github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-09 18:54:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(security): share DM allowlist state resolver

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-18 23:58:11 +00:00
parent 2709c0ba51
commit 5c5c032f42
4 changed files with 83 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/security/audit-channel.ts
View File

@@ -11,6 +11,7 @@ import type { OpenClawConfig } from "../config/config.js";
import { readChannelAllowFromStore } from "../pairing/pairing-store.js";
import { normalizeStringEntries } from "../shared/string-normalization.js";
import type { SecurityAuditFinding, SecurityAuditSeverity } from "./audit.js";
import { resolveDmAllowState } from "./dm-policy-shared.js";
function normalizeAllowFromList(list: Array<string | number> | undefined | null): string[] {
return normalizeStringEntries(Array.isArray(list) ? list : undefined);
@@ -63,22 +64,12 @@ export async function collectChannelSecurityFindings(params: {
normalizeEntry?: (raw: string) => string;
}) => {
const policyPath = input.policyPath ?? `${input.allowFromPath}policy`;
const configAllowFrom = normalizeAllowFromList(input.allowFrom);
const hasWildcard = configAllowFrom.includes("*");
const { hasWildcard, isMultiUserDm } = await resolveDmAllowState({
provider: input.provider,
allowFrom: input.allowFrom,
normalizeEntry: input.normalizeEntry,
});
const dmScope = params.cfg.session?.dmScope ?? "main";
const storeAllowFrom = await readChannelAllowFromStore(input.provider).catch(() => []);
const normalizeEntry = input.normalizeEntry ?? ((value: string) => value);
const normalizedCfg = configAllowFrom
.filter((value) => value !== "*")
.map((value) => normalizeEntry(value))
.map((value) => value.trim())
.filter(Boolean);
const normalizedStore = storeAllowFrom
.map((value) => normalizeEntry(value))
.map((value) => value.trim())
.filter(Boolean);
const allowCount = Array.from(new Set([...normalizedCfg, ...normalizedStore])).length;
const isMultiUserDm = hasWildcard || allowCount > 1;
if (input.dmPolicy === "open") {
const allowFromKey = `${input.allowFromPath}allowFrom`;