openclaw
Version:
Multi-channel AI gateway with extensible messaging integrations
172 lines (171 loc) • 9.18 kB
JavaScript
import { l as normalizeStringEntries } from "./string-normalization-WNUDCpXX.js";
import { o as resolveGroupAllowFromSources } from "./allow-from-Ddq5GeWG.js";
import { n as resolveControlCommandGate } from "./command-gating-65fgTdwb.js";
import { t as readChannelIngressStoreAllowFromForDmPolicy } from "./store-allow-from-CwbNJoLu.js";
import { t as resolveDmAllowAuditState } from "./dm-allow-state-DgWvIrZa.js";
import { t as resolveChannelIngressEffectiveAllowFromLists } from "./effective-allow-from-DBbOZ23Y.js";
import { n as evaluateMatchedGroupAccessForPolicy } from "./group-access-rvLgnooh.js";
//#region src/security/dm-policy-shared.ts
/**
* Derive a stable main-DM owner from a single-entry allowlist.
* Wildcards, multi-owner lists, and non-main DM scopes stay unpinned so callers keep route-specific sessions.
*/
function resolvePinnedMainDmOwnerFromAllowlist(params) {
if ((params.dmScope ?? "main") !== "main") return null;
const rawAllowFrom = Array.isArray(params.allowFrom) ? params.allowFrom : [];
if (rawAllowFrom.some((entry) => String(entry).trim() === "*")) return null;
const normalizedOwners = Array.from(new Set(rawAllowFrom.map((entry) => params.normalizeEntry(String(entry))).filter((entry) => Boolean(entry))));
return normalizedOwners.length === 1 ? normalizedOwners[0] : null;
}
/** @deprecated Use `resolveChannelMessageIngress` from `openclaw/plugin-sdk/channel-ingress-runtime`. */
function resolveEffectiveAllowFromLists(params) {
return resolveChannelIngressEffectiveAllowFromLists(params);
}
/** Stable reason codes used by channel plugins, command auth, and diagnostics. */
const DM_GROUP_ACCESS_REASON = {
GROUP_POLICY_ALLOWED: "group_policy_allowed",
GROUP_POLICY_DISABLED: "group_policy_disabled",
GROUP_POLICY_EMPTY_ALLOWLIST: "group_policy_empty_allowlist",
GROUP_POLICY_NOT_ALLOWLISTED: "group_policy_not_allowlisted",
DM_POLICY_OPEN: "dm_policy_open",
DM_POLICY_DISABLED: "dm_policy_disabled",
DM_POLICY_ALLOWLISTED: "dm_policy_allowlisted",
DM_POLICY_PAIRING_REQUIRED: "dm_policy_pairing_required",
DM_POLICY_NOT_ALLOWLISTED: "dm_policy_not_allowlisted"
};
const dmGroupAccess = (decision, reasonCode, reason) => ({
decision,
reasonCode,
reason
});
/**
* Resolve sender access for `dmPolicy=open`, where `*` means fully open and a configured
* allowlist still restricts the accepted sender set.
*
* @deprecated Use `resolveChannelMessageIngress` from `openclaw/plugin-sdk/channel-ingress-runtime`.
*/
function resolveOpenDmAllowlistAccess(params) {
const effectiveAllowFrom = normalizeStringEntries(params.effectiveAllowFrom);
return effectiveAllowFrom.includes("*") ? dmGroupAccess("allow", DM_GROUP_ACCESS_REASON.DM_POLICY_OPEN, "dmPolicy=open") : params.isSenderAllowed(effectiveAllowFrom) ? dmGroupAccess("allow", DM_GROUP_ACCESS_REASON.DM_POLICY_ALLOWLISTED, "dmPolicy=open (allowlisted)") : dmGroupAccess("block", DM_GROUP_ACCESS_REASON.DM_POLICY_NOT_ALLOWLISTED, "dmPolicy=open (not allowlisted)");
}
const GROUP_ACCESS_RESULT = {
disabled: dmGroupAccess("block", DM_GROUP_ACCESS_REASON.GROUP_POLICY_DISABLED, "groupPolicy=disabled"),
empty_allowlist: dmGroupAccess("block", DM_GROUP_ACCESS_REASON.GROUP_POLICY_EMPTY_ALLOWLIST, "groupPolicy=allowlist (empty allowlist)"),
missing_match_input: dmGroupAccess("block", DM_GROUP_ACCESS_REASON.GROUP_POLICY_NOT_ALLOWLISTED, "groupPolicy=allowlist (not allowlisted)"),
not_allowlisted: dmGroupAccess("block", DM_GROUP_ACCESS_REASON.GROUP_POLICY_NOT_ALLOWLISTED, "groupPolicy=allowlist (not allowlisted)")
};
/** @deprecated Use `resolveChannelMessageIngress` or `readChannelIngressStoreAllowFromForDmPolicy` from `openclaw/plugin-sdk/channel-ingress-runtime`. */
async function readStoreAllowFromForDmPolicy(params) {
return await readChannelIngressStoreAllowFromForDmPolicy(params);
}
/**
* Resolve legacy DM/group sender admission from already-computed allowlists.
* Group messages are evaluated against group policy first; DM policy applies only outside groups.
*
* @deprecated Use `resolveChannelMessageIngress` from `openclaw/plugin-sdk/channel-ingress-runtime`.
*/
function resolveDmGroupAccessDecision(params) {
const dmPolicy = params.dmPolicy ?? "pairing";
const groupPolicy = params.groupPolicy === "open" || params.groupPolicy === "disabled" ? params.groupPolicy : "allowlist";
const effectiveAllowFrom = normalizeStringEntries(params.effectiveAllowFrom);
const effectiveGroupAllowFrom = normalizeStringEntries(params.effectiveGroupAllowFrom);
if (params.isGroup) {
const groupAccess = evaluateMatchedGroupAccessForPolicy({
groupPolicy,
allowlistConfigured: effectiveGroupAllowFrom.length > 0,
allowlistMatched: params.isSenderAllowed(effectiveGroupAllowFrom)
});
if (groupAccess.allowed) return dmGroupAccess("allow", DM_GROUP_ACCESS_REASON.GROUP_POLICY_ALLOWED, `groupPolicy=${groupPolicy}`);
switch (groupAccess.reason) {
case "disabled":
case "empty_allowlist":
case "missing_match_input":
case "not_allowlisted": return GROUP_ACCESS_RESULT[groupAccess.reason];
case "allowed": return dmGroupAccess("allow", DM_GROUP_ACCESS_REASON.GROUP_POLICY_ALLOWED, `groupPolicy=${groupPolicy}`);
}
}
if (dmPolicy === "disabled") return dmGroupAccess("block", DM_GROUP_ACCESS_REASON.DM_POLICY_DISABLED, "dmPolicy=disabled");
if (dmPolicy === "open") return resolveOpenDmAllowlistAccess({
effectiveAllowFrom,
isSenderAllowed: params.isSenderAllowed
});
return params.isSenderAllowed(effectiveAllowFrom) ? dmGroupAccess("allow", DM_GROUP_ACCESS_REASON.DM_POLICY_ALLOWLISTED, `dmPolicy=${dmPolicy} (allowlisted)`) : dmPolicy === "pairing" ? dmGroupAccess("pairing", DM_GROUP_ACCESS_REASON.DM_POLICY_PAIRING_REQUIRED, "dmPolicy=pairing (not allowlisted)") : dmGroupAccess("block", DM_GROUP_ACCESS_REASON.DM_POLICY_NOT_ALLOWLISTED, `dmPolicy=${dmPolicy} (not allowlisted)`);
}
/**
* Resolve legacy DM/group sender admission and return the effective allowlists used.
*
* @deprecated Use `resolveChannelMessageIngress` from `openclaw/plugin-sdk/channel-ingress-runtime`.
*/
function resolveDmGroupAccessWithLists(params) {
const { effectiveAllowFrom, effectiveGroupAllowFrom } = resolveEffectiveAllowFromLists({
allowFrom: params.allowFrom,
groupAllowFrom: params.groupAllowFrom,
storeAllowFrom: params.storeAllowFrom,
dmPolicy: params.dmPolicy,
groupAllowFromFallbackToAllowFrom: params.groupAllowFromFallbackToAllowFrom
});
return {
...resolveDmGroupAccessDecision({
isGroup: params.isGroup,
dmPolicy: params.dmPolicy,
groupPolicy: params.groupPolicy,
effectiveAllowFrom,
effectiveGroupAllowFrom,
isSenderAllowed: params.isSenderAllowed
}),
effectiveAllowFrom,
effectiveGroupAllowFrom
};
}
/**
* Resolve legacy sender admission plus control-command authorization.
* Control commands use configured allowlists, not pairing-store state, for group safety.
*
* @deprecated Use `resolveChannelMessageIngress` from `openclaw/plugin-sdk/channel-ingress-runtime`.
*/
function resolveDmGroupAccessWithCommandGate(params) {
const access = resolveDmGroupAccessWithLists({
isGroup: params.isGroup,
dmPolicy: params.dmPolicy,
groupPolicy: params.groupPolicy,
allowFrom: params.allowFrom,
groupAllowFrom: params.groupAllowFrom,
storeAllowFrom: params.storeAllowFrom,
groupAllowFromFallbackToAllowFrom: params.groupAllowFromFallbackToAllowFrom,
isSenderAllowed: params.isSenderAllowed
});
const configuredAllowFrom = normalizeStringEntries(params.allowFrom ?? []);
const configuredGroupAllowFrom = normalizeStringEntries(resolveGroupAllowFromSources({
allowFrom: configuredAllowFrom,
groupAllowFrom: normalizeStringEntries(params.groupAllowFrom ?? []),
fallbackToAllowFrom: params.groupAllowFromFallbackToAllowFrom ?? void 0
}));
const commandDmAllowFrom = params.isGroup ? configuredAllowFrom : access.effectiveAllowFrom;
const commandGroupAllowFrom = params.isGroup ? configuredGroupAllowFrom : access.effectiveGroupAllowFrom;
const commandGate = params.command ? resolveControlCommandGate({
useAccessGroups: params.command.useAccessGroups,
authorizers: [{
configured: commandDmAllowFrom.length > 0,
allowed: params.isSenderAllowed(commandDmAllowFrom)
}, {
configured: commandGroupAllowFrom.length > 0,
allowed: params.isSenderAllowed(commandGroupAllowFrom)
}],
allowTextCommands: params.command.allowTextCommands,
hasControlCommand: params.command.hasControlCommand
}) : {
commandAuthorized: false,
shouldBlock: false
};
return {
...access,
commandAuthorized: commandGate.commandAuthorized,
shouldBlockControlCommand: params.isGroup && commandGate.shouldBlock
};
}
/** @deprecated Use `resolveChannelMessageIngress` from `openclaw/plugin-sdk/channel-ingress-runtime`. */
async function resolveDmAllowState(params) {
return await resolveDmAllowAuditState(params);
}
//#endregion
export { resolveDmGroupAccessWithCommandGate as a, resolveOpenDmAllowlistAccess as c, resolveDmGroupAccessDecision as i, resolvePinnedMainDmOwnerFromAllowlist as l, readStoreAllowFromForDmPolicy as n, resolveDmGroupAccessWithLists as o, resolveDmAllowState as r, resolveEffectiveAllowFromLists as s, DM_GROUP_ACCESS_REASON as t };