Merge pull request #97 from SkullGaming31/feature/electron-setup

Feature/electron setup

Author: SkullGaming31

.env.example

@@ -1,60 +1,40 @@
-# Example environment variables for OpenDevBot
-# Copy this file to .env and fill in secrets. DO NOT commit your real .env to source control.
-
-# Twitch
 TWITCH_CLIENT_ID=
 TWITCH_CLIENT_SECRET=
-TWITCH_EVENTSUB_SECRET= # random secret for EventSub signature verification
-TWITCH_REDIRECT_URL=http://localhost:3000/api/v1/auth/twitch/callback
+TWITCH_EVENTSUB_SECRET=
+TWITCH_REDIRECT_URL=http://localhost:3001/api/v1/auth/twitch/callback
 
-# Discord / webhooks
 DEV_DISCORD_BOT_TOKEN=
 DEV_DISCORD_CLIENT_ID=
 DEV_DISCORD_CLIENT_SECRET=
 DEV_DISCORD_GUILD_ID=
-DEV_DISCORD_WEBHOOK_ID=
-DEV_DISCORD_WEBHOOK_TOKEN=
-DEV_DISCORD_WEBHOOK_URL=
-DEV_DISCORD_ERROR_LOGS_ID=
-DEV_DISCORD_ERROR_WEBHOOK=
+
 DEV_DISCORD_PROMOTE_WEBHOOK_ID=
 DEV_DISCORD_PROMOTE_WEBHOOK_TOKEN=
+
 DEV_DISCORD_TWITCH_ACTIVITY_ID=
 DEV_DISCORD_TWITCH_ACTIVITY_TOKEN=
 DEV_DISCORD_FEATURE_REQUEST=
-DEV_DISCORD_FEATURE_REQUEST_ID=
-DEV_DISCORD_FEATURE_REQUEST_TOKEN=
+
 DISCORD_COMMAND_USAGE_ID=
 DISCORD_COMMAND_USAGE_TOKEN=
+
 BUG_REPORT_WEBHOOK_ID=
 BUG_REPORT_WEBHOOK_TOKEN=
+DEV_DISCORD_FEATURE_REQUEST_ID=
+DEV_DISCORD_FEATURE_REQUEST_TOKEN=
+PORT=
 
-# Server & logging
-PORT=3000
-PROD_LOG_FILE=./logs/prod.log
-DEV_LOG_FILE=./logs/dev.log
-
-# MongoDB (choose one)
-# For production (when ENVIRONMENT=prod) set MONGO_URI
 MONGO_USER=
 MONGO_PASS=
 MONGO_DB=
-MONGO_URI=
+MONGO_URI=full mongodb connection string
 
-# For local Docker Compose (dev), use DOCKER_URI pointing to the published mongo port
 DOCKER_URI=mongodb://localhost:27017/opendevbot
-
-# Feature flags / environment (note the project uses the misspelled 'ENVIRONMENT')
-ENVIRONMENT=dev # allowed: dev | debug | prod
+PROD_LOG_FILE=where you want the prod logs stored too
+DEV_LOG_FILE=where you want the dev logs stored too
+ENVIRONMENT=prod | debug | dev
 ENABLE_CHAT=true
 ENABLE_EVENTSUB=true
 
-# Optional third-party keys
-GUILDED_TOKEN=
-NEXON_API_KEY=
-DEV_NEXON_API_KEY=
-NITRADO_LONGLIFE_TOKEN=
-
-# Notes:
-# - Keep this file as a template. Never commit your real .env with secrets.
-# - If you run the app inside Docker Compose as a service, prefer DOCKER_URI=mongodb://mongodb:27017/opendevbot
+ADMIN_API_TOKEN=can be anything
+ADMIN_SETUP_TOKEN=can be anything

.gitignore

@@ -1,5 +1,6 @@
 node_modules/
 dist/
+dist-electron/
 .env
 /node_modules
 .env
@@ -11,5 +12,4 @@ NOTES.txt
 /logs
 /coverage
 .tsbuildinfo
-/.agents
-*.agent.md
+bot-status.diff

CHANGELOG.md

@@ -38,6 +38,13 @@
 
 All notable changes to this project are documented in this file.
 
+### 2026-07-15 — Electron / Admin dashboard
+
+- Added: Electron admin shell support improvements — masked `ADMIN_API_TOKEN` is now logged in the main process for diagnostics (masked, not the full secret). File: `electron/adminProxy.ts`.
+- Added: Health indicator to the local admin dashboard UI at the top header. The dashboard now polls `/health` and shows a green "API OK" badge on 200 responses and a red "API ERROR" badge for failures. File: `public/admin/dashboard.html`.
+- Changed: Built and pushed these changes to the `feature/electron-setup` branch for further testing; no PR opened.
+
+
 ## 2025-12-09 — Test hygiene & Jest/TypeScript fixes
 
 - Re-enabled strict TypeScript unused checks (`noUnusedLocals` / `noUnusedParameters`) and fixed the resulting errors across the codebase to restore strict type hygiene.

CODE-REVIEW-PRIORITY.md

@@ -0,0 +1,121 @@
+# OpenDevBot — Core Architecture Code Review by ClaudeAI
+
+Scope: `authProvider.ts`, `chat.ts`, `createApp.ts`, `EventSubEvents.ts`, `index.ts`
+Date: 2026-07-13
+
+---
+
+## 🔴 Critical
+
+### 1. `chat.ts:289` — `setInterval` created on every single chat message, never cleared
+
+Inside `commandHandler` (which runs on **every** incoming chat message), there's:
+
+```ts
+void setInterval(async () => {
+    if (isIntervalRunning) {
+        await intervalHandler();
+    }
+}, intervalDuration);
+```
+
+This has no guard flag and no stored handle. Compare this to `periodicSaveIntervalId` and
+`socialIntervalId`, which *are* correctly guarded/cleared elsewhere in this same file (e.g. the
+`periodicSocialTimerStarted` flag around line 454).
+
+**Impact:** every chat message in every joined channel spins up a brand-new interval that fetches
+chatters, checks live status, and credits wallets — and it runs forever. With any real chat
+activity this is an unbounded interval leak:
+- growing memory use over time
+- growing Twitch API call volume (rate-limit risk)
+- duplicate/overlapping wallet credits for the same users each interval tick
+
+**This is almost certainly the top production risk right now.**
+
+**Fix direction:** this "periodically credit chatters while live" block shouldn't live inside the
+message handler at all. Pull it out into a one-time setup step (same pattern you already used
+correctly for the periodic social-message timer), guarded by a module-level flag so it only starts
+once per process, and store/clear its interval handle like `periodicSaveIntervalId`.
+
+---
+
+## 🟠 High
+
+### 2. `createApp.ts` — admin token handling
+
+- Token comparisons use plain `!==` (`provided !== token`, `token !== expected`) instead of a
+  constant-time comparison. Low real-world risk for a personal bot, but cheap to harden with
+  `crypto.timingSafeEqual`.
+- The admin token can be supplied via `?admin_token=` query param, and the setup/login tokens via
+  `?setup_token=` / `?token=` query params. These end up in server access logs, any reverse-proxy
+  logs, and browser history. Recommend dropping query-param support for tokens entirely and
+  requiring the header/cookie only.
+
+### 3. `/api/v1/admin/setup` writes directly to `.env` on disk
+
+`fs.writeFileSync` is used to persist `ADMIN_API_TOKEN` whenever the endpoint is hit with a valid
+`ADMIN_SETUP_TOKEN`. If that setup token ever leaks, or is left set in a prod `.env` after initial
+setup, anyone who finds it gets full admin API access. Confirm `ADMIN_SETUP_TOKEN` is unset in prod
+once initial setup is complete — maybe add a startup warning if it's still set alongside
+`ENVIRONMENT=prod`.
+
+---
+
+## 🟡 Medium
+
+### 4. Chatter-fetch/crediting logic duplicated in two places
+
+Once as the (broken) interval inside `commandHandler`, and again in the `onJoin` watch-time
+interval logic. Worth consolidating into a single periodic service so there's one source of truth
+for "credit points every N minutes while live."
+
+### 5. `chat.ts:623-624` — dead code
+
+```ts
+if (stream === null) clearInterval(intervalId);
+```
+
+This runs right after the function already `return`s earlier when `stream === null` (~line 557),
+so this branch can never be reached. Harmless, but confusing — safe to delete.
+
+### 6. `chat.ts` `onJoin` — potential interval leak on reconnect without `part`
+
+If a user rejoins without a `part` event firing first (reconnect edge case), `viewerWatchTimes.set(user, ...)`
+overwrites the map entry without clearing the *previous* interval tied to that user — a smaller-scale
+version of the same leak pattern as issue #1. Worth clearing any existing interval for `user` before
+overwriting the map entry.
+
+### 7. `authProvider.ts` — fragile Twurple SDK fallback chain
+
+`getChatAuthProvider()`'s intent-registration logic (~lines 120–193) tries four different fallback
+paths wrapped in nested try/catch to work around Twurple SDK version differences between
+`addUserForToken`, `addUser` with options, `addUser`, and `addIntentsToUser`. It works, but it's
+fragile — any Twurple upgrade could silently change which path fires and you might not notice until
+chat auth breaks. Worth a code comment noting the exact Twurple version this was validated against.
+
+---
+
+## 🟢 Low / cleanup
+
+### 8. `index.ts` — `printEnvironmentVariables()` logs secrets, but is dead code
+
+Not called anywhere in the codebase currently, but if it's ever wired up it will `logger.debug`
+every `.env` key/value pair verbatim — including `TWITCH_CLIENT_SECRET`, Discord webhook tokens,
+`MONGO_PASS`, `NEXON_API_KEY`, etc. Either delete it, or if you want to keep it for future
+debugging, redact any key containing `TOKEN`, `SECRET`, `PASS`, or `KEY` before logging.
+
+### 9. Silent error swallowing in `authProvider.ts`
+
+Multiple `catch (e) { /* ignore */ }` blocks around the SDK-fallback probing in
+`getChatAuthProvider()`. Reasonable for probing which SDK method exists, but worth double-checking
+none of these are hiding a genuine auth failure in prod — consider at least a `logger.debug` in
+each ignored catch so there's a breadcrumb if chat auth ever silently stops working.
+
+---
+
+## Suggested order of attack
+
+1. Fix #1 (interval leak) — this is the one actually degrading the running bot over time.
+2. Fix #2/#3 (admin auth hardening) — quick wins, closes real exposure.
+3. #4–#7 as time allows — quality-of-life and future-proofing.
+4. #8/#9 — cleanup whenever convenient.

Dockerfile

@@ -42,11 +42,11 @@ RUN mkdir -p /app/logs && chown -R nodejs:nodejs /app/logs
 USER nodejs
 
 # Expose port (adjust if needed)
-EXPOSE 3000
+EXPOSE 3001
 
 # Health check
 HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-  CMD node -e "require('http').get('http://localhost:3000', (r) => {if (r.statusCode !== 200) throw new Error(r.statusCode)})"
+  CMD node -e "require('http').get('http://localhost:3001/health', (r) => {if (r.statusCode !== 200) throw new Error(r.statusCode)})"
 
 # Start application
 CMD ["node", "./dist/index.js"]

README.md

@@ -129,9 +129,13 @@ This is an example of how to list things you need to use the software and how to
 <p align="right">(<a href="#top">back to top</a>)</p>
 
 <!-- USAGE EXAMPLES -->
-<!-- ## Usage
+## Usage
+<p>electron:dev will build the electron app and start it</p>
 
-<p align="right">(<a href="#top">back to top</a>)</p> -->
+```sh
+npm run electron:dev
+```
+<p align="right">(<a href="#top">back to top</a>)</p>
 
 <!-- ROADMAP -->
 ## Roadmap
@@ -147,7 +151,7 @@ This is an example of how to list things you need to use the software and how to
 * [x] add word detection to send commands without prefix
 * [x] create channelPoints with userToken to modify the channel points with commands [Hard Coded ChannelPoints]
 * [x] Advanced Lurk Command
-* [ ] Timer Commands
+* [X] Timer Command
 * [x] Counters
 * [x] Quotes System?
 * [x] Viewer Watch Time?

TODO.md

@@ -26,6 +26,15 @@
 * [x] change channelPoints Message to display only on the console when channelpoints rewardId is not found.
 * [x] Que/delay webhooks being sent to avoid being rate limited by the Discord API
 
+## Remaining work
+
+* [ ] Finish the test-fix sweep and make the full test suite (`npm test`) pass deterministically.
+* [ ] Remove temporary diagnostic `console.log` lines added during debugging and re-run tests.
+* [ ] Harden mirroring logic: avoid upserts with null keys, add guards before mirror writes, and make `MIRROR_TO_USERMODEL` explicitly toggleable (default OFF for migrations).
+* [ ] Finalize and validate migration tooling for canonicalizing user IDs (dry-run + `--apply`, batching/limit, backups).
+* [ ] Ensure all commands use the correct API: wallet ops via `balanceAdapter` (short-lived/game bets) and bank ops via `economyService` (persistent ops), and update any remaining command code/tests.
+* [ ] Add/expand integration tests for transactional flows (heist/replica-set transactions) and outbox/migration scenarios.
+* [ ] Fix remaining TypeScript/Jest issues (unused imports like in `src/Commands/Fun/rps.ts`) and run `tsc`/lint to clean up errors.
+* [ ] Update docs: `NOTES.txt`, `README.md`, and migration instructions showing `MIRROR_TO_USERMODEL` usage and rollback guidance.
+* [ ] Run formatting and prepare a tidy commit/PR with descriptive changes and test results.
 
-FIX:
-* [x] (node:2288) [MONGOOSE] Warning: mongoose: the `new` option for `findOneAndUpdate()` and `findOneAndReplace()` is deprecated. Use `returnDocument: 'after'` instead.

docker-compose.yml

@@ -4,11 +4,11 @@ services:
   app:
     build: .
     ports:
-      - "3000:3000"
+      - "3001:3001"
     environment:
       - ENVIRONMENT=prod
       - MONGO_URI=mongodb://mongodb:27017/opendevbot
-      - PORT=3000
+      - PORT=3001
     env_file:
       - .env.prod
     depends_on:

electron/adminProxy.ts

@@ -0,0 +1,78 @@
+import { ipcMain } from 'electron';
+import logger from '../src/util/logger';
+
+interface AdminFetchOptions {
+	method?: string;
+	body?: string;
+}
+
+/**
+ * Proxies admin API calls from the renderer to the bot's local Express
+ * server, attaching `x-admin-token` on the main-process side so the
+ * renderer (and dashboard.html) never sees the token.
+ */
+export function registerAdminProxy(port: number): void {
+	const token = process.env.ADMIN_API_TOKEN || '';
+	logger.info('[electron] adminProxy configured');
+
+	ipcMain.handle('admin:fetch', async (_event, path: string, opts: AdminFetchOptions = {}) => {
+		const maxAttempts = 3;
+		let attempt = 0;
+		const token = process.env.ADMIN_API_TOKEN || '';
+
+		while (true) {
+			attempt++;
+			try {
+				const res = await fetch(`http://localhost:${port}${path}`, {
+					method: opts.method || 'GET',
+					headers: {
+						'Content-Type': 'application/json',
+						'x-admin-token': token
+					},
+					body: opts.body
+				});
+
+				if (res.ok) {
+					const ct = (res.headers.get('content-type') || '').toLowerCase();
+					if (ct.includes('application/json')) return await res.json();
+					// Try to parse body as JSON, otherwise return raw text
+					const text = await res.text();
+					try { return JSON.parse(text); } catch { return text; }
+				}
+
+				// Handle 429 with retry/backoff when possible
+				if (res.status === 429 && attempt < maxAttempts) {
+					const retryAfter = res.headers.get('retry-after');
+					let wait = 1000 * Math.pow(2, attempt - 1); // 1s, 2s, 4s
+					if (retryAfter) {
+						const ra = Number(retryAfter);
+						if (!Number.isNaN(ra)) wait = ra * 1000;
+					}
+					logger.warn(`admin:fetch ${path} returned 429; retrying in ${wait}ms (attempt ${attempt}/${maxAttempts})`);
+					await new Promise((r) => setTimeout(r, wait));
+					continue;
+				}
+
+				// Non-OK response: read body and surface a clear error
+				const bodyText = await res.text();
+				// If body is JSON, return parsed object to preserve existing behaviour
+				try {
+					const parsed = JSON.parse(bodyText);
+					return parsed;
+				} catch {
+					logger.warn(`admin:fetch ${path} returned ${res.status} ${res.statusText}`);
+					throw new Error(`HTTP ${res.status} ${res.statusText}: ${bodyText}`);
+				}
+			} catch (err) {
+				// Network or parsing error — retry a few times before failing
+				if (attempt >= maxAttempts) {
+					logger.error(`admin:fetch proxy failed for ${path}`, err as Error);
+					throw err;
+				}
+				const wait = 500 * attempt;
+				logger.warn(`admin:fetch transient error for ${path}, retrying in ${wait}ms (attempt ${attempt}/${maxAttempts})`, err as Error);
+				await new Promise((r) => setTimeout(r, wait));
+			}
+		}
+	});
+}