@kodelyth/discord 2026.5.39 → 2026.5.42

package/src/token.test.ts

@@ -0,0 +1,174 @@
+import type { KlawConfig } from "klaw/plugin-sdk/config-contracts";
+import {
+  clearRuntimeConfigSnapshot,
+  setRuntimeConfigSnapshot,
+} from "klaw/plugin-sdk/runtime-config-snapshot";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { resolveDiscordToken } from "./token.js";
+
+describe("resolveDiscordToken", () => {
+  afterEach(() => {
+    clearRuntimeConfigSnapshot();
+    vi.unstubAllEnvs();
+  });
+
+  it("prefers config token over env", () => {
+    vi.stubEnv("DISCORD_BOT_TOKEN", "env-token");
+    const cfg = {
+      channels: { discord: { token: "cfg-token" } },
+    } as KlawConfig;
+    const res = resolveDiscordToken(cfg);
+    expect(res.token).toBe("cfg-token");
+    expect(res.source).toBe("config");
+    expect(res.tokenStatus).toBe("available");
+  });
+
+  it("uses env token when config is missing", () => {
+    vi.stubEnv("DISCORD_BOT_TOKEN", "env-token");
+    const cfg = {
+      channels: { discord: {} },
+    } as KlawConfig;
+    const res = resolveDiscordToken(cfg);
+    expect(res.token).toBe("env-token");
+    expect(res.source).toBe("env");
+    expect(res.tokenStatus).toBe("available");
+  });
+
+  it("prefers account token for non-default accounts", () => {
+    vi.stubEnv("DISCORD_BOT_TOKEN", "env-token");
+    const cfg = {
+      channels: {
+        discord: {
+          token: "base-token",
+          accounts: {
+            work: { token: "acct-token" },
+          },
+        },
+      },
+    } as KlawConfig;
+    const res = resolveDiscordToken(cfg, { accountId: "work" });
+    expect(res.token).toBe("acct-token");
+    expect(res.source).toBe("config");
+    expect(res.tokenStatus).toBe("available");
+  });
+
+  it("falls back to top-level token for non-default accounts without account token", () => {
+    const cfg = {
+      channels: {
+        discord: {
+          token: "base-token",
+          accounts: {
+            work: {},
+          },
+        },
+      },
+    } as KlawConfig;
+    const res = resolveDiscordToken(cfg, { accountId: "work" });
+    expect(res.token).toBe("base-token");
+    expect(res.source).toBe("config");
+    expect(res.tokenStatus).toBe("available");
+  });
+
+  it("does not inherit top-level token when account token is explicitly blank", () => {
+    const cfg = {
+      channels: {
+        discord: {
+          token: "base-token",
+          accounts: {
+            work: { token: "" },
+          },
+        },
+      },
+    } as KlawConfig;
+    const res = resolveDiscordToken(cfg, { accountId: "work" });
+    expect(res.token).toBe("");
+    expect(res.source).toBe("none");
+    expect(res.tokenStatus).toBe("missing");
+  });
+
+  it("resolves account token when account key casing differs from normalized id", () => {
+    const cfg = {
+      channels: {
+        discord: {
+          accounts: {
+            Work: { token: "acct-token" },
+          },
+        },
+      },
+    } as KlawConfig;
+    const res = resolveDiscordToken(cfg, { accountId: "work" });
+    expect(res.token).toBe("acct-token");
+    expect(res.source).toBe("config");
+    expect(res.tokenStatus).toBe("available");
+  });
+
+  it("uses the active runtime snapshot when resolving a matching source config", () => {
+    const sourceCfg = {
+      channels: {
+        discord: {
+          accounts: {
+            work: {
+              token: { source: "env", provider: "default", id: "DISCORD_WORK_TOKEN" },
+            },
+          },
+        },
+      },
+    } as unknown as KlawConfig;
+    const runtimeCfg = {
+      channels: {
+        discord: {
+          accounts: {
+            work: {
+              token: "Bot runtime-work-token",
+            },
+          },
+        },
+      },
+    } as KlawConfig;
+    setRuntimeConfigSnapshot(runtimeCfg, sourceCfg);
+
+    const res = resolveDiscordToken(sourceCfg, { accountId: "work" });
+
+    expect(res.token).toBe("runtime-work-token");
+    expect(res.source).toBe("config");
+    expect(res.tokenStatus).toBe("available");
+  });
+
+  it("treats unresolved top-level SecretRefs as configured unavailable without env fallback", () => {
+    vi.stubEnv("DISCORD_BOT_TOKEN", "env-token");
+    const cfg = {
+      channels: {
+        discord: {
+          token: { source: "env", provider: "default", id: "DISCORD_BOT_TOKEN" },
+        },
+      },
+    } as unknown as KlawConfig;
+
+    const res = resolveDiscordToken(cfg);
+
+    expect(res.token).toBe("");
+    expect(res.source).toBe("config");
+    expect(res.tokenStatus).toBe("configured_unavailable");
+  });
+
+  it("treats unresolved account SecretRefs as configured unavailable without top-level fallback", () => {
+    const cfg = {
+      channels: {
+        discord: {
+          token: "base-token",
+          accounts: {
+            work: {
+              token: { source: "env", provider: "default", id: "DISCORD_WORK_TOKEN" },
+            },
+          },
+        },
+      },
+    } as unknown as KlawConfig;
+
+    const res = resolveDiscordToken(cfg, { accountId: "work" });
+
+    expect(res.token).toBe("");
+    expect(res.source).toBe("config");
+    expect(res.tokenStatus).toBe("configured_unavailable");
+  });
+});

package/src/token.ts

@@ -0,0 +1,107 @@
+import type { BaseTokenResolution } from "klaw/plugin-sdk/channel-contract";
+import type { KlawConfig } from "klaw/plugin-sdk/config-contracts";
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "klaw/plugin-sdk/routing";
+import { resolveAccountEntry } from "klaw/plugin-sdk/routing";
+import {
+  normalizeResolvedSecretInputString,
+  resolveSecretInputString,
+} from "klaw/plugin-sdk/secret-input";
+import { selectDiscordRuntimeConfig } from "./runtime-config.js";
+
+type DiscordTokenSource = "env" | "config" | "none";
+export type DiscordCredentialStatus = "available" | "configured_unavailable" | "missing";
+
+export type DiscordTokenResolution = BaseTokenResolution & {
+  source: DiscordTokenSource;
+  tokenStatus: DiscordCredentialStatus;
+};
+
+type DiscordTokenValueResolution =
+  | { status: "available"; value: string }
+  | { status: "configured_unavailable" }
+  | { status: "missing" };
+
+function stripDiscordBotPrefix(token: string): string {
+  return token.replace(/^Bot\s+/i, "");
+}
+
+export function normalizeDiscordToken(raw: unknown, path: string): string | undefined {
+  const trimmed = normalizeResolvedSecretInputString({ value: raw, path });
+  if (!trimmed) {
+    return undefined;
+  }
+  return stripDiscordBotPrefix(trimmed);
+}
+
+function resolveDiscordTokenValue(params: {
+  cfg: KlawConfig;
+  value: unknown;
+  path: string;
+}): DiscordTokenValueResolution {
+  const resolved = resolveSecretInputString({
+    value: params.value,
+    path: params.path,
+    defaults: params.cfg.secrets?.defaults,
+    mode: "inspect",
+  });
+  if (resolved.status === "available") {
+    return {
+      status: "available",
+      value: stripDiscordBotPrefix(resolved.value),
+    };
+  }
+  if (resolved.status === "configured_unavailable") {
+    return { status: "configured_unavailable" };
+  }
+  return { status: "missing" };
+}
+
+export function resolveDiscordToken(
+  cfg: KlawConfig,
+  opts: { accountId?: string | null; envToken?: string | null } = {},
+): DiscordTokenResolution {
+  const selectedCfg = selectDiscordRuntimeConfig(cfg);
+  const accountId = normalizeAccountId(opts.accountId);
+  const discordCfg = selectedCfg?.channels?.discord;
+  const accountCfg = resolveAccountEntry(discordCfg?.accounts, accountId);
+  const hasAccountToken = Boolean(
+    accountCfg &&
+    Object.prototype.hasOwnProperty.call(accountCfg as Record<string, unknown>, "token"),
+  );
+  const accountToken = resolveDiscordTokenValue({
+    cfg: selectedCfg,
+    value: (accountCfg as { token?: unknown } | undefined)?.token,
+    path: `channels.discord.accounts.${accountId}.token`,
+  });
+  if (accountToken.status === "available" && accountToken.value) {
+    return { token: accountToken.value, source: "config", tokenStatus: "available" };
+  }
+  if (accountToken.status === "configured_unavailable") {
+    return { token: "", source: "config", tokenStatus: "configured_unavailable" };
+  }
+  if (hasAccountToken) {
+    return { token: "", source: "none", tokenStatus: "missing" };
+  }
+
+  const configToken = resolveDiscordTokenValue({
+    cfg: selectedCfg,
+    value: discordCfg?.token,
+    path: "channels.discord.token",
+  });
+  if (configToken.status === "available" && configToken.value) {
+    return { token: configToken.value, source: "config", tokenStatus: "available" };
+  }
+  if (configToken.status === "configured_unavailable") {
+    return { token: "", source: "config", tokenStatus: "configured_unavailable" };
+  }
+
+  const allowEnv = accountId === DEFAULT_ACCOUNT_ID;
+  const envToken = allowEnv
+    ? normalizeDiscordToken(opts.envToken ?? process.env.DISCORD_BOT_TOKEN, "DISCORD_BOT_TOKEN")
+    : undefined;
+  if (envToken) {
+    return { token: envToken, source: "env", tokenStatus: "available" };
+  }
+
+  return { token: "", source: "none", tokenStatus: "missing" };
+}

package/src/ui-colors.ts

@@ -0,0 +1,27 @@
+import type { KlawConfig } from "klaw/plugin-sdk/config-contracts";
+import { inspectDiscordAccount } from "./account-inspect.js";
+
+const DEFAULT_DISCORD_ACCENT_COLOR = "#5865F2";
+
+type ResolveDiscordAccentColorParams = {
+  cfg: KlawConfig;
+  accountId?: string | null;
+};
+
+export function normalizeDiscordAccentColor(raw?: string | null): string | null {
+  const trimmed = (raw ?? "").trim();
+  if (!trimmed) {
+    return null;
+  }
+  const normalized = trimmed.startsWith("#") ? trimmed : `#${trimmed}`;
+  if (!/^#[0-9a-fA-F]{6}$/.test(normalized)) {
+    return null;
+  }
+  return normalized.toUpperCase();
+}
+
+export function resolveDiscordAccentColor(params: ResolveDiscordAccentColorParams): string {
+  const account = inspectDiscordAccount({ cfg: params.cfg, accountId: params.accountId });
+  const configured = normalizeDiscordAccentColor(account.config.ui?.components?.accentColor);
+  return configured ?? DEFAULT_DISCORD_ACCENT_COLOR;
+}

package/src/ui.ts

@@ -0,0 +1,20 @@
+import type { KlawConfig } from "klaw/plugin-sdk/config-contracts";
+import { Container } from "./internal/discord.js";
+import { normalizeDiscordAccentColor, resolveDiscordAccentColor } from "./ui-colors.js";
+
+type DiscordContainerComponents = ConstructorParameters<typeof Container>[0];
+
+export class DiscordUiContainer extends Container {
+  constructor(params: {
+    cfg: KlawConfig;
+    accountId?: string | null;
+    components?: DiscordContainerComponents;
+    accentColor?: string;
+    spoiler?: boolean;
+  }) {
+    const accentOverride = normalizeDiscordAccentColor(params.accentColor);
+    const accentColor =
+      accentOverride ?? resolveDiscordAccentColor({ cfg: params.cfg, accountId: params.accountId });
+    super(params.components, { accentColor, spoiler: params.spoiler });
+  }
+}

package/src/voice/access.test.ts

@@ -0,0 +1,288 @@
+import type { KlawConfig } from "klaw/plugin-sdk/config-contracts";
+import type { DiscordAccountConfig } from "klaw/plugin-sdk/config-contracts";
+import { describe, expect, it } from "vitest";
+import { authorizeDiscordVoiceIngress } from "./access.js";
+
+const baseCfg = { commands: { useAccessGroups: true } } as KlawConfig;
+
+describe("authorizeDiscordVoiceIngress", () => {
+  it("blocks speakers outside the configured channel user allowlist", async () => {
+    const access = await authorizeDiscordVoiceIngress({
+      cfg: baseCfg,
+      discordConfig: {
+        guilds: {
+          g1: {
+            channels: {
+              c1: {
+                users: ["discord:u-owner"],
+              },
+            },
+          },
+        },
+      } as DiscordAccountConfig,
+      groupPolicy: "allowlist",
+      guildId: "g1",
+      channelId: "c1",
+      channelSlug: "",
+      memberRoleIds: [],
+      sender: {
+        id: "u-guest",
+        name: "guest",
+      },
+    });
+
+    expect(access).toEqual({
+      ok: false,
+      message: "You are not authorized to use this command.",
+    });
+  });
+
+  it("allows speakers that match the configured channel user allowlist", async () => {
+    const access = await authorizeDiscordVoiceIngress({
+      cfg: baseCfg,
+      discordConfig: {
+        guilds: {
+          g1: {
+            channels: {
+              c1: {
+                users: ["discord:u-owner"],
+              },
+            },
+          },
+        },
+      } as DiscordAccountConfig,
+      groupPolicy: "allowlist",
+      guildId: "g1",
+      channelId: "c1",
+      channelSlug: "",
+      memberRoleIds: [],
+      sender: {
+        id: "u-owner",
+        name: "owner",
+      },
+    });
+
+    expect(access).toEqual({
+      ok: true,
+      channelConfig: {
+        allowed: true,
+        requireMention: undefined,
+        ignoreOtherMentions: undefined,
+        skills: undefined,
+        enabled: undefined,
+        users: ["discord:u-owner"],
+        roles: undefined,
+        systemPrompt: undefined,
+        includeThreadStarter: undefined,
+        autoThread: undefined,
+        autoThreadName: undefined,
+        autoArchiveDuration: undefined,
+        matchKey: "c1",
+        matchSource: "direct",
+      },
+    });
+  });
+
+  it("allows slug-keyed guild configs when manager context only has guild name", async () => {
+    const access = await authorizeDiscordVoiceIngress({
+      cfg: baseCfg,
+      discordConfig: {
+        guilds: {
+          "guild-one": {
+            channels: {
+              "*": {
+                users: ["discord:u-owner"],
+              },
+            },
+          },
+        },
+      } as DiscordAccountConfig,
+      groupPolicy: "allowlist",
+      guildId: "g1",
+      guildName: "Guild One",
+      channelId: "c1",
+      channelSlug: "",
+      memberRoleIds: [],
+      sender: {
+        id: "u-owner",
+        name: "owner",
+      },
+    });
+
+    expect(access).toEqual({
+      ok: true,
+      channelConfig: {
+        allowed: true,
+        requireMention: undefined,
+        ignoreOtherMentions: undefined,
+        skills: undefined,
+        enabled: undefined,
+        users: ["discord:u-owner"],
+        roles: undefined,
+        systemPrompt: undefined,
+        includeThreadStarter: undefined,
+        autoThread: undefined,
+        autoThreadName: undefined,
+        autoArchiveDuration: undefined,
+        matchKey: "*",
+        matchSource: "wildcard",
+      },
+    });
+  });
+
+  it("allows wildcard guild configs when only the guild id is available", async () => {
+    const access = await authorizeDiscordVoiceIngress({
+      cfg: baseCfg,
+      discordConfig: {
+        guilds: {
+          "*": {
+            channels: {
+              "*": {
+                users: ["discord:u-owner"],
+              },
+            },
+          },
+        },
+      } as DiscordAccountConfig,
+      groupPolicy: "allowlist",
+      guildId: "g1",
+      channelId: "c1",
+      channelSlug: "",
+      memberRoleIds: [],
+      sender: {
+        id: "u-owner",
+        name: "owner",
+      },
+    });
+
+    expect(access).toEqual({
+      ok: true,
+      channelConfig: {
+        allowed: true,
+        requireMention: undefined,
+        ignoreOtherMentions: undefined,
+        skills: undefined,
+        enabled: undefined,
+        users: ["discord:u-owner"],
+        roles: undefined,
+        systemPrompt: undefined,
+        includeThreadStarter: undefined,
+        autoThread: undefined,
+        autoThreadName: undefined,
+        autoArchiveDuration: undefined,
+        matchKey: "*",
+        matchSource: "wildcard",
+      },
+    });
+  });
+
+  it("blocks commands when channel id is unavailable for an allowlisted channel", async () => {
+    const access = await authorizeDiscordVoiceIngress({
+      cfg: baseCfg,
+      discordConfig: {
+        guilds: {
+          g1: {
+            users: ["discord:u-owner"],
+            channels: {
+              c1: {
+                users: ["discord:u-owner"],
+              },
+            },
+          },
+        },
+      } as DiscordAccountConfig,
+      groupPolicy: "allowlist",
+      guildId: "g1",
+      channelId: "",
+      channelSlug: "",
+      memberRoleIds: [],
+      sender: {
+        id: "u-owner",
+        name: "owner",
+      },
+    });
+
+    expect(access).toEqual({
+      ok: false,
+      message: "This channel is not allowlisted for voice commands.",
+    });
+  });
+
+  it("ignores dangerous name matching for voice ingress", async () => {
+    const access = await authorizeDiscordVoiceIngress({
+      cfg: baseCfg,
+      discordConfig: {
+        dangerouslyAllowNameMatching: true,
+        guilds: {
+          g1: {
+            channels: {
+              c1: {
+                users: ["owner"],
+              },
+            },
+          },
+        },
+      } as DiscordAccountConfig,
+      groupPolicy: "allowlist",
+      guildId: "g1",
+      channelId: "c1",
+      channelSlug: "",
+      memberRoleIds: [],
+      sender: {
+        id: "u-guest",
+        name: "owner",
+      },
+    });
+
+    expect(access).toEqual({
+      ok: false,
+      message: "You are not authorized to use this command.",
+    });
+  });
+
+  it("uses resolved account owner allowFrom over merged Discord config", async () => {
+    const access = await authorizeDiscordVoiceIngress({
+      cfg: baseCfg,
+      discordConfig: {
+        allowFrom: ["discord:u-root"],
+        guilds: {
+          g1: {
+            channels: {
+              c1: {},
+            },
+          },
+        },
+      } as DiscordAccountConfig,
+      groupPolicy: "allowlist",
+      guildId: "g1",
+      channelId: "c1",
+      channelSlug: "",
+      memberRoleIds: [],
+      ownerAllowFrom: ["discord:u-account"],
+      sender: {
+        id: "u-account",
+        name: "owner",
+      },
+    });
+
+    expect(access).toEqual({
+      ok: true,
+      channelConfig: {
+        allowed: true,
+        requireMention: undefined,
+        ignoreOtherMentions: undefined,
+        skills: undefined,
+        enabled: undefined,
+        users: undefined,
+        roles: undefined,
+        systemPrompt: undefined,
+        includeThreadStarter: undefined,
+        autoThread: undefined,
+        autoThreadName: undefined,
+        autoArchiveDuration: undefined,
+        matchKey: "c1",
+        matchSource: "direct",
+      },
+    });
+  });
+});