feat: directly add customer service friend

internal/imclient/client.go

@@ -107,6 +107,11 @@ type Conversation struct {
 	CanSend      bool   `json:"can_send"`
 }
 
+type DirectFriendResult struct {
+	Relationship string `json:"relationship"`
+	Topic        string `json:"topic"`
+}
+
 func New(cfg config.IMConfig) *Client {
 	timeout := cfg.Timeout
 	if timeout <= 0 {
@@ -229,6 +234,18 @@ func (c *Client) CreateFriendRequest(ctx context.Context, token, userID, idempot
 	return &out, err
 }
 
+// AddFriendDirect establishes a trusted server-side friendship without
+// creating a user-visible friend request. The IM internal API authenticates
+// this operation with the configured internal secret.
+func (c *Client) AddFriendDirect(ctx context.Context, userID, peerUserID string) (*DirectFriendResult, error) {
+	var out DirectFriendResult
+	path := "/internal/admin-query/tenants/" + url.PathEscape(c.cfg.TenantCode) + "/friends/direct"
+	err := c.internalJSON(ctx, http.MethodPost, path, map[string]any{
+		"user_id": userID, "peer_user_id": peerUserID,
+	}, &out)
+	return &out, err
+}
+
 func (c *Client) EnsureP2P(ctx context.Context, token, userID, idempotencyKey string) (*Conversation, error) {
 	var out Conversation
 	err := c.productJSON(ctx, http.MethodPost, "/conversations/p2p", token, idempotencyKey,

internal/imclient/client_test.go

@@ -52,6 +52,46 @@ func TestCreateUserAcceptsNumericIDAndSignsRequest(t *testing.T) {
 	}
 }
 
+func TestAddFriendDirectUsesSignedInternalAPI(t *testing.T) {
+	const secret = "internal-secret"
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		if r.Method != http.MethodPost || r.URL.Path != "/internal/admin-query/tenants/default/friends/direct" {
+			t.Fatalf("unexpected request %s %s", r.Method, r.URL.Path)
+		}
+		if r.Header.Get("X-Service-Name") != "olons-server" {
+			t.Fatal("missing service header")
+		}
+		canonical := strings.Join([]string{r.Method, r.URL.RequestURI(), hashHex(body),
+			r.Header.Get("X-Timestamp"), r.Header.Get("X-Nonce")}, "\n")
+		mac := hmac.New(sha256.New, []byte(secret))
+		_, _ = mac.Write([]byte(canonical))
+		if r.Header.Get("X-Signature") != hex.EncodeToString(mac.Sum(nil)) {
+			t.Fatal("invalid signature")
+		}
+		var payload map[string]string
+		if err := json.Unmarshal(body, &payload); err != nil {
+			t.Fatal(err)
+		}
+		if payload["user_id"] != "usr_member" || payload["peer_user_id"] != "usr_agent" {
+			t.Fatalf("unexpected direct friendship payload: %+v", payload)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"code":0,"data":{"relationship":"friend","topic":"p2pAB"}}`))
+	}))
+	defer server.Close()
+
+	client := New(config.IMConfig{BaseURL: server.URL, TenantCode: "default",
+		InternalService: "olons-server", InternalSecret: secret, Timeout: time.Second})
+	result, err := client.AddFriendDirect(context.Background(), "usr_member", "usr_agent")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Relationship != "friend" || result.Topic != "p2pAB" {
+		t.Fatalf("unexpected direct friendship result: %+v", result)
+	}
+}
+
 func TestProductRequestHeaders(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Header.Get("Authorization") != "Bearer user-token" || r.Header.Get("X-MeetingIM-APIKey") != "public-key" {