fix(whatsapp): cap QR login timers

steipete · steipete · commit b09cab4ebd2c · 2026-05-30T04:16:36.000-04:00
diff --git a/extensions/whatsapp/src/login-qr.test.ts b/extensions/whatsapp/src/login-qr.test.ts
@@ -1,4 +1,5 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { MAX_TIMER_TIMEOUT_MS } from "openclaw/plugin-sdk/number-runtime";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { startWebLoginWithQr, waitForWebLogin } from "./login-qr.js";
 import { renderQrPngDataUrl } from "./qr-image.js";
 import {
@@ -101,6 +102,10 @@ describe("login-qr", () => {
       .mockImplementation(async (input) => `data:image/png;base64,encoded:${input}`);
   });
 
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
   it("restarts login once on status 515 and completes", async () => {
     waitForWaConnectionMock
       // Baileys v7 wraps the error: { error: BoomError(515) }
@@ -181,6 +186,27 @@ describe("login-qr", () => {
     expect(logoutWebMock).toHaveBeenCalledOnce();
   });
 
+  it("caps oversized wait timeouts to a timer-safe delay", async () => {
+    const accountId = "oversized-wait-timeout";
+    waitForWaConnectionMock.mockImplementation(() => new Promise(() => {}));
+
+    const start = await startWebLoginWithQr({ timeoutMs: 5000, accountId });
+    expect(start.qrDataUrl).toBe("data:image/png;base64,encoded:qr-data");
+
+    vi.useFakeTimers();
+    const resultPromise = waitForWebLogin({
+      timeoutMs: Number.MAX_SAFE_INTEGER,
+      currentQrDataUrl: start.qrDataUrl,
+      accountId,
+    });
+
+    await vi.advanceTimersByTimeAsync(MAX_TIMER_TIMEOUT_MS);
+    await expect(resultPromise).resolves.toEqual({
+      connected: false,
+      message: "Still waiting for the QR scan. Let me know when you’ve scanned it.",
+    });
+  });
+
   it("turns unexpected login cleanup failures into a normal login error", async () => {
     waitForWaConnectionMock.mockRejectedValueOnce({
       output: { statusCode: 401 },
diff --git a/extensions/whatsapp/src/login-qr.ts b/extensions/whatsapp/src/login-qr.ts
@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { logInfo } from "openclaw/plugin-sdk/logging-core";
+import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { getRuntimeConfig } from "openclaw/plugin-sdk/runtime-config-snapshot";
 import { danger, info, success } from "openclaw/plugin-sdk/runtime-env";
 import { defaultRuntime, type RuntimeEnv } from "openclaw/plugin-sdk/runtime-env";
@@ -62,6 +63,14 @@ const ACTIVE_LOGIN_TTL_MS = 3 * 60_000;
 const MAX_QR_RENDER_CHASES = 10;
 const activeLogins = new Map<string, ActiveLogin>();
 
+function resolveWhatsAppLoginTimeoutMs(
+  value: number | undefined,
+  fallbackMs: number,
+  minMs: number,
+): number {
+  return resolveTimerTimeoutMs(value, fallbackMs, minMs);
+}
+
 function closeSocket(sock: WaSocket) {
   closeWaSocket(sock);
 }
@@ -344,7 +353,7 @@ export async function startWebLoginWithQr(
     () => {
       rejectQr?.(new Error("Timed out waiting for WhatsApp QR"));
     },
-    Math.max(opts.timeoutMs ?? 30_000, 5000),
+    resolveWhatsAppLoginTimeoutMs(opts.timeoutMs, 30_000, 5000),
   );
 
   let sock: WaSocket;
@@ -492,7 +501,7 @@ export async function waitForWebLogin(
       message: "The login QR expired. Ask me to generate a new one.",
     };
   }
-  const timeoutMs = Math.max(opts.timeoutMs ?? 120_000, 1000);
+  const timeoutMs = resolveWhatsAppLoginTimeoutMs(opts.timeoutMs, 120_000, 1000);
   const deadline = Date.now() + timeoutMs;
   const currentQrDataUrl = opts.currentQrDataUrl;
 
