mautrix-lovoo

An experimental Lovoo-to-Matrix bridge using the mautrix bridgev2 framework.

The bridge imports an existing Lovoo browser session, discovers the current Next.js server actions, synchronizes conversations into Matrix portals, and sends plain-text Matrix messages to Lovoo. Other Lovoo mutations are intentionally disabled.

Status

The local protocol, credential encryption, connector, and polling implementation are under active development. Do not deploy this repository to production until live protocol verification and deployment approval are complete.

Build

The Matrix SDK's pure-Go crypto backend is selected with the goolm build tag:

go test -tags=goolm ./... -race -count=1
go build -tags=goolm ./cmd/mautrix-lovoo

The repository also provides isolated devcontainer recipes:

just test
just lint
just build
just check

Configuration

Generate a standard mautrix configuration and registration with the binary's -g mode, then configure the network section:

network:
  page_url: https://app.lovoo.com/chats
  poll_interval: 15s

Set LOVOO_CREDENTIAL_KEY to 32 random bytes encoded as base64. The key encrypts imported browser-session metadata before database storage.

openssl rand -base64 32

Provide the generated value through your secret manager. Never commit it to .env, configuration, fixtures, or source control.

Login

Start the bridge's browser-session login flow in a private, unfederated management room. In a browser where Lovoo is already signed in:

1. Open Developer Tools > Network and load https://app.lovoo.com/chats.
2. Select any request whose URL is exactly https://app.lovoo.com/chats.
3. Choose Copy > Copy as cURL (bash).
4. Paste the complete cURL into the bot's single login field.

The bridge parses the command as text and never executes it. It accepts only a request targeting HTTPS app.lovoo.com/chats, extracts the session cookie, retrieves the current CSRF token with its own authenticated read-only page request, and derives the stable Lovoo user ID from the returned conversations before storing encrypted credentials.

Security Boundaries

• Matrix-to-Lovoo writes are limited to plain-text messages in existing conversations.
• Credential-bearing requests are restricted to HTTPS app.lovoo.com.
• Imported cURL text is size-bounded, cannot reference local files, and is never passed to a shell.
• Cross-origin redirects and cross-origin action bundles are rejected.
• Response sizes are bounded and remote bodies are excluded from errors.
• Action IDs are discovered dynamically and are not persisted as secrets.

Limitations

• Synchronization currently uses polling rather than Lovoo's realtime WebSocket transport.
• Conversation, text, image, and voice-message data observed in sanitized fixtures are parsed.
• The account needs at least one conversation so its stable Lovoo user ID can be derived without trusting manual identity input.
• A live Lovoo session is required for end-to-end verification.