abc, '')", h, tail)
}
// Unicode: Vietnamese "xin" → 3 runes, bytes differ.
h, tail = sliceRunes("xinchào", 3)
if h != "xin" || tail != "chào" {
t.Errorf("unicode slice: (%q, %q); want (xin, chào)", h, tail)
}
}
func TestFindChunkBoundary_NewlinePreferred(t *testing.T) {
// Newline at byte index 5, space at 11. Must cut AFTER newline (index 6).
s := "line1\nmore content here"
cut := findChunkBoundary(s, 15)
if cut != 6 {
t.Errorf("cut = %d; want 6 (after newline)", cut)
}
}
func TestFindChunkBoundary_WhitespaceFallback(t *testing.T) {
// No newline. Cut should land right after the last space inside `limit`.
s := "one two three four"
cut := findChunkBoundary(s, 8)
// First 8 runes: "one two " — last space at index 7, cut = 8.
if cut != 8 {
t.Errorf("cut = %d; want 8 (after space)", cut)
}
}
func TestFindChunkBoundary_HardBreakNoBoundaries(t *testing.T) {
s := "abcdefghij"
cut := findChunkBoundary(s, 5)
if cut != 5 {
t.Errorf("hard break cut = %d; want 5", cut)
}
}
func TestIsRateLimitErr(t *testing.T) {
cases := []struct {
name string
err error
want bool
}{
{"nil", nil, false},
{"plain error", errors.New("generic"), false},
{"QUERY_LIMIT_EXCEEDED", &APIError{Code: "QUERY_LIMIT_EXCEEDED"}, true},
{"OPERATION_TIME_LIMIT", &APIError{Code: "OPERATION_TIME_LIMIT"}, true},
{"other code", &APIError{Code: "expired_token"}, false},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
if got := isRateLimitErr(tc.err); got != tc.want {
t.Errorf("isRateLimitErr(%v) = %v; want %v", tc.err, got, tc.want)
}
})
}
}
func TestSend_NotRunningErrors(t *testing.T) {
fs := newFakeStore()
resetWebhookRouterForTest()
defer resetWebhookRouterForTest()
fn := FactoryWithPortalStore(fs, "")
ch, err := fn("b1", nil,
[]byte(`{"portal":"p","bot_code":"c","bot_name":"n"}`),
bus.New(), nil)
if err != nil {
t.Fatalf("factory: %v", err)
}
// Channel not started — IsRunning() == false.
err = ch.Send(context.Background(), bus.OutboundMessage{ChatID: "1", Content: "hi"})
if err == nil || !strings.Contains(err.Error(), "not running") {
t.Errorf("expected 'not running' error, got %v", err)
}
}
func TestSend_MissingChatID(t *testing.T) {
fs := newFakeStore()
resetWebhookRouterForTest()
defer resetWebhookRouterForTest()
fn := FactoryWithPortalStore(fs, "")
ch, err := fn("b1", nil,
[]byte(`{"portal":"p","bot_code":"c","bot_name":"n"}`),
bus.New(), nil)
if err != nil {
t.Fatalf("factory: %v", err)
}
bc := ch.(*Channel)
// Hack: pretend we're initialised without going through Start.
bc.SetRunning(true)
bc.startMu.Lock()
bc.botID = 1
bc.client = NewClient("portal.bitrix24.com", nil)
bc.startMu.Unlock()
err = ch.Send(context.Background(), bus.OutboundMessage{ChatID: " ", Content: "hi"})
if err == nil || !strings.Contains(err.Error(), "chat_id") {
t.Errorf("expected missing chat_id error, got %v", err)
}
}
func TestSend_EmptyContentIsNoOp(t *testing.T) {
fs := newFakeStore()
resetWebhookRouterForTest()
defer resetWebhookRouterForTest()
fn := FactoryWithPortalStore(fs, "")
ch, err := fn("b1", nil,
[]byte(`{"portal":"p","bot_code":"c","bot_name":"n"}`),
bus.New(), nil)
if err != nil {
t.Fatalf("factory: %v", err)
}
bc := ch.(*Channel)
bc.SetRunning(true)
bc.startMu.Lock()
bc.botID = 1
bc.client = NewClient("portal.bitrix24.com", nil)
bc.startMu.Unlock()
// No content, no media — must not attempt any HTTP call.
if err := ch.Send(context.Background(), bus.OutboundMessage{ChatID: "42", Content: " "}); err != nil {
t.Errorf("empty content should be no-op, got %v", err)
}
}
// TestResolveSendOptions verifies the Metadata → sendOptions decoding that
// Send() uses to pick v1 whisper vs v2 public and to thread replyId into
// the v2 fields object. Defaults must preserve pre-refactor behaviour
// (public, no replyId) so any caller missing the keys still works.
func TestResolveSendOptions(t *testing.T) {
cases := []struct {
name string
meta map[string]string
wantVisibility string
wantReplyToMID int
}{
{
name: "empty metadata defaults to public",
meta: nil,
wantVisibility: VisibilityPublic,
wantReplyToMID: 0,
},
{
name: "whisper visibility",
meta: map[string]string{MetaKeyVisibility: VisibilityWhisper},
wantVisibility: VisibilityWhisper,
wantReplyToMID: 0,
},
{
name: "explicit public visibility",
meta: map[string]string{MetaKeyVisibility: VisibilityPublic},
wantVisibility: VisibilityPublic,
wantReplyToMID: 0,
},
{
name: "unknown visibility value falls back to public",
meta: map[string]string{MetaKeyVisibility: "secret"},
wantVisibility: VisibilityPublic,
wantReplyToMID: 0,
},
{
name: "valid numeric message_id parsed for replyToMID",
meta: map[string]string{MetaKeyMessageID: "297178"},
wantVisibility: VisibilityPublic,
wantReplyToMID: 297178,
},
{
name: "non-numeric message_id ignored",
meta: map[string]string{MetaKeyMessageID: "abc"},
wantVisibility: VisibilityPublic,
wantReplyToMID: 0,
},
{
name: "zero message_id ignored",
meta: map[string]string{MetaKeyMessageID: "0"},
wantVisibility: VisibilityPublic,
wantReplyToMID: 0,
},
{
name: "whisper with replyToMID still captures both",
meta: map[string]string{
MetaKeyVisibility: VisibilityWhisper,
MetaKeyMessageID: "12345",
},
wantVisibility: VisibilityWhisper,
wantReplyToMID: 12345,
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
opts := resolveSendOptions(tc.meta)
if opts.visibility != tc.wantVisibility {
t.Errorf("visibility = %q; want %q", opts.visibility, tc.wantVisibility)
}
if opts.replyToMID != tc.wantReplyToMID {
t.Errorf("replyToMID = %d; want %d", opts.replyToMID, tc.wantReplyToMID)
}
})
}
}
// TestSend_BranchesOnVisibility wires Send() through the HTTP-layer stub
// (captureRT) so we can assert exactly which Bitrix REST method got
// invoked and what params were on the wire. Public visibility → v2;
// whisper visibility → v1 with SKIP_CONNECTOR=Y. The matrix also covers
// replyId propagation on v2 and its absence on v1.
func TestSend_BranchesOnVisibility(t *testing.T) {
cases := []struct {
name string
metadata map[string]string
wantPath string
wantFormChecks map[string]string // exact form-key → expected value
notWantKeys []string // form keys that must be absent
}{
{
name: "whisper routes to v1 imbot.message.add with SKIP_CONNECTOR=Y",
metadata: map[string]string{
MetaKeyVisibility: VisibilityWhisper,
MetaKeyMessageID: "297178", // v1 ignores replyId so must NOT appear
},
wantPath: "/rest/imbot.message.add.json",
wantFormChecks: map[string]string{
"BOT_ID": "1",
"DIALOG_ID": "chat4878",
"MESSAGE": "hi from bot",
"SKIP_CONNECTOR": "Y",
},
notWantKeys: []string{
"fields[replyId]",
"replyId",
"botId",
},
},
{
name: "public with replyId routes to v2 + fields[replyId]",
metadata: map[string]string{
MetaKeyVisibility: VisibilityPublic,
MetaKeyMessageID: "297196",
},
wantPath: "/rest/imbot.v2.Chat.Message.send.json",
wantFormChecks: map[string]string{
"botId": "1",
"dialogId": "chat4878",
"fields[message]": "hi from bot",
"fields[replyId]": "297196",
},
notWantKeys: []string{
"SKIP_CONNECTOR",
"BOT_ID",
"MESSAGE",
},
},
{
name: "public without message_id routes to v2 without replyId",
metadata: map[string]string{MetaKeyVisibility: VisibilityPublic},
wantPath: "/rest/imbot.v2.Chat.Message.send.json",
wantFormChecks: map[string]string{
"botId": "1",
"dialogId": "chat4878",
"fields[message]": "hi from bot",
},
notWantKeys: []string{
"fields[replyId]",
"replyId",
"SKIP_CONNECTOR",
},
},
{
name: "missing visibility defaults to v2 public (backward-compat)",
metadata: nil,
wantPath: "/rest/imbot.v2.Chat.Message.send.json",
wantFormChecks: map[string]string{
"botId": "1",
"dialogId": "chat4878",
"fields[message]": "hi from bot",
},
notWantKeys: []string{
"SKIP_CONNECTOR",
"fields[replyId]",
},
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
rt := &captureRT{result: `{"result":{"id":1}}`}
client := newStubClient("test.bitrix24.com", rt)
ch, _ := newFakeChannelWithClient(t, client)
ch.SetRunning(true)
msg := bus.OutboundMessage{
ChatID: "chat4878",
Content: "hi from bot",
Metadata: tc.metadata,
}
if err := ch.Send(context.Background(), msg); err != nil {
t.Fatalf("Send error: %v", err)
}
if len(rt.paths) != 1 {
t.Fatalf("expected exactly 1 HTTP call, got %d (paths=%v)", len(rt.paths), rt.paths)
}
if rt.paths[0] != tc.wantPath {
t.Errorf("path = %q; want %q", rt.paths[0], tc.wantPath)
}
form := rt.reqs[0]
for k, want := range tc.wantFormChecks {
if got := form.Get(k); got != want {
t.Errorf("form[%q] = %q; want %q (full form: %v)", k, got, want, form)
}
}
for _, k := range tc.notWantKeys {
if v := form.Get(k); v != "" {
t.Errorf("form[%q] should be absent, got %q", k, v)
}
}
})
}
}
// TestSend_OL_EchoPrefixPrepended verifies the openline sender-tag echo: whatever
// handle.go placed in MetaKeySenderPrefix is prepended verbatim to the outbound
// text so the Open Channel connector can route the reply back to the right
// external message. send.go is format-agnostic — handle.go decides the shape
// ("#msgId" for 3-token, "[name] #msgId" for legacy).
func TestSend_OL_EchoPrefixPrepended(t *testing.T) {
cases := []struct {
name string
prefix string
wantMsg string
}{
{
name: "3-token echo is msgId only",
prefix: "#777888",
wantMsg: "#777888 hi from bot",
},
{
name: "legacy echo keeps full [name] #msgId",
prefix: "[Trung Hee] #7957717404177",
wantMsg: "[Trung Hee] #7957717404177 hi from bot",
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
rt := &captureRT{result: `{"result":{"id":1}}`}
client := newStubClient("test.bitrix24.com", rt)
ch, _ := newFakeChannelWithClient(t, client)
ch.SetRunning(true)
msg := bus.OutboundMessage{
ChatID: "chat4878",
Content: "hi from bot",
Metadata: map[string]string{
MetaKeyVisibility: VisibilityPublic,
MetaKeySenderPrefix: tc.prefix,
},
}
if err := ch.Send(context.Background(), msg); err != nil {
t.Fatalf("Send error: %v", err)
}
if len(rt.reqs) != 1 {
t.Fatalf("expected exactly 1 HTTP call, got %d", len(rt.reqs))
}
if got := rt.reqs[0].Get("fields[message]"); got != tc.wantMsg {
t.Errorf("fields[message] = %q; want %q", got, tc.wantMsg)
}
})
}
}
// TestBuildAddressMention covers the address-user resolver that prepends the
// `[USER=<id>][/USER]` BBCode to outbound replies in group chats. The format
// is intentionally empty-named so Bitrix renders the user's current display
// name from id at delivery time (sidesteps escaping for names with BBCode
// metacharacters and reflects renames between turns).
//
// Consumer-side gating (cmd/gateway_consumer_normal.go) is responsible for
// only setting `bitrix_address_user_id` in group inbounds and skipping
// synthetic senders. This test pins the channel-side behaviour given that
// gating contract.
func TestBuildAddressMention(t *testing.T) {
cases := []struct {
name string
meta map[string]string
botID int
want string
}{
{
name: "no_metadata_returns_empty",
meta: nil,
botID: 940,
want: "",
},
{
name: "empty_user_id_returns_empty",
meta: map[string]string{"bitrix_address_user_id": ""},
botID: 940,
want: "",
},
{
name: "whitespace_user_id_returns_empty",
meta: map[string]string{"bitrix_address_user_id": " "},
botID: 940,
want: "",
},
{
name: "real_user_id_returns_bbcode",
meta: map[string]string{"bitrix_address_user_id": "62"},
botID: 940,
want: "[USER=62][/USER]",
},
{
name: "trims_user_id_whitespace",
meta: map[string]string{"bitrix_address_user_id": " 62 "},
botID: 940,
want: "[USER=62][/USER]",
},
{
// Self-mention guard: bot's own numeric id matches addressee →
// suppress to avoid weird "@Bot Synity" prefix in bot's own message.
name: "self_mention_suppressed",
meta: map[string]string{"bitrix_address_user_id": "940"},
botID: 940,
want: "",
},
{
// Bot id unknown (channel not yet started) → don't apply guard,
// trust the consumer's gating. Returning the BBCode is harmless;
// Bitrix will render whatever user the id resolves to.
name: "unknown_bot_id_skips_self_guard",
meta: map[string]string{"bitrix_address_user_id": "940"},
botID: 0,
want: "[USER=940][/USER]",
},
{
// Synthetic openline per-participant id is not a real Bitrix user —
// emitting [USER=openlines:...] would render as literal garbage.
name: "synthetic_openline_id_suppressed",
meta: map[string]string{"bitrix_address_user_id": "openlines:tamgiac:chat4878:111222"},
botID: 940,
want: "",
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
got := buildAddressMention(tc.meta, tc.botID)
if got != tc.want {
t.Errorf("buildAddressMention(%v, %d) = %q; want %q", tc.meta, tc.botID, got, tc.want)
}
})
}
}
// (Send() integration with httptest server is covered by existing send tests
// — adding a new httptest pipeline just for the prepend would duplicate that
// scaffolding for what is logically a single string-concat call site. The
// helper test above pins the behaviour; trust the existing send pipeline
// for chunk routing.)