import * as ssrf from "openclaw/plugin-sdk/infra-runtime";

import * as mediaFetch from "openclaw/plugin-sdk/media-runtime";

import type { SavedMedia } from "openclaw/plugin-sdk/media-runtime";

import * as mediaStore from "openclaw/plugin-sdk/media-runtime";

import { logVerbose } from "openclaw/plugin-sdk/runtime-env";

import { type FetchMock, withFetchPreconnect } from "openclaw/plugin-sdk/testing";

import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";

import { mockPinnedHostnameResolution } from "../../../../src/test-helpers/ssrf.js";

import {

fetchWithSlackAuth,

resolveSlackAttachmentContent,

resolveSlackThreadStarter,

resetSlackThreadStarterCacheForTest,

} from "./media.js";

vi.mock("openclaw/plugin-sdk/runtime-env", () => ({

logVerbose: vi.fn(),

danger: (message: string) => message,

shouldLogVerbose: () => false,

import type { FetchLike, SavedMedia } from "./media.runtime.js";

import * as mediaRuntime from "./media.runtime.js";

import { logVerbose } from "./media.runtime.js";

type FetchMock = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;

const fetchRemoteMediaMock = vi.hoisted(() =>

vi.fn(

async (params: {

url: string;

fetchImpl: FetchLike;

filePathHint?: string;

requestInit?: RequestInit;

}) => {

let response = await params.fetchImpl(params.url, {

...params.requestInit,

dispatcher: {},

} as RequestInit & { dispatcher: unknown });

if (response.status >= 300 && response.status < 400) {

const location = response.headers.get("location");

if (location) {

const source = new URL(params.url);

const redirect = new URL(location, source);

const sameOrigin = redirect.origin === source.origin;

response = await params.fetchImpl(redirect.toString(), {

...(sameOrigin ? params.requestInit : {}),

redirect: "follow",

dispatcher: {},

} as RequestInit & { dispatcher: unknown });

}

}

if (response.status < 200 || response.status >= 300) {

throw new Error(`fetch failed: ${response.status}`);

}

return {

buffer: Buffer.from(await response.arrayBuffer()),

contentType: response.headers.get("content-type") ?? undefined,

fileName: params.filePathHint ?? new URL(params.url).pathname.split("/").at(-1),

};

},

),

);

const saveMediaBufferMock = vi.hoisted(() =>

vi.fn(async (_buffer: Buffer, contentType?: string) => ({

id: "saved-media-id",

path: "/tmp/test.bin",

size: _buffer.byteLength,

contentType,

})),

);

const fetchWithRuntimeDispatcherMock = vi.hoisted(() => vi.fn());

const logVerboseMock = vi.hoisted(() => vi.fn());

vi.mock("./media.runtime.js", () => ({

fetchRemoteMedia: fetchRemoteMediaMock,

fetchWithRuntimeDispatcher: fetchWithRuntimeDispatcherMock,

logVerbose: logVerboseMock,

saveMediaBuffer: saveMediaBufferMock,

}));

function withFetchPreconnect(fetchMock: ReturnType<typeof vi.fn<FetchMock>>): typeof fetch {

return Object.assign(

((input: RequestInfo | URL, init?: RequestInit) => fetchMock(input, init)) as typeof fetch,

{ mock: fetchMock.mock },

);

}

// Store original fetch

const originalFetch = globalThis.fetch;

let mockFetch: ReturnType<typeof vi.fn<FetchMock>>;

beforeEach(() => {

fetchRemoteMediaMock.mockClear();

fetchWithRuntimeDispatcherMock.mockClear();

logVerboseMock.mockClear();

saveMediaBufferMock.mockClear();

});

const createSavedMedia = (filePath: string, contentType: string): SavedMedia => ({

id: "saved-media-id",

path: filePath,

redirectedUrl: string;

secondAuthorization: string | null;

}) {

vi.spyOn(mediaStore, "saveMediaBuffer").mockResolvedValue(

vi.spyOn(mediaRuntime, "saveMediaBuffer").mockResolvedValue(

createSavedMedia("/tmp/test.jpg", "image/jpeg"),

);

beforeEach(() => {

mockFetch = vi.fn();

globalThis.fetch = mockFetch as unknown as typeof fetch;

mockPinnedHostnameResolution();

});

afterEach(() => {

});

it("prefers url_private_download over url_private", async () => {

vi.spyOn(mediaStore, "saveMediaBuffer").mockResolvedValue(

vi.spyOn(mediaRuntime, "saveMediaBuffer").mockResolvedValue(

createSavedMedia("/tmp/test.jpg", "image/jpeg"),

);

});

it("rejects HTML auth pages for non-HTML files", async () => {

const saveMediaBufferMock = vi.spyOn(mediaStore, "saveMediaBuffer");

const saveMediaBufferMock = vi.spyOn(mediaRuntime, "saveMediaBuffer");

mockFetch.mockResolvedValueOnce(

new Response("<!DOCTYPE html><html><body>login</body></html>", {

status: 200,

});

it("allows expected HTML uploads", async () => {

vi.spyOn(mediaStore, "saveMediaBuffer").mockResolvedValue(

vi.spyOn(mediaRuntime, "saveMediaBuffer").mockResolvedValue(

createSavedMedia("/tmp/page.html", "text/html"),

);

mockFetch.mockResolvedValueOnce(

// video/mp4 for MP4 containers. Verify resolveSlackMedia preserves

// the overridden audio/* type in its return value despite this.

const saveMediaBufferMock = vi

.spyOn(mediaStore, "saveMediaBuffer")

.spyOn(mediaRuntime, "saveMediaBuffer")

.mockResolvedValue(createSavedMedia("/tmp/voice.mp4", "video/mp4"));

const mockResponse = new Response(Buffer.from("audio data"), {

it("preserves original MIME for non-voice Slack files", async () => {

const saveMediaBufferMock = vi

.spyOn(mediaStore, "saveMediaBuffer")

.spyOn(mediaRuntime, "saveMediaBuffer")

.mockResolvedValue(createSavedMedia("/tmp/video.mp4", "video/mp4"));

const mockResponse = new Response(Buffer.from("video data"), {

});

it("falls through to next file when first file returns error", async () => {

vi.spyOn(mediaStore, "saveMediaBuffer").mockResolvedValue(

vi.spyOn(mediaRuntime, "saveMediaBuffer").mockResolvedValue(

createSavedMedia("/tmp/test.jpg", "image/jpeg"),

);

});

it("returns all successfully downloaded files as an array", async () => {

vi.spyOn(mediaStore, "saveMediaBuffer").mockImplementation(async (buffer, _contentType) => {

vi.spyOn(mediaRuntime, "saveMediaBuffer").mockImplementation(async (buffer, _contentType) => {

const text = Buffer.from(buffer).toString("utf8");

if (text.includes("image a")) {

return createSavedMedia("/tmp/a.jpg", "image/jpeg");

it("caps downloads to 8 files for large multi-attachment messages", async () => {

const saveMediaBufferMock = vi

.spyOn(mediaStore, "saveMediaBuffer")

.spyOn(mediaRuntime, "saveMediaBuffer")

.mockResolvedValue(createSavedMedia("/tmp/x.jpg", "image/jpeg"));

mockFetch.mockImplementation(async () => {

});

it("routes dispatcher-backed Slack media requests through runtime fetch", async () => {

vi.spyOn(mediaStore, "saveMediaBuffer").mockResolvedValue(

vi.spyOn(mediaRuntime, "saveMediaBuffer").mockResolvedValue(

createSavedMedia("/tmp/test.jpg", "image/jpeg"),

);

globalThis.fetch = (async () => {

throw new Error("global fetch should not receive dispatcher-backed Slack media requests");

}) as typeof fetch;

const runtimeFetchSpy = vi

.spyOn(ssrf, "fetchWithRuntimeDispatcher")

.spyOn(mediaRuntime, "fetchWithRuntimeDispatcher")

.mockImplementation(async () => {

return new Response(Buffer.from("image data"), {

status: 200,

beforeEach(() => {

mockFetch = vi.fn();

globalThis.fetch = withFetchPreconnect(mockFetch);

mockPinnedHostnameResolution();

});

afterEach(() => {

});

it("passes ssrfPolicy with Slack CDN allowedHostnames and allowRfc2544BenchmarkRange to file downloads", async () => {

vi.spyOn(mediaStore, "saveMediaBuffer").mockResolvedValue(

vi.spyOn(mediaRuntime, "saveMediaBuffer").mockResolvedValue(

createSavedMedia("/tmp/test.jpg", "image/jpeg"),

);

mockFetch.mockResolvedValueOnce(

new Response(Buffer.from("img"), { status: 200, headers: { "content-type": "image/jpeg" } }),

);

const spy = vi.spyOn(mediaFetch, "fetchRemoteMedia");

const spy = vi.spyOn(mediaRuntime, "fetchRemoteMedia");

await resolveSlackMedia({

files: [{ url_private: "https://files.slack.com/test.jpg", name: "test.jpg" }],

});

it("passes ssrfPolicy to forwarded attachment image downloads", async () => {

vi.spyOn(mediaStore, "saveMediaBuffer").mockResolvedValue(

vi.spyOn(mediaRuntime, "saveMediaBuffer").mockResolvedValue(

createSavedMedia("/tmp/fwd.jpg", "image/jpeg"),

);

vi.spyOn(ssrf, "resolvePinnedHostnameWithPolicy").mockImplementation(async (hostname) => {

const normalized = hostname.trim().toLowerCase().replace(/\.$/, "");

return {

hostname: normalized,

addresses: ["93.184.216.34"],

lookup: ssrf.createPinnedLookup({ hostname: normalized, addresses: ["93.184.216.34"] }),

};

});

mockFetch.mockResolvedValueOnce(

new Response(Buffer.from("fwd"), { status: 200, headers: { "content-type": "image/jpeg" } }),

);

const spy = vi.spyOn(mediaFetch, "fetchRemoteMedia");

const spy = vi.spyOn(mediaRuntime, "fetchRemoteMedia");

await resolveSlackAttachmentContent({

attachments: [{ is_share: true, image_url: "https://files.slack.com/forwarded.jpg" }],

beforeEach(() => {

mockFetch = vi.fn();

globalThis.fetch = mockFetch as unknown as typeof fetch;

mockPinnedHostnameResolution();

});

afterEach(() => {

});

it("skips forwarded image URLs on non-Slack hosts", async () => {

const saveMediaBufferMock = vi.spyOn(mediaStore, "saveMediaBuffer");

const saveMediaBufferMock = vi.spyOn(mediaRuntime, "saveMediaBuffer");

const result = await resolveSlackAttachmentContent({

attachments: [{ is_share: true, image_url: "https://example.com/forwarded.jpg" }],

});

it("downloads Slack-hosted images from forwarded shared attachments", async () => {

vi.spyOn(mediaStore, "saveMediaBuffer").mockResolvedValue(

vi.spyOn(mediaRuntime, "saveMediaBuffer").mockResolvedValue(

createSavedMedia("/tmp/forwarded.jpg", "image/jpeg"),

);