@@ -6,14 +6,18 @@ import {
66resolveInboundDebounceMs,
77} from "openclaw/plugin-sdk/channel-inbound";
88import { resolveStoredModelOverride } from "openclaw/plugin-sdk/command-auth";
9+import {
10+resolveCommandAuthorization,
11+resolveCommandAuthorizedFromAuthorizers,
12+} from "openclaw/plugin-sdk/command-auth-native";
913import { buildCommandsMessagePaginated } from "openclaw/plugin-sdk/command-status";
1014import { writeConfigFile } from "openclaw/plugin-sdk/config-runtime";
1115import {
1216loadSessionStore,
1317resolveSessionStoreEntry,
1418updateSessionStore,
1519} from "openclaw/plugin-sdk/config-runtime";
16-import type { DmPolicy } from "openclaw/plugin-sdk/config-runtime";
20+import type { DmPolicy, OpenClawConfig } from "openclaw/plugin-sdk/config-runtime";
1721import type { TelegramGroupConfig, TelegramTopicConfig } from "openclaw/plugin-sdk/config-runtime";
1822import { applyModelOverrideToSessionEntry } from "openclaw/plugin-sdk/config-runtime";
1923import {
@@ -60,6 +64,7 @@ import {
6064import { resolveMedia } from "./bot/delivery.js";
6165import {
6266getTelegramTextParts,
67+buildTelegramGroupFrom,
6368buildTelegramGroupPeerId,
6469buildTelegramParentPeer,
6570resolveTelegramForumFlag,
@@ -783,6 +788,76 @@ export const registerTelegramHandlers = ({
783788return { allowed: true };
784789};
785790791+const isTelegramModelCallbackAuthorized = (params: {
792+chatId: number;
793+isGroup: boolean;
794+senderId: string;
795+senderUsername: string;
796+context: TelegramEventAuthorizationContext;
797+cfg: OpenClawConfig;
798+}): boolean => {
799+const { chatId, isGroup, senderId, senderUsername, context, cfg } = params;
800+const useAccessGroups = cfg.commands?.useAccessGroups !== false;
801+const dmAllowFrom = context.groupAllowOverride ?? allowFrom;
802+const commandsAllowFrom = cfg.commands?.allowFrom;
803+const commandsAllowFromConfigured =
804+commandsAllowFrom != null &&
805+typeof commandsAllowFrom === "object" &&
806+(Array.isArray(commandsAllowFrom.telegram) || Array.isArray(commandsAllowFrom["*"]));
807+if (commandsAllowFromConfigured) {
808+return resolveCommandAuthorization({
809+ctx: {
810+Provider: "telegram",
811+Surface: "telegram",
812+OriginatingChannel: "telegram",
813+AccountId: accountId,
814+ChatType: isGroup ? "group" : "direct",
815+From: isGroup
816+ ? buildTelegramGroupFrom(chatId, context.resolvedThreadId)
817+ : `telegram:${chatId}`,
818+SenderId: senderId || undefined,
819+SenderUsername: senderUsername || undefined,
820+},
821+ cfg,
822+commandAuthorized: false,
823+}).isAuthorizedSender;
824+}
825+826+const dmAllow = normalizeDmAllowFromWithStore({
827+allowFrom: dmAllowFrom,
828+storeAllowFrom: isGroup ? [] : context.storeAllowFrom,
829+dmPolicy: context.dmPolicy,
830+});
831+const senderAllowed = isSenderAllowed({
832+allow: dmAllow,
833+ senderId,
834+ senderUsername,
835+});
836+const groupSenderAllowed = isGroup
837+ ? isSenderAllowed({
838+allow: context.effectiveGroupAllow,
839+ senderId,
840+ senderUsername,
841+})
842+ : false;
843+844+return resolveCommandAuthorizedFromAuthorizers({
845+ useAccessGroups,
846+authorizers: [
847+{ configured: dmAllow.hasEntries, allowed: senderAllowed },
848+ ...(isGroup
849+ ? [
850+{
851+configured: context.effectiveGroupAllow.hasEntries,
852+allowed: groupSenderAllowed,
853+},
854+]
855+ : []),
856+],
857+modeWhenAccessGroupsOff: "configured",
858+});
859+};
860+786861// Handle emoji reactions to messages.
787862bot.on("message_reaction", async (ctx) => {
788863try {
@@ -1453,6 +1528,21 @@ export const registerTelegramHandlers = ({
14531528// Model selection callback handler (mdl_prov, mdl_list_*, mdl_sel_*, mdl_back)
14541529const modelCallback = parseModelCallbackData(data);
14551530if (modelCallback) {
1531+if (
1532+!isTelegramModelCallbackAuthorized({
1533+ chatId,
1534+ isGroup,
1535+ senderId,
1536+ senderUsername,
1537+context: eventAuthContext,
1538+cfg: runtimeCfg,
1539+})
1540+) {
1541+logVerbose(
1542+`Blocked telegram model callback from ${senderId || "unknown"} (not authorized for /models)`,
1543+);
1544+return;
1545+}
14561546let sessionState: ReturnType<typeof resolveTelegramSessionState>;
14571547let modelData: Awaited<ReturnType<typeof telegramDeps.buildModelsProviderData>>;
14581548try {
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。