github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-10 18:04:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(security): centralize channel allowlist auth policy

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-26 13:06:27 +01:00
parent eac86c2081
commit 892a9c24b0
12 changed files with 137 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/imessage/monitor/inbound-processing.ts
View File

@@ -20,6 +20,7 @@ import {
resolveChannelGroupRequireMention,
} from "../../config/group-policy.js";
import { resolveAgentRoute } from "../../routing/resolve-route.js";
import { resolveEffectiveAllowFromLists } from "../../security/dm-policy-shared.js";
import { truncateUtf16Safe } from "../../utils.js";
import {
formatIMessageChatTarget,
@@ -138,14 +139,14 @@ export function resolveIMessageInboundDecision(params: {
}
const groupId = isGroup ? groupIdCandidate : undefined;
const storeAllowFrom = params.dmPolicy === "allowlist" ? [] : params.storeAllowFrom;
const effectiveDmAllowFrom = Array.from(new Set([...params.allowFrom, ...storeAllowFrom]))
.map((v) => String(v).trim())
.filter(Boolean);
// Keep DM pairing-store authorization scoped to DMs; group access must come from explicit group allowlist config.
const effectiveGroupAllowFrom = Array.from(new Set(params.groupAllowFrom))
.map((v) => String(v).trim())
.filter(Boolean);
const { effectiveAllowFrom: effectiveDmAllowFrom, effectiveGroupAllowFrom } =
resolveEffectiveAllowFromLists({
allowFrom: params.allowFrom,
groupAllowFrom: params.groupAllowFrom,
storeAllowFrom: params.storeAllowFrom,
dmPolicy: params.dmPolicy,
groupAllowFromFallbackToAllowFrom: false,
});
if (isGroup) {
if (params.groupPolicy === "disabled") {