fix: keep Discord DM wildcard out of owner checks · openc...
steipete
·
2026-04-29
·
via Recent Commits to openclaw:main
| Original file line number | Diff line number | Diff line change |
|---|
@@ -10,6 +10,7 @@ import {
|
10 | 10 | resolveDiscordChannelConfig, |
11 | 11 | resolveDiscordChannelConfigWithFallback, |
12 | 12 | resolveDiscordGuildEntry, |
| 13 | +resolveDiscordOwnerAccess, |
13 | 14 | resolveDiscordShouldRequireMention, |
14 | 15 | resolveGroupDmAllow, |
15 | 16 | shouldEmitDiscordReactionNotification, |
@@ -252,6 +253,22 @@ describe("discord allowlist helpers", () => {
|
252 | 253 | expect(allowListMatches(allow, { id: "member-123" })).toBe(true); |
253 | 254 | expect(allowListMatches(allow, { id: "member-999" })).toBe(false); |
254 | 255 | }); |
| 256 | + |
| 257 | +it("does not treat DM wildcard access as owner access", () => { |
| 258 | +const wildcardOnly = resolveDiscordOwnerAccess({ |
| 259 | +allowFrom: ["*"], |
| 260 | +sender: { id: "123" }, |
| 261 | +}); |
| 262 | +expect(wildcardOnly.ownerAllowList).toBeNull(); |
| 263 | +expect(wildcardOnly.ownerAllowed).toBe(false); |
| 264 | + |
| 265 | +const explicitOwner = resolveDiscordOwnerAccess({ |
| 266 | +allowFrom: ["*", "user:123"], |
| 267 | +sender: { id: "123" }, |
| 268 | +}); |
| 269 | +expect(explicitOwner.ownerAllowList).not.toBeNull(); |
| 270 | +expect(explicitOwner.ownerAllowed).toBe(true); |
| 271 | +}); |
255 | 272 | }); |
256 | 273 | |
257 | 274 | describe("discord guild/channel resolution", () => { |
|
| Original file line number | Diff line number | Diff line change |
|---|
@@ -279,8 +279,11 @@ export function resolveDiscordOwnerAccess(params: {
|
279 | 279 | ownerAllowList: DiscordAllowList | null; |
280 | 280 | ownerAllowed: boolean; |
281 | 281 | } { |
| 282 | +const ownerAllowFrom = params.allowFrom?.filter( |
| 283 | +(entry) => (normalizeOptionalString(entry) ?? "") !== "*", |
| 284 | +); |
282 | 285 | const ownerAllowList = normalizeDiscordAllowList( |
283 | | -params.allowFrom, |
| 286 | +ownerAllowFrom && ownerAllowFrom.length > 0 ? ownerAllowFrom : undefined, |
284 | 287 | DISCORD_OWNER_ALLOWLIST_PREFIXES, |
285 | 288 | ); |
286 | 289 | const ownerAllowed = ownerAllowList |
|
| Original file line number | Diff line number | Diff line change |
|---|
@@ -342,6 +342,39 @@ describe("Discord native slash commands with commands.allowFrom", () => {
|
342 | 342 | expectUnauthorizedReply(interaction); |
343 | 343 | }); |
344 | 344 | |
| 345 | +it("does not treat open-DM wildcard access as guild command owner authorization", async () => { |
| 346 | +const { dispatchSpy, interaction } = await runGuildSlashCommand({ |
| 347 | +userId: "999999999999999999", |
| 348 | +mutateConfig: (cfg) => { |
| 349 | +cfg.commands = { |
| 350 | + ...cfg.commands, |
| 351 | +useAccessGroups: false, |
| 352 | +allowFrom: undefined, |
| 353 | +}; |
| 354 | +cfg.channels = { |
| 355 | + ...cfg.channels, |
| 356 | +discord: { |
| 357 | + ...cfg.channels?.discord, |
| 358 | +dmPolicy: "open", |
| 359 | +allowFrom: ["*"], |
| 360 | +guilds: { |
| 361 | +"000000000000000000": { |
| 362 | +channels: { |
| 363 | +"111111111111111111": { |
| 364 | +enabled: true, |
| 365 | +requireMention: false, |
| 366 | +}, |
| 367 | +}, |
| 368 | +}, |
| 369 | +}, |
| 370 | +}, |
| 371 | +}; |
| 372 | +}, |
| 373 | +}); |
| 374 | +expect(dispatchSpy).not.toHaveBeenCalled(); |
| 375 | +expectUnauthorizedReply(interaction); |
| 376 | +}); |
| 377 | + |
345 | 378 | it("rejects guild slash commands when commands.allowFrom.discord does not match the sender", async () => { |
346 | 379 | const { dispatchSpy, interaction } = await runGuildSlashCommand({ |
347 | 380 | userId: "999999999999999999", |
|
| Original file line number | Diff line number | Diff line change |
|---|
@@ -174,6 +174,8 @@ describe("monitorDiscordProvider", () => {
|
174 | 174 | vi.doMock("../accounts.js", () => ({ |
175 | 175 | resolveDiscordAccount: (...args: Parameters<typeof resolveDiscordAccountMock>) => |
176 | 176 | resolveDiscordAccountMock(...args), |
| 177 | +resolveDiscordAccountAllowFrom: () => undefined, |
| 178 | +resolveDiscordAccountDmPolicy: () => undefined, |
177 | 179 | })); |
178 | 180 | vi.doMock("../probe.js", () => ({ |
179 | 181 | fetchDiscordApplicationId: async () => "app-1", |
|
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
