mirror of
https://github.com/kuhyx/signal-bot.git
synced 2026-11-10 19:17:02 +01:00
Today the bot was up, healthy and answering nothing for three hours. A host
firewall change (fixed in testsAndMisc 334c0cd9) cut every Docker container
off the internet; signal-cli lost Signal and reconnected in a loop from
15:32:50 onward. Nothing noticed:
- the container's own healthcheck answered 204
- /v1/groups answered 200 out of local state, so discovery saw no change
- the bot's WebSocket to the container stayed OPEN, so the transport's
reconnect logic never fired
- /healthz answered {"status": "ok"} the entire time
The only symptom was silence, which is also what a quiet evening looks like.
signal_bot/liveness.py asks the one question that cannot be answered from a
cache -- GET /v1/devices, which needs a live round trip -- but only after
SILENCE_SECONDS (120) with no frame of any kind, so a busy group costs
nothing and an idle one costs one request per window. Three consecutive
failures and /healthz answers 503 with the reason. Verified end to end in
scripts/e2e.sh against the real process: 503 after 84s with the fake's
connection cut, back to 200 on its own 30s after restoring it.
scripts/signal_api_watchdog.sh + a two-minute user timer do the recovery the
bot cannot do for itself, since a wedged bot cannot restart the container it
depends on. Two tiers, so the steady state costs no Signal round trip at
all: the bot's own /healthz first, the authenticated probe only when that is
not 200. It stops after 3 restarts in 6 hours and escalates instead -- a
deregistered account or a blocked network is not fixable by restarting, and
a restart loop would hide it. Its own bash suite stubs curl and docker and
drives every branch including the give-up cap.
signal_bot/trust.py answers the other half: TRUSTED_INVITERS decides who may
put this bot in a group. The gate sits in GroupDirectory._permitted, which
both _join_pending and _adopt already route through -- gating only invites
would gate the door nobody uses, since prime_profile.sh exists precisely so
that an add becomes a direct join. Evidence is either the group-update
envelope, which is the only frame naming an inviter, or a trusted identity
being a full member in the listing. A refusal is logged once, with that
group's members, so the operator can see which string to add.
verify_allowlist moved to membership.py to keep discovery.py under the
250-line gate; it was already the module that owns MembershipError.
Verified live, by stopping the container by hand and touching nothing else:
18:54:35 docker stop signal-api
18:56:36 liveness: failure 1 of 3 after 123s of silence
18:57:36 failure 3 of 3 -> /healthz answers 503 from 18:57:45
18:58:18 watchdog: probe failed (1/2)
19:00:28 watchdog: probe failed (2/2) -> docker restart signal-api
19:00:36 liveness: receive path recovered after 8 failed probe(s)
19:01:13 watchdog: signal-api is back
Six minutes, unattended, against three hours of silence this afternoon. All
four real groups are still adopted with TRUSTED_INVITERS=+48123456789 set,
and no group was refused.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KbjfWdAyHbCubac7wJKJZW
97 lines
3.5 KiB
Python
97 lines
3.5 KiB
Python
# Copyright (c) 2026 Krzysztof Rudnicki. MIT licence.
|
|
"""The endpoints the real signal-cli-rest-api exposes."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Any
|
|
|
|
from fastapi import APIRouter, Request, WebSocket, WebSocketDisconnect
|
|
from fastapi.responses import JSONResponse, Response
|
|
|
|
from fake_signal.state import PIXEL_PNG, State
|
|
|
|
|
|
def _state(request: Request) -> State:
|
|
"""Return the State attached to the running app."""
|
|
state: State = request.app.state.fake
|
|
return state
|
|
|
|
|
|
def build_api_router() -> APIRouter:
|
|
"""Build the router mirroring the real container's API."""
|
|
router = APIRouter()
|
|
|
|
@router.get("/v1/about")
|
|
async def about(request: Request) -> dict[str, Any]:
|
|
return {"build": 2, "mode": _state(request).mode, "versions": ["v1", "v2"]}
|
|
|
|
@router.get("/v1/qrcodelink")
|
|
async def qrcodelink(device_name: str = "signal-api") -> Response:
|
|
# The real endpoint returns a PNG, which is why the live runbook has
|
|
# to open an image rather than print a string.
|
|
return Response(
|
|
content=PIXEL_PNG,
|
|
media_type="image/png",
|
|
headers={"X-Device-Name": device_name},
|
|
)
|
|
|
|
@router.get("/v1/devices/{number}")
|
|
async def devices(request: Request, number: str) -> JSONResponse:
|
|
"""The endpoint the deafness gate probes.
|
|
|
|
Answers from Signal, never from local state, which is exactly why
|
|
the bot uses it to tell "quiet" apart from "deaf".
|
|
"""
|
|
state = _state(request)
|
|
if number not in state.accounts:
|
|
return JSONResponse({"error": f"{number} is not registered"}, status_code=400)
|
|
if not state.connection_alive:
|
|
return JSONResponse(
|
|
{"error": "Failed to get linked devices: Closed unexpectedly"},
|
|
status_code=400,
|
|
)
|
|
return JSONResponse([{"id": 1, "name": "", "created": 0, "last_seen": 0}])
|
|
|
|
@router.post("/v2/send")
|
|
async def send(request: Request, payload: dict[str, Any]) -> JSONResponse:
|
|
_state(request).record_send(payload)
|
|
return JSONResponse({"timestamp": 1719177917717}, status_code=201)
|
|
|
|
@router.get("/v1/attachments")
|
|
async def list_attachments(request: Request) -> list[str]:
|
|
return list(_state(request).attachments)
|
|
|
|
@router.delete("/v1/attachments/{attachment_id}")
|
|
async def delete_attachment(request: Request, attachment_id: str) -> Response:
|
|
attachments = _state(request).attachments
|
|
if attachment_id in attachments:
|
|
attachments.remove(attachment_id)
|
|
return Response(status_code=204)
|
|
|
|
_add_receive_route(router)
|
|
|
|
return router
|
|
|
|
|
|
def _add_receive_route(router: APIRouter) -> None:
|
|
"""Attach the WebSocket receive endpoint.
|
|
|
|
Split out so the router builder stays under the complexity cap.
|
|
"""
|
|
|
|
@router.websocket("/v1/receive/{number}")
|
|
async def receive(websocket: WebSocket, number: str) -> None:
|
|
state: State = websocket.app.state.fake
|
|
await websocket.accept()
|
|
await websocket.send_json({"envelope": {"subscribed": number}})
|
|
state.sockets.append(websocket)
|
|
try:
|
|
while True:
|
|
# Blocks until the client goes away. The bot never sends.
|
|
await websocket.receive_text()
|
|
except WebSocketDisconnect:
|
|
pass
|
|
finally:
|
|
# Branchless: a conditional remove leaves an arc no test can reach.
|
|
state.sockets[:] = [s for s in state.sockets if s is not websocket]
|