fix: harden discord and slack reaction ingress authorization

src/slack/monitor/events/reactions.test.ts

@@ -0,0 +1,163 @@
+import { describe, expect, it, vi } from "vitest";
+import type { SlackMonitorContext } from "../context.js";
+import { registerSlackReactionEvents } from "./reactions.js";
+
+const enqueueSystemEventMock = vi.fn();
+const readAllowFromStoreMock = vi.fn();
+
+vi.mock("../../../infra/system-events.js", () => ({
+  enqueueSystemEvent: (...args: unknown[]) => enqueueSystemEventMock(...args),
+}));
+
+vi.mock("../../../pairing/pairing-store.js", () => ({
+  readChannelAllowFromStore: (...args: unknown[]) => readAllowFromStoreMock(...args),
+}));
+
+type SlackReactionHandler = (args: {
+  event: Record<string, unknown>;
+  body: unknown;
+}) => Promise<void>;
+
+function createReactionContext(overrides?: {
+  dmPolicy?: "open" | "pairing" | "allowlist" | "disabled";
+  allowFrom?: string[];
+  channelType?: "im" | "channel";
+}) {
+  let addedHandler: SlackReactionHandler | null = null;
+  let removedHandler: SlackReactionHandler | null = null;
+  const channelType = overrides?.channelType ?? "im";
+  const app = {
+    event: vi.fn((name: string, handler: SlackReactionHandler) => {
+      if (name === "reaction_added") {
+        addedHandler = handler;
+      } else if (name === "reaction_removed") {
+        removedHandler = handler;
+      }
+    }),
+  };
+  const ctx = {
+    app,
+    runtime: { error: vi.fn() },
+    dmPolicy: overrides?.dmPolicy ?? "open",
+    groupPolicy: "open",
+    allowFrom: overrides?.allowFrom ?? [],
+    allowNameMatching: false,
+    shouldDropMismatchedSlackEvent: vi.fn().mockReturnValue(false),
+    isChannelAllowed: vi.fn().mockReturnValue(true),
+    resolveChannelName: vi.fn().mockResolvedValue({
+      name: channelType === "im" ? "direct" : "general",
+      type: channelType,
+    }),
+    resolveUserName: vi.fn().mockResolvedValue({ name: "alice" }),
+    resolveSlackSystemEventSessionKey: vi.fn().mockReturnValue("agent:main:main"),
+  } as unknown as SlackMonitorContext;
+  registerSlackReactionEvents({ ctx });
+  return {
+    ctx,
+    getAddedHandler: () => addedHandler,
+    getRemovedHandler: () => removedHandler,
+  };
+}
+
+function makeReactionEvent(overrides?: { user?: string; channel?: string }) {
+  return {
+    type: "reaction_added",
+    user: overrides?.user ?? "U1",
+    reaction: "thumbsup",
+    item: {
+      type: "message",
+      channel: overrides?.channel ?? "D1",
+      ts: "123.456",
+    },
+    item_user: "UBOT",
+  };
+}
+
+describe("registerSlackReactionEvents", () => {
+  it("enqueues DM reaction system events when dmPolicy is open", async () => {
+    enqueueSystemEventMock.mockClear();
+    readAllowFromStoreMock.mockReset().mockResolvedValue([]);
+    const { getAddedHandler } = createReactionContext({ dmPolicy: "open" });
+    const addedHandler = getAddedHandler();
+    expect(addedHandler).toBeTruthy();
+
+    await addedHandler!({
+      event: makeReactionEvent(),
+      body: {},
+    });
+
+    expect(enqueueSystemEventMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("blocks DM reaction system events when dmPolicy is disabled", async () => {
+    enqueueSystemEventMock.mockClear();
+    readAllowFromStoreMock.mockReset().mockResolvedValue([]);
+    const { getAddedHandler } = createReactionContext({ dmPolicy: "disabled" });
+    const addedHandler = getAddedHandler();
+    expect(addedHandler).toBeTruthy();
+
+    await addedHandler!({
+      event: makeReactionEvent(),
+      body: {},
+    });
+
+    expect(enqueueSystemEventMock).not.toHaveBeenCalled();
+  });
+
+  it("blocks DM reaction system events for unauthorized senders in allowlist mode", async () => {
+    enqueueSystemEventMock.mockClear();
+    readAllowFromStoreMock.mockReset().mockResolvedValue([]);
+    const { getAddedHandler } = createReactionContext({
+      dmPolicy: "allowlist",
+      allowFrom: ["U2"],
+    });
+    const addedHandler = getAddedHandler();
+    expect(addedHandler).toBeTruthy();
+
+    await addedHandler!({
+      event: makeReactionEvent({ user: "U1" }),
+      body: {},
+    });
+
+    expect(enqueueSystemEventMock).not.toHaveBeenCalled();
+  });
+
+  it("allows DM reaction system events for authorized senders in allowlist mode", async () => {
+    enqueueSystemEventMock.mockClear();
+    readAllowFromStoreMock.mockReset().mockResolvedValue([]);
+    const { getAddedHandler } = createReactionContext({
+      dmPolicy: "allowlist",
+      allowFrom: ["U1"],
+    });
+    const addedHandler = getAddedHandler();
+    expect(addedHandler).toBeTruthy();
+
+    await addedHandler!({
+      event: makeReactionEvent({ user: "U1" }),
+      body: {},
+    });
+
+    expect(enqueueSystemEventMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("enqueues channel reaction events regardless of dmPolicy", async () => {
+    enqueueSystemEventMock.mockClear();
+    readAllowFromStoreMock.mockReset().mockResolvedValue([]);
+    const { getRemovedHandler } = createReactionContext({
+      dmPolicy: "disabled",
+      channelType: "channel",
+    });
+    const removedHandler = getRemovedHandler();
+    expect(removedHandler).toBeTruthy();
+
+    await removedHandler!({
+      event: {
+        ...makeReactionEvent({ channel: "C1" }),
+        type: "reaction_removed",
+      },
+      body: {},
+    });
+
+    expect(enqueueSystemEventMock).toHaveBeenCalledTimes(1);
+  });
+});

src/slack/monitor/events/reactions.ts

@@ -1,6 +1,9 @@
 import type { SlackEventMiddlewareArgs } from "@slack/bolt";
-import { danger } from "../../../globals.js";
+import { danger, logVerbose } from "../../../globals.js";
 import { enqueueSystemEvent } from "../../../infra/system-events.js";
+import { resolveDmGroupAccessWithLists } from "../../../security/dm-policy-shared.js";
+import { resolveSlackAllowListMatch } from "../allow-list.js";
+import { resolveSlackEffectiveAllowFrom } from "../auth.js";
 import { resolveSlackChannelLabel } from "../channel-config.js";
 import type { SlackMonitorContext } from "../context.js";
 import type { SlackReactionEvent } from "../types.js";
@@ -32,6 +35,33 @@ export function registerSlackReactionEvents(params: { ctx: SlackMonitorContext }
         channelName: channelInfo?.name,
       });
       const actorInfo = event.user ? await ctx.resolveUserName(event.user) : undefined;
+      if (channelType === "im") {
+        if (!event.user) {
+          return;
+        }
+        const { allowFromLower } = await resolveSlackEffectiveAllowFrom(ctx);
+        const access = resolveDmGroupAccessWithLists({
+          isGroup: false,
+          dmPolicy: ctx.dmPolicy,
+          groupPolicy: ctx.groupPolicy,
+          allowFrom: allowFromLower,
+          groupAllowFrom: [],
+          storeAllowFrom: [],
+          isSenderAllowed: (allowList) =>
+            resolveSlackAllowListMatch({
+              allowList,
+              id: event.user,
+              name: actorInfo?.name,
+              allowNameMatching: ctx.allowNameMatching,
+            }).allowed,
+        });
+        if (access.decision !== "allow") {
+          logVerbose(
+            `slack: drop reaction sender ${event.user} (dmPolicy=${ctx.dmPolicy}, decision=${access.decision}, reason=${access.reason})`,
+          );
+          return;
+        }
+      }
       const actorLabel = actorInfo?.name ?? event.user;
       const emojiLabel = event.reaction ?? "emoji";
       const authorInfo = event.item_user ? await ctx.resolveUserName(event.item_user) : undefined;