@modesto_ma/dsh-channels 0.5.0-beta.6 → 0.5.0

package/lib/index.js

@@ -37,10 +37,16 @@ function decideAccess(subject, config, snapshot) {
 		kind: "allow",
 		reason: "admin"
 	};
-	if (subject.chatType === "p2p") return {
-		kind: "deny",
-		reason: "dm-non-admin"
-	};
+	if (subject.chatType === "p2p") {
+		if (config.dmAllowWhitelist && snapshot.users.has(subject.senderId)) return {
+			kind: "allow",
+			reason: "authorized-user"
+		};
+		return {
+			kind: "deny",
+			reason: "dm-non-admin"
+		};
+	}
 	if (!snapshot.groups.has(subject.chatId)) return {
 		kind: "deny",
 		reason: "group-not-authorized",
@@ -60,6 +66,8 @@ function decideAccess(subject, config, snapshot) {
 //#region src/access/controller.ts
 /** Fixed private-chat notice for non-administrators (no model call). */
 const DM_DENY_TEXT = "非管理员禁用私聊功能哦～如需使用，请在管理员授权的群里 @ 我；或联系管理员把你的 user_id 加入白名单。";
+/** Fixed private-chat notice for non-whitelisted users while `dmAllowWhitelist` is on. */
+const DM_DENY_WHITELIST_TEXT = "你还不在白名单里，暂时不能私聊哦～发送 /userid 查看你的 user_id，请管理员加入白名单后即可使用。";
 /** Fixed private-chat notice while no administrator is configured. */
 const DM_UNCONFIGURED_TEXT = "机器人尚未配置管理员。发送 /userid 可查看你的 user_id，交给部署者配置后即可启用。";
 /** Per-sender cooldown for the repeated private-chat notice (10 s). */
@@ -122,8 +130,9 @@ var AccessController = class {
 	/**
 	* Slash-command admission. Runs before any command card/topic/Session side
 	* effect. `open` mode keeps the legacy behavior; otherwise private chats
-	* stay administrator-only (with `/userid` as the bootstrap exception) and
-	* group chats must pass the full admission matrix; the administrator is
+	* admit whoever the admission matrix admits (with `/userid` as the
+	* bootstrap exception) and group chats must pass the full admission
+	* matrix; the administrator is
 	* never constrained by the whitelists, so all of their commands pass even
 	* inside an unauthorized group (`/auth` is the in-conversation grant
 	* entry).
@@ -133,7 +142,7 @@ var AccessController = class {
 		try {
 			if (msg.chatType === "p2p") {
 				if (commandName === "userid") return true;
-				if (this.isAdmin(msg.senderId)) return true;
+				if (this.decide(msg).kind === "allow") return true;
 				await this.noticeDeniedDm(msg);
 				return false;
 			}
@@ -195,7 +204,8 @@ var AccessController = class {
 		const last = this.dmNoticeAt.get(msg.senderId);
 		if (last !== void 0 && now - last < DM_NOTICE_COOLDOWN_MS) return;
 		this.dmNoticeAt.set(msg.senderId, now);
-		const text = this.config().adminUserId === void 0 ? DM_UNCONFIGURED_TEXT : DM_DENY_TEXT;
+		const config = this.config();
+		const text = config.adminUserId === void 0 ? DM_UNCONFIGURED_TEXT : config.dmAllowWhitelist ? DM_DENY_WHITELIST_TEXT : DM_DENY_TEXT;
 		await this.sendText(msg.chatId, text, msg.messageId);
 	}
 	/** Best-effort fixed-text send; unavailable channel/failures only warn. */
@@ -400,7 +410,7 @@ function buildUserRequestCard(input) {
 	} else if (input.chatId !== void 0 && input.chatId !== "") elements.push(field("所在群", `\`${input.chatId}\``));
 	elements.push(field("申请时间", formatTime(input.now)));
 	elements.push(divider());
-	elements.push(note("授权后该用户可在所有已授权群里使用；私聊仍仅管理员可用。"));
+	elements.push(note(input.dmAllowWhitelist === true ? "授权后该用户可在所有已授权群里使用，也可以私聊机器人。" : "授权后该用户可在所有已授权群里使用；私聊仍仅管理员可用。"));
 	elements.push(decisionButtons(input.token, "授权用户", "忽略"));
 	return standaloneCard("**🙋 用户授权申请**", elements);
 }
@@ -733,6 +743,7 @@ var AccessRequests = class {
 				...groupName === void 0 ? {} : { groupName },
 				...msg.senderName === void 0 ? {} : { requesterName: msg.senderName },
 				token: record.token,
+				dmAllowWhitelist: this.config().dmAllowWhitelist,
 				now
 			}), record);
 			return true;
@@ -1235,8 +1246,8 @@ const accessGroupRecordSchema = z.object({
 });
 /**
 * One authorized user (`user_id`), global across every authorized group.
-* Private chats are administrator-only, so this grant only affects group
-* conversations.
+* Private chats are administrator-only unless `dmAllowWhitelist` is on, so
+* by default this grant only affects group conversations.
 */
 const accessUserRecordSchema = z.object({
 	/** Feishu `user_id` — also the table key. */
@@ -16269,14 +16280,21 @@ const configSchema = z.object({
 	* Admission policy for inbound Feishu traffic.
 	*
 	* - `guarded` (default): only the configured administrator can talk in
-	*   private chats, and a group conversation additionally requires the group
-	*   to be authorized and the sender to be the administrator or an explicitly
+	*   private chats (plus whitelisted users when `dmAllowWhitelist` is on),
+	*   and a group conversation additionally requires the group to be
+	*   authorized and the sender to be the administrator or an explicitly
 	*   authorized user.
 	* - `open`: legacy behavior — any user inside the app's availability scope
 	*   can start a conversation. Debug/compatibility only; unsafe.
 	*/
 	accessMode: z.enum(["open", "guarded"]).default("guarded"),
 	/**
+	* In `guarded` mode, also admit users on the global user whitelist
+	* (`/auth user`) in private chats. Off by default: private chats stay
+	* administrator-only. Each private-chat user already has an own workspace.
+	*/
+	dmAllowWhitelist: z.boolean().default(false),
+	/**
 	* The unique administrator's Feishu `user_id`. Set it in the Web
 	* settings panel (or the profile config). Get it by sending `/userid` to the
 	* bot in a private chat. When unset, the Feishu app owner (looked up via
@@ -16436,6 +16454,7 @@ const EDITABLE_KEYS = [
 	"feishuTools.topicMessagesTimeoutMs",
 	"promptContextTimeoutMs",
 	"accessMode",
+	"dmAllowWhitelist",
 	"adminUserId",
 	"authRequestTtlDays",
 	"feishuTools.wikiRead",
@@ -18503,6 +18522,7 @@ var FeishuService = class {
 				await this.delivery.standaloneReply(msg, standaloneInfoCard("**🔐 访问授权状态**", [
 					`**准入模式**：\`${this.config.accessMode}\``,
 					`**管理员**：${this.adminStatusLine()}`,
+					`**私聊**：${this.config.dmAllowWhitelist ? "管理员与白名单用户" : "仅管理员"}`,
 					...msg.chatType === "group" ? [`**本群**：${this.accessStore.hasGroup(msg.chatId) ? "已授权" : "未授权"}（\`${msg.chatId}\`）`] : [],
 					`**白名单**：群 ${groups.length} 个 · 用户 ${users.length} 个 · 知识库 ${this.accessStore.wikiUserRecords().length} 个 · 待处理申请 ${pending.length} 个`,
 					"群授权：`/auth allow` 或 `/auth revoke`（在目标群内发）；用户授权：`/auth user add @用户` 或 `/auth user add <user_id>`；知识库授权：`/auth wiki add @用户`。"
@@ -20060,6 +20080,7 @@ const BOOLEAN_KEYS = /* @__PURE__ */ new Set([
 	"welcomeOnboarding",
 	"slashCommandPanel",
 	"allowPermissionSwitch",
+	"dmAllowWhitelist",
 	"acceptAttachments",
 	"prefetchImages",
 	"feishuTools.attachmentFetch",
@@ -20463,7 +20484,13 @@ const FIELD_META = {
 		label: "调试模式",
 		group: "access",
 		summary: "打开后所有人都能聊，不安全，只在调试时用",
-		help: "关闭时（默认）：管理员随时可用；非管理员私聊会被拒绝；群聊要同时满足群已授权、发言人在用户白名单里。授权入口有三个：群里 /auth 命令、授权卡、本页。撤销立即生效。"
+		help: "关闭时（默认）：管理员随时可用；非管理员私聊会被拒绝（打开「白名单用户可私聊」后白名单用户也可以）；群聊要同时满足群已授权、发言人在用户白名单里。授权入口有三个：群里 /auth 命令、授权卡、本页。撤销立即生效。"
+	},
+	dmAllowWhitelist: {
+		label: "白名单用户可私聊",
+		group: "access",
+		summary: "关闭时私聊仅管理员可用",
+		help: "打开后「已授权用户」里的人也可以私聊机器人，各自使用独立的私聊工作区，能力与群聊相同；不在白名单的人仍收到固定提示。撤销用户立即生效。"
 	},
 	adminUserId: {
 		label: "管理员 user_id",
@@ -21617,6 +21644,6 @@ function apply(ctx, config) {
 	}, "dsh-channels");
 }
 //#endregion
-export { AUTH_USER_TARGET_ERRORS, AccessController, AccessRequests, AccessStore, ApprovalAnswerer, CARD_MAX_BYTES, CARD_TARGET_BYTES, CATALOG_ROUTE, CHANNEL_COMMAND_NAMES, CONFIG_ROUTE, CREDENTIALS_ROUTE, Config, DM_DENY_TEXT, DM_UNCONFIGURED_TEXT, DSH_CHANNELS_VERSION, EDITABLE_KEYS, EMPTY_TOTALS, FIELD_DESCRIPTORS, FeishuService, HEALTH_DEPENDENCY_NAMES, INTERRUPTION_NOTICE, LOGICAL_EXPORT_FORMAT, LOGICAL_EXPORT_FORMAT_VERSION, MAX_QUESTION_OPTIONS, MAX_TABLES_PER_CARD, OverlayStore, PANEL_CHEVRON_TOKEN, PANEL_COPY, PANEL_ROUTE, PANEL_TITLES, PICK_DIRECTORY_ROUTE, QuestionAnswerer, REASONING_MAX_BYTES, RECONNECT_ROUTE, RESTART_KEYS, RouteOperationQueue, SESSION_HISTORY_DISPLAY_LIMIT, STATUS_ROUTE, SUPPORTED_COMMAND_NAMES, SettingsSurface, TRUNCATION_SUFFIX, TurnStreamer, accessGroupRecordSchema, accessRequestRecordSchema, accessUserRecordSchema, addUsage, appendSessionHistory, apply, applyCatalog, applyProjectionViews, armModelCommand, averageDecodeTokensPerSecond, averageTtftMs, buildApprovalCard, buildApprovalSettledCard, buildCard, buildCommandResultCard, buildCompactComparisonCard, buildGroupInfoCard, buildHealthCard, buildInterruptionCard, buildQuestionCard, buildQuestionSettledCard, buildRenewCard, buildRequestSettledCard, buildSessionHistoryCard, buildSessionStatusCard, buildUserRequestCard, buildWorkDirCard, cacheHitPct, cardJsonBytes, chatRouteKey, commandResultCardKind, compactFailureContext, countFiberStates, createHostCatalog, createLogicalSessionExport, createSettingsDirectoryPicker, decideAccess, defaultOverlayPath, emptyCatalog, ensureWorkspace, expiredRouteRecordSchema, feishuDomain, foldAll, foldEvent, foldHealthSnapshot, foldSessionStats, inflightSnapshotSchema, inject, isAdminUserId, isSameOriginRequest, isSupportedCommand, maskOpenIdTail, measureSessionContext, mergeOverlay, mountSettingsRoutes, name, normalizeCredentialValue, normalizeOverlay, normalizeRouteRecord, normalizeSessionHistory, parseOverlay, parseSlashCommand, pickEditable, processedRecordSchema, querySessionHistory, readProjectionViews, registerChannelCommands, registerModelCommand, registerSettingsRoutes, resolveAuthUserTarget, resolveDshHome, resolveWorkDir, routeRecordSchema, segmentCardContent, serializeLogicalSession, sessionDirOf, sessionHistoryEntrySchema, splitBodyForCard, stagingPathFor, stagingRoot, stripTables, supportedCommandHelp, supportedCommandList, tableBlocks, topicDirFor, topicTokenFor, usageFromBuckets, withDirectoryBrowse, workspacePathFor, workspaceTitleFor, worktreeBranchFor };
+export { AUTH_USER_TARGET_ERRORS, AccessController, AccessRequests, AccessStore, ApprovalAnswerer, CARD_MAX_BYTES, CARD_TARGET_BYTES, CATALOG_ROUTE, CHANNEL_COMMAND_NAMES, CONFIG_ROUTE, CREDENTIALS_ROUTE, Config, DM_DENY_TEXT, DM_DENY_WHITELIST_TEXT, DM_UNCONFIGURED_TEXT, DSH_CHANNELS_VERSION, EDITABLE_KEYS, EMPTY_TOTALS, FIELD_DESCRIPTORS, FeishuService, HEALTH_DEPENDENCY_NAMES, INTERRUPTION_NOTICE, LOGICAL_EXPORT_FORMAT, LOGICAL_EXPORT_FORMAT_VERSION, MAX_QUESTION_OPTIONS, MAX_TABLES_PER_CARD, OverlayStore, PANEL_CHEVRON_TOKEN, PANEL_COPY, PANEL_ROUTE, PANEL_TITLES, PICK_DIRECTORY_ROUTE, QuestionAnswerer, REASONING_MAX_BYTES, RECONNECT_ROUTE, RESTART_KEYS, RouteOperationQueue, SESSION_HISTORY_DISPLAY_LIMIT, STATUS_ROUTE, SUPPORTED_COMMAND_NAMES, SettingsSurface, TRUNCATION_SUFFIX, TurnStreamer, accessGroupRecordSchema, accessRequestRecordSchema, accessUserRecordSchema, addUsage, appendSessionHistory, apply, applyCatalog, applyProjectionViews, armModelCommand, averageDecodeTokensPerSecond, averageTtftMs, buildApprovalCard, buildApprovalSettledCard, buildCard, buildCommandResultCard, buildCompactComparisonCard, buildGroupInfoCard, buildHealthCard, buildInterruptionCard, buildQuestionCard, buildQuestionSettledCard, buildRenewCard, buildRequestSettledCard, buildSessionHistoryCard, buildSessionStatusCard, buildUserRequestCard, buildWorkDirCard, cacheHitPct, cardJsonBytes, chatRouteKey, commandResultCardKind, compactFailureContext, countFiberStates, createHostCatalog, createLogicalSessionExport, createSettingsDirectoryPicker, decideAccess, defaultOverlayPath, emptyCatalog, ensureWorkspace, expiredRouteRecordSchema, feishuDomain, foldAll, foldEvent, foldHealthSnapshot, foldSessionStats, inflightSnapshotSchema, inject, isAdminUserId, isSameOriginRequest, isSupportedCommand, maskOpenIdTail, measureSessionContext, mergeOverlay, mountSettingsRoutes, name, normalizeCredentialValue, normalizeOverlay, normalizeRouteRecord, normalizeSessionHistory, parseOverlay, parseSlashCommand, pickEditable, processedRecordSchema, querySessionHistory, readProjectionViews, registerChannelCommands, registerModelCommand, registerSettingsRoutes, resolveAuthUserTarget, resolveDshHome, resolveWorkDir, routeRecordSchema, segmentCardContent, serializeLogicalSession, sessionDirOf, sessionHistoryEntrySchema, splitBodyForCard, stagingPathFor, stagingRoot, stripTables, supportedCommandHelp, supportedCommandList, tableBlocks, topicDirFor, topicTokenFor, usageFromBuckets, withDirectoryBrowse, workspacePathFor, workspaceTitleFor, worktreeBranchFor };
 
 //# sourceMappingURL=index.js.map