github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-10 13:44:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): centralize dm/group allowlist auth composition

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-26 16:35:18 +01:00
parent 7f863e22b0
commit 051fdcc428
8 changed files with 428 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files

97
src/imessage/monitor/inbound-processing.ts
View File

@@ -20,7 +20,7 @@ import {
resolveChannelGroupRequireMention,
} from "../../config/group-policy.js";
import { resolveAgentRoute } from "../../routing/resolve-route.js";
import { resolveEffectiveAllowFromLists } from "../../security/dm-policy-shared.js";
import { resolveDmGroupAccessWithLists } from "../../security/dm-policy-shared.js";
import { truncateUtf16Safe } from "../../utils.js";
import {
formatIMessageChatTarget,
@@ -139,72 +139,61 @@ export function resolveIMessageInboundDecision(params: {
}
const groupId = isGroup ? groupIdCandidate : undefined;
const { effectiveAllowFrom: effectiveDmAllowFrom, effectiveGroupAllowFrom } =
resolveEffectiveAllowFromLists({
allowFrom: params.allowFrom,
groupAllowFrom: params.groupAllowFrom,
storeAllowFrom: params.storeAllowFrom,
dmPolicy: params.dmPolicy,
groupAllowFromFallbackToAllowFrom: false,
});
const accessDecision = resolveDmGroupAccessWithLists({
isGroup,
dmPolicy: params.dmPolicy,
groupPolicy: params.groupPolicy,
allowFrom: params.allowFrom,
groupAllowFrom: params.groupAllowFrom,
storeAllowFrom: params.storeAllowFrom,
groupAllowFromFallbackToAllowFrom: false,
isSenderAllowed: (allowFrom) =>
isAllowedIMessageSender({
allowFrom,
sender,
chatId,
chatGuid,
chatIdentifier,
}),
});
const effectiveDmAllowFrom = accessDecision.effectiveAllowFrom;
const effectiveGroupAllowFrom = accessDecision.effectiveGroupAllowFrom;
const dmAuthorized = !isGroup && accessDecision.decision === "allow";
if (isGroup) {
if (params.groupPolicy === "disabled") {
params.logVerbose?.("Blocked iMessage group message (groupPolicy: disabled)");
return { kind: "drop", reason: "groupPolicy disabled" };
}
if (params.groupPolicy === "allowlist") {
if (effectiveGroupAllowFrom.length === 0) {
if (accessDecision.decision !== "allow") {
if (isGroup) {
if (accessDecision.reason === "groupPolicy=disabled") {
params.logVerbose?.("Blocked iMessage group message (groupPolicy: disabled)");
return { kind: "drop", reason: "groupPolicy disabled" };
}
if (accessDecision.reason === "groupPolicy=allowlist (empty allowlist)") {
params.logVerbose?.(
"Blocked iMessage group message (groupPolicy: allowlist, no groupAllowFrom)",
);
return { kind: "drop", reason: "groupPolicy allowlist (empty groupAllowFrom)" };
}
const allowed = isAllowedIMessageSender({
allowFrom: effectiveGroupAllowFrom,
sender,
chatId,
chatGuid,
chatIdentifier,
});
if (!allowed) {
if (accessDecision.reason === "groupPolicy=allowlist (not allowlisted)") {
params.logVerbose?.(`Blocked iMessage sender ${sender} (not in groupAllowFrom)`);
return { kind: "drop", reason: "not in groupAllowFrom" };
}
params.logVerbose?.(`Blocked iMessage group message (${accessDecision.reason})`);
return { kind: "drop", reason: accessDecision.reason };
}
if (groupListPolicy.allowlistEnabled && !groupListPolicy.allowed) {
params.logVerbose?.(
`imessage: skipping group message (${groupId ?? "unknown"}) not in allowlist`,
);
return { kind: "drop", reason: "group id not in allowlist" };
}
}
const dmHasWildcard = effectiveDmAllowFrom.includes("*");
const dmAuthorized =
params.dmPolicy === "open"
? true
: dmHasWildcard ||
(effectiveDmAllowFrom.length > 0 &&
isAllowedIMessageSender({
allowFrom: effectiveDmAllowFrom,
sender,
chatId,
chatGuid,
chatIdentifier,
}));
if (!isGroup) {
if (params.dmPolicy === "disabled") {
if (accessDecision.reason === "dmPolicy=disabled") {
return { kind: "drop", reason: "dmPolicy disabled" };
}
if (!dmAuthorized) {
if (params.dmPolicy === "pairing") {
return { kind: "pairing", senderId: senderNormalized };
}
params.logVerbose?.(`Blocked iMessage sender ${sender} (dmPolicy=${params.dmPolicy})`);
return { kind: "drop", reason: "dmPolicy blocked" };
if (accessDecision.decision === "pairing") {
return { kind: "pairing", senderId: senderNormalized };
}
params.logVerbose?.(`Blocked iMessage sender ${sender} (dmPolicy=${params.dmPolicy})`);
return { kind: "drop", reason: "dmPolicy blocked" };
}
if (isGroup && groupListPolicy.allowlistEnabled && !groupListPolicy.allowed) {
params.logVerbose?.(
`imessage: skipping group message (${groupId ?? "unknown"}) not in allowlist`,
);
return { kind: "drop", reason: "group id not in allowlist" };
}
const route = resolveAgentRoute({