mirror of
https://github.com/kuhyx/signal-bot.git
synced 2026-11-11 14:37:32 +01:00
Today the bot was up, healthy and answering nothing for three hours. A host
firewall change (fixed in testsAndMisc 334c0cd9) cut every Docker container
off the internet; signal-cli lost Signal and reconnected in a loop from
15:32:50 onward. Nothing noticed:
- the container's own healthcheck answered 204
- /v1/groups answered 200 out of local state, so discovery saw no change
- the bot's WebSocket to the container stayed OPEN, so the transport's
reconnect logic never fired
- /healthz answered {"status": "ok"} the entire time
The only symptom was silence, which is also what a quiet evening looks like.
signal_bot/liveness.py asks the one question that cannot be answered from a
cache -- GET /v1/devices, which needs a live round trip -- but only after
SILENCE_SECONDS (120) with no frame of any kind, so a busy group costs
nothing and an idle one costs one request per window. Three consecutive
failures and /healthz answers 503 with the reason. Verified end to end in
scripts/e2e.sh against the real process: 503 after 84s with the fake's
connection cut, back to 200 on its own 30s after restoring it.
scripts/signal_api_watchdog.sh + a two-minute user timer do the recovery the
bot cannot do for itself, since a wedged bot cannot restart the container it
depends on. Two tiers, so the steady state costs no Signal round trip at
all: the bot's own /healthz first, the authenticated probe only when that is
not 200. It stops after 3 restarts in 6 hours and escalates instead -- a
deregistered account or a blocked network is not fixable by restarting, and
a restart loop would hide it. Its own bash suite stubs curl and docker and
drives every branch including the give-up cap.
signal_bot/trust.py answers the other half: TRUSTED_INVITERS decides who may
put this bot in a group. The gate sits in GroupDirectory._permitted, which
both _join_pending and _adopt already route through -- gating only invites
would gate the door nobody uses, since prime_profile.sh exists precisely so
that an add becomes a direct join. Evidence is either the group-update
envelope, which is the only frame naming an inviter, or a trusted identity
being a full member in the listing. A refusal is logged once, with that
group's members, so the operator can see which string to add.
verify_allowlist moved to membership.py to keep discovery.py under the
250-line gate; it was already the module that owns MembershipError.
Verified live, by stopping the container by hand and touching nothing else:
18:54:35 docker stop signal-api
18:56:36 liveness: failure 1 of 3 after 123s of silence
18:57:36 failure 3 of 3 -> /healthz answers 503 from 18:57:45
18:58:18 watchdog: probe failed (1/2)
19:00:28 watchdog: probe failed (2/2) -> docker restart signal-api
19:00:36 liveness: receive path recovered after 8 failed probe(s)
19:01:13 watchdog: signal-api is back
Six minutes, unattended, against three hours of silence this afternoon. All
four real groups are still adopted with TRUSTED_INVITERS=+48516501330 set,
and no group was refused.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KbjfWdAyHbCubac7wJKJZW
124 lines
4.1 KiB
Python
124 lines
4.1 KiB
Python
# Copyright (c) 2026 Krzysztof Rudnicki. MIT licence.
|
|
"""Parsing of signal-cli-rest-api envelopes into a flat, typed message."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
from dataclasses import dataclass
|
|
from typing import Any
|
|
|
|
|
|
@dataclass(frozen=True, slots=True)
|
|
class IncomingMessage:
|
|
"""One inbound Signal message, normalised across envelope shapes.
|
|
|
|
signal-cli reports messages from other people under ``dataMessage`` and
|
|
the account's own outgoing messages under ``syncMessage.sentMessage``.
|
|
The two carry the same fields at different depths; everything downstream
|
|
works on this flattened form instead of re-deriving the nesting.
|
|
"""
|
|
|
|
source_uuid: str
|
|
source_name: str
|
|
group_id: str | None
|
|
text: str | None
|
|
has_sticker: bool
|
|
is_reaction: bool
|
|
# The sender's +E.164 number. "source" carries it too, but only
|
|
# sometimes: live envelopes have shown a display name there and the
|
|
# number here, so this is the field a trust decision may rely on.
|
|
source_number: str = ""
|
|
# A group membership change rather than a message: this is the only
|
|
# frame that names who added the bot to a group.
|
|
is_group_update: bool = False
|
|
|
|
@property
|
|
def is_direct_message(self) -> bool:
|
|
"""True when the message did not arrive via a group.
|
|
|
|
A linked device receives every direct conversation on the account, so
|
|
this is the discriminator that keeps the bot scoped to its group.
|
|
"""
|
|
return self.group_id is None
|
|
|
|
|
|
def _payload(envelope: dict[str, Any]) -> dict[str, Any] | None:
|
|
"""Return the dataMessage or sentMessage body, whichever is present."""
|
|
data = envelope.get("dataMessage")
|
|
if isinstance(data, dict):
|
|
return data
|
|
sync = envelope.get("syncMessage")
|
|
if isinstance(sync, dict):
|
|
sent = sync.get("sentMessage")
|
|
if isinstance(sent, dict):
|
|
return sent
|
|
return None
|
|
|
|
|
|
def _group_id(payload: dict[str, Any]) -> str | None:
|
|
"""Return the group id, or None for a direct message."""
|
|
info = payload.get("groupInfo")
|
|
if not isinstance(info, dict):
|
|
return None
|
|
group_id = info.get("groupId")
|
|
if not isinstance(group_id, str) or not group_id:
|
|
return None
|
|
return group_id
|
|
|
|
|
|
def _group_type(payload: dict[str, Any]) -> str:
|
|
"""Return the groupInfo type ("DELIVER", "UPDATE", ...), or ""."""
|
|
info = payload.get("groupInfo")
|
|
if not isinstance(info, dict):
|
|
return ""
|
|
group_type = info.get("type")
|
|
return group_type if isinstance(group_type, str) else ""
|
|
|
|
|
|
def _text(payload: dict[str, Any]) -> str | None:
|
|
"""Return the message body, or None when there is no text."""
|
|
message = payload.get("message")
|
|
if not isinstance(message, str):
|
|
return None
|
|
return message
|
|
|
|
|
|
def parse_envelope(raw: str | bytes) -> IncomingMessage | None:
|
|
"""Parse one raw websocket frame.
|
|
|
|
Args:
|
|
raw: The JSON frame exactly as received.
|
|
|
|
Returns:
|
|
The normalised message, or None when the frame carries no message
|
|
body at all (receipts, typing indicators, malformed JSON).
|
|
"""
|
|
try:
|
|
decoded = json.loads(raw)
|
|
except json.JSONDecodeError, UnicodeDecodeError:
|
|
return None
|
|
if not isinstance(decoded, dict):
|
|
return None
|
|
|
|
envelope = decoded.get("envelope")
|
|
if not isinstance(envelope, dict):
|
|
return None
|
|
|
|
payload = _payload(envelope)
|
|
if payload is None:
|
|
return None
|
|
|
|
return IncomingMessage(
|
|
source_uuid=str(envelope.get("sourceUuid", "")),
|
|
source_name=str(envelope.get("sourceName", "")),
|
|
group_id=_group_id(payload),
|
|
text=_text(payload),
|
|
# The original bot looked for the sticker under dataMessage even when
|
|
# the envelope was a syncMessage, so its own stickers were never
|
|
# filtered. Reading it off the resolved payload fixes both shapes.
|
|
has_sticker=isinstance(payload.get("sticker"), dict),
|
|
is_reaction=isinstance(payload.get("reaction"), dict),
|
|
source_number=str(envelope.get("sourceNumber", "")),
|
|
is_group_update=_group_type(payload) == "UPDATE",
|
|
)
|