@@ -356,6 +356,88 @@ describe("resolveCommandAuthorization", () => {
356356expect(auth.isAuthorizedSender).toBe(true);
357357});
358358359+it("does not apply channel-prefixed owner wildcards to webchat command contexts", () => {
360+const cfg = {
361+commands: { ownerAllowFrom: ["discord:*"] },
362+} as OpenClawConfig;
363+364+const auth = resolveCommandAuthorization({
365+ctx: {
366+Provider: "webchat",
367+Surface: "webchat",
368+OriginatingChannel: "webchat",
369+SenderId: "123456789012345678",
370+GatewayClientScopes: ["operator.write"],
371+} as MsgContext,
372+ cfg,
373+commandAuthorized: true,
374+});
375+376+expect(auth.providerId).toBeUndefined();
377+expect(auth.senderIsOwner).toBe(false);
378+});
379+380+it("does not apply channel-prefixed owner identities to webchat command contexts", () => {
381+const cfg = {
382+commands: { ownerAllowFrom: ["discord:123456789012345678"] },
383+} as OpenClawConfig;
384+385+const auth = resolveCommandAuthorization({
386+ctx: {
387+Provider: "webchat",
388+Surface: "webchat",
389+OriginatingChannel: "webchat",
390+SenderId: "123456789012345678",
391+GatewayClientScopes: ["operator.write"],
392+} as MsgContext,
393+ cfg,
394+commandAuthorized: true,
395+});
396+397+expect(auth.providerId).toBeUndefined();
398+expect(auth.senderIsOwner).toBe(false);
399+});
400+401+it("applies channel-prefixed owner identities to matching providers", () => {
402+const cfg = {
403+commands: { ownerAllowFrom: ["discord:123456789012345678"] },
404+} as OpenClawConfig;
405+406+const auth = resolveCommandAuthorization({
407+ctx: {
408+Provider: "discord",
409+Surface: "discord",
410+From: "discord:123456789012345678",
411+SenderId: "123456789012345678",
412+} as MsgContext,
413+ cfg,
414+commandAuthorized: true,
415+});
416+417+expect(auth.providerId).toBe("discord");
418+expect(auth.senderIsOwner).toBe(true);
419+});
420+421+it("does not apply channel-prefixed owner wildcards to mismatched providers", () => {
422+const cfg = {
423+commands: { ownerAllowFrom: ["telegram:*"] },
424+} as OpenClawConfig;
425+426+const auth = resolveCommandAuthorization({
427+ctx: {
428+Provider: "discord",
429+Surface: "discord",
430+From: "discord:123456789012345678",
431+SenderId: "123456789012345678",
432+} as MsgContext,
433+ cfg,
434+commandAuthorized: true,
435+});
436+437+expect(auth.providerId).toBe("discord");
438+expect(auth.senderIsOwner).toBe(false);
439+});
440+359441it("preserves external channel command auth in mixed webchat contexts", () => {
360442const cfg = {
361443commands: { allowFrom: { whatsapp: ["+15551234567"] } },
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。