Doctor: keep allowFrom account-scoped in multi-account configs

src/slack/accounts.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, it } from "vitest";
+import { resolveSlackAccount } from "./accounts.js";
+
+describe("resolveSlackAccount allowFrom precedence", () => {
+  it("prefers accounts.default.allowFrom over top-level for default account", () => {
+    const resolved = resolveSlackAccount({
+      cfg: {
+        channels: {
+          slack: {
+            allowFrom: ["top"],
+            accounts: {
+              default: {
+                botToken: "xoxb-default",
+                appToken: "xapp-default",
+                allowFrom: ["default"],
+              },
+            },
+          },
+        },
+      },
+      accountId: "default",
+    });
+
+    expect(resolved.config.allowFrom).toEqual(["default"]);
+  });
+
+  it("falls back to top-level allowFrom for named account without override", () => {
+    const resolved = resolveSlackAccount({
+      cfg: {
+        channels: {
+          slack: {
+            allowFrom: ["top"],
+            accounts: {
+              work: { botToken: "xoxb-work", appToken: "xapp-work" },
+            },
+          },
+        },
+      },
+      accountId: "work",
+    });
+
+    expect(resolved.config.allowFrom).toEqual(["top"]);
+  });
+
+  it("does not inherit default account allowFrom for named account when top-level is absent", () => {
+    const resolved = resolveSlackAccount({
+      cfg: {
+        channels: {
+          slack: {
+            accounts: {
+              default: {
+                botToken: "xoxb-default",
+                appToken: "xapp-default",
+                allowFrom: ["default"],
+              },
+              work: { botToken: "xoxb-work", appToken: "xapp-work" },
+            },
+          },
+        },
+      },
+      accountId: "work",
+    });
+
+    expect(resolved.config.allowFrom).toBeUndefined();
+  });
+
+  it("falls back to top-level dm.allowFrom when allowFrom alias is unset", () => {
+    const resolved = resolveSlackAccount({
+      cfg: {
+        channels: {
+          slack: {
+            dm: { allowFrom: ["U123"] },
+            accounts: {
+              work: { botToken: "xoxb-work", appToken: "xapp-work" },
+            },
+          },
+        },
+      },
+      accountId: "work",
+    });
+
+    expect(resolved.config.allowFrom).toBeUndefined();
+    expect(resolved.config.dm?.allowFrom).toEqual(["U123"]);
+  });
+});