Repo cleanup and updates

apps/bridge-whatsapp/Dockerfile

@@ -2,20 +2,26 @@ FROM node:22-bookworm-slim AS base
 
 FROM base AS builder
 ARG APP_DIR=/opt/bridge-whatsapp
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
 RUN mkdir -p ${APP_DIR}/
-RUN npm i -g turbo
+RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
+RUN pnpm add -g turbo
 WORKDIR ${APP_DIR}
 COPY . .
 RUN turbo prune --scope=@link-stack/bridge-whatsapp --docker
 
 FROM base AS installer
 ARG APP_DIR=/opt/bridge-whatsapp
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
 WORKDIR ${APP_DIR}
+RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
 COPY --from=builder ${APP_DIR}/out/json/ .
 COPY --from=builder ${APP_DIR}/out/full/ .
-COPY --from=builder ${APP_DIR}/out/package-lock.json ./package-lock.json
-RUN npm ci
-RUN npm i -g turbo
+COPY --from=builder ${APP_DIR}/out/pnpm-lock.yaml ./pnpm-lock.yaml
+RUN pnpm install --frozen-lockfile
+RUN pnpm add -g turbo
 RUN turbo run build --filter=@link-stack/bridge-whatsapp
 
 FROM base as runner

apps/bridge-whatsapp/docker-entrypoint.sh

@@ -2,4 +2,4 @@
 
 set -e
 echo "starting bridge-whatsapp"
-exec dumb-init npm run start
+exec dumb-init pnpm run start

apps/bridge-whatsapp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-stack/bridge-whatsapp",
-  "version": "3.2.0b3",
+  "version": "3.3.0-beta.1",
   "main": "build/main/index.js",
   "author": "Darren Clarke <darren@redaranj.com>",
   "license": "AGPL-3.0-or-later",
@@ -9,15 +9,17 @@
     "@hapi/hapi": "^21.4.3",
     "@hapipal/schmervice": "^3.0.0",
     "@hapipal/toys": "^4.0.0",
-    "@link-stack/logger": "*",
+    "@link-stack/bridge-common": "workspace:*",
+    "@link-stack/logger": "workspace:*",
     "@whiskeysockets/baileys": "^6.7.20",
     "hapi-pino": "^13.0.0",
     "link-preview-js": "^3.1.0"
   },
   "devDependencies": {
-    "@link-stack/eslint-config": "*",
-    "@link-stack/jest-config": "*",
-    "@link-stack/typescript-config": "*",
+    "@link-stack/eslint-config": "workspace:*",
+    "@link-stack/jest-config": "workspace:*",
+    "@link-stack/typescript-config": "workspace:*",
+    "@types/long": "^5",
     "@types/node": "*",
     "dotenv-cli": "^10.0.0",
     "tsx": "^4.20.6",

apps/bridge-whatsapp/src/service.ts

@@ -12,6 +12,11 @@ import makeWASocket, {
 } from "@whiskeysockets/baileys";
 import fs from "fs";
 import { createLogger } from "@link-stack/logger";
+import {
+  getMaxAttachmentSize,
+  getMaxTotalAttachmentSize,
+  MAX_ATTACHMENTS,
+} from "@link-stack/bridge-common";
 
 const logger = createLogger("bridge-whatsapp-service");
 
@@ -36,7 +41,24 @@ export default class WhatsappService extends Service {
   }
 
   getBotDirectory(id: string): string {
-    return `${this.getBaseDirectory()}/${id}`;
+    // Validate that ID contains only safe characters (alphanumeric, dash, underscore)
+    if (!/^[a-zA-Z0-9_-]+$/.test(id)) {
+      throw new Error(`Invalid bot ID format: ${id}`);
+    }
+
+    // Prevent path traversal by checking for suspicious patterns
+    if (id.includes('..') || id.includes('/') || id.includes('\\')) {
+      throw new Error(`Path traversal detected in bot ID: ${id}`);
+    }
+
+    const botPath = `${this.getBaseDirectory()}/${id}`;
+
+    // Ensure the resolved path is still within the base directory
+    if (!botPath.startsWith(this.getBaseDirectory())) {
+      throw new Error(`Invalid bot path: ${botPath}`);
+    }
+
+    return botPath;
   }
 
   getAuthDirectory(id: string): string {
@@ -340,9 +362,39 @@ export default class WhatsappService extends Service {
       await connection.sendMessage(recipient, { text: message });
     }
 
-    // Send attachments if provided
+    // Send attachments if provided with size validation
     if (attachments && attachments.length > 0) {
+      const MAX_ATTACHMENT_SIZE = getMaxAttachmentSize();
+      const MAX_TOTAL_SIZE = getMaxTotalAttachmentSize();
+
+      if (attachments.length > MAX_ATTACHMENTS) {
+        throw new Error(`Too many attachments: ${attachments.length} (max ${MAX_ATTACHMENTS})`);
+      }
+
+      let totalSize = 0;
+
       for (const attachment of attachments) {
+        // Calculate size before converting to buffer
+        const estimatedSize = (attachment.data.length * 3) / 4;
+
+        if (estimatedSize > MAX_ATTACHMENT_SIZE) {
+          logger.warn({
+            filename: attachment.filename,
+            size: estimatedSize,
+            maxSize: MAX_ATTACHMENT_SIZE
+          }, 'Attachment exceeds size limit, skipping');
+          continue;
+        }
+
+        totalSize += estimatedSize;
+        if (totalSize > MAX_TOTAL_SIZE) {
+          logger.warn({
+            totalSize,
+            maxTotalSize: MAX_TOTAL_SIZE
+          }, 'Total attachment size exceeds limit, skipping remaining');
+          break;
+        }
+
         const buffer = Buffer.from(attachment.data, "base64");
 
         if (attachment.mime_type.startsWith("image/")) {

apps/bridge-whatsapp/tsconfig.json

@@ -8,7 +8,7 @@
     "outDir": "build/main",
     "rootDir": "src",
     "skipLibCheck": true,
-    "types": ["node", "long"],
+    "types": ["node"],
     "lib": ["es2020", "DOM"],
     "composite": true
   },