Talk bot receives events but cannot respond after ExApp restart due to missing secret

[Dazezh]

Steps to reproduce

1. Create and register an ExApp that implements a Talk bot using AppAPI.
2. Add the bot to one or more Talk conversations.
3. Restart the ExApp container.
4. Send a new message to a conversation where the bot is present.

Expected behaviour

The bot should automatically reconnect after the container restarts and continue receiving Talk webhook events without requiring any manual action.

Actual behaviour

After restarting the ExApp container, the bot continues to receive webhook requests from Talk, but it is unable to respond to messages.

Outgoing responses fail because the bot secret is missing, so requests to Talk cannot be authenticated.

The ExApp log contains the following messages immediately after restart:

App log

TRACE:    ASGI [3] Started scope={'type': 'http', 'asgi': {'version': '3.0', 'spec_version': '2.3'}, 'http_version': '1.1', 'server': ('/tmp/exapp.sock', None), 'client': None, 'scheme': 'http', 'root_path': '', 'headers': '<...>', 'state': {}, 'method': 'POST', 'path': '/message', 'raw_path': b'/message', 'query_string': b'reply_to=63944&token=ismeabhj'}
TRACE:    ASGI [3] Receive {'type': 'http.request', 'body': '<11829 bytes>', 'more_body': False}
TRACE:    ASGI [3] Send {'type': 'http.response.start', 'status': 500, 'headers': '<...>'}
INFO:      - "POST /message?reply_to=63944&token=ismeabhj HTTP/1.1" 500 Internal Server Error
TRACE:    ASGI [3] Send {'type': 'http.response.body', 'body': '<21 bytes>'}
TRACE:    ASGI [3] Raised exception
ERROR:    Exception in ASGI application
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/uvicorn/protocols/http/httptools_impl.py", line 420, in run_asgi
    result = await app(  # type: ignore[func-returns-value]
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/uvicorn/middleware/proxy_headers.py", line 60, in __call__
    return await self.app(scope, receive, send)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/uvicorn/middleware/message_logger.py", line 84, in __call__
    raise exc from None
  File "/usr/local/lib/python3.12/site-packages/uvicorn/middleware/message_logger.py", line 80, in __call__
    await self.app(scope, inner_receive, inner_send)
  File "/usr/local/lib/python3.12/site-packages/fastapi/applications.py", line 1163, in __call__
    await super().__call__(scope, receive, send)
  File "/usr/local/lib/python3.12/site-packages/starlette/applications.py", line 90, in __call__
    await self.middleware_stack(scope, receive, send)
  File "/usr/local/lib/python3.12/site-packages/starlette/middleware/errors.py", line 186, in __call__
    raise exc
  File "/usr/local/lib/python3.12/site-packages/starlette/middleware/errors.py", line 164, in __call__
    await self.app(scope, receive, _send)
  File "/usr/local/lib/python3.12/site-packages/nc_py_api/ex_app/integration_fastapi.py", line 374, in __call__
    await self.app(scope, receive, send)
  File "/usr/local/lib/python3.12/site-packages/starlette/middleware/exceptions.py", line 63, in __call__
    await wrap_app_handling_exceptions(self.app, conn)(scope, receive, send)
  File "/usr/local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 53, in wrapped_app
    raise exc
  File "/usr/local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 42, in wrapped_app
    await app(scope, receive, sender)
  File "/usr/local/lib/python3.12/site-packages/fastapi/middleware/asyncexitstack.py", line 18, in __call__
    await self.app(scope, receive, send)
  File "/usr/local/lib/python3.12/site-packages/starlette/routing.py", line 660, in __call__
    await self.middleware_stack(scope, receive, send)
  File "/usr/local/lib/python3.12/site-packages/starlette/routing.py", line 680, in app
    await route.handle(scope, receive, send)
  File "/usr/local/lib/python3.12/site-packages/starlette/routing.py", line 276, in handle
    await self.app(scope, receive, send)
  File "/usr/local/lib/python3.12/site-packages/fastapi/routing.py", line 134, in app
    await wrap_app_handling_exceptions(app, request)(scope, receive, send)
  File "/usr/local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 53, in wrapped_app
    raise exc
  File "/usr/local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 42, in wrapped_app
    await app(scope, receive, sender)
  File "/usr/local/lib/python3.12/site-packages/fastapi/routing.py", line 120, in app
    response = await f(request)
               ^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/fastapi/routing.py", line 674, in app
    raw_response = await run_endpoint_function(
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/fastapi/routing.py", line 330, in run_endpoint_function
    return await run_in_threadpool(dependant.call, **values)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/starlette/concurrency.py", line 32, in run_in_threadpool
    return await anyio.to_thread.run_sync(func)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/anyio/to_thread.py", line 63, in run_sync
    return await get_async_backend().run_sync_in_worker_thread(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/anyio/_backends/_asyncio.py", line 2518, in run_sync_in_worker_thread
    return await future
           ^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/anyio/_backends/_asyncio.py", line 1002, in run
    result = context.run(func, *args)
             ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/main.py", line 232, in message_handler
    AI_BOT.send_message(task["output"]["output"] + AI_WATERMARK, reply_to, token=token)
  File "/usr/local/lib/python3.12/site-packages/nc_py_api/talk_bot.py", line 165, in send_message
    return self._sign_send_request("POST", f"/{token}/message", params, message), reference_id
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/nc_py_api/talk_bot.py", line 208, in _sign_send_request
    raise RuntimeError("Can't find the 'secret' of the bot. Has the bot been installed?")
RuntimeError: Can't find the 'secret' of the bot. Has the bot been installed?
TRACE:    HTTP connection lost

As a result, the bot appears online and receives events, but does not send any replies until it is manually re-enabled.

Server configuration

Web server: Apache

Database: Maria

PHP version: 8.4-fpm

Nextcloud version: 34.0.0

List of activated apps

- activity: 7.0.0
 - announcementcenter: 7.4.1
 - app_api: 34.0.0
 - appstore: 1.0.0
 - assistant: 3.4.3
 - bruteforcesettings: 7.0.0
 - calendar: 6.5.0
 - cloud_federation_api: 1.18.0
 - contacts: 8.7.2
 - contactsinteraction: 1.15.0
 - dashboard: 7.14.0
 - dav: 1.39.0
 - drop_account: 3.0.0
 - federatedfilesharing: 1.24.0
 - files: 2.6.0
 - files_external: 1.26.0
 - files_lock: 34.0.0
 - files_sharing: 1.26.0
 - files_trashbin: 1.24.0
 - files_versions: 1.27.0
 - integration_google: 4.4.0
 - integration_openai: 4.5.1
 - logreader: 7.0.0
 - lookup_server_connector: 1.22.0
 - mail: 5.10.3
 - metadata: 0.24.0
 - music: 3.1.0
 - notes: 6.0.1
 - notifications: 7.0.0-dev.1
 - notify_push: 1.3.3
 - oauth2: 1.22.0
 - office: 1.0.0
 - onlyoffice: 10.1.2
 - password_policy: 6.0.0-dev.0
 - photos: 7.0.0
 - previewgenerator: 5.14.0
 - privacy: 6.0.0-dev.1
 - profile: 1.3.0
 - provisioning_api: 1.24.0
 - serverinfo: 6.0.0
 - settings: 1.17.0
 - solitaire: 1.0.0
 - spreed: 24.0.1
 - systemtags: 1.24.0
 - text: 8.0.0
 - theming: 2.9.0
 - twofactor_backupcodes: 1.23.0
 - twofactor_email: 3.1.2
 - twofactor_nextcloud_notification: 8.0.0
 - twofactor_totp: 16.0.0
 - user_status: 1.14.0
 - viewer: 7.0.0-dev.0
 - weather_status: 1.14.0
 - webhook_listeners: 1.6.0
 - workflowengine: 2.16.0

Nextcloud configuration

{
 "system": {
 "instanceid": "***REMOVED SENSITIVE VALUE***",
 "passwordsalt": "***REMOVED SENSITIVE VALUE***",
 "secret": "***REMOVED SENSITIVE VALUE***",
 "trusted_domains": [
 "cloud.zezh.ru"
 ],
 "updater.release.channel": "stable",
 "datadirectory": "***REMOVED SENSITIVE VALUE***",
 "dbtype": "mysql",
 "version": "34.0.0.12",
 "dbname": "***REMOVED SENSITIVE VALUE***",
 "dbhost": "***REMOVED SENSITIVE VALUE***",
 "dbport": "",
 "dbtableprefix": "oc_",
 "mysql.utf8mb4": true,
 "dbuser": "***REMOVED SENSITIVE VALUE***",
 "dbpassword": "***REMOVED SENSITIVE VALUE***",
 "installed": true,
 "app_install_overwrite": {
 "1": "metadata",
 "2": "extract",
 "3": "printer",
 "7": "solitaire",
 "8": "previewgenerator"
 },
 "overwrite.cli.url": "https:\/\/cloud.zezh.ru",
 "overwriteprotocol": "https",
 "memcache.local": "\\OC\\Memcache\\APCu",
 "memcache.distributed": "\\OC\\Memcache\\Redis",
 "memcache.locking": "\\OC\\Memcache\\Redis",
 "redis": {
 "host": "***REMOVED SENSITIVE VALUE***",
 "port": 6379
 },
 "default_phone_region": "RU",
 "default_language": "ru",
 "default_locale": "ru_RU",
 "skeletondirectory": "",
 "htaccess.RewriteBase": "\/",
 "mail_smtpmode": "smtp",
 "mail_sendmailmode": "smtp",
 "mail_from_address": "***REMOVED SENSITIVE VALUE***",
 "mail_domain": "***REMOVED SENSITIVE VALUE***",
 "mail_smtpauth": true,
 "maintenance": false,
 "loglevel": 2,
 "maintenance_window_start": 1,
 "forbidden_filename_basenames": [
 "con",
 "prn",
 "aux",
 "nul",
 "com0",
 "com1",
 "com2",
 "com3",
 "com4",
 "com5",
 "com6",
 "com7",
 "com8",
 "com9",
 "com\u00b9",
 "com\u00b2",
 "com\u00b3",
 "lpt0",
 "lpt1",
 "lpt2",
 "lpt3",
 "lpt4",
 "lpt5",
 "lpt6",
 "lpt7",
 "lpt8",
 "lpt9",
 "lpt\u00b9",
 "lpt\u00b2",
 "lpt\u00b3"
 ],
 "forbidden_filename_characters": [
 "<",
 ">",
 ":",
 "\"",
 "|",
 "?",
 "*",
 "\\",
 "\/"
 ],
 "forbidden_filename_extensions": [
 " ",
 ".",
 ".filepart",
 ".part"
 ],
 "simpleSignUpLink.shown": false,
 "trashbin_retention_obligation": "14, auto",
 "versions_retention_obligation": "30, auto",
 "activity_expire_days": 7,
 "memories.db.triggers.fcu": true,
 "memories.exiftool": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/exiftool-amd64-glibc",
 "memories.vod.path": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/go-vod-amd64",
 "memories.vod.ffmpeg": "\/usr\/bin\/ffmpeg",
 "memories.vod.ffprobe": "\/usr\/bin\/ffprobe",
 "memories.gis_type": 1,
 "theme": "",
 "data-fingerprint": "08a90f108d4d718fe7e0a0455841f1d6",
 "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
 "enabledPreviewProviders": [
 "OC\\Preview\\Image",
 "OC\\Preview\\Movie",
 "OC\\Preview\\MP3"
 ],
 "preview_max_memory": 512,
 "preview_max_filesize_image": 1024,
 "preview_ffmpeg_path": "\/usr\/bin\/ffmpeg",
 "preview_ffprobe_path": "\/usr\/bin\/ffprobe",
 "preview_concurrency_all": 16,
 "preview_concurrency_new": 8,
 "preview_max_x": 1024,
 "preview_max_y": 1024,
 "defaultapp": "",
 "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
 "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
 "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
 "mail_smtpport": "587",
 "mail_smtpstreamoptions": {
 "ssl": {
 "allow_self_signed": false,
 "verify_peer": true,
 "verify_peer_name": true
 }
 }
 }
}

Browser

Browser name:

Browser version:

Operating system:

Browser log

[edward-ly]

I'm not too familiar with how authentication works in AppAPI or Talk, but regardless, I don't see how allowing the ExApp to be replaced would be desirable from a security standpoint. For now, I think it's fine that Talk/AppAPI establishes a connection to only one specific ExApp server process, and that re-enabling the app should be required to connect to a new ExApp server.

[Dazezh]

I'm not too familiar with how authentication works in AppAPI or Talk, but regardless, I don't see how allowing the ExApp to be replaced would be desirable from a security standpoint. For now, I think it's fine that Talk/AppAPI establishes a connection to only one specific ExApp server process, and that re-enabling the app should be required to connect to a new ExApp server.

I don't expect Talk to trust an arbitrary new ExApp instance.

My expectation is that a normal restart of the same registered ExApp should not invalidate its authentication state. Restarting a container is a routine operation in containerized environments (for example, after updating Docker or following a host machine reboot), and requiring manual re-enablement after every restart makes updates and recovery unnecessarily difficult.

Is this behavior intentional?

[edward-ly]

This is a question that I'll have to defer to one of the Talk app maintainers, most likely, as I'm not entirely sure how the Talk app handles ExApp bots. I'll transfer this issue over there now.

[nickvergessen]

I'm not entirely sure how the Talk app handles ExApp bots

We don't. We fire webhooks to set URLs and will accept inbound messages from defined bots signed as a checksum with the configured secret. I don't have a local setup of ExApps, so can't debug what's going on or where it goes wrong.
Maybe the bot is re-registered on start and using a new/different secret?

@edward-ly can you check with app_api people maybe?

[edward-ly]

Good to know, I'll transfer this to app_api, then. Unfortunately, @oleksandr-nc is on vacation right now, but I'll ask if someone else has an answer in the meantime.

[edward-ly]

So we now figured out this is a bug affecting the Python library for NC 34 and above. A fix is already in progress and it will hopefully be available in a future update.