fix(security): gate slash/control commands

src/telegram/bot-message-context.ts

@@ -1,4 +1,5 @@
-// @ts-nocheck
+import type { Bot } from "grammy";
+
 import { resolveAckReaction } from "../agents/identity.js";
 import { hasControlCommand } from "../auto-reply/command-detection.js";
 import { normalizeCommandBody } from "../auto-reply/commands-registry.js";
@@ -6,15 +7,19 @@ import { formatInboundEnvelope } from "../auto-reply/envelope.js";
 import {
   buildPendingHistoryContextFromMap,
   recordPendingHistoryEntry,
+  type HistoryEntry,
 } from "../auto-reply/reply/history.js";
 import { finalizeInboundContext } from "../auto-reply/reply/inbound-context.js";
 import { buildMentionRegexes, matchesMentionPatterns } from "../auto-reply/reply/mentions.js";
 import { formatLocationText, toLocationContext } from "../channels/location.js";
 import { resolveStorePath, updateLastRoute } from "../config/sessions.js";
+import type { ClawdbotConfig } from "../config/config.js";
+import type { DmPolicy, TelegramGroupConfig, TelegramTopicConfig } from "../config/types.js";
 import { logVerbose, shouldLogVerbose } from "../globals.js";
 import { recordChannelActivity } from "../infra/channel-activity.js";
 import { resolveAgentRoute } from "../routing/resolve-route.js";
 import { resolveMentionGating } from "../channels/mention-gating.js";
+import { resolveCommandAuthorizedFromAuthorizers } from "../channels/command-gating.js";
 import {
   buildGroupLabel,
   buildSenderLabel,
@@ -29,6 +34,52 @@ import {
 } from "./bot/helpers.js";
 import { firstDefined, isSenderAllowed, normalizeAllowFrom } from "./bot-access.js";
 import { upsertTelegramPairingRequest } from "./pairing-store.js";
+import type { TelegramContext } from "./bot/types.js";
+
+type TelegramMediaRef = { path: string; contentType?: string };
+
+type TelegramMessageContextOptions = {
+  forceWasMentioned?: boolean;
+  messageIdOverride?: string;
+};
+
+type TelegramLogger = {
+  info: (obj: Record<string, unknown>, msg: string) => void;
+};
+
+type ResolveTelegramGroupConfig = (
+  chatId: string | number,
+  messageThreadId?: number,
+) => { groupConfig?: TelegramGroupConfig; topicConfig?: TelegramTopicConfig };
+
+type ResolveGroupActivation = (params: {
+  chatId: string | number;
+  agentId?: string;
+  messageThreadId?: number;
+  sessionKey?: string;
+}) => boolean | undefined;
+
+type ResolveGroupRequireMention = (chatId: string | number) => boolean;
+
+type BuildTelegramMessageContextParams = {
+  primaryCtx: TelegramContext;
+  allMedia: TelegramMediaRef[];
+  storeAllowFrom: string[];
+  options?: TelegramMessageContextOptions;
+  bot: Bot;
+  cfg: ClawdbotConfig;
+  account: { accountId: string };
+  historyLimit: number;
+  groupHistories: Map<string, HistoryEntry[]>;
+  dmPolicy: DmPolicy;
+  allowFrom?: Array<string | number>;
+  groupAllowFrom?: Array<string | number>;
+  ackReactionScope: "off" | "group-mentions" | "group-all" | "direct" | "all";
+  logger: TelegramLogger;
+  resolveGroupActivation: ResolveGroupActivation;
+  resolveGroupRequireMention: ResolveGroupRequireMention;
+  resolveTelegramGroupConfig: ResolveTelegramGroupConfig;
+};
 
 export const buildTelegramMessageContext = async ({
   primaryCtx,
@@ -48,7 +99,7 @@ export const buildTelegramMessageContext = async ({
   resolveGroupActivation,
   resolveGroupRequireMention,
   resolveTelegramGroupConfig,
-}) => {
+}: BuildTelegramMessageContextParams) => {
   const msg = primaryCtx.message;
   recordChannelActivity({
     channel: "telegram",
@@ -205,8 +256,10 @@ export const buildTelegramMessageContext = async ({
     senderUsername,
   });
   const useAccessGroups = cfg.commands?.useAccessGroups !== false;
-  const commandAuthorized =
-    useAccessGroups && !allowForCommands.hasEntries ? false : senderAllowedForCommands;
+  const commandAuthorized = resolveCommandAuthorizedFromAuthorizers({
+    useAccessGroups,
+    authorizers: [{ configured: allowForCommands.hasEntries, allowed: senderAllowedForCommands }],
+  });
   const historyKey = isGroup ? buildTelegramGroupPeerId(chatId, resolvedThreadId) : undefined;
 
   let placeholder = "";
@@ -227,7 +280,7 @@ export const buildTelegramMessageContext = async ({
     bodyText = `<media:image>${allMedia.length > 1 ? ` (${allMedia.length} images)` : ""}`;
   }
   const computedWasMentioned =
-    (Boolean(botUsername) && hasBotMention(msg, botUsername)) ||
+    (botUsername ? hasBotMention(msg, botUsername) : false) ||
     matchesMentionPatterns(msg.text ?? msg.caption ?? "", mentionRegexes);
   const wasMentioned = options?.forceWasMentioned === true ? true : computedWasMentioned;
   const hasAnyMention = (msg.entities ?? msg.caption_entities ?? []).some(