From 9fc3f1c5b8082f86ef47b98b3a5bb591d6725a17 Mon Sep 17 00:00:00 2001 From: MengMengCode Date: Sun, 9 Aug 2026 19:28:12 +0800 Subject: [PATCH] feat: add Telegram API URL handling and version comparison utilities - Implemented `telegramAPIURL` and `validateTelegramAPIURL` functions for constructing and validating Telegram API URLs. - Added semantic versioning utilities in `version.go` to compare versions and validate semantic version formats. - Created tests for version comparison logic in `version_test.go`. - Introduced IMS call handling in `call_runtime.go`, including methods for dialing, answering, and hanging up calls. - Added tests for incoming call handling and validation in `call_runtime_test.go`. - Developed a new `PluginsCard` component for managing plugins via URL or file upload in the web interface. - Implemented plugin management functions in `extensions.ts` and created an `ExtensionPage` for displaying plugin contributions. --- .github/workflows/release.yml | 4 + .gitignore | 3 + README.md | 19 +- cmd/vocat/cli.go | 18 +- cmd/vocat/develop.go | 108 ++++ cmd/vocat/main.go | 58 +- cmd/vocat/menu.go | 235 ++++++-- docs/README.zh-CN.md | 295 ++++++++++ internal/extensions/manager.go | 518 ++++++++++++++++++ internal/extensions/manager_test.go | 100 ++++ internal/extensions/manifest.go | 135 +++++ internal/modem/discovery.go | 58 +- internal/modem/discovery_test.go | 48 ++ internal/server/call_api.go | 262 +++++++++ internal/server/call_api_test.go | 30 + internal/server/device_api.go | 52 +- internal/server/device_features_api_test.go | 97 ++++ internal/server/extensions_api.go | 161 ++++++ internal/server/general_api.go | 118 +++- internal/server/server.go | 35 +- internal/server/settings_api.go | 20 +- internal/server/settings_api_test.go | 24 + internal/server/sms_api.go | 84 ++- internal/server/sms_api_test.go | 48 +- internal/server/sms_notifications.go | 20 +- internal/server/telegram_bot.go | 6 +- internal/server/telegram_bot_test.go | 45 ++ internal/server/telegram_url.go | 65 +++ internal/store/devices.go | 45 +- internal/store/domain_test.go | 97 ++++ internal/store/migrations.go | 25 + internal/store/models.go | 18 +- internal/store/sms.go | 86 ++- internal/store/store.go | 10 +- internal/update/asset_test.go | 2 +- internal/update/github.go | 36 +- internal/update/update.go | 77 ++- internal/update/version.go | 120 ++++ internal/update/version_test.go | 34 ++ internal/vowifi/ims/call_runtime.go | 468 ++++++++++++++++ internal/vowifi/ims/call_runtime_test.go | 72 +++ internal/vowifi/ims/provider.go | 9 +- internal/vowifi/ims/sms_runtime.go | 3 + internal/vowifi/orchestrator.go | 59 ++ internal/vowifi/runtime/manager.go | 52 ++ internal/vowifi/types.go | 19 + scripts/install.sh | 7 +- web/src/App.tsx | 2 + web/src/api.ts | 9 +- .../devices/DiscoveredDeviceRow.tsx | 2 +- web/src/components/settings/PluginsCard.tsx | 120 ++++ .../components/shell/AuthenticatedShell.tsx | 41 +- web/src/components/sms/smsApi.ts | 5 +- web/src/components/sms/smsText.ts | 5 +- web/src/extensions.ts | 35 ++ web/src/lib/i18n-en.ts | 26 + web/src/pages/ExtensionPage.tsx | 46 ++ web/src/pages/ProxyPage.tsx | 24 + web/src/pages/SettingsPage.tsx | 12 +- web/src/pages/SmsPage.tsx | 20 +- web/src/types.ts | 3 + 61 files changed, 4029 insertions(+), 226 deletions(-) create mode 100644 cmd/vocat/develop.go create mode 100644 docs/README.zh-CN.md create mode 100644 internal/extensions/manager.go create mode 100644 internal/extensions/manager_test.go create mode 100644 internal/extensions/manifest.go create mode 100644 internal/server/call_api.go create mode 100644 internal/server/call_api_test.go create mode 100644 internal/server/extensions_api.go create mode 100644 internal/server/telegram_url.go create mode 100644 internal/update/version.go create mode 100644 internal/update/version_test.go create mode 100644 internal/vowifi/ims/call_runtime.go create mode 100644 internal/vowifi/ims/call_runtime_test.go create mode 100644 web/src/components/settings/PluginsCard.tsx create mode 100644 web/src/extensions.ts create mode 100644 web/src/pages/ExtensionPage.tsx diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a046d1a..19130db 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -72,6 +72,10 @@ jobs: goarch: arm64 goarm: "" filename: vocat-linux-arm64 + - target: linux-aarch64 + goarch: arm64 + goarm: "" + filename: vocat-linux-aarch64 - target: linux-armv7 goarch: arm goarm: "7" diff --git a/.gitignore b/.gitignore index d81703a..9f23bf7 100644 --- a/.gitignore +++ b/.gitignore @@ -33,9 +33,12 @@ __pycache__/ # committed. The whole build directory and the root release.py are ignored. build/*.py +/extension/ + # ---- Docs / scratch ---- *.md !README.md +!docs/**/*.md *.txt build/lists/ diff --git a/README.md b/README.md index f4caa08..fd35529 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@

- Linux + Linux Docker WiFi Calling eSIM @@ -22,6 +22,8 @@ GitHub Actions

+**English** | [简体中文](docs/README.zh-CN.md) + Vocat is an open-source web control panel and engineering toolkit for Quectel EC20/EC25-class cellular modems. It combines modem discovery, live radio status, AT and USSD terminals, SMS, WiFi Calling, eSIM management, network selection, proxy routing, notifications, audit logs, and release automation in one self-contained service. The backend is written in Go, the interface is built with React and TypeScript, and the production frontend is embedded into the Go binary. A single executable contains the web application and uses SQLite for persistent state. @@ -76,7 +78,7 @@ sudo bash install.sh 0.0.2 The installer: -- detects `amd64`, `386`, `arm64`, or `armv7`; +- detects `amd64`, `386`, `arm64`, `aarch64`, or `armv7`; - downloads the matching GitHub Release binary; - verifies it against `SHA256SUMS`; - installs Vocat under `/opt/vocat`; @@ -99,6 +101,7 @@ Download the matching binary and `SHA256SUMS` from GitHub Releases: | Linux x86-64 | `vocat-linux-amd64` | | Linux x86 32-bit | `vocat-linux-386` | | Linux ARM64 | `vocat-linux-arm64` | +| Linux AArch64 | `vocat-linux-aarch64` | | Linux ARMv7 | `vocat-linux-armv7` | Verify and install it: @@ -110,11 +113,13 @@ sudo install -m 0755 vocat-linux-amd64 /opt/vocat/bin/vocat sudo env \ VOCAT_DATABASE_PATH=/opt/vocat/data/vocat.db \ VOCAT_ADMIN_PASSWORD=change-this-password \ - /opt/vocat/bin/vocat + /opt/vocat/bin/vocat serve ``` -This manual command runs Vocat in the foreground. Use the one-click installer -when a managed systemd service and automatic restart are required. +This manual command runs Vocat in the foreground. Use `vocat serve` so the +process starts the server directly; running `vocat` without arguments as root +on a TTY opens the interactive management menu instead. Use the one-click +installer when a managed systemd service and automatic restart are required. ### Docker @@ -167,7 +172,7 @@ Vocat reads an optional JSON configuration file from `VOCAT_CONFIG`, then applie | `VOCAT_SECURE_COOKIES` | `false` | Marks session cookies as secure when HTTPS is used. | | `VOCAT_SHUTDOWN_TIMEOUT` | `10s` | Graceful shutdown timeout. | | `VOCAT_MAX_REQUEST_BODY_BYTES` | `1048576` | Maximum API request body size. | -| `VOCAT_REPO` | empty | GitHub repository used by the self-updater, in `owner/name` form. | +| `VOCAT_REPO` | `MengMengCode/VoCat` | Trusted GitHub repository used by the self-updater, in `owner/name` form. | | `GITHUB_TOKEN` | empty | Optional GitHub token for private repositories or higher API limits. | Do not store Telegram tokens, SMTP passwords, webhook secrets, SIM credentials, or other private data in the repository. Configure them through the application settings or protected environment files. @@ -255,7 +260,7 @@ go build -trimpath -ldflags "-s -w" -o vocat ./cmd/vocat Pushing a version tag starts two GitHub Actions workflows: -- `release-binaries` builds and publishes `amd64`, `386`, `arm64`, and `armv7` binaries plus `SHA256SUMS`. +- `release-binaries` builds and publishes `amd64`, `386`, `arm64`, `aarch64`, and `armv7` binaries plus `SHA256SUMS`. - `docker` builds and publishes a multi-architecture image to GitHub Container Registry. ```bash diff --git a/cmd/vocat/cli.go b/cmd/vocat/cli.go index 4c444ad..6c67892 100644 --- a/cmd/vocat/cli.go +++ b/cmd/vocat/cli.go @@ -15,23 +15,29 @@ func printUsage(w io.Writer) { fmt.Fprintf(w, `vocat %s Usage: - vocat Run the vocat server (default; same as no arguments). + vocat No arguments: interactive management menu when run as + root on a TTY, otherwise the server. systemd (non-TTY) + starts the server unchanged. + vocat serve Run the server in the foreground (use from a TTY when + vocat without arguments would enter the menu). vocat version Print the build version and exit. vocat update Check GitHub for a newer release and self-update. Flags: --check Only report whether an update is available. - --repo owner/name GitHub repository (default: $VOCAT_REPO). + --repo owner/name GitHub repository (default: $VOCAT_REPO or MengMengCode/VoCat). --target path Binary to replace (default: running exe). --force Reinstall even at the same version. Environment: VOCAT_REPO Fallback for --repo. GITHUB_TOKEN Optional bearer token for private repos or higher rate limits. - vocat menu Interactive lifecycle menu (run as root on the host): - change password, restart service, uninstall. + vocat menu Interactive lifecycle menu (root on the host): + toggle language, change password, restart, update, + uninstall. vocat help Show this help message. -When run without a subcommand, vocat starts the HTTP server using -VOCAT_* environment variables or $VOCAT_CONFIG for configuration. +When run without a subcommand on a non-TTY (e.g. systemd), vocat starts the +HTTP server using VOCAT_* environment variables or $VOCAT_CONFIG for +configuration. `, buildinfo.Version) } diff --git a/cmd/vocat/develop.go b/cmd/vocat/develop.go new file mode 100644 index 0000000..21c7063 --- /dev/null +++ b/cmd/vocat/develop.go @@ -0,0 +1,108 @@ +package main + +import ( + "context" + "encoding/json" + "errors" + "fmt" + "log/slog" + "os" + "strings" + "time" + + "vocat/internal/config" + "vocat/internal/store" +) + +// developerEnabledSettingKey is the app_settings key that gates the entire +// plugin/extension system. When absent the developer mode defaults to off, so +// a fresh install exposes no plugin surface until an operator explicitly turns +// it on with `vocat develop on` and restarts the service. +const developerEnabledSettingKey = "developer.enabled" + +// runDevelop handles the hidden `vocat develop on|off` subcommand. It is +// intentionally excluded from printUsage and the interactive menu: the plugin +// system is an opt-in developer surface, and the toggle must be typed in full +// to activate it. The flag is persisted to app_settings and takes effect on +// the next server start (run() reads it before creating the plugin manager). +func runDevelop(args []string, logger *slog.Logger) error { + if len(args) == 0 { + return errors.New(`usage: vocat develop `) + } + enabled, ok := parseDevelopArg(args[0]) + if !ok { + return fmt.Errorf(`vocat develop: invalid argument %q (expected "on" or "off")`, args[0]) + } + + // Match the menu's env resolution. An operator runs `vocat develop` on the + // host where the shell has not sourced /etc/vocat/env (a systemd + // EnvironmentFile, not a shell rc) and VOCAT_DATABASE_PATH is unset, so + // config.Load() would otherwise resolve a CWD-relative ./data/vocat.db — a + // different database than /opt/vocat/data/vocat.db the service reads. The + // flag would then be written to a DB the service never opens, silently. + loadMenuEnv() + + cfg, err := config.Load() + if err != nil { + return fmt.Errorf("load configuration: %w", err) + } + ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) + defer cancel() + + database, err := store.Open(ctx, cfg.DatabasePath) + if err != nil { + return fmt.Errorf("open database: %w", err) + } + defer database.Close() + + payload, err := json.Marshal(map[string]bool{"enabled": enabled}) + if err != nil { + return fmt.Errorf("encode developer flag: %w", err) + } + if err := database.UpsertAppSetting(ctx, store.AppSetting{ + Key: developerEnabledSettingKey, + Value: payload, + }); err != nil { + return fmt.Errorf("persist developer flag: %w", err) + } + + if enabled { + fmt.Printf("开发者模式已开启。重启 vocat 服务后插件功能生效。\n数据库：%s\n", cfg.DatabasePath) + fmt.Printf("Developer mode enabled. Restart the vocat service for plugins to take effect.\nDatabase: %s\n", cfg.DatabasePath) + } else { + fmt.Printf("开发者模式已关闭。重启 vocat 服务后插件功能将停用。\n数据库：%s\n", cfg.DatabasePath) + fmt.Printf("Developer mode disabled. Restart the vocat service to deactivate plugins.\nDatabase: %s\n", cfg.DatabasePath) + } + return nil +} + +func parseDevelopArg(arg string) (bool, bool) { + switch strings.ToLower(strings.TrimSpace(arg)) { + case "on", "1", "true", "yes": + return true, true + case "off", "0", "false", "no": + return false, true + default: + return false, false + } +} + +// isDeveloperEnabled reads the persisted developer-mode flag. A missing record +// or an unparseable value resolves to false — the system defaults closed, so +// any read failure keeps plugins off rather than exposing them by accident. +func isDeveloperEnabled(ctx context.Context, database *store.Store) bool { + setting, err := database.AppSetting(ctx, developerEnabledSettingKey) + if err != nil { + if !errors.Is(err, store.ErrNotFound) { + fmt.Fprintf(os.Stderr, "vocat: read developer flag failed; plugin system stays off: %v\n", err) + } + return false + } + var document struct { + Enabled bool `json:"enabled"` + } + if err := json.Unmarshal(setting.Value, &document); err != nil { + return false + } + return document.Enabled +} diff --git a/cmd/vocat/main.go b/cmd/vocat/main.go index 5404bee..21abe79 100644 --- a/cmd/vocat/main.go +++ b/cmd/vocat/main.go @@ -9,13 +9,17 @@ import ( "net/http" "os" "os/signal" + "path/filepath" "strings" "syscall" "time" + "golang.org/x/term" + "vocat/internal/auth" "vocat/internal/config" "vocat/internal/device" + "vocat/internal/extensions" "vocat/internal/loghub" "vocat/internal/server" "vocat/internal/store" @@ -35,8 +39,25 @@ func main() { args := os.Args[1:] switch subcommand, rest := splitSubcommand(args); subcommand { case "": - // No subcommand: run the server. Backward-compatible with the - // existing systemd unit (ExecStart=/opt/vocat/bin/vocat). + // No subcommand: TTY+root → interactive menu (operator on the host); + // otherwise run the server. systemd runs vocat with stdin=/dev/null + // (non-TTY) so the unit keeps starting the server unchanged. Non-root + // on a TTY also falls through to the server rather than erroring on + // runMenu's root requirement. + if term.IsTerminal(int(os.Stdin.Fd())) && os.Geteuid() == 0 { + if err := runMenu(logger); err != nil { + logger.Error("menu failed", "error", err) + os.Exit(1) + } + } else { + if err := run(logger, logs); err != nil { + logger.Error("server stopped", "error", err) + os.Exit(1) + } + } + case "serve": + // Explicit foreground server. Use this when vocat with no arguments + // would otherwise enter the menu (root on a TTY) but a server is wanted. if err := run(logger, logs); err != nil { logger.Error("server stopped", "error", err) os.Exit(1) @@ -53,6 +74,14 @@ func main() { logger.Error("menu failed", "error", err) os.Exit(1) } + case "develop": + // Hidden subcommand: intentionally not listed in printUsage or the + // interactive menu. It toggles the developer-mode flag that gates the + // entire plugin/extension system; the flag takes effect on next start. + if err := runDevelop(rest, logger); err != nil { + logger.Error("develop failed", "error", err) + os.Exit(2) + } case "help", "-h", "--help": printUsage(os.Stdout) default: @@ -91,6 +120,25 @@ func run(logger *slog.Logger, logs *loghub.Hub) error { } defer database.Close() + // The plugin/extension system is gated behind a hidden developer-mode flag. + // When off (the default) the manager is never created and the server receives + // a nil Extensions handle, so every /extensions* and /plugin-assets/* route + // returns 503/404 and the SPA hides the plugin surface. + developerEnabled := isDeveloperEnabled(startupContext, database) + var extensionManager *extensions.Manager + if developerEnabled { + extensionManager, err = extensions.NewManager( + filepath.Join(filepath.Dir(cfg.DatabasePath), "plugins"), + logger, + ) + if err != nil { + return fmt.Errorf("create plugin manager: %w", err) + } + defer extensionManager.Close() + } else { + logger.Info("developer mode is off; plugin system disabled") + } + authService, err := auth.New(database, auth.Options{ SessionTTL: cfg.SessionTTL, }) @@ -154,6 +202,10 @@ func run(logger *slog.Logger, logs *loghub.Hub) error { Logger: logger, SecureCookies: cfg.SecureCookies, MaxRequestBodyBytes: cfg.MaxRequestBodyBytes, + Extensions: extensionManager, + DeveloperEnabled: developerEnabled, + UpdateRepository: strings.TrimSpace(os.Getenv("VOCAT_REPO")), + UpdateToken: strings.TrimSpace(os.Getenv("GITHUB_TOKEN")), }) if err != nil { return err @@ -302,6 +354,7 @@ func newVoWiFiOrchestrator( _, saveErr := database.SaveSMSMessage(ctx, store.SMSMessage{ MessageID: message.MessageID, DeviceID: message.DeviceID, + ModemIMEI: deviceConfig.ModemIMEI, IMSI: message.IMSI, Peer: message.From, Direction: "inbound", @@ -318,6 +371,7 @@ func newVoWiFiOrchestrator( OnSMSStatus: func(ctx context.Context, report ims.ReceivedSMSStatus) error { deliveryReport := store.SMSDeliveryReport{ DeviceID: report.DeviceID, + ModemIMEI: deviceConfig.ModemIMEI, IMSI: report.IMSI, Peer: report.To, Source: "ims", diff --git a/cmd/vocat/menu.go b/cmd/vocat/menu.go index 9c0a0b1..8daaa14 100644 --- a/cmd/vocat/menu.go +++ b/cmd/vocat/menu.go @@ -3,6 +3,7 @@ package main import ( "bufio" "context" + "encoding/json" "errors" "fmt" "log/slog" @@ -16,18 +17,62 @@ import ( "vocat/internal/auth" "vocat/internal/config" "vocat/internal/store" + "vocat/internal/update" ) -//envFilePath is the systemd EnvironmentFile that carries VOCAT_ADMIN_PASSWORD. +// envFilePath is the systemd EnvironmentFile that carries VOCAT_ADMIN_PASSWORD. // EnsureAdmin reseeds the DB from it on every start, so change-password must // rewrite it or the next restart reverts the password. const envFilePath = "/etc/vocat/env" const systemdUnitPath = "/etc/systemd/system/vocat.service" -// runMenu is the interactive lifecycle menu: change password, restart the -// systemd unit, or fully uninstall vocat. It must run as root on the host -// (needs systemctl + the 0600 env file). Docker deployments do not use it. +// defaultDatabasePath is the install-default SQLite location written into the +// systemd unit by scripts/install.sh. Used only when VOCAT_DATABASE_PATH is not +// already set in the operator's environment. +const defaultDatabasePath = "/opt/vocat/data/vocat.db" + +// uiPreferencesSettingKey is the same app_settings key the Web UI's +// /api/settings/preferences handler reads and writes (see general_api.go). The +// menu toggles language through it so a single preference is shared with the +// SPA and the backend i18n layer. +const uiPreferencesSettingKey = "ui.preferences" + +// loadMenuEnv ensures the menu reaches the production config that systemd +// would otherwise inject. When an operator runs `sudo vocat` on the host, the +// shell has not sourced /etc/vocat/env (a systemd EnvironmentFile, not a shell +// rc) and VOCAT_DATABASE_PATH is unset, so config.Load() would resolve a +// CWD-relative ./data/vocat.db — a different, empty database than +// /opt/vocat/data/vocat.db the service uses. This loads the installed env file +// for VOCAT_ADMIN_PASSWORD and pins VOCAT_DATABASE_PATH to the install default, +// without overriding any value the operator already exported. +func loadMenuEnv() { + if _, ok := os.LookupEnv("VOCAT_DATABASE_PATH"); !ok { + _ = os.Setenv("VOCAT_DATABASE_PATH", defaultDatabasePath) + } + if data, err := os.ReadFile(envFilePath); err == nil { + for _, line := range strings.Split(string(data), "\n") { + line = strings.TrimSpace(line) + if line == "" || strings.HasPrefix(line, "#") { + continue + } + eq := strings.IndexByte(line, '=') + if eq < 0 { + continue + } + key := strings.TrimSpace(line[:eq]) + val := strings.TrimSpace(line[eq+1:]) + if _, ok := os.LookupEnv(key); !ok { + _ = os.Setenv(key, val) + } + } + } +} + +// runMenu is the interactive lifecycle menu: toggle language, change password, +// restart the systemd unit, self-update, or fully uninstall vocat. It must run +// as root on the host (needs systemctl + the 0600 env file). Docker deployments +// do not use it. func runMenu(logger *slog.Logger) error { if os.Geteuid() != 0 { return errors.New("vocat menu must run as root (needs systemctl and /etc/vocat/env)") @@ -37,8 +82,13 @@ func runMenu(logger *slog.Logger) error { return errors.New("vocat menu requires an interactive terminal") } - lang := promptLanguage() + loadMenuEnv() + + lang, langErr := loadMenuLanguage() menu := newMenu(lang) + if langErr != nil { + logger.Warn("menu: load language preference failed; defaulting to English", "error", langErr) + } reader := bufio.NewReader(os.Stdin) for { @@ -55,44 +105,69 @@ func runMenu(logger *slog.Logger) error { choice := strings.TrimSpace(line) switch choice { case "1": - if err := menuChangePassword(reader, menu, logger); err != nil { + if err := menuToggleLanguage(menu, logger); err != nil { fmt.Println(menu.errorPrefix(err)) } case "2": - if err := menuRestart(menu); err != nil { + if err := menuChangePassword(reader, menu, logger); err != nil { fmt.Println(menu.errorPrefix(err)) } case "3": - if err := menuUninstall(reader, menu); err != nil { + if err := menuRestart(menu); err != nil { fmt.Println(menu.errorPrefix(err)) } - case "0", "": - fmt.Println(menu.bye()) - return nil + case "4": + if err := menuUpdate(menu, logger); err != nil { + fmt.Println(menu.errorPrefix(err)) + } + case "0": + if err := menuUninstall(reader, menu); err != nil { + fmt.Println(menu.errorPrefix(err)) + } else { + return nil + } default: fmt.Println(menu.invalid()) } } } -// promptLanguage asks for 中文 (1) or English (2) once per invocation. The -// user chose to re-ask every run rather than persist a language preference. -func promptLanguage() string { - reader := bufio.NewReader(os.Stdin) - for { - fmt.Println("选择语言 / Select language: 1) 中文 2) English") - fmt.Print("> ") - line, err := reader.ReadString('\n') - if err != nil { - return "zh" - } - switch strings.TrimSpace(line) { - case "1", "": - return "zh" - case "2": - return "en" - } +// loadMenuLanguage reads the persisted UI preference (the same ui.preferences +// app_setting the Web UI writes) and returns "zh" or "en". When no record +// exists yet it returns "en", matching the Web default in writeUIPreferences. +// Any failure is surfaced to the caller, which logs a warning and keeps the +// default rather than blocking the menu. +func loadMenuLanguage() (string, error) { + cfg, err := config.Load() + if err != nil { + return "en", fmt.Errorf("%w: %v", errMenuConfig, err) } + ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) + defer cancel() + + database, err := store.Open(ctx, cfg.DatabasePath) + if err != nil { + return "en", fmt.Errorf("%w: %v", errMenuStore, err) + } + defer database.Close() + + setting, err := database.AppSetting(ctx, uiPreferencesSettingKey) + if err != nil { + if errors.Is(err, store.ErrNotFound) { + return "en", nil + } + return "en", fmt.Errorf("%w: %v", errMenuStore, err) + } + var prefs struct { + Language string `json:"language"` + } + if err := json.Unmarshal(setting.Value, &prefs); err != nil { + return "en", nil + } + if prefs.Language == "zh" { + return "zh", nil + } + return "en", nil } func menuChangePassword(reader *bufio.Reader, m *menu, logger *slog.Logger) error { @@ -212,6 +287,45 @@ func rewriteEnvPassword(newPassword string) error { return os.Rename(tmpName, envFilePath) } +// menuToggleLanguage flips the persisted language preference between "zh" and +// "en" by writing the same ui.preferences app_setting the Web UI uses, then +// switches the menu's own language so the next prompt renders in the new +// language. The Web SPA picks up the change on its next preferences fetch; the +// menu never needs to call i18n.Set itself since it carries its own lang copy. +func menuToggleLanguage(m *menu, logger *slog.Logger) error { + cfg, err := config.Load() + if err != nil { + return fmt.Errorf("%w: %v", errMenuConfig, err) + } + ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) + defer cancel() + + database, err := store.Open(ctx, cfg.DatabasePath) + if err != nil { + return fmt.Errorf("%w: %v", errMenuStore, err) + } + defer database.Close() + + current := m.lang + next := "zh" + if current == "zh" { + next = "en" + } + payload, err := json.Marshal(map[string]string{"language": next}) + if err != nil { + return fmt.Errorf("%w: %v", errMenuStore, err) + } + if err := database.UpsertAppSetting(ctx, store.AppSetting{ + Key: uiPreferencesSettingKey, + Value: payload, + }); err != nil { + return fmt.Errorf("%w: %v", errMenuStore, err) + } + m.lang = next + fmt.Println(m.languageSwitched()) + return nil +} + func menuRestart(m *menu) error { if _, err := exec.LookPath("systemctl"); err != nil { return errNoSystemctl @@ -224,6 +338,23 @@ func menuRestart(m *menu) error { return nil } +// menuUpdate delegates to the self-updater in internal/update. It resolves the +// repo the same way update.Run itself does ($VOCAT_REPO or the default) and lets +// that package handle the check/download/verify/replace/restart flow. The +// running menu process keeps the old binary until the operator exits; only the +// systemd service runs the new build after restartService. +func menuUpdate(m *menu, logger *slog.Logger) error { + repo := strings.TrimSpace(os.Getenv("VOCAT_REPO")) + if repo == "" { + repo = update.DefaultRepository + } + fmt.Println(m.updateChecking()) + if err := update.Run(logger, []string{"--repo", repo}); err != nil { + return fmt.Errorf("%w: %v", errUpdateFailed, err) + } + return nil +} + // menuUninstall performs full removal: stop/disable the unit, delete the unit, // remove /opt/vocat (binary + data + SQLite DB), remove the env file, reload // systemd, and best-effort delete the vocat user. @@ -261,6 +392,7 @@ var ( errPasswordsDiffer = errors.New("menu: passwords do not match") errNoSystemctl = errors.New("menu: systemctl not found") errRestartFailed = errors.New("menu: restart failed") + errUpdateFailed = errors.New("menu: update failed") errMenuConfig = errors.New("menu: load configuration") errMenuStore = errors.New("menu: open database") errMenuAuth = errors.New("menu: auth service") @@ -277,19 +409,24 @@ func newMenu(lang string) *menu { return &menu{lang: lang} } func (m *menu) msg(key string) string { const zh, en = 0, 1 table := map[string][2]string{ - "title": {"vocat 管理菜单", "vocat management menu"}, - "opt_change": {"1) 修改密码", "1) Change password"}, - "opt_restart": {"2) 重启服务", "2) Restart service"}, - "opt_uninstall": {"3) 卸载程序", "3) Uninstall"}, - "opt_exit": {"0) 退出", "0) Exit"}, - "prompt": {"请选择: ", "Select: "}, - "invalid": {"无效选项，请重试。", "Invalid choice, try again."}, - "bye": {"再见。", "Bye."}, - "cur_pw": {"当前密码: ", "Current password: "}, - "new_pw": {"新密码 (至少 12 位): ", "New password (min 12 chars): "}, - "confirm_pw": {"确认新密码: ", "Confirm new password: "}, - "pw_changed": {"密码已修改。重启后仍然有效。", "Password changed. Survives restart."}, - "restarted": {"服务已重启。", "Service restarted."}, + "title": {"vocat 管理菜单", "vocat management menu"}, + "opt_lang": {"1) 切换中英文", "1) Toggle language"}, + "opt_change": {"2) 修改账号密码", "2) Change admin password"}, + "opt_restart": {"3) 重启软件", "3) Restart software"}, + "opt_update": {"4) 更新软件", "4) Update software"}, + "opt_uninstall": {"0) 卸载软件", "0) Uninstall software"}, + "prompt": {"请选择: ", "Select: "}, + "invalid": {"无效选项，请重试。按 Ctrl+C 退出。", "Invalid choice, try again. Press Ctrl+C to exit."}, + "cur_pw": {"当前密码: ", "Current password: "}, + "new_pw": {"新密码 (至少 12 位): ", "New password (min 12 chars): "}, + "confirm_pw": {"确认新密码: ", "Confirm new password: "}, + "pw_changed": {"密码已修改。重启后仍然有效。", "Password changed. Survives restart."}, + "lang_switched": { + "语言已切换。Web 界面下次刷新后同步。", + "Language switched. The web UI syncs on next refresh.", + }, + "upd_checking": {"正在检查更新…", "Checking for updates…"}, + "restarted": {"软件已重启。", "Software restarted."}, "uninstall_warn": { "警告: 将删除程序、数据与配置,且不可恢复!", "WARNING: removes the program, data and config. Irreversible!", @@ -311,11 +448,12 @@ func (m *menu) msg(key string) string { func (m *menu) title() string { return m.msg("title") } func (m *menu) prompt() string { return m.msg("prompt") } func (m *menu) invalid() string { return m.msg("invalid") } -func (m *menu) bye() string { return m.msg("bye") } func (m *menu) currentPassword() string { return m.msg("cur_pw") } func (m *menu) newPassword() string { return m.msg("new_pw") } func (m *menu) confirmPassword() string { return m.msg("confirm_pw") } func (m *menu) passwordChanged() string { return m.msg("pw_changed") } +func (m *menu) languageSwitched() string { return m.msg("lang_switched") } +func (m *menu) updateChecking() string { return m.msg("upd_checking") } func (m *menu) restarted() string { return m.msg("restarted") } func (m *menu) uninstallWarn() string { return m.msg("uninstall_warn") } func (m *menu) uninstallConfirm() string { return m.msg("uninstall_confirm") } @@ -323,7 +461,13 @@ func (m *menu) uninstallCancelled() string { return m.msg("uninstall_cancelled") func (m *menu) uninstalled() string { return m.msg("uninstalled") } func (m *menu) options() []string { - return []string{m.msg("opt_change"), m.msg("opt_restart"), m.msg("opt_uninstall"), m.msg("opt_exit")} + return []string{ + m.msg("opt_lang"), + m.msg("opt_change"), + m.msg("opt_restart"), + m.msg("opt_update"), + m.msg("opt_uninstall"), + } } func (m *menu) errorPrefix(err error) string { @@ -348,6 +492,11 @@ func (m *menu) errorPrefix(err error) string { return "Restart failed." } return "重启失败。" + case errors.Is(err, errUpdateFailed): + if m.lang == "en" { + return "Update failed." + } + return "更新失败。" case errors.Is(err, errMenuConfig): if m.lang == "en" { return "Failed to load configuration." diff --git a/docs/README.zh-CN.md b/docs/README.zh-CN.md new file mode 100644 index 0000000..3f5279d --- /dev/null +++ b/docs/README.zh-CN.md @@ -0,0 +1,295 @@ +

+ Vocat +

+ +

VoCat

+ +

+ Go + React + TypeScript + Vite + Tailwind CSS + SQLite +

+ +

+ Linux + Docker + WiFi Calling + eSIM + Telegram + GitHub Actions +

+ +[English](../README.md) | **简体中文** + +Vocat 是一款面向 Quectel EC20/EC25 系列蜂窝模组的开源 Web 控制面板与工程工具套件。它在一个自包含的服务中整合了模组发现、实时射频状态、AT 与 USSD 终端、短信、WiFi Calling(WiFi 通话)、eSIM 管理、网络选择、代理路由、通知、审计日志以及发布自动化。 + +后端使用 Go 编写,界面采用 React 与 TypeScript 构建,生产环境前端被嵌入进 Go 二进制中。单个可执行文件即包含完整的 Web 应用,并使用 SQLite 进行持久化存储。 + +

+ + +

+ +## 功能 + +| 领域 | Vocat 提供的能力 | +| --- | --- | +| 设备管理 | 自动串口/USB 发现、多模组支持、设备友好名称、概览实时刷新、模组重启、飞行模式以及 USB 网卡模式控制。 | +| 射频与网络 | 注册状态、运营商、信号指标、RSRP/RSRQ/SINR、网络模式、频段、信道、运营商扫描以及自动/手动选网。 | +| AT 与 USSD | 交互式 AT 终端、命令历史、原始模组响应、USSD 发起/继续/取消流程以及清晰的模组错误上报。 | +| 短信 | 蜂窝与 IMS 短信直接发送、入站同步、长短信合并、送达报告、会话历史、未读状态、时间戳以及逐条消息的送达状态。 | +| WiFi Calling | IKEv2/ePDG 隧道建立、EAP-AKA 鉴权、IMS 注册、IMS 短信、重连控制、状态诊断以及按设备路由。 | +| eSIM 与 eUICC | eUICC 发现、EID 与生产信息、证书元数据、多 eUICC 清单、已安装配置文件列表、启用/禁用/切换操作,以及在卡片支持时进行下载、重命名和删除。 | +| 卡策略 | 基于 ICCID 的 WiFi Calling 与飞行模式行为,策略即时应用。 | +| 代理路由 | 上游 SOCKS 路由、设备绑定、国家规则、TCP 可达性检查以及面向 WiFi Calling 数据路径的 UDP Associate 检查。 | +| 通知 | 通过 Telegram、Bark、邮件、Pushplus 以及签名 Webhook 转发新入站短信,每条短信单独推送。 | +| Telegram 机器人 | 设备状态、已安装配置文件列表与切换、WiFi Calling 控制、短信发送、定时拨号并自动挂断、通话状态、接听与挂断命令。敏感操作需要管理员确认。 | +| 运维 | 鉴权、CSRF 防护、访问策略、审计事件、实时日志、日志留存、健康检查、响应式布局、深色模式以及中英文应用界面。 | +| 分发 | 静态 Linux 二进制、systemd 安装脚本、带 SHA-256 校验的自更新、Docker 镜像、GHCR 发布以及 GitHub Actions 发布构建。 | + +## 支持的硬件 + +Vocat 面向基于高通芯片、并暴露兼容 AT、QMI、串口与 USB 网络接口的 Quectel 模组,包括: + +- Quectel EC20 +- Quectel EC25 +- Quectel EG25 系列 +- 兼容的 EG600 及相关模组 + +可用功能取决于模组固件、USB 复合设备配置、SIM/eSIM 能力、主机驱动、无线网络以及运营商配置。 + +## 安装 + +### Linux 一键安装 + +```bash +curl -fsSL https://raw.githubusercontent.com/MengMengCode/VoCat/master/scripts/install.sh | sudo bash +``` + +安装指定版本: + +```bash +curl -fsSL https://raw.githubusercontent.com/MengMengCode/VoCat/master/scripts/install.sh -o install.sh +sudo bash install.sh 0.0.2 +``` + +安装程序会: + +- 检测 `amd64`、`386`、`arm64` 或 `armv7` 架构; +- 下载对应的 GitHub Release 二进制; +- 对照 `SHA256SUMS` 进行校验; +- 将 Vocat 安装到 `/opt/vocat`; +- 创建具有 Vocat 所需硬件与网络访问权限的强化版 systemd 服务; +- 将运行时配置存放在 `/etc/vocat/env`; +- 首次安装时生成随机初始管理员密码。 + +安装完成后打开: + +```text +http://<服务器地址>:7575 +``` + +### 手动二进制安装 + +从 GitHub Releases 下载对应的二进制与 `SHA256SUMS`: + +| 平台 | 发布文件 | +| --- | --- | +| Linux x86-64 | `vocat-linux-amd64` | +| Linux x86 32 位 | `vocat-linux-386` | +| Linux ARM64 | `vocat-linux-arm64` | +| Linux ARMv7 | `vocat-linux-armv7` | + +校验并安装: + +```bash +sha256sum -c SHA256SUMS --ignore-missing +sudo install -d -m 0755 /opt/vocat/bin /opt/vocat/data +sudo install -m 0755 vocat-linux-amd64 /opt/vocat/bin/vocat +sudo env \ + VOCAT_DATABASE_PATH=/opt/vocat/data/vocat.db \ + VOCAT_ADMIN_PASSWORD=change-this-password \ + /opt/vocat/bin/vocat serve +``` + +该手动命令会在前台运行 Vocat。请使用 `vocat serve` 以直接启动服务器；在 TTY 下以 root 运行无参数的 `vocat` 会进入交互式管理菜单。如需托管的 systemd 服务与自动重启,请使用一键安装脚本。 + +### Docker + +如果 Linux 主机需要发现每一个接入的受支持 Quectel 模组,并持续感知 USB 热插拔事件,请以硬件访问模式运行 Vocat: + +```bash +docker pull ghcr.io/mengmengcode/vocat:latest + +docker run -d \ + --name vocat \ + --restart unless-stopped \ + --network host \ + --privileged \ + --user 0:0 \ + -e VOCAT_ADMIN_PASSWORD=change-this-password \ + -v vocat-data:/opt/vocat/data \ + -v /dev:/dev \ + -v /sys:/sys:ro \ + ghcr.io/mengmengcode/vocat:latest +``` + +容器启动后打开 `http://<服务器地址>:7575`。主机网络是必需的,这样 QMI 网络接口才能对 Vocat 可见;而特权设备访问是串口、QMI 控制节点、TUN 接口、网络配置以及容器启动后新增设备所必需的。`/dev` 挂载使新的 `ttyUSB*`、`ttyACM*` 和 `cdc-wdm*` 节点无需重建容器即可见。 + +该模式有意赋予 Vocat 对主机设备与网络栈的广泛访问权限,仅在受信任的 Linux 主机上使用。自动发现目前仅识别受支持的 Quectel USB 模组(USB 厂商 ID `2c7c`),不识别任意品牌的模组。仅用 `--device` 映射单个节点(例如 `/dev/ttyUSB2` 与 `/dev/cdc-wdm0`)会将容器限定在这些固定节点上,无法提供完整的多设备或热插拔发现。 + +GHCR 镜像发布为 `linux/amd64` 与 `linux/arm64`。 + +## 配置 + +Vocat 先从 `VOCAT_CONFIG` 读取可选的 JSON 配置文件,再应用 `VOCAT_*` 环境变量。环境变量优先级更高。 + +| 环境变量 | 默认值 | 说明 | +| --- | --- | --- | +| `VOCAT_ADDR` | `0.0.0.0:7575` | HTTP 监听地址。 | +| `VOCAT_DATABASE_PATH` | `./data/vocat.db` | SQLite 数据库路径。 | +| `VOCAT_ADMIN_USERNAME` | `admin` | 初始管理员用户名。 | +| `VOCAT_ADMIN_PASSWORD` | `admin` | 初始管理员密码。暴露服务前请务必修改。 | +| `VOCAT_SESSION_TTL` | `24h` | 鉴权会话有效期。 | +| `VOCAT_SECURE_COOKIES` | `false` | 在使用 HTTPS 时将会话 Cookie 标记为安全。 | +| `VOCAT_SHUTDOWN_TIMEOUT` | `10s` | 优雅关闭超时时间。 | +| `VOCAT_MAX_REQUEST_BODY_BYTES` | `1048576` | API 请求体最大字节数。 | +| `VOCAT_REPO` | `MengMengCode/VoCat` | 自更新器使用的受信任 GitHub 仓库，格式为 `owner/name`。 | +| `GITHUB_TOKEN` | 空 | 可选的 GitHub token,用于私有仓库或更高的 API 限额。 | + +请勿将 Telegram token、SMTP 密码、Webhook 密钥、SIM 凭据或其他私密数据存放在仓库中。请通过应用设置或受保护的环境文件来配置它们。 + +## Telegram 机器人 + +启用 Telegram 通知并配置好 Chat ID 与 Admin ID 后,机器人支持: + +```text +/status [设备] +/esim <设备> +/switch <设备> +/wfc <设备> +/sms <设备> <号码> <内容> +/call <设备> <号码> <秒数> +/calls <设备> +/answer <设备> +/hangup <设备> +``` + +配置文件切换、短信提交与拨号使用一次性确认按钮。定时拨号会执行模组拨号动作,并在 1–600 秒后自动挂断;不会捕获或处理通话音频。机器人不暴露 eSIM 下载、删除或重命名命令。 + +## 更新 + +检查是否有更新的 GitHub Release: + +```bash +vocat update --check --repo MengMengCode/VoCat +``` + +安装最新发布版: + +```bash +sudo vocat update --repo MengMengCode/VoCat +``` + +更新器会下载与当前 Linux 架构匹配的二进制,使用已发布的 `SHA256SUMS` 进行校验,原子性地替换可执行文件,并在可用时重启 `vocat` systemd 服务。 + +Docker 安装的更新方式: + +```bash +docker pull ghcr.io/mengmengcode/vocat:latest +``` + +拉取新镜像后重建容器。 + +## 开发 + +依赖要求: + +- Go 1.25 或更新版本 +- Node.js 20 或更新版本 +- npm + +运行前端开发服务器: + +```bash +cd web +npm install +npm run dev +``` + +构建嵌入的前端并启动后端: + +```bash +cd web +npm run build +cd .. +go run ./cmd/vocat +``` + +运行全部测试: + +```bash +go test ./... +``` + +构建生产二进制: + +```bash +go build -trimpath -ldflags "-s -w" -o vocat ./cmd/vocat +``` + +## 发布自动化 + +推送版本标签会触发两个 GitHub Actions 工作流: + +- `release-binaries` 构建并发布 `amd64`、`386`、`arm64` 与 `armv7` 二进制及 `SHA256SUMS`。 +- `docker` 构建并向 GitHub Container Registry 发布多架构镜像。 + +```bash +git tag v0.2.0 +git push origin v0.2.0 +``` + +## 项目结构 + +```text +cmd/vocat/ 应用入口与 CLI +internal/device/ 模组发现与设备控制 +internal/modem/ AT 会话与响应处理 +internal/server/ HTTP API、通知与内嵌 Web 服务器 +internal/store/ SQLite 持久化 +internal/update/ GitHub Release 自更新器 +internal/vowifi/ IKE、EAP-AKA、IMS 与 WiFi Calling 运行时 +scripts/install.sh Linux 安装与更新脚本 +web/src/ React 与 TypeScript 前端 +.github/workflows/ 二进制与 Docker 发布自动化 +``` + +## 合规使用 + +蜂窝模组与 eSIM 操作可能影响用户服务、已存储的配置文件、网络注册以及硬件状态。请做好备份,谨慎审视破坏性操作,并仅在您被允许操作所连接的硬件与网络资源的合法环境中使用本软件。 + +Vocat 不会绕过运营商鉴权、网络策略、硬件安全或 eSIM 信任要求。支持某项操作意味着 Vocat 能够向模组或 eUICC 发起该请求;但设备、配置文件、网络或运营商仍可能拒绝。 + +## 贡献 + +欢迎提交 Issue 与 Pull Request。请保持改动聚焦,在可行处附带测试,避免提交凭据或用户数据,并清晰地说明硬件相关行为。 + +提交改动前: + +```bash +go test ./... +cd web && npm run build +``` + +## 致谢 +- [Nodeseek.com](https://www.nodeseek.com) — 专注服务器的社群 +- [Linux.do](https://linux.do) — 富有启发的技术社群 +- [iniwex5](https://github.com/iniwex5) — 风格与功能指南 + +## 许可证 + +参见 [LICENSE](../LICENSE)。 diff --git a/internal/extensions/manager.go b/internal/extensions/manager.go new file mode 100644 index 0000000..1ea4f3d --- /dev/null +++ b/internal/extensions/manager.go @@ -0,0 +1,518 @@ +package extensions + +import ( + "archive/zip" + "bufio" + "context" + "crypto/sha256" + "encoding/hex" + "encoding/json" + "errors" + "fmt" + "io" + "log/slog" + "mime" + "net" + "net/http" + "net/http/httputil" + "net/url" + "os" + "os/exec" + "path/filepath" + "runtime" + "sort" + "strings" + "sync" + "time" +) + +const maxPackageBytes int64 = 64 << 20 + +type Plugin struct { + Manifest + Enabled bool `json:"enabled"` + BackendAvailable bool `json:"backend_available"` + BackendRunning bool `json:"backend_running"` + BackendError string `json:"backend_error,omitempty"` + InstalledAt string `json:"installed_at"` + SHA256 string `json:"sha256"` + + dir string + command *exec.Cmd + backend *url.URL + installed time.Time +} + +type stateFile struct { + Enabled bool `json:"enabled"` + InstalledAt time.Time `json:"installed_at"` + SHA256 string `json:"sha256"` +} + +type Manager struct { + root string + logger *slog.Logger + client *http.Client + + mu sync.RWMutex + plugins map[string]*Plugin +} + +func NewManager(root string, logger *slog.Logger) (*Manager, error) { + root, err := filepath.Abs(root) + if err != nil { + return nil, fmt.Errorf("resolve plugin directory: %w", err) + } + if err := os.MkdirAll(root, 0o750); err != nil { + return nil, fmt.Errorf("create plugin directory: %w", err) + } + if logger == nil { + logger = slog.Default() + } + manager := &Manager{ + root: root, logger: logger, plugins: make(map[string]*Plugin), + client: &http.Client{Timeout: 45 * time.Second}, + } + if err := manager.scan(); err != nil { + return nil, err + } + return manager, nil +} + +func (manager *Manager) scan() error { + entries, err := os.ReadDir(manager.root) + if err != nil { + return err + } + for _, entry := range entries { + if !entry.IsDir() || !pluginIDPattern.MatchString(entry.Name()) { + continue + } + dir := filepath.Join(manager.root, entry.Name()) + plugin, err := loadPlugin(dir) + if err != nil { + manager.logger.Warn("skip invalid plugin", "directory", dir, "error", err) + continue + } + manager.plugins[plugin.ID] = plugin + if plugin.Enabled { + manager.startLocked(plugin) + } + } + return nil +} + +func loadPlugin(dir string) (*Plugin, error) { + file, err := os.Open(filepath.Join(dir, ManifestFilename)) + if err != nil { + return nil, err + } + manifest, err := DecodeManifest(file) + _ = file.Close() + if err != nil { + return nil, err + } + if filepath.Base(dir) != manifest.ID { + return nil, errors.New("plugin directory does not match manifest id") + } + var state stateFile + stateData, err := os.ReadFile(filepath.Join(dir, ".vocat-state.json")) + if err == nil { + if err := json.Unmarshal(stateData, &state); err != nil { + return nil, fmt.Errorf("decode plugin state: %w", err) + } + } + command, available := manifest.BackendCommand() + if available { + _, err = os.Stat(filepath.Join(dir, filepath.FromSlash(command))) + available = err == nil + } + return &Plugin{ + Manifest: manifest, Enabled: state.Enabled, BackendAvailable: available, + InstalledAt: state.InstalledAt.UTC().Format(time.RFC3339), SHA256: state.SHA256, + dir: dir, installed: state.InstalledAt, + }, nil +} + +func (manager *Manager) List() []Plugin { + manager.mu.RLock() + defer manager.mu.RUnlock() + result := make([]Plugin, 0, len(manager.plugins)) + for _, plugin := range manager.plugins { + copy := *plugin + copy.command = nil + copy.backend = nil + result = append(result, copy) + } + sort.Slice(result, func(i, j int) bool { return result[i].Name < result[j].Name }) + return result +} + +func (manager *Manager) InstallURL(ctx context.Context, rawURL, expectedSHA string) (Plugin, error) { + parsed, err := url.Parse(strings.TrimSpace(rawURL)) + if err != nil || (parsed.Scheme != "https" && parsed.Scheme != "http") || parsed.Host == "" { + return Plugin{}, errors.New("plugin URL must be an absolute HTTP or HTTPS URL") + } + request, err := http.NewRequestWithContext(ctx, http.MethodGet, parsed.String(), nil) + if err != nil { + return Plugin{}, err + } + response, err := manager.client.Do(request) + if err != nil { + return Plugin{}, fmt.Errorf("download plugin: %w", err) + } + defer response.Body.Close() + if response.StatusCode < 200 || response.StatusCode >= 300 { + return Plugin{}, fmt.Errorf("download plugin: HTTP %d", response.StatusCode) + } + return manager.Install(response.Body, expectedSHA) +} + +func (manager *Manager) Install(reader io.Reader, expectedSHA string) (Plugin, error) { + temp, err := os.CreateTemp(manager.root, ".upload-*.vocat-plugin") + if err != nil { + return Plugin{}, err + } + tempName := temp.Name() + defer os.Remove(tempName) + hash := sha256.New() + written, copyErr := io.Copy(io.MultiWriter(temp, hash), io.LimitReader(reader, maxPackageBytes+1)) + closeErr := temp.Close() + if copyErr != nil { + return Plugin{}, copyErr + } + if closeErr != nil { + return Plugin{}, closeErr + } + if written > maxPackageBytes { + return Plugin{}, fmt.Errorf("plugin package exceeds %d MiB", maxPackageBytes>>20) + } + actualSHA := hex.EncodeToString(hash.Sum(nil)) + if expected := strings.ToLower(strings.TrimSpace(expectedSHA)); expected != "" && expected != actualSHA { + return Plugin{}, errors.New("plugin package SHA-256 does not match") + } + + archive, err := zip.OpenReader(tempName) + if err != nil { + return Plugin{}, errors.New("plugin package must be a ZIP archive") + } + defer archive.Close() + manifest, err := manifestFromArchive(archive.File) + if err != nil { + return Plugin{}, err + } + staging, err := os.MkdirTemp(manager.root, ".install-"+manifest.ID+"-") + if err != nil { + return Plugin{}, err + } + defer os.RemoveAll(staging) + if err := extractArchive(archive.File, staging); err != nil { + return Plugin{}, err + } + installedAt := time.Now().UTC() + state := stateFile{Enabled: true, InstalledAt: installedAt, SHA256: actualSHA} + if err := writeState(staging, state); err != nil { + return Plugin{}, err + } + target := filepath.Join(manager.root, manifest.ID) + manager.mu.Lock() + defer manager.mu.Unlock() + if _, exists := manager.plugins[manifest.ID]; exists { + return Plugin{}, fmt.Errorf("plugin %q is already installed; uninstall it before replacing", manifest.ID) + } + if err := os.Rename(staging, target); err != nil { + return Plugin{}, fmt.Errorf("activate plugin: %w", err) + } + plugin, err := loadPlugin(target) + if err != nil { + _ = os.RemoveAll(target) + return Plugin{}, err + } + manager.plugins[plugin.ID] = plugin + manager.startLocked(plugin) + return publicPlugin(plugin), nil +} + +func manifestFromArchive(files []*zip.File) (Manifest, error) { + for _, file := range files { + name := strings.ReplaceAll(file.Name, `\`, "/") + if name != ManifestFilename { + continue + } + reader, err := file.Open() + if err != nil { + return Manifest{}, err + } + manifest, decodeErr := DecodeManifest(reader) + _ = reader.Close() + return manifest, decodeErr + } + return Manifest{}, fmt.Errorf("plugin package is missing root %s", ManifestFilename) +} + +func extractArchive(files []*zip.File, staging string) error { + var expanded int64 + for _, file := range files { + name := strings.ReplaceAll(file.Name, `\`, "/") + if strings.HasSuffix(name, "/") { + continue + } + if !safeRelativePath(name) || file.Mode()&os.ModeSymlink != 0 { + return fmt.Errorf("plugin package contains unsafe path %q", file.Name) + } + expanded += int64(file.UncompressedSize64) + if expanded > maxPackageBytes*4 { + return errors.New("expanded plugin package is too large") + } + target := filepath.Join(staging, filepath.FromSlash(name)) + if err := os.MkdirAll(filepath.Dir(target), 0o750); err != nil { + return err + } + input, err := file.Open() + if err != nil { + return err + } + mode := os.FileMode(0o640) + if file.Mode()&0o111 != 0 { + mode = 0o750 + } + output, err := os.OpenFile(target, os.O_CREATE|os.O_EXCL|os.O_WRONLY, mode) + if err == nil { + _, err = io.Copy(output, input) + _ = output.Close() + } + _ = input.Close() + if err != nil { + return err + } + } + return nil +} + +func writeState(dir string, state stateFile) error { + data, err := json.MarshalIndent(state, "", " ") + if err != nil { + return err + } + return os.WriteFile(filepath.Join(dir, ".vocat-state.json"), data, 0o600) +} + +func (manager *Manager) SetEnabled(id string, enabled bool) (Plugin, error) { + manager.mu.Lock() + defer manager.mu.Unlock() + plugin := manager.plugins[id] + if plugin == nil { + return Plugin{}, os.ErrNotExist + } + if plugin.Enabled == enabled { + return publicPlugin(plugin), nil + } + plugin.Enabled = enabled + if err := writeState(plugin.dir, stateFile{Enabled: enabled, InstalledAt: plugin.installed, SHA256: plugin.SHA256}); err != nil { + plugin.Enabled = !enabled + return Plugin{}, err + } + if enabled { + manager.startLocked(plugin) + } else { + manager.stopLocked(plugin) + } + return publicPlugin(plugin), nil +} + +func (manager *Manager) Uninstall(id string) error { + manager.mu.Lock() + defer manager.mu.Unlock() + plugin := manager.plugins[id] + if plugin == nil { + return os.ErrNotExist + } + manager.stopLocked(plugin) + delete(manager.plugins, id) + clean := filepath.Clean(plugin.dir) + if filepath.Dir(clean) != filepath.Clean(manager.root) || filepath.Base(clean) != id { + return errors.New("refusing to remove plugin outside plugin directory") + } + return os.RemoveAll(clean) +} + +func (manager *Manager) ServeAsset(w http.ResponseWriter, r *http.Request, id, name string) { + manager.mu.RLock() + plugin := manager.plugins[id] + manager.mu.RUnlock() + if plugin == nil || !plugin.Enabled || !safeRelativePath(name) { + http.NotFound(w, r) + return + } + filename := filepath.Join(plugin.dir, filepath.FromSlash(name)) + if !strings.HasPrefix(filepath.Clean(filename), filepath.Clean(plugin.dir)+string(os.PathSeparator)) { + http.NotFound(w, r) + return + } + file, err := os.Open(filename) + if err != nil { + http.NotFound(w, r) + return + } + defer file.Close() + info, err := file.Stat() + if err != nil || !info.Mode().IsRegular() { + http.NotFound(w, r) + return + } + contentType := mime.TypeByExtension(filepath.Ext(filename)) + if contentType != "" { + w.Header().Set("Content-Type", contentType) + } + w.Header().Set("Cache-Control", "no-cache") + http.ServeContent(w, r, info.Name(), info.ModTime(), file) +} + +func (manager *Manager) ProxyBackend(w http.ResponseWriter, r *http.Request, id string) { + manager.mu.RLock() + plugin := manager.plugins[id] + var target *url.URL + if plugin != nil && plugin.Enabled && plugin.BackendRunning && plugin.backend != nil { + copy := *plugin.backend + target = © + } + manager.mu.RUnlock() + if target == nil { + http.Error(w, "plugin backend is not running", http.StatusServiceUnavailable) + return + } + proxy := httputil.NewSingleHostReverseProxy(target) + originalDirector := proxy.Director + proxy.Director = func(request *http.Request) { + originalDirector(request) + request.Header.Del("Cookie") + request.Header.Del("X-CSRF-Token") + request.Header.Del("Authorization") + request.Header.Set("X-VoCat-Plugin-ID", id) + } + proxy.ModifyResponse = func(response *http.Response) error { + response.Header.Del("Set-Cookie") + return nil + } + prefix := "/api/extensions/" + id + "/backend" + r.URL.Path = strings.TrimPrefix(r.URL.Path, prefix) + if r.URL.Path == "" { + r.URL.Path = "/" + } + proxy.ErrorHandler = func(w http.ResponseWriter, _ *http.Request, err error) { + manager.logger.Warn("plugin backend proxy failed", "plugin", id, "error", err) + http.Error(w, "plugin backend is unavailable", http.StatusBadGateway) + } + proxy.ServeHTTP(w, r) +} + +func (manager *Manager) startLocked(plugin *Plugin) { + commandPath, supported := plugin.BackendCommand() + if !supported { + if plugin.Backend != nil { + plugin.BackendError = "backend does not support " + runtime.GOOS + "/" + runtime.GOARCH + } + return + } + fullCommand := filepath.Join(plugin.dir, filepath.FromSlash(commandPath)) + if _, err := os.Stat(fullCommand); err != nil { + plugin.BackendError = "backend executable is missing" + return + } + if runtime.GOOS != "windows" { + if err := os.Chmod(fullCommand, 0o750); err != nil { + plugin.BackendError = "make backend executable: " + err.Error() + return + } + } + listener, err := net.Listen("tcp", "127.0.0.1:0") + if err != nil { + plugin.BackendError = err.Error() + return + } + address := listener.Addr().String() + _ = listener.Close() + dataDir := filepath.Join(plugin.dir, "data") + if err := os.MkdirAll(dataDir, 0o700); err != nil { + plugin.BackendError = err.Error() + return + } + command := exec.Command(fullCommand) + command.Dir = plugin.dir + command.Env = append(os.Environ(), + "VOCAT_PLUGIN_ID="+plugin.ID, + "VOCAT_PLUGIN_LISTEN="+address, + "VOCAT_PLUGIN_DATA_DIR="+dataDir, + ) + stdout, err := command.StdoutPipe() + if err != nil { + plugin.BackendError = err.Error() + return + } + command.Stderr = command.Stdout + if err := command.Start(); err != nil { + plugin.BackendError = err.Error() + return + } + plugin.command = command + plugin.backend = &url.URL{Scheme: "http", Host: address} + plugin.BackendRunning = true + plugin.BackendError = "" + go manager.captureOutput(plugin.ID, stdout) + go manager.waitProcess(plugin.ID, command) +} + +func (manager *Manager) captureOutput(id string, reader io.Reader) { + scanner := bufio.NewScanner(reader) + for scanner.Scan() { + manager.logger.Info("plugin output", "plugin", id, "message", scanner.Text()) + } +} + +func (manager *Manager) waitProcess(id string, command *exec.Cmd) { + err := command.Wait() + manager.mu.Lock() + defer manager.mu.Unlock() + plugin := manager.plugins[id] + if plugin == nil || plugin.command != command { + return + } + plugin.command = nil + plugin.backend = nil + plugin.BackendRunning = false + if err != nil && plugin.Enabled { + plugin.BackendError = err.Error() + manager.logger.Warn("plugin backend exited", "plugin", id, "error", err) + } +} + +func (manager *Manager) stopLocked(plugin *Plugin) { + command := plugin.command + plugin.command = nil + plugin.backend = nil + plugin.BackendRunning = false + if command != nil && command.Process != nil { + _ = command.Process.Signal(os.Interrupt) + go func() { + timer := time.NewTimer(3 * time.Second) + defer timer.Stop() + <-timer.C + _ = command.Process.Kill() + }() + } +} + +func (manager *Manager) Close() { + manager.mu.Lock() + defer manager.mu.Unlock() + for _, plugin := range manager.plugins { + manager.stopLocked(plugin) + } +} + +func publicPlugin(plugin *Plugin) Plugin { + copy := *plugin + copy.command = nil + copy.backend = nil + return copy +} diff --git a/internal/extensions/manager_test.go b/internal/extensions/manager_test.go new file mode 100644 index 0000000..acacd8a --- /dev/null +++ b/internal/extensions/manager_test.go @@ -0,0 +1,100 @@ +package extensions + +import ( + "archive/zip" + "bytes" + "io" + "log/slog" + "strings" + "testing" +) + +func TestInstallListDisableAndUninstall(t *testing.T) { + manager, err := NewManager(t.TempDir(), slog.New(slog.NewTextHandler(io.Discard, nil))) + if err != nil { + t.Fatal(err) + } + defer manager.Close() + archive := testPackage(t, map[string]string{ + ManifestFilename: `{ + "schema_version":1,"id":"test-plugin","name":"Test","version":"1.0.0", + "permissions":["devices.read"], + "contributions":[{"id":"test-page","label":"Test","location":"sidebar","entry":"web/index.html"}] + }`, + "web/index.html": "

test

", + }) + plugin, err := manager.Install(bytes.NewReader(archive), "") + if err != nil { + t.Fatal(err) + } + if plugin.ID != "test-plugin" || !plugin.Enabled || len(manager.List()) != 1 { + t.Fatalf("unexpected installed plugin: %#v", plugin) + } + if _, err := manager.SetEnabled(plugin.ID, false); err != nil { + t.Fatal(err) + } + if manager.List()[0].Enabled { + t.Fatal("plugin remained enabled") + } + if err := manager.Uninstall(plugin.ID); err != nil { + t.Fatal(err) + } + if len(manager.List()) != 0 { + t.Fatal("plugin remained installed") + } +} + +func TestInstallRejectsPathTraversal(t *testing.T) { + manager, err := NewManager(t.TempDir(), nil) + if err != nil { + t.Fatal(err) + } + defer manager.Close() + archive := testPackage(t, map[string]string{ + ManifestFilename: `{ + "schema_version":1,"id":"bad-plugin","name":"Bad","version":"1", + "contributions":[{"id":"bad-page","label":"Bad","location":"sidebar","entry":"web/index.html"}] + }`, + "../escaped": "bad", + }) + if _, err := manager.Install(bytes.NewReader(archive), ""); err == nil || !strings.Contains(err.Error(), "unsafe path") { + t.Fatalf("Install traversal error = %v", err) + } +} + +func TestInstallVerifiesSHA256(t *testing.T) { + manager, err := NewManager(t.TempDir(), nil) + if err != nil { + t.Fatal(err) + } + defer manager.Close() + archive := testPackage(t, map[string]string{ + ManifestFilename: `{ + "schema_version":1,"id":"hash-plugin","name":"Hash","version":"1", + "contributions":[{"id":"hash-page","label":"Hash","location":"sidebar","entry":"web/index.html"}] + }`, + "web/index.html": "ok", + }) + if _, err := manager.Install(bytes.NewReader(archive), strings.Repeat("0", 64)); err == nil { + t.Fatal("Install accepted incorrect SHA-256") + } +} + +func testPackage(t *testing.T, files map[string]string) []byte { + t.Helper() + var output bytes.Buffer + writer := zip.NewWriter(&output) + for name, content := range files { + entry, err := writer.Create(name) + if err != nil { + t.Fatal(err) + } + if _, err := entry.Write([]byte(content)); err != nil { + t.Fatal(err) + } + } + if err := writer.Close(); err != nil { + t.Fatal(err) + } + return output.Bytes() +} diff --git a/internal/extensions/manifest.go b/internal/extensions/manifest.go new file mode 100644 index 0000000..fbad8c3 --- /dev/null +++ b/internal/extensions/manifest.go @@ -0,0 +1,135 @@ +package extensions + +import ( + "encoding/json" + "errors" + "fmt" + "io" + "regexp" + "runtime" + "sort" + "strings" +) + +const ( + ManifestFilename = "vocat-plugin.json" + SchemaVersion = 1 +) + +var pluginIDPattern = regexp.MustCompile(`^[a-z][a-z0-9-]{1,62}[a-z0-9]$`) + +type Contribution struct { + ID string `json:"id"` + Label string `json:"label"` + LabelZH string `json:"label_zh,omitempty"` + Location string `json:"location"` + After string `json:"after,omitempty"` + Entry string `json:"entry"` +} + +type Backend struct { + Commands map[string]string `json:"commands,omitempty"` +} + +type Manifest struct { + SchemaVersion int `json:"schema_version"` + ID string `json:"id"` + Name string `json:"name"` + Version string `json:"version"` + Description string `json:"description,omitempty"` + Author string `json:"author,omitempty"` + Homepage string `json:"homepage,omitempty"` + Permissions []string `json:"permissions,omitempty"` + Contributions []Contribution `json:"contributions"` + Backend *Backend `json:"backend,omitempty"` +} + +func DecodeManifest(reader io.Reader) (Manifest, error) { + decoder := json.NewDecoder(io.LimitReader(reader, 256<<10)) + decoder.DisallowUnknownFields() + var manifest Manifest + if err := decoder.Decode(&manifest); err != nil { + return Manifest{}, fmt.Errorf("decode %s: %w", ManifestFilename, err) + } + var trailing any + if err := decoder.Decode(&trailing); !errors.Is(err, io.EOF) { + return Manifest{}, errors.New("plugin manifest must contain one JSON object") + } + if err := manifest.Validate(); err != nil { + return Manifest{}, err + } + return manifest, nil +} + +func (manifest Manifest) Validate() error { + if manifest.SchemaVersion != SchemaVersion { + return fmt.Errorf("unsupported plugin schema_version %d", manifest.SchemaVersion) + } + if !pluginIDPattern.MatchString(manifest.ID) { + return errors.New("plugin id must be 3-64 lowercase letters, digits, or hyphens") + } + if strings.TrimSpace(manifest.Name) == "" || len(manifest.Name) > 100 { + return errors.New("plugin name is required and must not exceed 100 characters") + } + if strings.TrimSpace(manifest.Version) == "" || len(manifest.Version) > 64 { + return errors.New("plugin version is required and must not exceed 64 characters") + } + seen := make(map[string]struct{}, len(manifest.Contributions)) + for _, contribution := range manifest.Contributions { + if !pluginIDPattern.MatchString(contribution.ID) { + return fmt.Errorf("invalid contribution id %q", contribution.ID) + } + if _, duplicate := seen[contribution.ID]; duplicate { + return fmt.Errorf("duplicate contribution id %q", contribution.ID) + } + seen[contribution.ID] = struct{}{} + if contribution.Location != "sidebar" && contribution.Location != "proxy" { + return fmt.Errorf("contribution %q has unsupported location %q", contribution.ID, contribution.Location) + } + if strings.TrimSpace(contribution.Label) == "" { + return fmt.Errorf("contribution %q requires a label", contribution.ID) + } + if !safeRelativePath(contribution.Entry) { + return fmt.Errorf("contribution %q has an unsafe entry path", contribution.ID) + } + } + if manifest.Backend != nil { + if len(manifest.Backend.Commands) == 0 { + return errors.New("plugin backend commands are empty") + } + for platform, command := range manifest.Backend.Commands { + if !strings.Contains(platform, "/") || !safeRelativePath(command) { + return fmt.Errorf("plugin backend command for %q is invalid", platform) + } + } + } + permissions := append([]string(nil), manifest.Permissions...) + sort.Strings(permissions) + for index, permission := range permissions { + if strings.TrimSpace(permission) == "" || (index > 0 && permission == permissions[index-1]) { + return errors.New("plugin permissions must be non-empty and unique") + } + } + return nil +} + +func (manifest Manifest) BackendCommand() (string, bool) { + if manifest.Backend == nil { + return "", false + } + command, ok := manifest.Backend.Commands[runtime.GOOS+"/"+runtime.GOARCH] + return command, ok +} + +func safeRelativePath(value string) bool { + value = strings.ReplaceAll(strings.TrimSpace(value), `\`, "/") + if value == "" || strings.HasPrefix(value, "/") || strings.Contains(value, ":") { + return false + } + for _, segment := range strings.Split(value, "/") { + if segment == "" || segment == "." || segment == ".." { + return false + } + } + return true +} diff --git a/internal/modem/discovery.go b/internal/modem/discovery.go index a254b17..d510481 100644 --- a/internal/modem/discovery.go +++ b/internal/modem/discovery.go @@ -127,6 +127,7 @@ func (d *SysFSDiscoverer) Discover(ctx context.Context) ([]Candidate, error) { } return left.Name < right.Name }) + assignQuectelPortRoles(state.candidate.Ports) state.candidate.ATPort = selectATPort(state.candidate.Ports) result = append(result, state.candidate) } @@ -240,30 +241,45 @@ func sanitizeID(value string) string { return strings.Trim(result.String(), "-") } -func quecPortRole(interfaceNumber int, name string) PortRole { - // Quectel exposes the same logical ports under more than one USB - // composition. In both layouts seen on EC20/EC25 hardware the kernel - // stable tty name is the stronger hint: ttyUSB0 is diagnostic and - // ttyUSB2 is the primary AT port, even when their interface numbers are - // 00/02 instead of 02/04. - switch name { - case "ttyUSB0": - return PortRoleDiagnostic - case "ttyUSB1": - return PortRoleNMEA - case "ttyUSB2": - return PortRoleAT - case "ttyUSB3": - return PortRoleModem +func assignQuectelPortRoles(ports []Port) { + // ttyUSB numbers are allocated globally by Linux. A second modem therefore + // commonly exposes ttyUSB4..ttyUSB7, so absolute tty names cannot identify + // the logical AT port. Infer the Quectel composition once per physical USB + // device and assign roles from that device's interface numbers. + base := 0x02 + for _, port := range ports { + if port.InterfaceNumber <= 0x01 { + base = 0x00 + break + } } + for index := range ports { + switch ports[index].InterfaceNumber - base { + case 0: + ports[index].Role = PortRoleDiagnostic + case 1: + ports[index].Role = PortRoleNMEA + case 2: + ports[index].Role = PortRoleAT + case 3: + ports[index].Role = PortRoleModem + default: + ports[index].Role = PortRoleUnknown + } + } +} + +func quecPortRole(interfaceNumber int, name string) PortRole { + // Initial best effort. assignQuectelPortRoles replaces this once every + // interface belonging to the same physical modem has been collected. switch interfaceNumber { - case 0x02: + case 0x00: return PortRoleDiagnostic - case 0x03: + case 0x01: return PortRoleNMEA - case 0x04: + case 0x02: return PortRoleAT - case 0x05: + case 0x03: return PortRoleModem default: if name == "ttyUSB2" { @@ -279,9 +295,9 @@ func selectATPort(ports []Port) Port { for _, port := range ports { score := 0 switch { - case port.Name == "ttyUSB2": - score = 120 case port.Role == PortRoleAT: + score = 120 + case port.Name == "ttyUSB2": score = 100 case port.InterfaceNumber == 0x04: score = 90 diff --git a/internal/modem/discovery_test.go b/internal/modem/discovery_test.go index 05c9423..950306c 100644 --- a/internal/modem/discovery_test.go +++ b/internal/modem/discovery_test.go @@ -123,6 +123,54 @@ func TestSysFSDiscoverySelectsTTYUSB2InQMIInterface00Layout(t *testing.T) { } } +func TestSysFSDiscoverySelectsATPortForSecondQMIUSBModem(t *testing.T) { + root := t.TempDir() + sysRoot := filepath.Join(root, "sys") + devRoot := filepath.Join(root, "dev") + usbRoot := filepath.Join(sysRoot, "bus", "usb", "devices") + + for _, modem := range []struct { + usbName string + ttys []string + wdm string + }{ + {"1-6", []string{"ttyUSB0", "ttyUSB1", "ttyUSB2", "ttyUSB3"}, "cdc-wdm0"}, + {"1-5", []string{"ttyUSB4", "ttyUSB5", "ttyUSB6", "ttyUSB7"}, "cdc-wdm1"}, + } { + mustWrite(t, filepath.Join(usbRoot, modem.usbName, "idVendor"), "2c7c\n") + mustWrite(t, filepath.Join(usbRoot, modem.usbName, "idProduct"), "0125\n") + for number, tty := range modem.ttys { + interfaceName := modem.usbName + ":1." + strconv.Itoa(number) + mustWrite(t, filepath.Join(usbRoot, interfaceName, "bInterfaceNumber"), fmt.Sprintf("%02x\n", number)) + mustMkdir(t, filepath.Join(usbRoot, interfaceName, tty, "tty", tty)) + } + mustWrite(t, filepath.Join(usbRoot, modem.usbName+":1.4", "bInterfaceNumber"), "04\n") + mustMkdir(t, filepath.Join(usbRoot, modem.usbName+":1.4", "usbmisc", modem.wdm)) + } + + candidates, err := NewSysFSDiscoverer(sysRoot, devRoot).Discover(context.Background()) + if err != nil { + t.Fatalf("Discover: %v", err) + } + if len(candidates) != 2 { + t.Fatalf("got %d candidates, want 2", len(candidates)) + } + for _, candidate := range candidates { + switch filepath.Base(candidate.USBPath) { + case "1-5": + if candidate.ATPort.Name != "ttyUSB6" || candidate.ATPort.Role != PortRoleAT { + t.Fatalf("second modem AT port = %#v, want ttyUSB6", candidate.ATPort) + } + case "1-6": + if candidate.ATPort.Name != "ttyUSB2" || candidate.ATPort.Role != PortRoleAT { + t.Fatalf("first modem AT port = %#v, want ttyUSB2", candidate.ATPort) + } + default: + t.Fatalf("unexpected candidate USB path %q", candidate.USBPath) + } + } +} + func TestSysFSDiscoveryIgnoresNonQuectelUSB(t *testing.T) { root := t.TempDir() usbRoot := filepath.Join(root, "sys", "bus", "usb", "devices") diff --git a/internal/server/call_api.go b/internal/server/call_api.go new file mode 100644 index 0000000..0949cbe --- /dev/null +++ b/internal/server/call_api.go @@ -0,0 +1,262 @@ +package server + +import ( + "context" + "errors" + "net/http" + "strconv" + "strings" + "time" + + "vocat/internal/modem" + "vocat/internal/store" + "vocat/internal/vowifi" +) + +const maxCallDuration = 10 * time.Minute + +func (s *Server) handleCalls(w http.ResponseWriter, r *http.Request, config store.Device, physicalID string) bool { + if !requireMethod(w, r, http.MethodGet) { + return true + } + transport := s.callTransport(config.ID) + if transport == "vowifi" { + controller, ok := s.vowifi.(VoWiFiCallController) + if !ok { + writeError(w, http.StatusNotImplemented, "vowifi_voice_unavailable", "the active VoWiFi IMS session does not expose voice-call signalling") + return true + } + calls, err := controller.Calls(config.ID) + if err != nil { + writeError(w, http.StatusServiceUnavailable, "vowifi_call_failed", err.Error()) + return true + } + writeJSON(w, http.StatusOK, map[string]any{"data": map[string]any{ + "device_id": config.ID, "transport": transport, "calls": calls, + }}) + return true + } + response, err := s.devices.ExecuteAT(r.Context(), physicalID, "AT+CLCC") + if err != nil { + s.writeDeviceError(w, err) + return true + } + writeJSON(w, http.StatusOK, map[string]any{ + "data": map[string]any{ + "device_id": config.ID, + "transport": transport, + "calls": parseCLCC(response), + "raw": response.Text(), + }, + }) + return true +} + +func (s *Server) handleCallAction(w http.ResponseWriter, r *http.Request, config store.Device, physicalID, action string) bool { + if !requireMethod(w, r, http.MethodPost) { + return true + } + command := "" + duration := time.Duration(0) + number := "" + callID := "" + switch action { + case "dial": + var request struct { + Number string `json:"number"` + DurationSeconds int `json:"duration_seconds"` + } + if err := s.decodeJSON(w, r, &request); err != nil { + writeError(w, http.StatusBadRequest, "invalid_request", err.Error()) + return true + } + number = strings.TrimSpace(request.Number) + if !validDialNumber(number) { + writeError(w, http.StatusBadRequest, "invalid_number", "phone number is invalid") + return true + } + duration = time.Duration(request.DurationSeconds) * time.Second + if duration < time.Second || duration > maxCallDuration { + writeError(w, http.StatusBadRequest, "invalid_duration", "duration_seconds must be between 1 and 600") + return true + } + command = "ATD" + number + ";" + case "answer": + var request struct { + CallID string `json:"call_id"` + } + if err := s.decodeJSON(w, r, &request); err != nil { + writeError(w, http.StatusBadRequest, "invalid_request", err.Error()) + return true + } + callID = strings.TrimSpace(request.CallID) + command = "ATA" + case "hangup": + var request struct { + CallID string `json:"call_id"` + } + if err := s.decodeJSON(w, r, &request); err != nil { + writeError(w, http.StatusBadRequest, "invalid_request", err.Error()) + return true + } + callID = strings.TrimSpace(request.CallID) + command = "ATH" + default: + writeError(w, http.StatusNotFound, "not_found", "call action not found") + return true + } + + transport := s.callTransport(config.ID) + if transport == "vowifi" { + controller, ok := s.vowifi.(VoWiFiCallController) + if !ok { + writeError(w, http.StatusNotImplemented, "vowifi_voice_unavailable", "the active VoWiFi IMS session does not expose voice-call signalling") + return true + } + var result any + var err error + switch action { + case "dial": + result, err = controller.DialCall(r.Context(), config.ID, number) + case "answer": + callID, err = resolveVoWiFiCallID(controller, config.ID, callID, "ringing") + if err == nil { + result, err = controller.AnswerCall(r.Context(), config.ID, callID) + } + case "hangup": + callID, err = resolveVoWiFiCallID(controller, config.ID, callID, "") + if err == nil { + err = controller.HangupCall(r.Context(), config.ID, callID) + } + } + if err != nil { + writeError(w, http.StatusBadGateway, "vowifi_call_failed", err.Error()) + return true + } + if action == "dial" { + if call, ok := result.(vowifi.Call); ok { + callID = call.ID + } + go s.hangupVoWiFiAfter(config.ID, callID, duration) + } + s.recordAudit(r.Context(), "admin", "call."+action, "device", config.ID, "success", transport) + writeJSON(w, http.StatusAccepted, map[string]any{"data": map[string]any{ + "accepted": true, "action": action, "number": number, "call_id": callID, + "duration_seconds": int(duration / time.Second), "transport": transport, "call": result, + }}) + return true + } + operationContext, cancel := context.WithTimeout(r.Context(), 20*time.Second) + response, err := s.devices.ExecuteAT(operationContext, physicalID, command) + cancel() + if err != nil { + s.writeDeviceError(w, err) + return true + } + if !strings.EqualFold(strings.TrimSpace(response.Final), "OK") { + writeError(w, http.StatusBadGateway, "call_rejected", "modem did not accept the call action") + return true + } + if action == "dial" { + go s.hangupAfter(config.ID, physicalID, duration) + } + s.recordAudit(r.Context(), "admin", "call."+action, "device", config.ID, "success", transport) + writeJSON(w, http.StatusAccepted, map[string]any{ + "data": map[string]any{ + "accepted": true, "action": action, "number": number, + "duration_seconds": int(duration / time.Second), "transport": transport, + }, + }) + return true +} + +func resolveVoWiFiCallID(controller VoWiFiCallController, deviceID, id, requiredState string) (string, error) { + if id != "" { + return id, nil + } + calls, err := controller.Calls(deviceID) + if err != nil { + return "", err + } + for _, call := range calls { + if requiredState == "" || call.State == requiredState { + return call.ID, nil + } + } + return "", errors.New("no matching active call") +} + +func (s *Server) hangupVoWiFiAfter(deviceID, callID string, duration time.Duration) { + timer := time.NewTimer(duration) + defer timer.Stop() + <-timer.C + controller, ok := s.vowifi.(VoWiFiCallController) + if !ok { + return + } + ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second) + defer cancel() + if err := controller.HangupCall(ctx, deviceID, callID); err != nil { + s.logger.Warn("automatic VoWiFi call hangup failed", "device_id", deviceID, "call_id", callID, "error", err) + } +} + +func (s *Server) callTransport(deviceID string) string { + if s.vowifi != nil { + if state, err := s.vowifi.State(deviceID); err == nil && state.Enabled { + return "vowifi" + } + } + return "cellular" +} + +func (s *Server) hangupAfter(deviceID, physicalID string, duration time.Duration) { + timer := time.NewTimer(duration) + defer timer.Stop() + <-timer.C + ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second) + defer cancel() + if _, err := s.devices.ExecuteAT(ctx, physicalID, "ATH"); err != nil { + s.logger.Warn("automatic call hangup failed", "device_id", deviceID, "error", err) + } +} + +func validDialNumber(value string) bool { + if len(value) < 2 || len(value) > 32 { + return false + } + for index, character := range value { + if character >= '0' && character <= '9' || (index == 0 && character == '+') || character == '*' || character == '#' { + continue + } + return false + } + return true +} + +func parseCLCC(response modem.Response) []map[string]any { + result := make([]map[string]any, 0) + for _, line := range response.Lines { + line = strings.TrimSpace(line) + if !strings.HasPrefix(strings.ToUpper(line), "+CLCC:") { + continue + } + fields := strings.Split(strings.TrimSpace(strings.TrimPrefix(line, "+CLCC:")), ",") + if len(fields) < 5 { + continue + } + integer := func(index int) int { + value, _ := strconv.Atoi(strings.TrimSpace(fields[index])) + return value + } + call := map[string]any{ + "index": integer(0), "direction": integer(1), "state": integer(2), + "mode": integer(3), "multiparty": integer(4), "raw": line, + } + if len(fields) > 5 { + call["number"] = strings.Trim(strings.TrimSpace(fields[5]), `"`) + } + result = append(result, call) + } + return result +} diff --git a/internal/server/call_api_test.go b/internal/server/call_api_test.go new file mode 100644 index 0000000..b277396 --- /dev/null +++ b/internal/server/call_api_test.go @@ -0,0 +1,30 @@ +package server + +import ( + "testing" + + "vocat/internal/modem" +) + +func TestParseCLCC(t *testing.T) { + calls := parseCLCC(modem.Response{Lines: []string{ + `+CLCC: 1,1,4,0,0,"+447700900000",145`, + `+CLCC: 2,0,0,0,0,"12345",129`, + }}) + if len(calls) != 2 || calls[0]["number"] != "+447700900000" || calls[1]["state"] != 0 { + t.Fatalf("parseCLCC = %#v", calls) + } +} + +func TestValidDialNumber(t *testing.T) { + for _, value := range []string{"+447700900000", "12345", "*100#"} { + if !validDialNumber(value) { + t.Errorf("validDialNumber(%q) = false", value) + } + } + for _, value := range []string{"", "+", "12;ATH", "12 34", "abc"} { + if validDialNumber(value) { + t.Errorf("validDialNumber(%q) = true", value) + } + } +} diff --git a/internal/server/device_api.go b/internal/server/device_api.go index 075ceb8..50a2d82 100644 --- a/internal/server/device_api.go +++ b/internal/server/device_api.go @@ -251,18 +251,33 @@ func (s *Server) handleDevices(w http.ResponseWriter, r *http.Request) bool { } func findDiscoveredDevice(devices []device.Device, config deviceConfigPayload) *device.Device { + if config.ModemIMEI != "" { + for index := range devices { + if devices[index].Snapshot != nil && devices[index].Snapshot.IMEI == config.ModemIMEI { + return &devices[index] + } + } + } + if config.USBPath != "" { + for index := range devices { + if devices[index].Candidate.USBPath == config.USBPath { + return &devices[index] + } + } + } + if config.ControlDevice != "" { + for index := range devices { + if devices[index].Candidate.QMIControl == config.ControlDevice { + return &devices[index] + } + } + } for index := range devices { candidate := devices[index].Candidate if config.ATPort != "" && (candidate.ATPort.Path == config.ATPort || candidate.ATPort.OpenPath() == config.ATPort) { return &devices[index] } - if config.ControlDevice != "" && candidate.QMIControl == config.ControlDevice { - return &devices[index] - } - if config.USBPath != "" && candidate.USBPath == config.USBPath { - return &devices[index] - } } return nil } @@ -502,6 +517,16 @@ func (s *Server) handleDevicePath( return s.handleVoWiFiReconnect(w, r, config, physicalPresent) case "vowifi/e911/websheet": return s.handleE911Websheet(w, r, config) + case "calls": + if !s.requirePhysicalDevice(w, physicalPresent) { + return true + } + return s.handleCalls(w, r, config, physicalID) + case "calls/dial", "calls/answer", "calls/hangup": + if !s.requirePhysicalDevice(w, physicalPresent) { + return true + } + return s.handleCallAction(w, r, config, physicalID, tail[1]) default: return false } @@ -1043,6 +1068,14 @@ func physicalMatchesConfig(entry device.Device, config store.Device) bool { if entry.ID == config.ID { return true } + if config.ModemIMEI != "" && entry.Snapshot != nil && entry.Snapshot.IMEI != "" { + return config.ModemIMEI == entry.Snapshot.IMEI + } + if config.USBPath != "" && candidate.USBPath != "" { + return config.USBPath == candidate.USBPath + } + // Control and serial device nodes are allocation-order dependent. They are + // only legacy fallbacks when no physical USB path or readable IMEI exists. if config.ATPort != "" && (config.ATPort == candidate.ATPort.Path || config.ATPort == candidate.ATPort.OpenPath()) { return true @@ -1050,12 +1083,7 @@ func physicalMatchesConfig(entry device.Device, config store.Device) bool { if config.ControlDevice != "" && config.ControlDevice == candidate.QMIControl { return true } - if config.USBPath != "" && config.USBPath == candidate.USBPath { - return true - } - return config.ModemIMEI != "" && - entry.Snapshot != nil && - config.ModemIMEI == entry.Snapshot.IMEI + return false } func (s *Server) configuredDeviceSummary( diff --git a/internal/server/device_features_api_test.go b/internal/server/device_features_api_test.go index 207f28f..6b6a73f 100644 --- a/internal/server/device_features_api_test.go +++ b/internal/server/device_features_api_test.go @@ -3,13 +3,16 @@ package server import ( "context" "encoding/json" + "log/slog" "net/http" "net/http/httptest" "strings" "testing" "vocat/internal/device" + "vocat/internal/modem" "vocat/internal/store" + "vocat/internal/update" ) func decodeData(t *testing.T, recorder *httptest.ResponseRecorder) map[string]any { @@ -40,6 +43,50 @@ func TestAttachSingleEUICCIdentityFillsProfileGroupMetadataKey(t *testing.T) { } } +func TestPhysicalMatchesConfigRejectsDuplicateAndroidSerialAlias(t *testing.T) { + config := store.Device{ + ID: "EC20", + ATPort: "/dev/serial/by-id/usb-Android_Android-if02-port0", + USBPath: "/sys/bus/usb/devices/1-6", + ModemIMEI: "111111111111111", + } + newModem := device.Device{ + ID: "quectel-0125-1-5", + Candidate: modem.Candidate{ + USBPath: "/sys/bus/usb/devices/1-5", + ATPort: modem.Port{ + Path: "/dev/ttyUSB6", + StablePath: config.ATPort, + }, + }, + Snapshot: &device.Snapshot{IMEI: "222222222222222"}, + } + if physicalMatchesConfig(newModem, config) { + t.Fatal("different modem matched through a duplicated Android by-id alias") + } + + movedOriginal := newModem + movedOriginal.Snapshot = &device.Snapshot{IMEI: config.ModemIMEI} + if !physicalMatchesConfig(movedOriginal, config) { + t.Fatal("same IMEI should follow the modem to a different USB port") + } +} + +func TestFindDiscoveredDevicePrefersPhysicalIdentityOverSerialAlias(t *testing.T) { + alias := "/dev/serial/by-id/usb-Android_Android-if02-port0" + devices := []device.Device{ + {ID: "old", Candidate: modem.Candidate{USBPath: "/sys/bus/usb/devices/1-6", ATPort: modem.Port{StablePath: alias}}}, + {ID: "new", Candidate: modem.Candidate{USBPath: "/sys/bus/usb/devices/1-5", ATPort: modem.Port{StablePath: alias}}}, + } + selected := findDiscoveredDevice(devices, deviceConfigPayload{ + USBPath: "/sys/bus/usb/devices/1-5", + ATPort: alias, + }) + if selected == nil || selected.ID != "new" { + t.Fatalf("selected = %#v, want new physical USB device", selected) + } +} + func TestHandleOperatorScanReturnsOperators(t *testing.T) { server := &Server{ logger: regionTestLogger(), @@ -278,6 +325,56 @@ func TestHandleUpdateApplyIsSafeNoop(t *testing.T) { } } +func TestHandleUpdateCheckUsesTrustedRepository(t *testing.T) { + server := &Server{ + logger: regionTestLogger(), + updateRepository: update.DefaultRepository, + updateCheck: func(_ context.Context, repo, token, current string) (update.CheckResult, error) { + if repo != update.DefaultRepository || token != "token" || current == "" { + t.Fatalf("check arguments = %q, %q, %q", repo, token, current) + } + return update.CheckResult{ + Available: true, + Current: current, + Latest: "9.9.9", + ReleaseNotes: "release notes", + }, nil + }, + updateToken: "token", + } + recorder := httptest.NewRecorder() + server.handleUpdateCheck(recorder, httptest.NewRequest(http.MethodGet, "/check", nil)) + if recorder.Code != http.StatusOK { + t.Fatalf("status = %d, body = %s", recorder.Code, recorder.Body) + } + data := decodeData(t, recorder) + if data["available"] != true || data["version"] != "9.9.9" || data["repository"] != update.DefaultRepository { + t.Fatalf("check data = %#v", data) + } +} + +func TestHandleUpdateApplyInstallsFromTrustedRepository(t *testing.T) { + server := &Server{ + logger: regionTestLogger(), + updateRepository: update.DefaultRepository, + updateApply: func(_ context.Context, _ *slog.Logger, options update.Options, restart bool) (update.CheckResult, error) { + if options.Repo != update.DefaultRepository || restart { + t.Fatalf("apply options = %#v, restart = %v", options, restart) + } + return update.CheckResult{Applied: true, Latest: "9.9.9"}, nil + }, + } + recorder := httptest.NewRecorder() + server.handleUpdateApply(recorder, httptest.NewRequest(http.MethodPost, "/apply", nil)) + if recorder.Code != http.StatusOK { + t.Fatalf("status = %d, body = %s", recorder.Code, recorder.Body) + } + data := decodeData(t, recorder) + if data["applied"] != true || data["version"] != "9.9.9" { + t.Fatalf("apply data = %#v", data) + } +} + func TestE911WebsheetFlow(t *testing.T) { database, err := store.Open(context.Background(), ":memory:") if err != nil { diff --git a/internal/server/extensions_api.go b/internal/server/extensions_api.go new file mode 100644 index 0000000..8f6475e --- /dev/null +++ b/internal/server/extensions_api.go @@ -0,0 +1,161 @@ +package server + +import ( + "context" + "errors" + "io" + "net/http" + "os" + "strings" + "time" +) + +const maxPluginUploadBytes int64 = 64 << 20 + +func (s *Server) routeExtensionAPI(w http.ResponseWriter, r *http.Request, cleanPath string) bool { + if cleanPath == "extensions" { + if s.extensions == nil { + writeError(w, http.StatusServiceUnavailable, "extensions_unavailable", "plugin manager is unavailable") + return true + } + switch r.Method { + case http.MethodGet: + writeJSON(w, http.StatusOK, map[string]any{"data": s.extensions.List()}) + default: + w.Header().Set("Allow", "GET") + writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed") + } + return true + } + if cleanPath == "extensions/install-url" { + if s.extensions == nil { + writeError(w, http.StatusServiceUnavailable, "extensions_unavailable", "plugin manager is unavailable") + return true + } + if !requireMethod(w, r, http.MethodPost) { + return true + } + var request struct { + URL string `json:"url"` + SHA256 string `json:"sha256"` + } + if err := s.decodeJSON(w, r, &request); err != nil { + writeError(w, http.StatusBadRequest, "invalid_request", err.Error()) + return true + } + ctx, cancel := contextWithTimeout(r, 60*time.Second) + defer cancel() + plugin, err := s.extensions.InstallURL(ctx, request.URL, request.SHA256) + if err != nil { + writeError(w, http.StatusBadRequest, "plugin_install_failed", err.Error()) + return true + } + s.recordAudit(r.Context(), "admin", "plugin.install_url", "plugin", plugin.ID, "success", request.URL) + writeJSON(w, http.StatusCreated, map[string]any{"data": plugin}) + return true + } + if cleanPath == "extensions/upload" { + if s.extensions == nil { + writeError(w, http.StatusServiceUnavailable, "extensions_unavailable", "plugin manager is unavailable") + return true + } + if !requireMethod(w, r, http.MethodPost) { + return true + } + r.Body = http.MaxBytesReader(w, r.Body, maxPluginUploadBytes+(1<<20)) + if err := r.ParseMultipartForm(maxPluginUploadBytes); err != nil { + writeError(w, http.StatusBadRequest, "invalid_plugin_upload", "plugin upload must be multipart/form-data and no larger than 64 MiB") + return true + } + file, _, err := r.FormFile("package") + if err != nil { + writeError(w, http.StatusBadRequest, "invalid_plugin_upload", "multipart field package is required") + return true + } + defer file.Close() + plugin, err := s.extensions.Install(io.LimitReader(file, maxPluginUploadBytes+1), r.FormValue("sha256")) + if err != nil { + writeError(w, http.StatusBadRequest, "plugin_install_failed", err.Error()) + return true + } + s.recordAudit(r.Context(), "admin", "plugin.upload", "plugin", plugin.ID, "success", "upload") + writeJSON(w, http.StatusCreated, map[string]any{"data": plugin}) + return true + } + + segments := splitAPIPath(cleanPath) + if len(segments) < 2 || segments[0] != "extensions" { + return false + } + if s.extensions == nil { + writeError(w, http.StatusServiceUnavailable, "extensions_unavailable", "plugin manager is unavailable") + return true + } + id := segments[1] + if len(segments) >= 3 && segments[2] == "backend" { + s.extensions.ProxyBackend(w, r, id) + return true + } + if len(segments) != 2 { + writeError(w, http.StatusNotFound, "not_found", "plugin endpoint not found") + return true + } + switch r.Method { + case http.MethodPut: + var request struct { + Enabled bool `json:"enabled"` + } + if err := s.decodeJSON(w, r, &request); err != nil { + writeError(w, http.StatusBadRequest, "invalid_request", err.Error()) + return true + } + plugin, err := s.extensions.SetEnabled(id, request.Enabled) + if errors.Is(err, os.ErrNotExist) { + writeError(w, http.StatusNotFound, "plugin_not_found", "plugin not found") + return true + } + if err != nil { + writeError(w, http.StatusInternalServerError, "plugin_state_failed", err.Error()) + return true + } + writeJSON(w, http.StatusOK, map[string]any{"data": plugin}) + case http.MethodDelete: + if err := s.extensions.Uninstall(id); errors.Is(err, os.ErrNotExist) { + writeError(w, http.StatusNotFound, "plugin_not_found", "plugin not found") + } else if err != nil { + writeError(w, http.StatusInternalServerError, "plugin_uninstall_failed", err.Error()) + } else { + writeJSON(w, http.StatusOK, map[string]any{"data": map[string]bool{"uninstalled": true}}) + } + default: + w.Header().Set("Allow", "PUT, DELETE") + writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed") + } + return true +} + +func (s *Server) handlePluginAsset(w http.ResponseWriter, r *http.Request) { + if r.Method != http.MethodGet && r.Method != http.MethodHead { + w.Header().Set("Allow", "GET, HEAD") + writeError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed") + return + } + if !s.requireAuthenticated(w, r) { + return + } + if s.extensions == nil { + http.NotFound(w, r) + return + } + path := strings.TrimPrefix(r.URL.Path, "/plugin-assets/") + parts := strings.SplitN(path, "/", 2) + if len(parts) != 2 || parts[0] == "" || parts[1] == "" { + http.NotFound(w, r) + return + } + s.extensions.ServeAsset(w, r, parts[0], parts[1]) +} + +func contextWithTimeout(r *http.Request, timeout time.Duration) (context.Context, context.CancelFunc) { + return context.WithTimeout(r.Context(), timeout) +} diff --git a/internal/server/general_api.go b/internal/server/general_api.go index 818434e..2c016fd 100644 --- a/internal/server/general_api.go +++ b/internal/server/general_api.go @@ -7,6 +7,7 @@ import ( "fmt" "log/slog" "net/http" + "os" "runtime" "strconv" "strings" @@ -17,10 +18,14 @@ import ( "vocat/internal/i18n" "vocat/internal/loghub" "vocat/internal/store" + "vocat/internal/update" ) func (s *Server) routeGeneralAPI(w http.ResponseWriter, r *http.Request) bool { cleanPath := strings.Trim(strings.TrimPrefix(r.URL.Path, "/api"), "/") + if s.routeExtensionAPI(w, r, cleanPath) { + return true + } if s.routeSMSAPI(w, r, cleanPath) { return true } @@ -309,6 +314,7 @@ func (s *Server) handleSystemInfo(w http.ResponseWriter, r *http.Request) { "os": runtime.GOOS, "architecture": runtime.GOARCH, "uptime": formatDuration(time.Since(s.startedAt)), + "developer": s.developerEnabled, }, }) } @@ -317,28 +323,124 @@ func (s *Server) handleUpdateCheck(w http.ResponseWriter, r *http.Request) { if !requireMethod(w, r, http.MethodGet) { return } + if strings.TrimSpace(s.updateRepository) == "" || s.updateCheck == nil { + writeJSON(w, http.StatusOK, map[string]any{ + "data": map[string]any{ + "available": false, + "version": buildinfo.Version, + "message": i18n.T("未配置受信任的软件更新源；不会从未知地址下载或执行文件。"), + }, + }) + return + } + ctx, cancel := context.WithTimeout(r.Context(), 15*time.Second) + defer cancel() + result, err := s.updateCheck( + ctx, + s.updateRepository, + s.updateToken, + buildinfo.Version, + ) + if err != nil { + s.logger.Warn("check for updates failed", "repository", s.updateRepository, "error", err) + writeError(w, http.StatusBadGateway, "update_check_failed", err.Error()) + return + } + message := "" + if result.Available { + message = result.ReleaseNotes + } writeJSON(w, http.StatusOK, map[string]any{ "data": map[string]any{ - "available": false, - "version": buildinfo.Version, - "message": i18n.T("未配置受信任的软件更新源；不会从未知地址下载或执行文件。"), + "available": result.Available, + "current_version": result.Current, + "version": result.Latest, + "message": message, + "repository": s.updateRepository, + "is_docker": runningInDocker(), }, }) } -// handleUpdateApply deliberately performs no update. Without a configured, -// trusted update channel the product never downloads or executes code, so an -// apply request is acknowledged as a safe no-op rather than acted on. +func runningInDocker() bool { + if _, err := os.Stat("/.dockerenv"); err == nil { + return true + } + return strings.EqualFold(strings.TrimSpace(os.Getenv("VOCAT_CONTAINER")), "docker") +} + func (s *Server) handleUpdateApply(w http.ResponseWriter, r *http.Request) { if !requireMethod(w, r, http.MethodPost) { return } + if strings.TrimSpace(s.updateRepository) == "" || s.updateApply == nil { + writeJSON(w, http.StatusOK, map[string]any{ + "data": map[string]any{ + "applied": false, + "message": i18n.T("未配置受信任的软件更新源；未执行任何更新。"), + }, + }) + return + } + if runningInDocker() { + writeError(w, http.StatusConflict, "container_update_required", "pull the latest container image and recreate the container") + return + } + s.updateMu.Lock() + if s.updateApplying { + s.updateMu.Unlock() + writeError(w, http.StatusConflict, "update_busy", "another update is already in progress") + return + } + s.updateApplying = true + s.updateMu.Unlock() + defer func() { + s.updateMu.Lock() + s.updateApplying = false + s.updateMu.Unlock() + }() + + ctx, cancel := context.WithTimeout(r.Context(), 2*time.Minute) + defer cancel() + result, err := s.updateApply(ctx, s.logger, update.Options{ + Repo: s.updateRepository, + Token: s.updateToken, + }, false) + if err != nil { + s.logger.Error("apply update failed", "repository", s.updateRepository, "error", err) + writeError(w, http.StatusBadGateway, "update_apply_failed", err.Error()) + return + } + if !result.Applied { + writeJSON(w, http.StatusOK, map[string]any{ + "data": map[string]any{ + "applied": false, + "version": result.Latest, + "message": "The installed version is already current.", + }, + }) + return + } writeJSON(w, http.StatusOK, map[string]any{ "data": map[string]any{ - "applied": false, - "message": i18n.T("未配置受信任的软件更新源；未执行任何更新。"), + "applied": true, + "version": result.Latest, + "message": "Update verified and installed; the service is restarting.", }, }) + if flusher, ok := w.(http.Flusher); ok { + flusher.Flush() + } + if s.updateRestart != nil { + restart := s.updateRestart + logger := s.logger + go func() { + time.Sleep(time.Second) + if err := restart(logger); err != nil { + logger.Error("restart after update failed", "error", err) + } + }() + } } func (s *Server) handlePasswordChange(w http.ResponseWriter, r *http.Request) { diff --git a/internal/server/server.go b/internal/server/server.go index 51a755d..630080f 100644 --- a/internal/server/server.go +++ b/internal/server/server.go @@ -18,8 +18,10 @@ import ( "time" "vocat/internal/auth" + "vocat/internal/extensions" "vocat/internal/loghub" "vocat/internal/store" + "vocat/internal/update" "vocat/internal/vowifi" ) @@ -39,6 +41,10 @@ type Options struct { Logger *slog.Logger SecureCookies bool MaxRequestBodyBytes int64 + Extensions *extensions.Manager + DeveloperEnabled bool + UpdateRepository string + UpdateToken string } // Server is the single HTTP handler for the JSON API and embedded SPA. @@ -60,6 +66,15 @@ type Server struct { accessMu sync.RWMutex access parsedAccessConfig loginLimiter *loginRateLimiter + extensions *extensions.Manager + developerEnabled bool + updateRepository string + updateToken string + updateCheck func(context.Context, string, string, string) (update.CheckResult, error) + updateApply func(context.Context, *slog.Logger, update.Options, bool) (update.CheckResult, error) + updateRestart func(*slog.Logger) error + updateMu sync.Mutex + updateApplying bool } func New(options Options) (*Server, error) { @@ -82,6 +97,9 @@ func New(options Options) (*Server, error) { if options.MaxRequestBodyBytes <= 0 { options.MaxRequestBodyBytes = 1 << 20 } + if strings.TrimSpace(options.UpdateRepository) == "" { + options.UpdateRepository = update.DefaultRepository + } server := &Server{ store: options.Store, @@ -98,6 +116,13 @@ func New(options Options) (*Server, error) { startedAt: time.Now().UTC(), websheets: newWebsheetManager(), loginLimiter: newLoginRateLimiter(), + extensions: options.Extensions, + developerEnabled: options.DeveloperEnabled, + updateRepository: strings.TrimSpace(options.UpdateRepository), + updateToken: strings.TrimSpace(options.UpdateToken), + updateCheck: update.CheckLatest, + updateApply: update.ApplyLatest, + updateRestart: update.RestartService, } server.loadAccessConfig(context.Background()) server.loadUILanguage(context.Background()) @@ -110,6 +135,7 @@ func New(options Options) (*Server, error) { mux.HandleFunc("/api", server.handleAPI) mux.HandleFunc("/api/", server.handleAPI) mux.HandleFunc("/websheets/", server.handleWebsheet) + mux.HandleFunc("/plugin-assets/", server.handlePluginAsset) mux.HandleFunc("/", server.handleSPA) server.handler = server.recoverPanics( @@ -127,6 +153,13 @@ type VoWiFiController interface { RequestReconnect(string) (vowifi.State, error) } +type VoWiFiCallController interface { + Calls(string) ([]vowifi.Call, error) + DialCall(context.Context, string, string) (vowifi.Call, error) + AnswerCall(context.Context, string, string) (vowifi.Call, error) + HangupCall(context.Context, string, string) error +} + func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { s.handler.ServeHTTP(w, r) } @@ -528,7 +561,7 @@ func (s *Server) securityHeaders(next http.Handler) http.Handler { w.Header().Set("X-Content-Type-Options", "nosniff") w.Header().Set("Referrer-Policy", "same-origin") w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()") - if strings.HasPrefix(r.URL.Path, "/websheets/") { + if strings.HasPrefix(r.URL.Path, "/websheets/") || strings.HasPrefix(r.URL.Path, "/plugin-assets/") { // The self-hosted E911 websheet is embedded in an iframe by the SPA, so // it must be frameable same-origin. Every other route stays DENY. w.Header().Set("X-Frame-Options", "SAMEORIGIN") diff --git a/internal/server/settings_api.go b/internal/server/settings_api.go index 1cde8c8..884e252 100644 --- a/internal/server/settings_api.go +++ b/internal/server/settings_api.go @@ -255,8 +255,8 @@ func validateNotificationField( return fmt.Errorf("%s is too long or contains invalid characters", field) } if name == "base_url" && value != "" { - if _, err := parseOutboundURL(value, true); err != nil { - return fmt.Errorf("%s must be an absolute HTTPS URL", field) + if _, err := telegramAPIURL(value, "123456:validation-token", "sendMessage"); err != nil { + return fmt.Errorf("%s must be an absolute HTTPS URL or a URL template with two %%s placeholders", field) } } if name == "proxy" && value != "" { @@ -551,8 +551,8 @@ func validateNotificationTestConfig(channel string, config map[string]any) error return errors.New("telegram.chat_id is required") } if baseURL := configString(config, "base_url"); baseURL != "" { - if _, err := parseOutboundURL(baseURL, true); err != nil { - return errors.New("telegram.base_url must be an absolute HTTPS URL") + if _, err := telegramAPIURL(baseURL, token, "sendMessage"); err != nil { + return errors.New("telegram.base_url must be an absolute HTTPS URL or a URL template with two %s placeholders") } } case "email": @@ -660,19 +660,11 @@ func sendBarkNotificationTest(ctx context.Context, config map[string]any) error } func sendTelegramNotificationTest(ctx context.Context, config map[string]any) error { - baseURL := configString(config, "base_url") - if baseURL == "" { - baseURL = "https://api.telegram.org" - } - parsed, err := validateOutboundURL(ctx, baseURL, true) + token := configString(config, "bot_token") + parsed, err := validateTelegramAPIURL(ctx, configString(config, "base_url"), token, "sendMessage") if err != nil { return err } - token := configString(config, "bot_token") - parsed.Path = strings.TrimRight(parsed.Path, "/") + "/bot" + token + "/sendMessage" - parsed.RawPath = "" - parsed.RawQuery = "" - parsed.Fragment = "" client, err := restrictedHTTPClient(ctx, 6*time.Second, configString(config, "proxy")) if err != nil { return err diff --git a/internal/server/settings_api_test.go b/internal/server/settings_api_test.go index 8015540..6e00ec5 100644 --- a/internal/server/settings_api_test.go +++ b/internal/server/settings_api_test.go @@ -211,6 +211,30 @@ func TestNotificationSettingsRejectsUnknownAndMalformedInput(t *testing.T) { } } +func TestNotificationSettingsAcceptsTelegramReverseProxyTemplate(t *testing.T) { + test := newSettingsAPITest(t) + recorder := test.request( + t, + http.MethodPut, + "/api/settings/notifications", + `{"telegram":{"enabled":true,"bot_token":"123456:abcdefghijklmnopqrstuvwxyz","chat_id":"1","base_url":"https://telegram.example.com/bot%s/%s"}}`, + ) + if recorder.Code != http.StatusOK { + t.Fatalf("PUT status = %d, body = %s", recorder.Code, recorder.Body) + } + stored, err := test.database.NotificationSetting(context.Background(), "telegram") + if err != nil { + t.Fatal(err) + } + var config map[string]any + if err := json.Unmarshal(stored.Config, &config); err != nil { + t.Fatal(err) + } + if config["base_url"] != "https://telegram.example.com/bot%s/%s" { + t.Fatalf("stored Telegram base URL = %#v", config["base_url"]) + } +} + func TestNotificationTestsBlockSSRFAndUnsupportedChannels(t *testing.T) { test := newSettingsAPITest(t) var webhookHits atomic.Int32 diff --git a/internal/server/sms_api.go b/internal/server/sms_api.go index e82164d..27bf994 100644 --- a/internal/server/sms_api.go +++ b/internal/server/sms_api.go @@ -46,10 +46,9 @@ func (s *Server) handleSMSContacts(w http.ResponseWriter, r *http.Request) { } deviceID := normalizeSMSDeviceFilter(r.URL.Query().Get("device_id")) s.syncModemSMS(r.Context(), deviceID) - contacts, err := s.store.ListSMSContacts(r.Context(), store.SMSFilter{ - DeviceID: deviceID, - Limit: queryLimit(r, 100), - }) + filter := s.smsStoreFilter(r.Context(), deviceID, "") + filter.Limit = queryLimit(r, 100) + contacts, err := s.store.ListSMSContacts(r.Context(), filter) if err != nil { s.writeStoreError(w, err) return @@ -59,6 +58,7 @@ func (s *Server) handleSMSContacts(w http.ResponseWriter, r *http.Request) { result = append(result, map[string]any{ "device_id": contact.DeviceID, "device_name": contact.DeviceName, + "modem_imei": contact.ModemIMEI, "imsi": contact.IMSI, "local_phone": contact.LocalPhone, "peer": contact.Peer, @@ -78,6 +78,7 @@ func (s *Server) handleSMSContacts(w http.ResponseWriter, r *http.Request) { func (s *Server) handleSMSThread(w http.ResponseWriter, r *http.Request) { deviceID := normalizeSMSDeviceFilter(r.URL.Query().Get("device_id")) + modemIMEI := strings.TrimSpace(r.URL.Query().Get("modem_imei")) imsi := strings.TrimSpace(r.URL.Query().Get("imsi")) peer := strings.TrimSpace(r.URL.Query().Get("peer")) if peer == "" { @@ -87,12 +88,14 @@ func (s *Server) handleSMSThread(w http.ResponseWriter, r *http.Request) { switch r.Method { case http.MethodGet: s.syncModemSMS(r.Context(), deviceID) - messages, err := s.store.ListSMSMessages(r.Context(), store.SMSFilter{ - DeviceID: deviceID, - IMSI: imsi, - Peer: peer, - Limit: queryLimit(r, 100), - }) + filter := s.smsStoreFilter(r.Context(), deviceID, modemIMEI) + filter.IMSI = imsi + filter.Peer = peer + filter.Limit = queryLimit(r, 100) + if beforeID, parseErr := strconv.ParseInt(strings.TrimSpace(r.URL.Query().Get("before_id")), 10, 64); parseErr == nil && beforeID > 0 { + filter.BeforeID = beforeID + } + messages, err := s.store.ListSMSMessages(r.Context(), filter) if err != nil { s.writeStoreError(w, err) return @@ -110,12 +113,11 @@ func (s *Server) handleSMSThread(w http.ResponseWriter, r *http.Request) { } writeJSON(w, http.StatusOK, map[string]any{"data": result}) case http.MethodDelete: - messages, err := s.store.ListSMSMessages(r.Context(), store.SMSFilter{ - DeviceID: deviceID, - IMSI: imsi, - Peer: peer, - Limit: 1000, - }) + filter := s.smsStoreFilter(r.Context(), deviceID, modemIMEI) + filter.IMSI = imsi + filter.Peer = peer + filter.Limit = 1000 + messages, err := s.store.ListSMSMessages(r.Context(), filter) if err != nil { s.writeStoreError(w, err) return @@ -147,6 +149,35 @@ func normalizeSMSDeviceFilter(value string) string { return value } +// smsStoreFilter resolves a mutable configured device ID to the modem's stable +// IMEI. The ID is still used to address the live modem, but persisted history +// remains attached to the same hardware after the user renames that ID. +func (s *Server) smsStoreFilter(ctx context.Context, deviceID, requestedIMEI string) store.SMSFilter { + filter := store.SMSFilter{ModemIMEI: strings.TrimSpace(requestedIMEI)} + deviceID = strings.TrimSpace(deviceID) + if deviceID == "" { + return filter + } + filter.ModemIMEI = "" + filter.DeviceID = deviceID + config, err := s.store.Device(ctx, deviceID) + if err != nil { + return filter + } + imei := strings.TrimSpace(config.ModemIMEI) + if entry, _, present := s.physicalForConfig(config); present { + imei = firstNonEmpty( + snapshotString(entry.Snapshot, func(snapshot *device.Snapshot) string { return snapshot.IMEI }), + imei, + ) + } + if imei != "" { + filter.DeviceID = "" + filter.ModemIMEI = imei + } + return filter +} + // blockedSMSDestination reports whether the recipient is in a barred country. // Normalization mirrors the PDU/IMS paths so the block cannot be sidestepped by // dropping the leading "+" or using a 00 international prefix. @@ -227,6 +258,10 @@ func (s *Server) handleSMSSend(w http.ResponseWriter, r *http.Request) { return } imsi := snapshotString(entry.Snapshot, func(snapshot *device.Snapshot) string { return snapshot.IMSI }) + modemIMEI := firstNonEmpty( + snapshotString(entry.Snapshot, func(snapshot *device.Snapshot) string { return snapshot.IMEI }), + config.ModemIMEI, + ) extra, _ := json.Marshal(map[string]any{ "encoding": result.Encoding, "message_reference": result.MessageReference, @@ -245,13 +280,14 @@ func (s *Server) handleSMSSend(w http.ResponseWriter, r *http.Request) { }) messageID := fmt.Sprintf( "at-submit:%s:%d:%d", - request.DeviceID, + firstNonEmpty(modemIMEI, request.DeviceID), result.MessageReference, result.SubmittedAt.UnixNano(), ) saved, err := s.store.SaveSMSMessage(r.Context(), store.SMSMessage{ MessageID: messageID, DeviceID: request.DeviceID, + ModemIMEI: modemIMEI, IMSI: imsi, Peer: result.To, Direction: "outbound", @@ -354,9 +390,14 @@ func (s *Server) writeIMSSMSSendResult( "submission_status": result.SubmissionStatus, }) imsi := snapshotString(entry.Snapshot, func(snapshot *device.Snapshot) string { return snapshot.IMSI }) + modemIMEI := snapshotString(entry.Snapshot, func(snapshot *device.Snapshot) string { return snapshot.IMEI }) + if config, configErr := s.store.Device(r.Context(), deviceID); configErr == nil { + modemIMEI = firstNonEmpty(modemIMEI, config.ModemIMEI) + } saved, err := s.store.SaveSMSMessage(r.Context(), store.SMSMessage{ - MessageID: fmt.Sprintf("ims-submit:%s:%d", deviceID, result.SubmittedAt.UnixNano()), + MessageID: fmt.Sprintf("ims-submit:%s:%d", firstNonEmpty(modemIMEI, deviceID), result.SubmittedAt.UnixNano()), DeviceID: deviceID, + ModemIMEI: modemIMEI, IMSI: imsi, Peer: result.To, Direction: "outbound", @@ -494,11 +535,16 @@ func (s *Server) syncModemSMS(ctx context.Context, onlyDevice string) { continue } imsi := snapshotString(entry.Snapshot, func(snapshot *device.Snapshot) string { return snapshot.IMSI }) + modemIMEI := firstNonEmpty( + snapshotString(entry.Snapshot, func(snapshot *device.Snapshot) string { return snapshot.IMEI }), + config.ModemIMEI, + ) for _, message := range messages { if message.Direction == device.SMSDirectionStatusReport && message.MessageReference != nil && message.StatusCode != nil { _, applyErr := s.store.ApplySMSDeliveryReport(ctx, store.SMSDeliveryReport{ DeviceID: config.ID, + ModemIMEI: modemIMEI, IMSI: imsi, Peer: message.To, Source: "cellular_at", @@ -550,6 +596,7 @@ func (s *Server) syncModemSMS(ctx context.Context, onlyDevice string) { _, saveErr := s.store.SaveSMSMessage(ctx, store.SMSMessage{ MessageID: messageID, DeviceID: config.ID, + ModemIMEI: modemIMEI, IMSI: imsi, Peer: peer, Direction: direction, @@ -605,6 +652,7 @@ func storedSMSResponse(message store.SMSMessage) map[string]any { "id": message.ID, "message_id": message.MessageID, "device_id": message.DeviceID, + "modem_imei": message.ModemIMEI, "imsi": message.IMSI, "peer": message.Peer, "direction": message.Direction, diff --git a/internal/server/sms_api_test.go b/internal/server/sms_api_test.go index 2ba68af..aa0fde9 100644 --- a/internal/server/sms_api_test.go +++ b/internal/server/sms_api_test.go @@ -54,6 +54,48 @@ func TestSMSThreadAllDevicesUsesIMSIFilter(t *testing.T) { } } +func TestSMSThreadConfiguredDeviceUsesStableIMEI(t *testing.T) { + ctx := context.Background() + database, err := store.Open(ctx, ":memory:") + if err != nil { + t.Fatal(err) + } + t.Cleanup(func() { _ = database.Close() }) + const imei = "867394042309830" + if err := database.UpsertDevice(ctx, store.Device{ + ID: "ec20_2", Name: "EC20 renamed", ModemIMEI: imei, + }); err != nil { + t.Fatal(err) + } + if _, err := database.SaveSMSMessage(ctx, store.SMSMessage{ + MessageID: "before-rename", DeviceID: "ec20_1", ModemIMEI: imei, + IMSI: "imsi-a", Peer: "VOXI", Direction: "inbound", Body: "history", + }); err != nil { + t.Fatal(err) + } + + server := &Server{store: database} + request := httptest.NewRequest( + http.MethodGet, + "/api/sms/thread?device_id=ec20_2&imsi=imsi-a&peer=VOXI", + nil, + ) + response := httptest.NewRecorder() + server.handleSMSThread(response, request) + if response.Code != http.StatusOK { + t.Fatalf("status = %d, body = %s", response.Code, response.Body.String()) + } + var envelope struct { + Data []map[string]any `json:"data"` + } + if err := json.Unmarshal(response.Body.Bytes(), &envelope); err != nil { + t.Fatal(err) + } + if len(envelope.Data) != 1 || envelope.Data[0]["modem_imei"] != imei { + t.Fatalf("thread data = %#v", envelope.Data) + } +} + func TestNormalizeSMSDeviceFilter(t *testing.T) { if got := normalizeSMSDeviceFilter(" ALL "); got != "" { t.Fatalf("all filter = %q", got) @@ -88,9 +130,9 @@ func TestSMSSendOutcome(t *testing.T) { func TestBlockedSMSDestination(t *testing.T) { tests := []struct { - name string - phone string - block bool + name string + phone string + block bool }{ {"e164 china", "+8613800138000", true}, {"no plus china", "8613800138000", true}, diff --git a/internal/server/sms_notifications.go b/internal/server/sms_notifications.go index 9ec6f96..84ed882 100644 --- a/internal/server/sms_notifications.go +++ b/internal/server/sms_notifications.go @@ -160,13 +160,27 @@ func validateSMSNotificationConfig(channel string, config map[string]any) error func (s *Server) newSMSNotification(ctx context.Context, message store.SMSMessage) smsNotification { name := "" - if device, err := s.store.Device(ctx, message.DeviceID); err == nil { + deviceID := message.DeviceID + if message.ModemIMEI != "" { + if devices, err := s.store.ListDevices(ctx); err == nil { + var newest time.Time + for _, candidate := range devices { + if candidate.ModemIMEI == message.ModemIMEI && + (newest.IsZero() || candidate.UpdatedAt.After(newest)) { + deviceID = candidate.ID + name = strings.TrimSpace(candidate.Name) + newest = candidate.UpdatedAt + } + } + } + } + if device, err := s.store.Device(ctx, deviceID); err == nil { name = strings.TrimSpace(device.Name) } return smsNotification{ - DeviceID: message.DeviceID, + DeviceID: deviceID, DeviceName: name, - DeviceLabel: firstNonEmpty(name, message.DeviceID, "--"), + DeviceLabel: firstNonEmpty(name, deviceID, "--"), Number: firstNonEmpty(message.Peer, "--"), Time: message.Timestamp, Content: message.Body, diff --git a/internal/server/telegram_bot.go b/internal/server/telegram_bot.go index c8196e5..f1c8adc 100644 --- a/internal/server/telegram_bot.go +++ b/internal/server/telegram_bot.go @@ -811,7 +811,7 @@ func (bot *telegramBot) loadConfig(ctx context.Context) (telegramRuntimeConfig, Proxy: configString(raw, "proxy"), } if config.BaseURL == "" { - config.BaseURL = "https://api.telegram.org" + config.BaseURL = defaultTelegramBaseURL } if admin := configString(raw, "admin_id"); admin != "" { config.AdminID, err = strconv.ParseInt(admin, 10, 64) @@ -826,12 +826,10 @@ func (bot *telegramBot) loadConfig(ctx context.Context) (telegramRuntimeConfig, } func (bot *telegramBot) call(ctx context.Context, config telegramRuntimeConfig, method string, payload any, result any) error { - base, err := validateOutboundURL(ctx, config.BaseURL, true) + base, err := validateTelegramAPIURL(ctx, config.BaseURL, config.Token, method) if err != nil { return err } - base.Path = strings.TrimRight(base.Path, "/") + "/bot" + config.Token + "/" + method - base.RawPath, base.RawQuery, base.Fragment = "", "", "" body, err := json.Marshal(payload) if err != nil { return err diff --git a/internal/server/telegram_bot_test.go b/internal/server/telegram_bot_test.go index f1f7176..5ab2386 100644 --- a/internal/server/telegram_bot_test.go +++ b/internal/server/telegram_bot_test.go @@ -1,12 +1,57 @@ package server import ( + "strings" "testing" "time" "vocat/internal/modem" ) +func TestTelegramAPIURLSupportsBaseAndTemplate(t *testing.T) { + tests := []struct { + name string + baseURL string + want string + }{ + { + name: "base URL", + baseURL: "https://api.telegram.org", + want: "https://api.telegram.org/bot123456:test-token/sendMessage", + }, + { + name: "reverse proxy template", + baseURL: "https://telegram.example.com/bot%s/%s", + want: "https://telegram.example.com/bot123456:test-token/sendMessage", + }, + } + for _, item := range tests { + t.Run(item.name, func(t *testing.T) { + got, err := telegramAPIURL(item.baseURL, "123456:test-token", "sendMessage") + if err != nil { + t.Fatal(err) + } + if got.String() != item.want { + t.Fatalf("telegramAPIURL() = %q, want %q", got, item.want) + } + }) + } +} + +func TestTelegramAPIURLRejectsMalformedTemplates(t *testing.T) { + for _, value := range []string{ + "https://telegram.example.com/bot%s/sendMessage", + "https://%s.example.com/bot/token/%s", + "http://telegram.example.com/bot%s/%s", + } { + if _, err := telegramAPIURL(value, "123456:test-token", "sendMessage"); err == nil { + t.Errorf("telegramAPIURL(%q) unexpectedly succeeded", value) + } else if strings.TrimSpace(err.Error()) == "" { + t.Errorf("telegramAPIURL(%q) returned an empty error", value) + } + } +} + func TestParseTelegramCommand(t *testing.T) { command, remainder := parseTelegramCommand(" /sms@vocat_bot EC20 +447700900123 hello world ") if command != "sms" || remainder != "EC20 +447700900123 hello world" { diff --git a/internal/server/telegram_url.go b/internal/server/telegram_url.go new file mode 100644 index 0000000..408390c --- /dev/null +++ b/internal/server/telegram_url.go @@ -0,0 +1,65 @@ +package server + +import ( + "context" + "errors" + "net/url" + "strings" +) + +const defaultTelegramBaseURL = "https://api.telegram.org" + +// telegramAPIURL accepts either a Telegram API base URL or a printf-style +// endpoint template whose two %s placeholders are the bot token and method. +func telegramAPIURL(baseURL, token, method string) (*url.URL, error) { + raw := strings.TrimSpace(baseURL) + if raw == "" { + raw = defaultTelegramBaseURL + } + + placeholderCount := strings.Count(raw, "%s") + if placeholderCount != 0 && placeholderCount != 2 { + return nil, errors.New("Telegram API URL must contain either no %s placeholders or exactly two") + } + if placeholderCount == 2 { + if telegramPlaceholderInAuthority(raw) { + return nil, errors.New("Telegram API URL placeholders are not allowed in the host") + } + endpoint := strings.Replace(raw, "%s", token, 1) + endpoint = strings.Replace(endpoint, "%s", method, 1) + return parseOutboundURL(endpoint, true) + } + + parsed, err := parseOutboundURL(raw, true) + if err != nil { + return nil, err + } + parsed.Path = strings.TrimRight(parsed.Path, "/") + "/bot" + token + "/" + method + parsed.RawPath = "" + parsed.RawQuery = "" + parsed.Fragment = "" + return parsed, nil +} + +func validateTelegramAPIURL(ctx context.Context, baseURL, token, method string) (*url.URL, error) { + parsed, err := telegramAPIURL(baseURL, token, method) + if err != nil { + return nil, err + } + if _, err := resolvePublicAddresses(ctx, parsed.Hostname()); err != nil { + return nil, err + } + return parsed, nil +} + +func telegramPlaceholderInAuthority(raw string) bool { + schemeEnd := strings.Index(raw, "://") + if schemeEnd < 0 { + return false + } + authority := raw[schemeEnd+3:] + if end := strings.IndexAny(authority, "/?#"); end >= 0 { + authority = authority[:end] + } + return strings.Contains(authority, "%s") +} diff --git a/internal/store/devices.go b/internal/store/devices.go index 789bc03..1abe4ba 100644 --- a/internal/store/devices.go +++ b/internal/store/devices.go @@ -206,11 +206,52 @@ func (s *Store) ListDevices(ctx context.Context) ([]Device, error) { } func (s *Store) DeleteDevice(ctx context.Context, id string) error { - result, err := s.db.ExecContext(ctx, `DELETE FROM devices WHERE id = ?`, id) + tx, err := s.db.BeginTx(ctx, nil) + if err != nil { + return fmt.Errorf("begin delete device %q: %w", id, err) + } + defer tx.Rollback() + var modemIMEI string + if err := tx.QueryRowContext(ctx, `SELECT modem_imei FROM devices WHERE id = ?`, id).Scan(&modemIMEI); err != nil { + if errors.Is(err, sql.ErrNoRows) { + return ErrNotFound + } + return fmt.Errorf("read device %q before deletion: %w", id, err) + } + // SMS history must outlive a mutable configured device ID. Anchor any + // legacy ID-owned rows to the physical modem before the device row and its + // runtime records are removed. + if strings.TrimSpace(modemIMEI) != "" { + if _, err := tx.ExecContext(ctx, ` + DELETE FROM sms_messages AS legacy + WHERE legacy.device_id = ? AND legacy.modem_imei = '' AND legacy.message_id <> '' + AND EXISTS ( + SELECT 1 FROM sms_messages current + WHERE current.modem_imei = ? + AND current.message_id = legacy.message_id + ) + `, id, strings.TrimSpace(modemIMEI)); err != nil { + return fmt.Errorf("deduplicate SMS history for device %q: %w", id, err) + } + if _, err := tx.ExecContext(ctx, ` + UPDATE sms_messages + SET modem_imei = ?, updated_at = ? + WHERE device_id = ? AND modem_imei = '' + `, strings.TrimSpace(modemIMEI), time.Now().UTC().Unix(), id); err != nil { + return fmt.Errorf("anchor SMS history for device %q: %w", id, err) + } + } + result, err := tx.ExecContext(ctx, `DELETE FROM devices WHERE id = ?`, id) if err != nil { return fmt.Errorf("delete device %q: %w", id, err) } - return requireAffected(result) + if err := requireAffected(result); err != nil { + return err + } + if err := tx.Commit(); err != nil { + return fmt.Errorf("commit delete device %q: %w", id, err) + } + return nil } const deviceSelect = ` diff --git a/internal/store/domain_test.go b/internal/store/domain_test.go index 012fa14..e86df7d 100644 --- a/internal/store/domain_test.go +++ b/internal/store/domain_test.go @@ -70,6 +70,41 @@ func TestMigrationFromAuthenticationSchema(t *testing.T) { } } +func TestMigration7BackfillsSMSModemIMEI(t *testing.T) { + ctx := context.Background() + path := filepath.Join(t.TempDir(), "sms-imei.db") + raw, err := sql.Open("sqlite", path) + if err != nil { + t.Fatal(err) + } + for version := 1; version <= 6; version++ { + for _, statement := range migrationStatements(version) { + if _, err := raw.ExecContext(ctx, statement); err != nil { + t.Fatalf("create v%d schema: %v", version, err) + } + } + } + if _, err := raw.ExecContext(ctx, ` + INSERT INTO devices (id, name, modem_imei, created_at, updated_at) + VALUES ('ec20_1', 'EC20', '867394042309830', 100, 100); + INSERT INTO sms_messages ( + message_id, device_id, peer, direction, message_time, created_at, updated_at + ) VALUES ('legacy-message', 'ec20_1', 'VOXI', 'inbound', 100, 100, 100); + PRAGMA user_version = 6; + `); err != nil { + t.Fatal(err) + } + if err := raw.Close(); err != nil { + t.Fatal(err) + } + + database := openTestStore(t, path) + messages, err := database.ListSMSMessages(ctx, SMSFilter{ModemIMEI: "867394042309830"}) + if err != nil || len(messages) != 1 || messages[0].DeviceID != "ec20_1" { + t.Fatalf("migrated SMS = %#v, %v", messages, err) + } +} + func TestMigration4PreservesIMSRedeliveryAndUsesReceiptTime(t *testing.T) { ctx := context.Background() path := filepath.Join(t.TempDir(), "ims-redelivery.db") @@ -291,6 +326,68 @@ func TestSMSPersistenceAndDerivedThreads(t *testing.T) { } } +func TestSMSHistoryFollowsModemIMEIAfterDeviceIDRename(t *testing.T) { + ctx := context.Background() + database := openTestStore(t, ":memory:") + const imei = "867394042309830" + if err := database.UpsertDevice(ctx, Device{ + ID: "ec20_1", Name: "EC20 old", ModemIMEI: imei, + }); err != nil { + t.Fatal(err) + } + if _, err := database.SaveSMSMessage(ctx, SMSMessage{ + MessageID: "network-old", DeviceID: "ec20_1", + IMSI: "23415", Peer: "VOXI", Direction: "inbound", Body: "before rename", + Timestamp: time.Unix(1_700_000_000, 0).UTC(), + }); err != nil { + t.Fatal(err) + } + if err := database.DeleteDevice(ctx, "ec20_1"); err != nil { + t.Fatal(err) + } + if err := database.UpsertDevice(ctx, Device{ + ID: "ec20_2", Name: "EC20 renamed", ModemIMEI: imei, + }); err != nil { + t.Fatal(err) + } + if _, err := database.SaveSMSMessage(ctx, SMSMessage{ + MessageID: "network-new", DeviceID: "ec20_2", ModemIMEI: imei, + IMSI: "23415", Peer: "VOXI", Direction: "inbound", Body: "after rename", + Timestamp: time.Unix(1_700_000_060, 0).UTC(), + }); err != nil { + t.Fatal(err) + } + + contacts, err := database.ListSMSContacts(ctx, SMSFilter{ModemIMEI: imei}) + if err != nil { + t.Fatal(err) + } + if len(contacts) != 1 || contacts[0].DeviceID != "ec20_2" || + contacts[0].ModemIMEI != imei || contacts[0].MessageCount != 2 { + t.Fatalf("renamed hardware contact = %#v", contacts) + } + messages, err := database.ListSMSMessages(ctx, SMSFilter{ + ModemIMEI: imei, IMSI: "23415", Peer: "VOXI", + }) + if err != nil || len(messages) != 2 { + t.Fatalf("renamed hardware messages = %#v, %v", messages, err) + } + + // A retry that arrives after the rename updates the same hardware message, + // rather than duplicating it under the new configured ID. + if _, err := database.SaveSMSMessage(ctx, SMSMessage{ + MessageID: "network-old", DeviceID: "ec20_2", ModemIMEI: imei, + IMSI: "23415", Peer: "VOXI", Direction: "inbound", Body: "retry", + Timestamp: time.Unix(1_700_000_000, 0).UTC(), + }); err != nil { + t.Fatal(err) + } + messages, err = database.ListSMSMessages(ctx, SMSFilter{ModemIMEI: imei}) + if err != nil || len(messages) != 2 { + t.Fatalf("retry after rename messages = %#v, %v", messages, err) + } +} + func TestListInboundSMSAfterIDUsesDurableInsertionCursor(t *testing.T) { ctx := context.Background() database := openTestStore(t, ":memory:") diff --git a/internal/store/migrations.go b/internal/store/migrations.go index 438de3c..3849700 100644 --- a/internal/store/migrations.go +++ b/internal/store/migrations.go @@ -81,6 +81,31 @@ func migrationStatements(version int) []string { `CREATE INDEX IF NOT EXISTS device_proxy_bindings_proxy_idx ON device_proxy_bindings(upstream_proxy_id)`, } + case 7: + return []string{ + `ALTER TABLE sms_messages + ADD COLUMN modem_imei TEXT NOT NULL DEFAULT ''`, + `UPDATE sms_messages + SET modem_imei = COALESCE(( + SELECT NULLIF(d.modem_imei, '') + FROM devices d + WHERE d.id = sms_messages.device_id + ), '') + WHERE modem_imei = ''`, + `DELETE FROM sms_messages + WHERE modem_imei <> '' AND message_id <> '' + AND id NOT IN ( + SELECT MIN(id) + FROM sms_messages + WHERE modem_imei <> '' AND message_id <> '' + GROUP BY modem_imei, message_id + )`, + `CREATE UNIQUE INDEX IF NOT EXISTS sms_messages_hardware_external_id_idx + ON sms_messages(modem_imei, message_id) + WHERE modem_imei <> '' AND message_id <> ''`, + `CREATE INDEX IF NOT EXISTS sms_messages_hardware_thread_idx + ON sms_messages(modem_imei, imsi, peer, message_time DESC, id DESC)`, + } default: return nil } diff --git a/internal/store/models.go b/internal/store/models.go index f7aa33d..9ad6118 100644 --- a/internal/store/models.go +++ b/internal/store/models.go @@ -127,6 +127,7 @@ type SMSMessage struct { ID int64 MessageID string DeviceID string + ModemIMEI string IMSI string Peer string Direction string @@ -143,19 +144,21 @@ type SMSMessage struct { } type SMSFilter struct { - DeviceID string - IMSI string - Peer string - Since time.Time - Until time.Time - BeforeID int64 - Limit int + DeviceID string + ModemIMEI string + IMSI string + Peer string + Since time.Time + Until time.Time + BeforeID int64 + Limit int } // SMSDeliveryReport is network evidence for one submitted SMS part. The // message reference is the TP-MR returned in SMS-STATUS-REPORT. type SMSDeliveryReport struct { DeviceID string + ModemIMEI string IMSI string Peer string Source string @@ -170,6 +173,7 @@ type SMSDeliveryReport struct { type SMSContact struct { DeviceID string DeviceName string + ModemIMEI string IMSI string LocalPhone string Peer string diff --git a/internal/store/sms.go b/internal/store/sms.go index 953496c..061d070 100644 --- a/internal/store/sms.go +++ b/internal/store/sms.go @@ -40,6 +40,7 @@ func saveSMSMessage( value SMSMessage, ) (SMSMessage, error) { value.DeviceID = strings.TrimSpace(value.DeviceID) + value.ModemIMEI = strings.TrimSpace(value.ModemIMEI) value.Peer = strings.TrimSpace(value.Peer) value.Direction = strings.ToLower(strings.TrimSpace(value.Direction)) if value.DeviceID == "" { @@ -77,13 +78,13 @@ func saveSMSMessage( if value.ID > 0 { result, err := executor.ExecContext(ctx, ` UPDATE sms_messages SET - message_id = ?, device_id = ?, imsi = ?, peer = ?, + message_id = ?, device_id = ?, modem_imei = ?, imsi = ?, peer = ?, direction = ?, body = ?, message_time = ?, status = ?, source = ?, parts_total = ?, delivery_state = ?, is_read = ?, extra_json = ?, updated_at = ? WHERE id = ? `, - value.MessageID, value.DeviceID, value.IMSI, value.Peer, + value.MessageID, value.DeviceID, value.ModemIMEI, value.IMSI, value.Peer, value.Direction, value.Body, value.Timestamp.Unix(), value.Status, value.Source, value.PartsTotal, value.DeliveryState, boolInt(value.Read), string(extra), value.UpdatedAt.Unix(), value.ID, @@ -99,11 +100,16 @@ func saveSMSMessage( result, err := executor.ExecContext(ctx, ` INSERT INTO sms_messages ( - message_id, device_id, imsi, peer, direction, body, message_time, + message_id, device_id, modem_imei, imsi, peer, direction, body, message_time, status, source, parts_total, delivery_state, is_read, extra_json, created_at, updated_at - ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) - ON CONFLICT(device_id, message_id) WHERE message_id <> '' DO UPDATE SET + ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) + ON CONFLICT DO UPDATE SET + device_id = excluded.device_id, + modem_imei = CASE + WHEN excluded.modem_imei <> '' THEN excluded.modem_imei + ELSE sms_messages.modem_imei + END, imsi = excluded.imsi, peer = excluded.peer, direction = excluded.direction, @@ -117,7 +123,7 @@ func saveSMSMessage( extra_json = excluded.extra_json, updated_at = excluded.updated_at `, - value.MessageID, value.DeviceID, value.IMSI, value.Peer, + value.MessageID, value.DeviceID, value.ModemIMEI, value.IMSI, value.Peer, value.Direction, value.Body, value.Timestamp.Unix(), value.Status, value.Source, value.PartsTotal, value.DeliveryState, boolInt(value.Read), string(extra), value.CreatedAt.Unix(), @@ -127,10 +133,13 @@ func saveSMSMessage( return SMSMessage{}, fmt.Errorf("save SMS: %w", err) } if value.MessageID != "" { + hardwareKey := smsHardwareKey(value.ModemIMEI, value.DeviceID) return scanSMSMessage(executor.QueryRowContext( ctx, - smsMessageSelect+` WHERE device_id = ? AND message_id = ?`, - value.DeviceID, + smsMessageSelect+` WHERE + COALESCE(NULLIF(modem_imei, ''), 'device:' || device_id) = ? + AND message_id = ?`, + hardwareKey, value.MessageID, )) } @@ -207,7 +216,9 @@ func (s *Store) ListInboundSMSAfterID(ctx context.Context, afterID int64, limit // outbound submission and advances its aggregate delivery state. Multipart // messages become delivered only after every submitted part is reported. func (s *Store) ApplySMSDeliveryReport(ctx context.Context, report SMSDeliveryReport) (SMSMessage, error) { - if report.DeviceID == "" || report.MessageReference < 0 || report.MessageReference > 255 { + report.DeviceID = strings.TrimSpace(report.DeviceID) + report.ModemIMEI = strings.TrimSpace(report.ModemIMEI) + if (report.DeviceID == "" && report.ModemIMEI == "") || report.MessageReference < 0 || report.MessageReference > 255 { return SMSMessage{}, errors.New("invalid SMS delivery report identity") } if report.ReceivedAt.IsZero() { @@ -219,7 +230,7 @@ func (s *Store) ApplySMSDeliveryReport(ctx context.Context, report SMSDeliveryRe } defer tx.Rollback() query := smsMessageSelect + ` - WHERE device_id = ? + WHERE ((? <> '' AND modem_imei = ?) OR (? = '' AND device_id = ?)) AND direction IN ('outbound', 'sent') AND (? = '' OR imsi = ?) AND (? = '' OR peer = ?) @@ -229,7 +240,7 @@ func (s *Store) ApplySMSDeliveryReport(ctx context.Context, report SMSDeliveryRe rows, err := tx.QueryContext( ctx, query, - report.DeviceID, + report.ModemIMEI, report.ModemIMEI, report.ModemIMEI, report.DeviceID, report.IMSI, report.IMSI, report.Peer, report.Peer, report.Source, report.Source, @@ -449,28 +460,42 @@ func (s *Store) MarkSMSThreadRead( func (s *Store) ListSMSContacts(ctx context.Context, filter SMSFilter) ([]SMSContact, error) { where, args := smsWhere(filter, "m.") query := ` - WITH ranked AS ( + WITH resolved AS ( SELECT - m.id, m.device_id, m.imsi, m.peer, m.body, m.message_time, - m.direction, + m.*, + COALESCE(NULLIF(m.modem_imei, ''), 'device:' || m.device_id) AS hardware_key, + COALESCE(( + SELECT current_device.id + FROM devices current_device + WHERE m.modem_imei <> '' + AND current_device.modem_imei = m.modem_imei + ORDER BY current_device.updated_at DESC, current_device.id + LIMIT 1 + ), m.device_id) AS resolved_device_id + FROM sms_messages m` + where + ` + ), ranked AS ( + SELECT + m.id, m.resolved_device_id, m.modem_imei, m.imsi, m.peer, + m.body, m.message_time, m.direction, ROW_NUMBER() OVER ( - PARTITION BY m.device_id, m.imsi, m.peer + PARTITION BY m.hardware_key, m.imsi, m.peer ORDER BY m.message_time DESC, m.id DESC ) AS row_number, SUM(CASE WHEN m.direction IN ('inbound', 'received') AND m.is_read = 0 THEN 1 ELSE 0 END) OVER ( - PARTITION BY m.device_id, m.imsi, m.peer + PARTITION BY m.hardware_key, m.imsi, m.peer ) AS unread_count, COUNT(*) OVER ( - PARTITION BY m.device_id, m.imsi, m.peer + PARTITION BY m.hardware_key, m.imsi, m.peer ) AS message_count - FROM sms_messages m` + where + ` + FROM resolved m ) SELECT - r.device_id, + r.resolved_device_id, COALESCE(d.name, ''), + r.modem_imei, r.imsi, COALESCE(NULLIF(dr.phone_number, ''), NULLIF(vr.local_phone, ''), ''), r.peer, @@ -482,9 +507,9 @@ func (s *Store) ListSMSContacts(ctx context.Context, filter SMSFilter) ([]SMSCon r.unread_count, r.message_count FROM ranked r - LEFT JOIN devices d ON d.id = r.device_id - LEFT JOIN device_runtime dr ON dr.device_id = r.device_id - LEFT JOIN vowifi_runtime vr ON vr.device_id = r.device_id + LEFT JOIN devices d ON d.id = r.resolved_device_id + LEFT JOIN device_runtime dr ON dr.device_id = r.resolved_device_id + LEFT JOIN vowifi_runtime vr ON vr.device_id = r.resolved_device_id WHERE r.row_number = 1 ORDER BY r.message_time DESC, r.id DESC LIMIT ?` @@ -500,7 +525,7 @@ func (s *Store) ListSMSContacts(ctx context.Context, filter SMSFilter) ([]SMSCon var value SMSContact var timestamp int64 if err := rows.Scan( - &value.DeviceID, &value.DeviceName, &value.IMSI, + &value.DeviceID, &value.DeviceName, &value.ModemIMEI, &value.IMSI, &value.LocalPhone, &value.Peer, &value.DisplayName, &value.LastMessage, ×tamp, &value.Direction, &value.LastSMSID, &value.UnreadCount, &value.MessageCount, @@ -517,7 +542,7 @@ func (s *Store) ListSMSContacts(ctx context.Context, filter SMSFilter) ([]SMSCon } const smsMessageSelect = ` - SELECT id, message_id, device_id, imsi, peer, direction, body, + SELECT id, message_id, device_id, modem_imei, imsi, peer, direction, body, message_time, status, source, parts_total, delivery_state, is_read, extra_json, created_at, updated_at FROM sms_messages` @@ -528,7 +553,7 @@ func scanSMSMessage(row rowScanner) (SMSMessage, error) { var read int var extra string err := row.Scan( - &value.ID, &value.MessageID, &value.DeviceID, &value.IMSI, + &value.ID, &value.MessageID, &value.DeviceID, &value.ModemIMEI, &value.IMSI, &value.Peer, &value.Direction, &value.Body, &messageTime, &value.Status, &value.Source, &value.PartsTotal, &value.DeliveryState, &read, &extra, &createdAt, &updatedAt, @@ -554,6 +579,10 @@ func smsWhere(filter SMSFilter, prefix string) (string, []any) { clauses = append(clauses, prefix+`device_id = ?`) args = append(args, filter.DeviceID) } + if filter.ModemIMEI != "" { + clauses = append(clauses, prefix+`modem_imei = ?`) + args = append(args, filter.ModemIMEI) + } if filter.IMSI != "" { clauses = append(clauses, prefix+`imsi = ?`) args = append(args, filter.IMSI) @@ -580,6 +609,13 @@ func smsWhere(filter SMSFilter, prefix string) (string, []any) { return " WHERE " + strings.Join(clauses, " AND "), args } +func smsHardwareKey(modemIMEI, deviceID string) string { + if modemIMEI = strings.TrimSpace(modemIMEI); modemIMEI != "" { + return modemIMEI + } + return "device:" + strings.TrimSpace(deviceID) +} + func normalizedLimit(value int) int { if value <= 0 { return 100 diff --git a/internal/store/store.go b/internal/store/store.go index 5da5eac..515691e 100644 --- a/internal/store/store.go +++ b/internal/store/store.go @@ -13,7 +13,7 @@ import ( _ "modernc.org/sqlite" ) -const schemaVersion = 6 +const schemaVersion = 7 var ErrNotFound = errors.New("store: not found") @@ -117,6 +117,14 @@ func migrate(ctx context.Context, db *sql.DB) error { } for _, statement := range migrationStatements(nextVersion) { if _, err := tx.ExecContext(ctx, statement); err != nil { + // A database whose user_version was repaired or rolled back may + // already contain this additive v7 column. The remaining v7 data + // backfill and indexes are still safe and must be applied. + if nextVersion == 7 && + strings.Contains(statement, "ADD COLUMN modem_imei") && + strings.Contains(strings.ToLower(err.Error()), "duplicate column name") { + continue + } _ = tx.Rollback() return fmt.Errorf("apply sqlite migration %d: %w", nextVersion, err) } diff --git a/internal/update/asset_test.go b/internal/update/asset_test.go index 8be8b5b..bbcc3c3 100644 --- a/internal/update/asset_test.go +++ b/internal/update/asset_test.go @@ -13,7 +13,7 @@ func TestAssetNamesFor(t *testing.T) { }{ {"linux", "amd64", []string{"vocat-linux-amd64"}}, {"linux", "386", []string{"vocat-linux-386"}}, - {"linux", "arm64", []string{"vocat-linux-arm64"}}, + {"linux", "arm64", []string{"vocat-linux-arm64", "vocat-linux-aarch64"}}, {"linux", "arm", []string{"vocat-linux-armv7", "vocat-linux-arm"}}, } for _, item := range tests { diff --git a/internal/update/github.go b/internal/update/github.go index 79aae47..f03168d 100644 --- a/internal/update/github.go +++ b/internal/update/github.go @@ -25,7 +25,20 @@ type Asset struct { Size int64 `json:"size"` } -const githubAPI = "https://api.github.com" +// CheckResult describes a trusted release check without downloading assets. +type CheckResult struct { + Available bool + Applied bool + Current string + Latest string + ReleaseNotes string + Release *Release +} + +const ( + githubAPI = "https://api.github.com" + DefaultRepository = "MengMengCode/VoCat" +) // LatestRelease fetches the newest published release for repo (form // "owner/name"). A non-empty token is sent as a Bearer header, which is @@ -73,6 +86,27 @@ func LatestRelease(ctx context.Context, repo, token string) (*Release, error) { return &release, nil } +// CheckLatest fetches the newest release and performs a semantic version +// comparison so development builds are never offered an older release. +func CheckLatest(ctx context.Context, repo, token, current string) (CheckResult, error) { + release, err := LatestRelease(ctx, repo, token) + if err != nil { + return CheckResult{}, err + } + latest := strings.TrimPrefix(strings.TrimSpace(release.TagName), "v") + available, err := IsNewerVersion(current, latest) + if err != nil { + return CheckResult{}, fmt.Errorf("update: compare release versions: %w", err) + } + return CheckResult{ + Available: available, + Current: current, + Latest: latest, + ReleaseNotes: strings.TrimSpace(release.Body), + Release: release, + }, nil +} + // downloadAsset streams a release asset into dst, honoring the request context. // The token is applied for consistency with the API call (GitHub release assets // redirect to a pre-signed S3 URL; the token is dropped on redirect, which is diff --git a/internal/update/update.go b/internal/update/update.go index 9fe781b..b3bd128 100644 --- a/internal/update/update.go +++ b/internal/update/update.go @@ -51,12 +51,12 @@ func Run(logger *slog.Logger, args []string) error { if opts.Repo == "" { opts.Repo = strings.TrimSpace(os.Getenv("VOCAT_REPO")) } + if opts.Repo == "" { + opts.Repo = DefaultRepository + } if opts.Token == "" { opts.Token = strings.TrimSpace(os.Getenv("GITHUB_TOKEN")) } - if opts.Repo == "" { - return fmt.Errorf("update: no repository configured (set --repo=owner/name or VOCAT_REPO)") - } if opts.Target == "" { opts.Target = resolveDefaultTarget() } @@ -65,33 +65,55 @@ func Run(logger *slog.Logger, args []string) error { defer cancel() logger.Info("checking for updates", "repo", opts.Repo, "current", buildinfo.Version) - release, err := LatestRelease(ctx, opts.Repo, opts.Token) + result, err := CheckLatest(ctx, opts.Repo, opts.Token, buildinfo.Version) if err != nil { return err } - latest := strings.TrimPrefix(release.TagName, "v") - if latest == "" { - latest = release.TagName - } - - if latest == buildinfo.Version && !opts.Force { + if !result.Available && !opts.Force { logger.Info("already up to date", "version", buildinfo.Version) fmt.Printf("vocat %s is already the latest release.\n", buildinfo.Version) return nil } if opts.Check { - fmt.Printf("update available: %s -> %s\n", buildinfo.Version, latest) - if release.Body != "" { - fmt.Println(strings.TrimSpace(release.Body)) + fmt.Printf("update available: %s -> %s\n", buildinfo.Version, result.Latest) + if result.ReleaseNotes != "" { + fmt.Println(result.ReleaseNotes) } return nil } - logger.Info("update available", "current", buildinfo.Version, "latest", latest) - return applyUpdate(ctx, logger, opts, release, latest) + logger.Info("update available", "current", buildinfo.Version, "latest", result.Latest) + return applyUpdate(ctx, logger, opts, result.Release, result.Latest, true) } -func applyUpdate(ctx context.Context, logger *slog.Logger, opts Options, release *Release, latest string) error { +// ApplyLatest downloads, verifies, and atomically installs the newest trusted +// release. HTTP callers can pass restart=false and restart after flushing the +// response. +func ApplyLatest(ctx context.Context, logger *slog.Logger, opts Options, restart bool) (CheckResult, error) { + if strings.TrimSpace(opts.Repo) == "" { + opts.Repo = DefaultRepository + } + if strings.TrimSpace(opts.Token) == "" { + opts.Token = strings.TrimSpace(os.Getenv("GITHUB_TOKEN")) + } + if strings.TrimSpace(opts.Target) == "" { + opts.Target = resolveDefaultTarget() + } + result, err := CheckLatest(ctx, opts.Repo, opts.Token, buildinfo.Version) + if err != nil { + return CheckResult{}, err + } + if !result.Available && !opts.Force { + return result, nil + } + if err := applyUpdate(ctx, logger, opts, result.Release, result.Latest, restart); err != nil { + return CheckResult{}, err + } + result.Applied = true + return result, nil +} + +func applyUpdate(ctx context.Context, logger *slog.Logger, opts Options, release *Release, latest string, restart bool) error { assetNames := assetNamesFor(runtime.GOOS, runtime.GOARCH) var asset *Asset for _, name := range assetNames { @@ -169,11 +191,13 @@ func applyUpdate(ctx context.Context, logger *slog.Logger, opts Options, release logger.Info("installed new binary", "target", opts.Target, "version", latest) fmt.Printf("vocat updated to %s.\n", latest) - if err := restartService(logger); err != nil { - // The file replacement already succeeded; a restart failure is not - // fatal — the operator can restart the service manually. - fmt.Printf("Binary replaced, but automatic restart failed: %v\n", err) - fmt.Println("Restart the vocat service manually to apply the new build.") + if restart { + if err := RestartService(logger); err != nil { + // The file replacement already succeeded; a restart failure is not + // fatal — the operator can restart the service manually. + fmt.Printf("Binary replaced, but automatic restart failed: %v\n", err) + fmt.Println("Restart the vocat service manually to apply the new build.") + } } return nil } @@ -201,10 +225,10 @@ func backupAndReplace(target, tmp string) error { return nil } -// restartService restarts the vocat systemd unit. If systemctl is unavailable +// RestartService restarts the vocat systemd unit. If systemctl is unavailable // (non-systemd hosts, containers), it returns an error the caller surfaces as // a non-fatal warning. -func restartService(logger *slog.Logger) error { +func RestartService(logger *slog.Logger) error { if _, err := exec.LookPath("systemctl"); err != nil { return fmt.Errorf("systemctl not found in PATH") } @@ -245,6 +269,11 @@ func findAsset(release *Release, name string) *Asset { } func assetNamesFor(goos, goarch string) []string { + if goos == "linux" && goarch == "arm64" { + // AArch64 and arm64 name the same instruction set. Prefer the historic + // release name and accept the explicit architecture alias as fallback. + return []string{"vocat-linux-arm64", "vocat-linux-aarch64"} + } if goos == "linux" && goarch == "arm" { // Official 32-bit ARM builds target GOARM=7. Keep the generic legacy // name as a fallback for installations consuming an older release. @@ -261,7 +290,7 @@ Fetch the latest release from GitHub and replace this binary in place. Flags: --check Report whether an update is available, then exit. --force Reinstall even when already at the latest version. - --repo owner/name GitHub repository (default: $VOCAT_REPO). + --repo owner/name GitHub repository (default: $VOCAT_REPO or MengMengCode/VoCat). --target path Binary to replace (default: /opt/vocat/bin/vocat if present, otherwise the running executable). --token token GitHub bearer token (default: $GITHUB_TOKEN). diff --git a/internal/update/version.go b/internal/update/version.go new file mode 100644 index 0000000..324b3e2 --- /dev/null +++ b/internal/update/version.go @@ -0,0 +1,120 @@ +package update + +import ( + "fmt" + "strconv" + "strings" +) + +type semanticVersion struct { + major int + minor int + patch int + prerelease string +} + +// IsNewerVersion reports whether latest is newer than current. Both values +// may include the conventional v prefix, prerelease suffixes, and build +// metadata. Invalid release versions are rejected instead of triggering a +// downgrade or an arbitrary file replacement. +func IsNewerVersion(current, latest string) (bool, error) { + currentVersion, err := parseSemanticVersion(current) + if err != nil { + return false, fmt.Errorf("current version: %w", err) + } + latestVersion, err := parseSemanticVersion(latest) + if err != nil { + return false, fmt.Errorf("latest version: %w", err) + } + if currentVersion.major != latestVersion.major { + return latestVersion.major > currentVersion.major, nil + } + if currentVersion.minor != latestVersion.minor { + return latestVersion.minor > currentVersion.minor, nil + } + if currentVersion.patch != latestVersion.patch { + return latestVersion.patch > currentVersion.patch, nil + } + if currentVersion.prerelease == latestVersion.prerelease { + return false, nil + } + if currentVersion.prerelease != "" && latestVersion.prerelease == "" { + return true, nil + } + if currentVersion.prerelease == "" { + return false, nil + } + return comparePrerelease(currentVersion.prerelease, latestVersion.prerelease) < 0, nil +} + +func parseSemanticVersion(raw string) (semanticVersion, error) { + value := strings.TrimPrefix(strings.TrimSpace(raw), "v") + if build := strings.IndexByte(value, '+'); build >= 0 { + value = value[:build] + } + prerelease := "" + hasPrerelease := false + if dash := strings.IndexByte(value, '-'); dash >= 0 { + hasPrerelease = true + prerelease = value[dash+1:] + value = value[:dash] + } + parts := strings.Split(value, ".") + if len(parts) != 3 || (hasPrerelease && prerelease == "") { + return semanticVersion{}, fmt.Errorf("%q is not a semantic version", raw) + } + numbers := make([]int, 3) + for index, part := range parts { + if part == "" || (len(part) > 1 && part[0] == '0') { + return semanticVersion{}, fmt.Errorf("%q is not a semantic version", raw) + } + value, err := strconv.Atoi(part) + if err != nil || value < 0 { + return semanticVersion{}, fmt.Errorf("%q is not a semantic version", raw) + } + numbers[index] = value + } + if strings.ContainsAny(prerelease, " \t\r\n") { + return semanticVersion{}, fmt.Errorf("%q is not a semantic version", raw) + } + return semanticVersion{ + major: numbers[0], + minor: numbers[1], + patch: numbers[2], + prerelease: prerelease, + }, nil +} + +func comparePrerelease(left, right string) int { + leftParts := strings.Split(left, ".") + rightParts := strings.Split(right, ".") + for index := 0; index < len(leftParts) && index < len(rightParts); index++ { + if leftParts[index] == rightParts[index] { + continue + } + leftNumber, leftErr := strconv.Atoi(leftParts[index]) + rightNumber, rightErr := strconv.Atoi(rightParts[index]) + switch { + case leftErr == nil && rightErr == nil: + if leftNumber < rightNumber { + return -1 + } + return 1 + case leftErr == nil: + return -1 + case rightErr == nil: + return 1 + case leftParts[index] < rightParts[index]: + return -1 + default: + return 1 + } + } + if len(leftParts) < len(rightParts) { + return -1 + } + if len(leftParts) > len(rightParts) { + return 1 + } + return 0 +} diff --git a/internal/update/version_test.go b/internal/update/version_test.go new file mode 100644 index 0000000..1c01130 --- /dev/null +++ b/internal/update/version_test.go @@ -0,0 +1,34 @@ +package update + +import "testing" + +func TestIsNewerVersion(t *testing.T) { + tests := []struct { + current string + latest string + want bool + }{ + {"0.0.3", "v0.0.4", true}, + {"0.0.4", "v0.0.4", false}, + {"0.1.0-dev", "v0.0.4", false}, + {"0.1.0-dev", "v0.1.0", true}, + {"1.2.3-rc.1", "v1.2.3-rc.2", true}, + {"1.2.3", "v1.2.3-rc.2", false}, + } + for _, item := range tests { + got, err := IsNewerVersion(item.current, item.latest) + if err != nil { + t.Errorf("IsNewerVersion(%q, %q): %v", item.current, item.latest, err) + continue + } + if got != item.want { + t.Errorf("IsNewerVersion(%q, %q) = %v, want %v", item.current, item.latest, got, item.want) + } + } +} + +func TestIsNewerVersionRejectsInvalidRelease(t *testing.T) { + if _, err := IsNewerVersion("0.1.0", "nightly"); err == nil { + t.Fatal("invalid latest version was accepted") + } +} diff --git a/internal/vowifi/ims/call_runtime.go b/internal/vowifi/ims/call_runtime.go new file mode 100644 index 0000000..c1dd614 --- /dev/null +++ b/internal/vowifi/ims/call_runtime.go @@ -0,0 +1,468 @@ +package ims + +import ( + "context" + "errors" + "fmt" + "net" + "sort" + "strconv" + "strings" + "time" + + "vocat/internal/vowifi" +) + +var ( + ErrCallNotFound = errors.New("ims: call not found") + ErrCallState = errors.New("ims: call is not in the required state") +) + +type imsCall struct { + public vowifi.Call + callID string + target string + from string + to string + branch string + cseq uint32 + invite *sipRequest + respond func([]byte) error + responses chan *sipResponse + remoteTag string + routes []string + terminated bool +} + +func (session *Session) Calls() []vowifi.Call { + session.callMu.Lock() + defer session.callMu.Unlock() + calls := make([]vowifi.Call, 0, len(session.calls)) + for _, call := range session.calls { + if call.public.State != "ended" && call.public.State != "failed" { + calls = append(calls, call.public) + } + } + sort.Slice(calls, func(i, j int) bool { return calls[i].StartedAt.Before(calls[j].StartedAt) }) + return calls +} + +func (session *Session) DialCall(ctx context.Context, number string) (vowifi.Call, error) { + number = strings.TrimSpace(number) + if !validCallNumber(number) { + return vowifi.Call{}, errors.New("ims: invalid dial number") + } + callToken, err := randomHex(18) + if err != nil { + return vowifi.Call{}, err + } + branch, err := randomHex(12) + if err != nil { + return vowifi.Call{}, err + } + callID := callToken + "@" + addressHost(session.conn.LocalAddr()) + target := "tel:" + number + session.mu.Lock() + cseq := session.cseq + session.cseq++ + routes := append([]string(nil), session.evidence.ServiceRoute...) + securityHeaders := runtimeSecurityHeaders(session.securityActive, session.securityAgreement.verifyValue) + session.mu.Unlock() + body := session.inactiveSDP() + transportUpper := strings.ToUpper(session.transport) + from := "<" + session.identity.public + ">;tag=" + session.fromTag + to := "<" + target + ">" + lines := []string{ + "INVITE " + target + " SIP/2.0", + fmt.Sprintf("Via: SIP/2.0/%s %s;branch=z9hG4bK%s;rport", transportUpper, session.conn.LocalAddr().String(), branch), + "Max-Forwards: 70", + } + lines = append(lines, securityHeaders...) + if len(routes) == 0 { + lines = append(lines, "Route: ") + } else { + for _, route := range routes { + lines = append(lines, "Route: "+route) + } + } + lines = append(lines, + "From: "+from, + "To: "+to, + "Call-ID: "+callID, + fmt.Sprintf("CSeq: %d INVITE", cseq), + "Contact: ", + "P-Preferred-Identity: <"+session.identity.public+">", + "Allow: INVITE, ACK, CANCEL, BYE, OPTIONS, MESSAGE", + "Supported: timer", + "Content-Type: application/sdp", + "Content-Length: "+strconv.Itoa(len(body)), "", "", + ) + request := append([]byte(strings.Join(lines, "\r\n")), body...) + responses := make(chan *sipResponse, 8) + key := sipTransactionKey{callID: callID, cseq: cseq, method: "INVITE"} + session.transactionsMu.Lock() + if _, duplicate := session.transactions[key]; duplicate { + session.transactionsMu.Unlock() + return vowifi.Call{}, errors.New("ims: duplicate call transaction") + } + session.transactions[key] = responses + session.transactionsMu.Unlock() + call := &imsCall{ + public: vowifi.Call{ID: callID, Number: number, Direction: "outgoing", State: "dialing", StartedAt: time.Now().UTC()}, + callID: callID, target: target, from: from, to: to, branch: branch, cseq: cseq, responses: responses, + routes: routes, + } + session.callMu.Lock() + session.calls[callID] = call + session.callMu.Unlock() + session.writeMu.Lock() + _, err = session.conn.Write(request) + session.writeMu.Unlock() + if err != nil { + session.transactionsMu.Lock() + delete(session.transactions, key) + session.transactionsMu.Unlock() + session.callMu.Lock() + delete(session.calls, callID) + session.callMu.Unlock() + return vowifi.Call{}, fmt.Errorf("ims: send SIP INVITE: %w", err) + } + go session.watchOutgoingCall(call, key) + return call.public, nil +} + +func (session *Session) watchOutgoingCall(call *imsCall, key sipTransactionKey) { + timer := time.NewTimer(2 * time.Minute) + defer timer.Stop() + defer func() { + session.transactionsMu.Lock() + delete(session.transactions, key) + session.transactionsMu.Unlock() + }() + for { + select { + case <-session.refreshContext.Done(): + return + case <-timer.C: + session.setCallState(call.callID, "failed") + return + case response := <-call.responses: + if response == nil { + continue + } + if response.StatusCode < 200 { + if response.StatusCode >= 180 { + session.setCallState(call.callID, "ringing") + } + continue + } + if response.StatusCode >= 200 && response.StatusCode < 300 { + session.callMu.Lock() + call.to = response.value("To") + call.remoteTag = headerParameter(call.to, "tag") + if contact := headerURI(response.value("Contact")); contact != "" { + call.target = contact + } + if recordRoutes := response.values("Record-Route"); len(recordRoutes) > 0 { + call.routes = reverseStrings(recordRoutes) + } + session.callMu.Unlock() + _ = session.sendACK(call) + session.setCallState(call.callID, "active") + } else { + session.setCallState(call.callID, "failed") + } + return + } + } +} + +func (session *Session) AnswerCall(_ context.Context, id string) (vowifi.Call, error) { + session.callMu.Lock() + call := session.calls[id] + if call == nil { + session.callMu.Unlock() + return vowifi.Call{}, ErrCallNotFound + } + if call.public.Direction != "incoming" || call.public.State != "ringing" || call.invite == nil || call.respond == nil { + session.callMu.Unlock() + return vowifi.Call{}, ErrCallState + } + request, respond := call.invite, call.respond + session.callMu.Unlock() + response, err := buildSIPResponseWithBody(request, 200, session.fromTag, session.inactiveSDP()) + if err != nil { + return vowifi.Call{}, err + } + if err := respond(response); err != nil { + return vowifi.Call{}, err + } + session.setCallState(id, "active") + session.callMu.Lock() + result := call.public + session.callMu.Unlock() + return result, nil +} + +func (session *Session) HangupCall(ctx context.Context, id string) error { + session.callMu.Lock() + call := session.calls[id] + if call == nil { + session.callMu.Unlock() + return ErrCallNotFound + } + state := call.public.State + direction := call.public.Direction + request, respond := call.invite, call.respond + session.callMu.Unlock() + if direction == "incoming" && state == "ringing" && request != nil && respond != nil { + response, err := buildSIPResponseWithBody(request, 486, session.fromTag, nil) + if err != nil { + return err + } + if err := respond(response); err != nil { + return err + } + session.setCallState(id, "ended") + return nil + } + method := "BYE" + if direction == "outgoing" && (state == "dialing" || state == "ringing") { + method = "CANCEL" + } + if err := session.sendDialogRequest(ctx, call, method); err != nil { + return err + } + session.setCallState(id, "ended") + return nil +} + +func (session *Session) handleCallRequest(request *sipRequest, respond func([]byte) error) bool { + switch request.Method { + case "INVITE": + callID := strings.TrimSpace(request.value("Call-ID")) + if callID == "" { + return true + } + number := identityNumber(request.value("From")) + target := headerURI(request.value("Contact")) + if target == "" { + target = request.URI + } + call := &imsCall{ + public: vowifi.Call{ID: callID, Number: number, Direction: "incoming", State: "ringing", StartedAt: time.Now().UTC()}, + callID: callID, target: target, from: request.value("To") + ";tag=" + session.fromTag, + to: request.value("From"), invite: request, respond: respond, routes: request.values("Record-Route"), + } + session.callMu.Lock() + session.calls[callID] = call + session.callMu.Unlock() + response, err := buildSIPResponseWithBody(request, 180, session.fromTag, nil) + if err == nil { + _ = respond(response) + } + return true + case "ACK": + return true + case "CANCEL", "BYE": + response, err := buildSIPResponseWithBody(request, 200, session.fromTag, nil) + if err == nil { + _ = respond(response) + } + callID := strings.TrimSpace(request.value("Call-ID")) + if request.Method == "CANCEL" { + session.callMu.Lock() + call := session.calls[callID] + session.callMu.Unlock() + if call != nil && call.invite != nil && call.respond != nil { + if terminated, buildErr := buildSIPResponseWithBody(call.invite, 487, session.fromTag, nil); buildErr == nil { + _ = call.respond(terminated) + } + } + } + session.setCallState(callID, "ended") + return true + default: + return false + } +} + +func (session *Session) sendACK(call *imsCall) error { + request := session.buildDialogRequest(call, "ACK", call.cseq) + session.writeMu.Lock() + _, err := session.conn.Write(request) + session.writeMu.Unlock() + return err +} + +func (session *Session) sendDialogRequest(ctx context.Context, call *imsCall, method string) error { + cseq := call.cseq + if method == "BYE" { + session.mu.Lock() + cseq = session.cseq + session.cseq++ + session.mu.Unlock() + } + request := session.buildDialogRequest(call, method, cseq) + if method == "ACK" { + session.writeMu.Lock() + _, err := session.conn.Write(request) + session.writeMu.Unlock() + return err + } + response, err := session.exchangeRuntime(ctx, request, sipTransactionKey{callID: call.callID, cseq: cseq, method: method}) + if err != nil { + return err + } + if response.StatusCode < 200 || response.StatusCode >= 300 { + return fmt.Errorf("ims: SIP %s rejected with %d", method, response.StatusCode) + } + return nil +} + +func (session *Session) buildDialogRequest(call *imsCall, method string, cseq uint32) []byte { + branch, _ := randomHex(12) + if method == "CANCEL" { + branch = call.branch + } + to := call.to + if to == "" { + to = "<" + call.target + ">" + } + lines := []string{ + method + " " + call.target + " SIP/2.0", + fmt.Sprintf("Via: SIP/2.0/%s %s;branch=z9hG4bK%s;rport", strings.ToUpper(session.transport), session.conn.LocalAddr().String(), branch), + "Max-Forwards: 70", + } + for _, route := range call.routes { + lines = append(lines, "Route: "+route) + } + lines = append(lines, + "From: "+call.from, + "To: "+to, + "Call-ID: "+call.callID, + fmt.Sprintf("CSeq: %d %s", cseq, method), + "Content-Length: 0", "", "", + ) + return []byte(strings.Join(lines, "\r\n")) +} + +func (session *Session) inactiveSDP() []byte { + var localAddress net.Addr + if session.conn != nil { + localAddress = session.conn.LocalAddr() + } + local := addressIP(localAddress) + if local == nil { + local = net.IPv4zero + } + family := "IP4" + if local.To4() == nil { + family = "IP6" + } + text := fmt.Sprintf("v=0\r\no=- %d %d IN %s %s\r\ns=VoCat Calling Test\r\nc=IN %s %s\r\nt=0 0\r\nm=audio 9 RTP/AVP 0 8\r\na=inactive\r\n", time.Now().Unix(), time.Now().Unix(), family, local.String(), family, local.String()) + return []byte(text) +} + +func buildSIPResponseWithBody(request *sipRequest, status int, tag string, body []byte) ([]byte, error) { + reasons := map[int]string{180: "Ringing", 200: "OK", 486: "Busy Here", 487: "Request Terminated"} + reason := reasons[status] + if reason == "" { + return nil, errors.New("ims: unsupported call response status") + } + via := request.values("Via") + from, to := request.value("From"), request.value("To") + callID, cseq := request.value("Call-ID"), request.value("CSeq") + if len(via) == 0 || from == "" || to == "" || callID == "" || cseq == "" { + return nil, errors.New("ims: call request omitted a mandatory response header") + } + if !strings.Contains(strings.ToLower(to), ";tag=") { + to += ";tag=" + tag + } + lines := []string{fmt.Sprintf("SIP/2.0 %d %s", status, reason)} + for _, value := range via { + lines = append(lines, "Via: "+value) + } + lines = append(lines, "From: "+from, "To: "+to, "Call-ID: "+callID, "CSeq: "+cseq) + if len(body) > 0 { + lines = append(lines, "Content-Type: application/sdp") + } + lines = append(lines, "Content-Length: "+strconv.Itoa(len(body)), "", "") + return append([]byte(strings.Join(lines, "\r\n")), body...), nil +} + +func (session *Session) setCallState(id, state string) { + session.callMu.Lock() + if call := session.calls[id]; call != nil { + call.public.State = state + } + session.callMu.Unlock() +} + +func validCallNumber(value string) bool { + if len(value) < 2 || len(value) > 32 { + return false + } + for index, character := range value { + if character >= '0' && character <= '9' || index == 0 && character == '+' || character == '*' || character == '#' { + continue + } + return false + } + return true +} + +func identityNumber(value string) string { + value = strings.TrimSpace(value) + if start := strings.Index(value, "<"); start >= 0 { + if end := strings.Index(value[start:], ">"); end > 0 { + value = value[start+1 : start+end] + } + } + value = strings.TrimPrefix(value, "sip:") + value = strings.TrimPrefix(value, "tel:") + if at := strings.Index(value, "@"); at >= 0 { + value = value[:at] + } + return strings.TrimSpace(value) +} + +func headerParameter(value, name string) string { + needle := ";" + strings.ToLower(name) + "=" + lower := strings.ToLower(value) + index := strings.Index(lower, needle) + if index < 0 { + return "" + } + value = value[index+len(needle):] + if end := strings.IndexAny(value, ";,> \t"); end >= 0 { + value = value[:end] + } + return strings.Trim(value, `"`) +} + +func headerURI(value string) string { + value = strings.TrimSpace(value) + if start := strings.Index(value, "<"); start >= 0 { + if end := strings.Index(value[start+1:], ">"); end >= 0 { + return strings.TrimSpace(value[start+1 : start+1+end]) + } + } + if end := strings.Index(value, ";"); end >= 0 { + value = value[:end] + } + if strings.HasPrefix(strings.ToLower(value), "sip:") || strings.HasPrefix(strings.ToLower(value), "tel:") { + return strings.TrimSpace(value) + } + return "" +} + +func reverseStrings(values []string) []string { + result := append([]string(nil), values...) + for left, right := 0, len(result)-1; left < right; left, right = left+1, right-1 { + result[left], result[right] = result[right], result[left] + } + return result +} + +var _ vowifi.CallController = (*Session)(nil) diff --git a/internal/vowifi/ims/call_runtime_test.go b/internal/vowifi/ims/call_runtime_test.go new file mode 100644 index 0000000..d20d40b --- /dev/null +++ b/internal/vowifi/ims/call_runtime_test.go @@ -0,0 +1,72 @@ +package ims + +import ( + "context" + "strings" + "testing" +) + +func TestIncomingCallCanRingAndAnswerWithoutAudio(t *testing.T) { + session := &Session{fromTag: "local-tag", calls: make(map[string]*imsCall)} + packet, err := parseSIPPacket([]byte(strings.Join([]string{ + "INVITE sip:subscriber@example.test SIP/2.0", + "Via: SIP/2.0/UDP 192.0.2.10:5060;branch=z9hG4bK-incoming", + "From: ;tag=remote", + "To: ", + "Call-ID: incoming-call@example.test", + "CSeq: 1 INVITE", + "Content-Length: 0", "", "", + }, "\r\n"))) + if err != nil || packet.Request == nil { + t.Fatalf("parse INVITE: %v", err) + } + var responses [][]byte + session.handleSIPRequest(packet.Request, func(response []byte) error { + responses = append(responses, append([]byte(nil), response...)) + return nil + }) + calls := session.Calls() + if len(calls) != 1 || calls[0].Direction != "incoming" || calls[0].State != "ringing" || calls[0].Number != "+447700900001" { + t.Fatalf("incoming Calls = %#v", calls) + } + if len(responses) != 1 || !strings.HasPrefix(string(responses[0]), "SIP/2.0 180 Ringing") { + t.Fatalf("ringing response = %q", responses) + } + answered, err := session.AnswerCall(context.Background(), calls[0].ID) + if err != nil { + t.Fatal(err) + } + if answered.State != "active" || len(responses) != 2 || !strings.Contains(string(responses[1]), "a=inactive") { + t.Fatalf("answered = %#v, response = %q", answered, responses[1]) + } +} + +func TestIncomingCallCanBeRejected(t *testing.T) { + session := &Session{fromTag: "local-tag", calls: make(map[string]*imsCall)} + packet, err := parseSIPPacket([]byte(strings.Join([]string{ + "INVITE sip:user@example.test SIP/2.0", + "Via: SIP/2.0/UDP 192.0.2.10:5060;branch=z9hG4bK-a", + "From: ;tag=a", "To: ", + "Call-ID: reject-call", "CSeq: 1 INVITE", "Content-Length: 0", "", "", + }, "\r\n"))) + if err != nil || packet.Request == nil { + t.Fatalf("parse INVITE: %v", err) + } + var response []byte + session.handleCallRequest(packet.Request, func(value []byte) error { response = append([]byte(nil), value...); return nil }) + if err := session.HangupCall(context.Background(), "reject-call"); err != nil { + t.Fatal(err) + } + if !strings.HasPrefix(string(response), "SIP/2.0 486 Busy Here") { + t.Fatalf("reject response = %q", response) + } + if len(session.Calls()) != 0 { + t.Fatal("ended call remained active") + } +} + +func TestValidCallNumber(t *testing.T) { + if !validCallNumber("+447700900000") || validCallNumber("12\r\nBYE") { + t.Fatal("call number validation mismatch") + } +} diff --git a/internal/vowifi/ims/provider.go b/internal/vowifi/ims/provider.go index 3705f2d..438fbdc 100644 --- a/internal/vowifi/ims/provider.go +++ b/internal/vowifi/ims/provider.go @@ -444,6 +444,8 @@ type Session struct { inboundConnections map[net.Conn]struct{} smsMu sync.Mutex nextRPReference byte + callMu sync.Mutex + calls map[string]*imsCall mu sync.Mutex closed bool @@ -494,6 +496,7 @@ func newSession( failures: make(chan error, 1), transactions: make(map[sipTransactionKey]chan *sipResponse), inboundConnections: make(map[net.Conn]struct{}), + calls: make(map[string]*imsCall), evidence: vowifi.IMSEvidence{ RegistrationState: "registering", Transport: transport, @@ -741,11 +744,13 @@ func (session *Session) buildRegister( requestURI := "sip:" + session.identity.domain routeURI := "sip:" + session.endpoint.address() + ";transport=" + session.transport + ";lr" contact := fmt.Sprintf( - ";+sip.instance=\"<%s>\";+g.3gpp.smsip", + ";+sip.instance=\"<%s>\";+g.3gpp.smsip;audio;"+ + `+g.3gpp.icsi-ref="%s"`, session.identity.user, contactAddress, session.transport, session.instanceID, + "urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel", ) lines := []string{ "REGISTER " + requestURI + " SIP/2.0", @@ -759,7 +764,7 @@ func (session *Session) buildRegister( "Contact: " + contact, fmt.Sprintf("Expires: %d", expires), "Supported: path, gruu", - "Allow: REGISTER, OPTIONS", + "Allow: REGISTER, INVITE, ACK, CANCEL, BYE, OPTIONS", "User-Agent: " + session.provider.config.UserAgent, } if session.securityOffered() { diff --git a/internal/vowifi/ims/sms_runtime.go b/internal/vowifi/ims/sms_runtime.go index d02b0a0..a3c331e 100644 --- a/internal/vowifi/ims/sms_runtime.go +++ b/internal/vowifi/ims/sms_runtime.go @@ -264,6 +264,9 @@ func (session *Session) exchangeRuntime( } func (session *Session) handleSIPRequest(request *sipRequest, respond func([]byte) error) { + if session.handleCallRequest(request, respond) { + return + } status := 200 switch request.Method { case "OPTIONS": diff --git a/internal/vowifi/orchestrator.go b/internal/vowifi/orchestrator.go index 5326146..10814f5 100644 --- a/internal/vowifi/orchestrator.go +++ b/internal/vowifi/orchestrator.go @@ -512,6 +512,65 @@ func (orchestrator *Orchestrator) SendSMS( return sender.SendSMS(ctx, request) } +func (orchestrator *Orchestrator) Calls() ([]Call, error) { + orchestrator.mu.Lock() + resources := orchestrator.resources + ready := orchestrator.state.IMSReady + orchestrator.mu.Unlock() + if resources == nil || resources.ims == nil || !ready { + return nil, ErrNotRunning + } + controller, ok := resources.ims.(CallController) + if !ok { + return nil, ErrNotRunning + } + return controller.Calls(), nil +} + +func (orchestrator *Orchestrator) DialCall(ctx context.Context, number string) (Call, error) { + return orchestrator.callAction(ctx, func(controller CallController) (Call, error) { + return controller.DialCall(ctx, number) + }) +} + +func (orchestrator *Orchestrator) AnswerCall(ctx context.Context, id string) (Call, error) { + return orchestrator.callAction(ctx, func(controller CallController) (Call, error) { + return controller.AnswerCall(ctx, id) + }) +} + +func (orchestrator *Orchestrator) HangupCall(ctx context.Context, id string) error { + _, err := orchestrator.callAction(ctx, func(controller CallController) (Call, error) { + return Call{}, controller.HangupCall(ctx, id) + }) + return err +} + +func (orchestrator *Orchestrator) callAction( + ctx context.Context, + action func(CallController) (Call, error), +) (Call, error) { + if ctx == nil { + ctx = context.Background() + } + if err := orchestrator.lockOperation(ctx); err != nil { + return Call{}, err + } + defer orchestrator.unlockOperation() + orchestrator.mu.Lock() + resources := orchestrator.resources + ready := orchestrator.state.IMSReady + orchestrator.mu.Unlock() + if resources == nil || resources.ims == nil || !ready { + return Call{}, ErrNotRunning + } + controller, ok := resources.ims.(CallController) + if !ok { + return Call{}, ErrNotRunning + } + return action(controller) +} + func (orchestrator *Orchestrator) Close(ctx context.Context) error { _, err := orchestrator.Disable(ctx) return err diff --git a/internal/vowifi/runtime/manager.go b/internal/vowifi/runtime/manager.go index 9245b4f..6989a5a 100644 --- a/internal/vowifi/runtime/manager.go +++ b/internal/vowifi/runtime/manager.go @@ -268,6 +268,58 @@ func (manager *Manager) SendSMS( return item.orchestrator.SendSMS(ctx, request) } +func (manager *Manager) Calls(deviceID string) ([]vowifi.Call, error) { + if err := manager.Ensure(manager.ctx, deviceID); err != nil { + return nil, err + } + manager.mu.Lock() + item := manager.entries[deviceID] + manager.mu.Unlock() + if item == nil { + return nil, ErrNotRegistered + } + return item.orchestrator.Calls() +} + +func (manager *Manager) DialCall(ctx context.Context, deviceID, number string) (vowifi.Call, error) { + if err := manager.Ensure(ctx, deviceID); err != nil { + return vowifi.Call{}, err + } + manager.mu.Lock() + item := manager.entries[deviceID] + manager.mu.Unlock() + if item == nil { + return vowifi.Call{}, ErrNotRegistered + } + return item.orchestrator.DialCall(ctx, number) +} + +func (manager *Manager) AnswerCall(ctx context.Context, deviceID, id string) (vowifi.Call, error) { + if err := manager.Ensure(ctx, deviceID); err != nil { + return vowifi.Call{}, err + } + manager.mu.Lock() + item := manager.entries[deviceID] + manager.mu.Unlock() + if item == nil { + return vowifi.Call{}, ErrNotRegistered + } + return item.orchestrator.AnswerCall(ctx, id) +} + +func (manager *Manager) HangupCall(ctx context.Context, deviceID, id string) error { + if err := manager.Ensure(ctx, deviceID); err != nil { + return err + } + manager.mu.Lock() + item := manager.entries[deviceID] + manager.mu.Unlock() + if item == nil { + return ErrNotRegistered + } + return item.orchestrator.HangupCall(ctx, id) +} + func (manager *Manager) startOperation( deviceID string, coalesceReconnect bool, diff --git a/internal/vowifi/types.go b/internal/vowifi/types.go index ec9ca43..d6c8d71 100644 --- a/internal/vowifi/types.go +++ b/internal/vowifi/types.go @@ -365,6 +365,25 @@ type SMSSender interface { SendSMS(context.Context, SMSSubmitRequest) (SMSSubmitResult, error) } +// Call describes one signalling-only IMS call. VoCat intentionally does not +// open, capture, or relay an RTP media stream for extension call tests. +type Call struct { + ID string `json:"id"` + Number string `json:"number"` + Direction string `json:"direction"` + State string `json:"state"` + StartedAt time.Time `json:"started_at"` +} + +// CallController is an optional capability of an IMS session. Implementations +// manage SIP signalling only; audio handling is explicitly outside this API. +type CallController interface { + Calls() []Call + DialCall(context.Context, string) (Call, error) + AnswerCall(context.Context, string) (Call, error) + HangupCall(context.Context, string) error +} + // PhoneStore persists a number only after it was explicitly associated by IMS. type PhoneStore interface { SaveAssociatedNumber(context.Context, PhoneRecord) error diff --git a/scripts/install.sh b/scripts/install.sh index 5b4652c..48a747e 100644 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -128,10 +128,12 @@ skip_if_equal() { # --- Detect architecture ----------------------------------------------------- detect_arch() { + ARCH_FALLBACK="" case "$(uname -m)" in x86_64) ARCH="amd64" ;; i386|i486|i586|i686) ARCH="386" ;; - aarch64|arm64) ARCH="arm64" ;; + aarch64) ARCH="aarch64"; ARCH_FALLBACK="arm64" ;; + arm64) ARCH="arm64"; ARCH_FALLBACK="aarch64" ;; armv7l|armv7*) ARCH="armv7" ;; *) die "不支持的架构: $(uname -m)" "Unsupported architecture: $(uname -m)" ;; esac @@ -144,6 +146,9 @@ download_and_verify() { trap 'rm -rf "$VOCAT_TMP"' EXIT local base="https://github.com/${REPO}/releases/download/v${TARGET_VERSION}" local asset="vocat-linux-${ARCH}" + if [ -n "$ARCH_FALLBACK" ] && ! curl -fsIL -o /dev/null "${base}/${asset}"; then + asset="vocat-linux-${ARCH_FALLBACK}" + fi msg "下载 $asset ..." "Downloading $asset ..." curl -fsSL -o "${VOCAT_TMP}/vocat" "${base}/${asset}" || die "下载二进制失败。" "Failed to download the binary." curl -fsSL -o "${VOCAT_TMP}/SHA256SUMS" "${base}/SHA256SUMS" || die "下载 SHA256SUMS 失败。" "Failed to download SHA256SUMS." diff --git a/web/src/App.tsx b/web/src/App.tsx index 2288792..b060371 100644 --- a/web/src/App.tsx +++ b/web/src/App.tsx @@ -15,6 +15,7 @@ import ProxyPage from "./pages/ProxyPage"; import SmsPage from "./pages/SmsPage"; import LogsPage from "./pages/LogsPage"; import SettingsPage from "./pages/SettingsPage"; +import ExtensionPage from "./pages/ExtensionPage"; const THEME_KEY = "theme"; const DISCLAIMER_KEY = "vocat_disclaimer_agreed_at"; @@ -109,6 +110,7 @@ function AppRoot() { } /> } /> } /> + } /> } /> } /> diff --git a/web/src/api.ts b/web/src/api.ts index 870b50a..f68f1d3 100644 --- a/web/src/api.ts +++ b/web/src/api.ts @@ -74,8 +74,9 @@ export interface RequestOptions extends Omit { export async function api(path: string, options: RequestOptions = {}): Promise { const method = (options.method || "GET").toUpperCase(); const headers = new Headers(options.headers); + const formBody = typeof FormData !== "undefined" && options.body instanceof FormData; headers.set("Accept", options.raw ? "*/*" : "application/json"); - if (options.body !== undefined) headers.set("Content-Type", "application/json"); + if (options.body !== undefined && !formBody) headers.set("Content-Type", "application/json"); if (isMutation(method)) { const csrf = sessionStorage.getItem(CSRF_KEY); if (csrf) headers.set("X-CSRF-Token", csrf); @@ -86,7 +87,11 @@ export async function api(path: string, options: RequestOptions = {}): Promis method, headers, credentials: "include", - body: options.body === undefined ? undefined : JSON.stringify(snakeize(options.body)), + body: options.body === undefined + ? undefined + : formBody + ? options.body as FormData + : JSON.stringify(snakeize(options.body)), }); if (options.raw) return response as T; diff --git a/web/src/components/devices/DiscoveredDeviceRow.tsx b/web/src/components/devices/DiscoveredDeviceRow.tsx index 55afa9b..2232dce 100644 --- a/web/src/components/devices/DiscoveredDeviceRow.tsx +++ b/web/src/components/devices/DiscoveredDeviceRow.tsx @@ -39,7 +39,7 @@ export function DiscoveredDeviceRow({
{device.controlPath} · AT: {device.atPort || "--"} · IMEI: {device.imei || "--"} · USB: {device.usbPath || "--"}
- {degraded ?
{t("无法读取 IMEI（控制口可能挂死），暂不可添加。")}
: null} + {degraded ?
{t("未找到可用的 AT 端口（串口可能仍在枚举），系统会自动重试；也可点击重新扫描。")}
: null} ); } diff --git a/web/src/components/settings/PluginsCard.tsx b/web/src/components/settings/PluginsCard.tsx new file mode 100644 index 0000000..ca50f47 --- /dev/null +++ b/web/src/components/settings/PluginsCard.tsx @@ -0,0 +1,120 @@ +import { useCallback, useEffect, useRef, useState } from "react"; +import { AddRegular, ArrowUploadRegular, DeleteRegular, PlugConnectedRegular } from "@fluentui/react-icons"; +import { api, apiMessage } from "../../api"; +import { listPlugins, type InstalledPlugin } from "../../extensions"; +import { Button, confirmDialog, Input, message } from "../ui"; +import { CardDecor, CardIcon, CardTitle } from "./Cards"; +import { useI18n } from "../../lib/i18n"; + +export function PluginsCard() { + const { t } = useI18n(); + const [plugins, setPlugins] = useState([]); + const [url, setURL] = useState(""); + const [sha256, setSHA256] = useState(""); + const [busy, setBusy] = useState(""); + const fileRef = useRef(null); + + const reload = useCallback(async () => { + try { setPlugins(await listPlugins()); } + catch (error) { message.error(apiMessage(error) || t("插件列表加载失败")); } + }, [t]); + + useEffect(() => { void reload(); }, [reload]); + + async function installURL() { + if (!url.trim()) return message.warning(t("请输入插件包 URL")); + const confirmed = await confirmDialog( + t("插件页面以当前管理员权限运行，插件后端还可以运行外部代码。仅安装你完全信任的插件。"), + t("安装外部插件？"), + { type: "warning", confirmText: t("安装") }, + ); + if (!confirmed) return; + setBusy("install"); + try { + await api("/extensions/install-url", { method: "POST", body: { url: url.trim(), sha256: sha256.trim() } }); + setURL(""); setSHA256(""); + message.success(t("插件已安装并启用")); + await reload(); + window.dispatchEvent(new Event("vocat:plugins-changed")); + } catch (error) { message.error(apiMessage(error) || t("插件安装失败")); } + finally { setBusy(""); } + } + + async function upload(file?: File) { + if (!file) return; + const confirmed = await confirmDialog( + t("插件页面以当前管理员权限运行，插件后端还可以运行外部代码。仅安装你完全信任的插件。"), + t("安装上传的插件？"), + { type: "warning", confirmText: t("安装") }, + ); + if (!confirmed) { if (fileRef.current) fileRef.current.value = ""; return; } + const form = new FormData(); + form.append("package", file); + setBusy("upload"); + try { + await api("/extensions/upload", { method: "POST", body: form }); + message.success(t("插件已安装并启用")); + await reload(); + window.dispatchEvent(new Event("vocat:plugins-changed")); + } catch (error) { message.error(apiMessage(error) || t("插件安装失败")); } + finally { setBusy(""); if (fileRef.current) fileRef.current.value = ""; } + } + + async function toggle(plugin: InstalledPlugin) { + setBusy(plugin.id); + try { + await api(`/extensions/${encodeURIComponent(plugin.id)}`, { method: "PUT", body: { enabled: !plugin.enabled } }); + await reload(); + window.dispatchEvent(new Event("vocat:plugins-changed")); + } catch (error) { message.error(apiMessage(error) || t("插件状态更新失败")); } + finally { setBusy(""); } + } + + async function uninstall(plugin: InstalledPlugin) { + const confirmed = await confirmDialog(t("插件代码和插件数据将从本机删除。"), t("卸载插件？"), { type: "warning", confirmText: t("卸载") }); + if (!confirmed) return; + setBusy(plugin.id); + try { + await api(`/extensions/${encodeURIComponent(plugin.id)}`, { method: "DELETE" }); + message.success(t("插件已卸载")); + await reload(); + window.dispatchEvent(new Event("vocat:plugins-changed")); + } catch (error) { message.error(apiMessage(error) || t("插件卸载失败")); } + finally { setBusy(""); } + } + + return ( +
+ +
+ + +
+
+ setURL(event.target.value)} placeholder="https://example.com/plugin.vocat-plugin" /> + setSHA256(event.target.value)} placeholder={t("SHA-256（可选，推荐）")} /> + +
+
+ void upload(event.target.files?.[0])} /> + +
+
+ {plugins.length === 0 ?
{t("尚未安装插件")}
: plugins.map((plugin) => ( +
+
+
{plugin.name} v{plugin.version}
+
{plugin.description || plugin.id}
+
+ {(plugin.permissions || []).map((permission) => {permission})} + {plugin.backendError ? {plugin.backendError} : null} +
+
+ + +
+ ))} +
+
+ ); +} diff --git a/web/src/components/shell/AuthenticatedShell.tsx b/web/src/components/shell/AuthenticatedShell.tsx index 0d7431b..519df07 100644 --- a/web/src/components/shell/AuthenticatedShell.tsx +++ b/web/src/components/shell/AuthenticatedShell.tsx @@ -21,6 +21,7 @@ import { ErrorBoundary } from "../ui/ErrorBoundary"; import { cx } from "../../lib/utils"; import { BrandLogo } from "./BrandLogo"; import { VersionBadge } from "./VersionBadge"; +import { listPlugins, type InstalledPlugin } from "../../extensions"; const NAV = [ { to: "/", label: "仪表盘", icon: BoardRegular, end: true }, @@ -41,8 +42,9 @@ export function AuthenticatedShell({ const [collapsed, setCollapsed] = useState(false); const [isMobile, setIsMobile] = useState(false); const [mobileOpen, setMobileOpen] = useState(false); + const [plugins, setPlugins] = useState([]); const { logout, user } = useAuth(); - const { t } = useI18n(); + const { t, lang } = useI18n(); const navigate = useNavigate(); const location = useLocation(); @@ -57,6 +59,16 @@ export function AuthenticatedShell({ return () => window.removeEventListener("resize", update); }, []); + useEffect(() => { + let active = true; + const load = () => listPlugins().then((items) => { + if (active) setPlugins(items || []); + }).catch(() => undefined); + void load(); + window.addEventListener("vocat:plugins-changed", load); + return () => { active = false; window.removeEventListener("vocat:plugins-changed", load); }; + }, []); + useEffect(() => { setMobileOpen(false); }, [location.pathname]); @@ -79,16 +91,37 @@ export function AuthenticatedShell({ } function menuList(collapse: boolean) { + const sidebarPlugins = plugins + .filter((plugin) => plugin.enabled) + .flatMap((plugin) => plugin.contributions + .filter((contribution) => contribution.location === "sidebar") + .map((contribution) => ({ plugin, contribution }))); + const navItems: Array<(typeof NAV)[number] | { to: string; label: string; icon: typeof GlobeRegular; pluginLabelZH?: string }> = []; + for (const item of NAV) { + navItems.push(item); + if (item.to === "/sms") { + for (const extension of sidebarPlugins.filter((entry) => !entry.contribution.after || entry.contribution.after === "sms")) { + navItems.push({ + to: `/extensions/${encodeURIComponent(extension.plugin.id)}/${encodeURIComponent(extension.contribution.id)}`, + label: extension.contribution.label, + pluginLabelZH: extension.contribution.labelZh, + icon: GlobeRegular, + }); + } + } + } return (