index.ts

import { parse } from 'node-html-parser'

const SECURITY_PAGE = 'https://support.apple.com/en-us/HT201222'
const STRING = /exploited/

const serve = async (req: Request) => {
  if (!req.body) return new Response('no body')

  const data = await req.json()

  // Something about us changed
  if (data?.my_chat_member) {
    const myInfo = data.my_chat_member
    const chatId = myInfo.chat.id as number
    const newStatus = myInfo.new_chat_member.status

    const addedStatuses = ['creator', 'administrator', 'member']
    const removedStatuses = ['restricted', 'left', 'kicked']

    const kv = await Deno.openKv()

    // We are added
    if (addedStatuses.includes(newStatus)) {
      console.log(`adding ${chatId} to chats`)

      const chatsCache = await kv.get<string>(['chats'])
      const chats = chatsCache.value ?? '[]'
      const chatsParsed = JSON.parse(chats) as number[]

      const newChats = [...chatsParsed, chatId]

      await kv.set(['chats'], JSON.stringify(newChats))
    } // We are removed
    else if (removedStatuses.includes(newStatus)) {
      console.log(`removing ${chatId} from chats`)

      const chats = (await kv.get<string>(['chats'])).value
      if (!chats) return new Response('no chats yet')
      const chatsParsed = JSON.parse(chats) as number[]

      const chatsFiltered = chatsParsed.filter(
        (existingId) => existingId !== chatId,
      )

      await kv.set(['chats'], JSON.stringify(chatsFiltered))
    }
  }

  return new Response('done')
}

const cron = async () => {
  const TOKEN = Deno.env.get('TOKEN')
  if (!TOKEN) {
    console.error('Telegram bot token is missing')
    return
  }
  const BOT = `https://api.telegram.org/bot${TOKEN}`

  const kv = await Deno.openKv()

  const chats = (await kv.get<string>(['chats'])).value
  if (!chats) {
    console.error('no chats yet, exiting')
    return
  }
  const chatsParsed = JSON.parse(chats) as number[]

  const sendMessage = async (
    text: string,
    options?: { [key: string]: unknown },
  ) => {
    for (const chat of chatsParsed) {
      const body = {
        chat_id: chat,
        text,
        ...options,
      }

      const req = await fetch(`${BOT}/sendMessage`, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
        },
        body: JSON.stringify(body),
      })

      if (!req.ok) {
        console.log(await req.json())
      }
    }
  }

  const req = await fetch(SECURITY_PAGE)
  const res = await req.text()

  if (!req.ok) {
    console.error('failed to load main support page')
    console.log(res)
    return
  }

  const parsed = parse(res)

  const rows = parsed.querySelectorAll('tr').slice(1) // without heading row

  // Rows: name with optional link - description - date
  for (const row of rows.slice(0, 10)) {
    const link = row.querySelector('a')
    const [name, descr, date] = row
      .querySelectorAll('td')
      // biome-ignore lint: must have a child per html markup
      .map((x) => x.firstChild!.innerText)

    if (link) {
      const href = link.attributes.href.toString()

      const isProcessed = (await kv.get([href])).value
      if (isProcessed) continue

      // biome-ignore lint: trust me, this is nicer
      const fullLink = 'https://support.apple.com' + href

      const req = await fetch(fullLink)
      const res = await req.text()

      if (!req.ok) {
        console.error('failed to load individual support page')
        console.log(res)
        return
      }

      const isExploited = STRING.test(res)

      if (isExploited) {
        await sendMessage(
          [
            'Update with a fix for an actively exploited vuln(s):',
            name,
            '', // spacer
            'For:',
            descr,
            '', // spacer
            'Released:',
            date,
            '', // spacer
            `<a href="${fullLink}">Security Document</a>`,
          ].join('\n'),
          { parse_mode: 'HTML' },
        )
      }

      await kv.set([href], 'done')
    }
  }
}

Deno.serve(serve)
Deno.cron('cron', '*/15 * * * *', cron)