Avoid unsolicited group APK analysis

Author: zhaobozhen

packages/bot-worker/package.json

@@ -19,7 +19,8 @@
     "commands:set": "node scripts/manage-webhook.mjs commands:set",
     "commands:info": "node scripts/manage-webhook.mjs commands:info",
     "commands:delete": "node scripts/manage-webhook.mjs commands:delete",
-    "check": "node --check src/index.js && node --check src/apk-url-preview.js && node --check src/i18n.js && node --check src/icons.js && node --check src/observability.js && node --check src/report-viewer.js && node --check src/telegraph.js && node --check src/upload-view.js && node --check scripts/manage-webhook.mjs"
+    "test": "node --test test/*.test.mjs",
+    "check": "node --check src/index.js && node --check src/apk-url-preview.js && node --check src/i18n.js && node --check src/icons.js && node --check src/observability.js && node --check src/report-viewer.js && node --check src/telegraph.js && node --check src/upload-view.js && node --check scripts/manage-webhook.mjs && npm test"
   },
   "devDependencies": {
     "wrangler": "^4.103.0"

packages/bot-worker/src/index.js

@@ -819,13 +819,9 @@ function selectTargetUrl(message, command, isEdited, botMentioned) {
     return null;
   }
 
-  const directApkLink = directLinks.find(isLikelyApkUrl);
-  if (directApkLink) {
-    return directApkLink;
-  }
-
   if (isPrivateChat(message.chat)) {
-    return directLinks[0] || null;
+    const directApkLink = directLinks.find(isLikelyApkUrl);
+    return directApkLink || directLinks[0] || null;
   }
 
   return null;
@@ -837,7 +833,7 @@ function shouldAutoAnalyzeMessage(message) {
     return false;
   }
 
-  return isPrivateChat(message.chat) || isGroupOrChannelChat(message.chat) || isForwardedMessage(message);
+  return isPrivateChat(message.chat);
 }
 
 function getApkDocument(message) {
@@ -1679,10 +1675,6 @@ function isPrivateChat(chat) {
   return chat?.type === "private";
 }
 
-function isGroupOrChannelChat(chat) {
-  return chat?.type === "group" || chat?.type === "supergroup" || chat?.type === "channel";
-}
-
 function isForwardedMessage(message) {
   return Boolean(
     message?.forward_origin ||
@@ -2367,3 +2359,8 @@ function getErrorStack(error) {
 
   return null;
 }
+
+export const __botWorkerTestInternals = {
+  selectTargetDocument,
+  selectTargetUrl,
+};

packages/bot-worker/test/message-target.test.mjs

@@ -0,0 +1,52 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { __botWorkerTestInternals } from "../src/index.js";
+
+const { selectTargetDocument, selectTargetUrl } = __botWorkerTestInternals;
+
+const apkDocument = {
+  file_id: "apk-file",
+  file_name: "sample.apk",
+  mime_type: "application/vnd.android.package-archive",
+};
+
+test("private chats auto-analyze direct APK documents", () => {
+  const message = {
+    chat: { id: 1, type: "private" },
+    document: apkDocument,
+  };
+
+  assert.equal(selectTargetDocument(message, null, false, false), apkDocument);
+});
+
+test("group chats ignore APK documents unless the bot is explicitly targeted", () => {
+  const message = {
+    chat: { id: -1, type: "supergroup" },
+    document: apkDocument,
+  };
+
+  assert.equal(selectTargetDocument(message, null, false, false), null);
+  assert.equal(selectTargetDocument(message, null, false, true), apkDocument);
+  assert.equal(selectTargetDocument(message, "apkinfo", false, false), apkDocument);
+});
+
+test("group chats ignore APK links unless the bot is explicitly targeted", () => {
+  const message = {
+    chat: { id: -1, type: "group" },
+    text: "https://example.com/sample.apk",
+  };
+
+  assert.equal(selectTargetUrl(message, null, false, false), null);
+  assert.equal(selectTargetUrl(message, null, false, true), "https://example.com/sample.apk");
+  assert.equal(selectTargetUrl(message, "apkinfo", false, false), "https://example.com/sample.apk");
+});
+
+test("private chats still auto-analyze direct APK links", () => {
+  const message = {
+    chat: { id: 1, type: "private" },
+    text: "https://example.com/sample.apk",
+  };
+
+  assert.equal(selectTargetUrl(message, null, false, false), "https://example.com/sample.apk");
+});