import { resolveMattermostOutboundSessionRoute } from "./session-route.js";

import { mattermostSetupAdapter } from "./setup-core.js";

import { mattermostSetupWizard } from "./setup-surface.js";

import { collectMattermostStatusIssues } from "./status-issues.js";

import type { MattermostConfig } from "./types.js";

const loadMattermostChannelRuntime = createLazyRuntimeModule(() => import("./channel.runtime.js"));

lastConnectedAt: null,

lastDisconnect: null,

}),

collectStatusIssues: collectMattermostStatusIssues,

buildChannelSummary: ({ snapshot }) =>

buildPassiveProbedChannelStatusSummary(snapshot, {

botTokenSource: snapshot.botTokenSource ?? "none",

extra: {

botTokenSource: account.botTokenSource,

baseUrl: account.baseUrl,

dmPolicy: account.config.dmPolicy ?? "pairing",

allowFrom: account.config.allowFrom ?? [],

connected: runtime?.connected ?? false,

lastConnectedAt: runtime?.lastConnectedAt ?? null,

lastDisconnect: runtime?.lastDisconnect ?? null,

expect(result.success).toBe(true);

});

it('rejects dmPolicy="open" without wildcard allowFrom', () => {

const result = MattermostConfigSchema.safeParse({

dmPolicy: "open",

});

expect(result.success).toBe(false);

});

it('accepts dmPolicy="open" with wildcard allowFrom', () => {

const result = MattermostConfigSchema.safeParse({

dmPolicy: "open",

allowFrom: ["*"],

});

expect(result.success).toBe(true);

});

it("accepts documented streaming modes and progress config", () => {

const result = MattermostConfigSchema.safeParse({

streaming: {

describe("mattermost monitor auth", () => {

let authorizeMattermostCommandInvocation: typeof import("./monitor-auth.js").authorizeMattermostCommandInvocation;

let formatMattermostDirectMessageDropLog: typeof import("./monitor-auth.js").formatMattermostDirectMessageDropLog;

let isMattermostSenderAllowed: typeof import("./monitor-auth.js").isMattermostSenderAllowed;

let normalizeMattermostAllowEntry: typeof import("./monitor-auth.js").normalizeMattermostAllowEntry;

let normalizeMattermostAllowList: typeof import("./monitor-auth.js").normalizeMattermostAllowList;

beforeAll(async () => {

({

authorizeMattermostCommandInvocation,

formatMattermostDirectMessageDropLog,

isMattermostSenderAllowed,

normalizeMattermostAllowEntry,

normalizeMattermostAllowList,

});

});

it("formats direct-message drops with the ingress reason and open-policy hint", () => {

expect(

formatMattermostDirectMessageDropLog({

senderId: "alice-id",

dmPolicy: "open",

reasonCode: "dm_policy_not_allowlisted",

}),

).toBe(

"mattermost: drop dm sender=alice-id (dmPolicy=open reason=dm_policy_not_allowlisted hint=add-allowFrom-wildcard)",

);

});

it("resolves direct command authorization from shared ingress", async () => {

isDangerousNameMatchingEnabled.mockReturnValue(false);

resolveAllowlistMatchSimple.mockReturnValue({ allowed: false });

return uniqueStrings(normalized);

}

export function formatMattermostDirectMessageDropLog(params: {

senderId: string;

dmPolicy: string;

reasonCode?: string;

}): string {

const reason = params.reasonCode ? ` reason=${params.reasonCode}` : "";

const hint =

params.dmPolicy === "open" && params.reasonCode === "dm_policy_not_allowlisted"

? " hint=add-allowFrom-wildcard"

: "";

return `mattermost: drop dm sender=${params.senderId} (dmPolicy=${params.dmPolicy}${reason}${hint})`;

}

export function isMattermostSenderAllowed(params: {

senderId: string;

senderName?: string;

} from "./model-picker.js";

import {

authorizeMattermostCommandInvocation,

formatMattermostDirectMessageDropLog,

normalizeMattermostAllowEntry,

resolveMattermostMonitorInboundAccess,

} from "./monitor-auth.js";

}

return;

}

logVerboseMessage(`mattermost: drop dm sender=${senderId} (dmPolicy=${dmPolicy})`);

logVerboseMessage(

formatMattermostDirectMessageDropLog({

senderId,

dmPolicy,

reasonCode: accessDecision.senderAccess.reasonCode,

}),

);

return;

}

if (accessDecision.ingress.reasonCode === "group_policy_disabled") {

// Mattermost tests cover status issues plugin behavior.

import { expectOpenDmPolicyConfigIssue } from "openclaw/plugin-sdk/channel-test-helpers";

import { describe, expect, it } from "vitest";

import { collectMattermostStatusIssues } from "./status-issues.js";

describe("collectMattermostStatusIssues", () => {

it("warns when dmPolicy is open without a wildcard allowlist", () => {

expectOpenDmPolicyConfigIssue({

collectIssues: collectMattermostStatusIssues,

account: {

accountId: "default",

enabled: true,

configured: true,

dmPolicy: "open",

},

});

});

it("allows open dmPolicy when allowFrom includes the wildcard", () => {

expect(

collectMattermostStatusIssues([

{

accountId: "default",

enabled: true,

configured: true,

dmPolicy: "open",

allowFrom: ["*"],

},

]),

).toEqual([]);

});

});

// Mattermost plugin module implements status issue collection.

import type {

ChannelAccountSnapshot,

ChannelStatusIssue,

} from "openclaw/plugin-sdk/channel-contract";

import {

coerceStatusIssueAccountId,

readStatusIssueFields,

} from "openclaw/plugin-sdk/extension-shared";

const MATTERMOST_STATUS_FIELDS = [

"accountId",

"enabled",

"configured",

"dmPolicy",

"allowFrom",

] as const;

function hasWildcardAllowFrom(value: unknown): boolean {

return Array.isArray(value) && value.some((entry) => String(entry).trim() === "*");

}

export function collectMattermostStatusIssues(

accounts: ChannelAccountSnapshot[],

): ChannelStatusIssue[] {

const issues: ChannelStatusIssue[] = [];

for (const entry of accounts) {

const account = readStatusIssueFields(entry, MATTERMOST_STATUS_FIELDS);

if (!account) {

continue;

}

const accountId = coerceStatusIssueAccountId(account.accountId) ?? "default";

const enabled = account.enabled !== false;

const configured = account.configured === true;

if (!enabled || !configured) {

continue;

}

if (account.dmPolicy === "open" && !hasWildcardAllowFrom(account.allowFrom)) {

issues.push({

channel: "mattermost",

accountId,

kind: "config",

message:

'Mattermost dmPolicy is "open" but allowFrom does not include "*"; public DMs will be dropped.',

fix: 'Add "*" to channels.mattermost.allowFrom (or the account-specific allowFrom) or set dmPolicy to "pairing"/"allowlist".',

});

}

}

return issues;

}

expect(result.config.channels?.discord?.accounts?.work?.agentComponents?.ttlMs).toBe(60_000);

}

});

it('rejects Mattermost dmPolicy="open" without wildcard allowFrom', () => {

const result = validateConfigObjectWithPlugins({

channels: {

mattermost: {

enabled: true,

baseUrl: "https://chat.example.com",

botToken: "test-token",

dmPolicy: "open",

},

},

});

expect(result.ok).toBe(false);

if (!result.ok) {

expect(result.issues).toContainEqual(

expect.objectContaining({

path: "channels.mattermost.allowFrom",

message: expect.stringContaining(

'channels.mattermost.dmPolicy="open" requires channels.mattermost.allowFrom to include "*"',

),

}),

);

}

});

it('rejects account-scoped Mattermost dmPolicy="open" without wildcard allowFrom', () => {

const result = validateConfigObjectWithPlugins({

channels: {

mattermost: {

accounts: {

work: {

enabled: true,

baseUrl: "https://chat.example.com",

botToken: "test-token",

dmPolicy: "open",

},

},

},

},

});

expect(result.ok).toBe(false);

if (!result.ok) {

expect(result.issues).toContainEqual(

expect.objectContaining({

path: "channels.mattermost.accounts.work.allowFrom",

message: expect.stringContaining(

'channels.mattermost.accounts.work.dmPolicy="open" requires channels.mattermost.accounts.work.allowFrom to include "*"',

),

}),

);

}

});

});

describe("validateConfigObjectRawWithPlugins channel metadata", () => {

function formatRawChannelConfigIssueMessage(message: string): string {

return `invalid config: ${message}`;

}

function hasWildcardAllowFrom(value: unknown): boolean {

return Array.isArray(value) && value.some((entry) => String(entry).trim() === "*");

}

function collectMattermostOpenDmAllowFromIssues(

value: unknown,

pathPrefix: string,

): ConfigValidationIssue[] {

if (!isRecord(value)) {

return [];

}

const issues: ConfigValidationIssue[] = [];

if (value.dmPolicy === "open" && !hasWildcardAllowFrom(value.allowFrom)) {

issues.push({

path: `${pathPrefix}.allowFrom`,

message: formatRawChannelConfigIssueMessage(

`${pathPrefix}.dmPolicy="open" requires ${pathPrefix}.allowFrom to include "*"`,

),

});

}

if (isRecord(value.accounts)) {

for (const [accountId, accountConfig] of Object.entries(value.accounts)) {

if (!isRecord(accountConfig)) {

continue;

}

const accountPath = `${pathPrefix}.accounts.${accountId}`;

if (accountConfig.dmPolicy === "open" && !hasWildcardAllowFrom(accountConfig.allowFrom)) {

issues.push({

path: `${accountPath}.allowFrom`,

message: formatRawChannelConfigIssueMessage(

`${accountPath}.dmPolicy="open" requires ${accountPath}.allowFrom to include "*"`,

),

});

}

}

}

return issues;

}

function collectBundledChannelConfigDependencyIssues(

channelId: string,

value: unknown,

): ConfigValidationIssue[] {

if (channelId === "mattermost") {

return collectMattermostOpenDmAllowFromIssues(value, "channels.mattermost");

}

return [];

}

function collectRawBundledChannelConfigIssues(config: OpenClawConfig): ConfigValidationIssue[] {

if (!config.channels || !isRecord(config.channels)) {

return [];

if (!Object.hasOwn(config.channels, channelId)) {

continue;

}

issues.push(

...collectBundledChannelConfigDependencyIssues(channelId, config.channels[channelId]),

);

const result = validateJsonSchemaValue({

schema: schema as Record<string, unknown>,

cacheKey: `raw-channel:${channelId}`,

}

continue;

}

issues.push(...collectBundledChannelConfigDependencyIssues(trimmed, result.value));

replaceChannelConfig(trimmed, result.value);

}

}