github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-07 02:51:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(approvals): gate /approve by gateway scopes

Browse Source
This commit is contained in:
Armin Ronacher
2026-02-02 11:51:42 +01:00
committed by Peter Steinberger
parent 66d8117d44
commit efe2a464af
4 changed files with 41 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/auto-reply/reply/commands-approve.ts
View File

@@ -1,7 +1,11 @@
import type { CommandHandler } from "./commands-types.js";
import { callGateway } from "../../gateway/call.js";
import { logVerbose } from "../../globals.js";
import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES } from "../../utils/message-channel.js";
import {
GATEWAY_CLIENT_MODES,
GATEWAY_CLIENT_NAMES,
isInternalMessageChannel,
} from "../../utils/message-channel.js";
const COMMAND = "/approve";
@@ -82,6 +86,20 @@ export const handleApproveCommand: CommandHandler = async (params, allowTextComm
return { shouldContinue: false, reply: { text: parsed.error } };
}
if (isInternalMessageChannel(params.command.channel)) {
const scopes = params.ctx.GatewayClientScopes ?? [];
const hasApprovals = scopes.includes("operator.approvals") || scopes.includes("operator.admin");
if (!hasApprovals) {
logVerbose("Ignoring /approve from gateway client missing operator.approvals.");
return {
shouldContinue: false,
reply: {
text: "❌ /approve requires operator.approvals for gateway clients.",
},
};
}
}
const resolvedBy = buildResolvedByLabel(params);
try {
await callGateway({