@openclaw/discord 2026.3.13 → 2026.5.1-beta.1

package/src/monitor/dm-command-auth.test.ts

@@ -0,0 +1,197 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { resolveDiscordDmCommandAccess } from "./dm-command-auth.js";
+
+const canViewDiscordGuildChannelMock = vi.hoisted(() => vi.fn());
+
+vi.mock("../send.permissions.js", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../send.permissions.js")>();
+  return {
+    ...actual,
+    canViewDiscordGuildChannel: canViewDiscordGuildChannelMock,
+  };
+});
+
+describe("resolveDiscordDmCommandAccess", () => {
+  const sender = {
+    id: "123",
+    name: "alice",
+    tag: "alice#0001",
+  };
+
+  beforeEach(() => {
+    canViewDiscordGuildChannelMock.mockReset();
+  });
+
+  async function resolveOpenDmAccess(configuredAllowFrom: string[]) {
+    return await resolveDiscordDmCommandAccess({
+      accountId: "default",
+      dmPolicy: "open",
+      configuredAllowFrom,
+      sender,
+      allowNameMatching: false,
+      useAccessGroups: true,
+      readStoreAllowFrom: async () => [],
+    });
+  }
+
+  it("blocks open DMs without allowlist wildcard entries", async () => {
+    const result = await resolveOpenDmAccess([]);
+
+    expect(result.decision).toBe("block");
+    expect(result.commandAuthorized).toBe(false);
+  });
+
+  it("marks command auth true when sender is allowlisted", async () => {
+    const result = await resolveOpenDmAccess(["discord:123"]);
+
+    expect(result.decision).toBe("allow");
+    expect(result.commandAuthorized).toBe(true);
+  });
+
+  it("blocks open DMs when configured allowlist does not match", async () => {
+    const result = await resolveDiscordDmCommandAccess({
+      accountId: "default",
+      dmPolicy: "open",
+      configuredAllowFrom: ["discord:999"],
+      sender,
+      allowNameMatching: false,
+      useAccessGroups: true,
+      readStoreAllowFrom: async () => [],
+    });
+
+    expect(result.decision).toBe("block");
+    expect(result.allowMatch.allowed).toBe(false);
+    expect(result.commandAuthorized).toBe(false);
+  });
+
+  it("returns pairing decision and unauthorized command auth for unknown senders", async () => {
+    const result = await resolveDiscordDmCommandAccess({
+      accountId: "default",
+      dmPolicy: "pairing",
+      configuredAllowFrom: ["discord:456"],
+      sender,
+      allowNameMatching: false,
+      useAccessGroups: true,
+      readStoreAllowFrom: async () => [],
+    });
+
+    expect(result.decision).toBe("pairing");
+    expect(result.commandAuthorized).toBe(false);
+  });
+
+  it("authorizes sender from pairing-store allowlist entries", async () => {
+    const result = await resolveDiscordDmCommandAccess({
+      accountId: "default",
+      dmPolicy: "pairing",
+      configuredAllowFrom: [],
+      sender,
+      allowNameMatching: false,
+      useAccessGroups: true,
+      readStoreAllowFrom: async () => ["discord:123"],
+    });
+
+    expect(result.decision).toBe("allow");
+    expect(result.commandAuthorized).toBe(true);
+  });
+
+  it("authorizes allowlist DMs from a Discord channel audience access group", async () => {
+    canViewDiscordGuildChannelMock.mockResolvedValueOnce(true);
+
+    const result = await resolveDiscordDmCommandAccess({
+      accountId: "default",
+      dmPolicy: "allowlist",
+      configuredAllowFrom: ["accessGroup:maintainers"],
+      sender,
+      allowNameMatching: false,
+      useAccessGroups: true,
+      cfg: {
+        accessGroups: {
+          maintainers: {
+            type: "discord.channelAudience",
+            guildId: "guild-1",
+            channelId: "channel-1",
+          },
+        },
+      },
+      token: "token",
+      readStoreAllowFrom: async () => [],
+    });
+
+    expect(canViewDiscordGuildChannelMock).toHaveBeenCalledWith(
+      "guild-1",
+      "channel-1",
+      "123",
+      expect.objectContaining({ accountId: "default", token: "token" }),
+    );
+    expect(result.decision).toBe("allow");
+    expect(result.commandAuthorized).toBe(true);
+  });
+
+  it("authorizes allowlist DMs from a generic message sender access group", async () => {
+    const result = await resolveDiscordDmCommandAccess({
+      accountId: "default",
+      dmPolicy: "allowlist",
+      configuredAllowFrom: ["accessGroup:owners"],
+      sender,
+      allowNameMatching: false,
+      useAccessGroups: true,
+      cfg: {
+        accessGroups: {
+          owners: {
+            type: "message.senders",
+            members: {
+              discord: ["discord:123"],
+              telegram: ["987"],
+            },
+          },
+        },
+      },
+      readStoreAllowFrom: async () => [],
+    });
+
+    expect(canViewDiscordGuildChannelMock).not.toHaveBeenCalled();
+    expect(result.decision).toBe("allow");
+    expect(result.commandAuthorized).toBe(true);
+  });
+
+  it("fails closed when a Discord channel audience access group lookup rejects", async () => {
+    canViewDiscordGuildChannelMock.mockRejectedValueOnce(new Error("missing intent"));
+
+    const result = await resolveDiscordDmCommandAccess({
+      accountId: "default",
+      dmPolicy: "allowlist",
+      configuredAllowFrom: ["accessGroup:maintainers"],
+      sender,
+      allowNameMatching: false,
+      useAccessGroups: true,
+      cfg: {
+        accessGroups: {
+          maintainers: {
+            type: "discord.channelAudience",
+            guildId: "guild-1",
+            channelId: "channel-1",
+          },
+        },
+      },
+      readStoreAllowFrom: async () => [],
+    });
+
+    expect(result.decision).toBe("block");
+    expect(result.commandAuthorized).toBe(false);
+  });
+
+  it("keeps open DM blocked without wildcard even when access groups are disabled", async () => {
+    const result = await resolveDiscordDmCommandAccess({
+      accountId: "default",
+      dmPolicy: "open",
+      configuredAllowFrom: [],
+      sender,
+      allowNameMatching: false,
+      useAccessGroups: false,
+      readStoreAllowFrom: async () => [],
+    });
+
+    expect(result.decision).toBe("block");
+    expect(result.commandAuthorized).toBe(false);
+  });
+});

package/src/monitor/dm-command-auth.ts

@@ -0,0 +1,158 @@
+import { expandAllowFromWithAccessGroups } from "openclaw/plugin-sdk/command-auth";
+import { resolveCommandAuthorizedFromAuthorizers } from "openclaw/plugin-sdk/command-auth-native";
+import type { OpenClawConfig } from "openclaw/plugin-sdk/config-types";
+import {
+  readStoreAllowFromForDmPolicy,
+  resolveDmGroupAccessWithLists,
+  type DmGroupAccessDecision,
+} from "openclaw/plugin-sdk/security-runtime";
+import type { RequestClient } from "../internal/discord.js";
+import { createDiscordAccessGroupMembershipResolver } from "./access-groups.js";
+import { normalizeDiscordAllowList, resolveDiscordAllowListMatch } from "./allow-list.js";
+
+const DISCORD_ALLOW_LIST_PREFIXES = ["discord:", "user:", "pk:"];
+
+export type DiscordDmPolicy = "open" | "pairing" | "allowlist" | "disabled";
+
+export type DiscordDmCommandAccess = {
+  decision: DmGroupAccessDecision;
+  reason: string;
+  commandAuthorized: boolean;
+  allowMatch: ReturnType<typeof resolveDiscordAllowListMatch> | { allowed: false };
+};
+
+function resolveSenderAllowMatch(params: {
+  allowEntries: string[];
+  sender: { id: string; name?: string; tag?: string };
+  allowNameMatching: boolean;
+}) {
+  const allowList = normalizeDiscordAllowList(params.allowEntries, DISCORD_ALLOW_LIST_PREFIXES);
+  return allowList
+    ? resolveDiscordAllowListMatch({
+        allowList,
+        candidate: params.sender,
+        allowNameMatching: params.allowNameMatching,
+      })
+    : ({ allowed: false } as const);
+}
+
+function resolveDmPolicyCommandAuthorization(params: {
+  decision: DmGroupAccessDecision;
+  commandAuthorized: boolean;
+}) {
+  return params.commandAuthorized;
+}
+
+async function expandAllowFromWithDiscordAccessGroups(params: {
+  cfg?: OpenClawConfig;
+  allowFrom: string[];
+  sender: { id: string };
+  accountId: string;
+  token?: string;
+  rest?: RequestClient;
+}) {
+  return await expandAllowFromWithAccessGroups({
+    cfg: params.cfg,
+    allowFrom: params.allowFrom,
+    channel: "discord",
+    accountId: params.accountId,
+    senderId: params.sender.id,
+    senderAllowEntry: `discord:${params.sender.id}`,
+    isSenderAllowed: (senderId, allowFrom) =>
+      resolveSenderAllowMatch({
+        allowEntries: allowFrom,
+        sender: { id: senderId },
+        allowNameMatching: false,
+      }).allowed,
+    resolveMembership: createDiscordAccessGroupMembershipResolver({
+      token: params.token,
+      rest: params.rest,
+    }),
+  });
+}
+
+export async function resolveDiscordDmCommandAccess(params: {
+  accountId: string;
+  dmPolicy: DiscordDmPolicy;
+  configuredAllowFrom: string[];
+  sender: { id: string; name?: string; tag?: string };
+  allowNameMatching: boolean;
+  useAccessGroups: boolean;
+  cfg?: OpenClawConfig;
+  token?: string;
+  rest?: RequestClient;
+  readStoreAllowFrom?: () => Promise<string[]>;
+}): Promise<DiscordDmCommandAccess> {
+  const storeAllowFrom = params.readStoreAllowFrom
+    ? params.dmPolicy === "open"
+      ? []
+      : await params.readStoreAllowFrom().catch(() => [])
+    : await readStoreAllowFromForDmPolicy({
+        provider: "discord",
+        accountId: params.accountId,
+        dmPolicy: params.dmPolicy,
+        shouldRead: params.dmPolicy !== "open",
+      });
+  const [configuredAllowFrom, effectiveStoreAllowFrom] = await Promise.all([
+    expandAllowFromWithDiscordAccessGroups({
+      cfg: params.cfg,
+      allowFrom: params.configuredAllowFrom,
+      sender: params.sender,
+      accountId: params.accountId,
+      token: params.token,
+      rest: params.rest,
+    }),
+    expandAllowFromWithDiscordAccessGroups({
+      cfg: params.cfg,
+      allowFrom: storeAllowFrom,
+      sender: params.sender,
+      accountId: params.accountId,
+      token: params.token,
+      rest: params.rest,
+    }),
+  ]);
+
+  const access = resolveDmGroupAccessWithLists({
+    isGroup: false,
+    dmPolicy: params.dmPolicy,
+    allowFrom: configuredAllowFrom,
+    groupAllowFrom: [],
+    storeAllowFrom: effectiveStoreAllowFrom,
+    isSenderAllowed: (allowEntries) =>
+      resolveSenderAllowMatch({
+        allowEntries,
+        sender: params.sender,
+        allowNameMatching: params.allowNameMatching,
+      }).allowed,
+  });
+
+  const allowMatch = resolveSenderAllowMatch({
+    allowEntries: access.effectiveAllowFrom,
+    sender: params.sender,
+    allowNameMatching: params.allowNameMatching,
+  });
+
+  const commandAuthorized = resolveCommandAuthorizedFromAuthorizers({
+    useAccessGroups: params.useAccessGroups,
+    authorizers: [
+      {
+        configured: access.effectiveAllowFrom.length > 0,
+        allowed: allowMatch.allowed,
+      },
+    ],
+    modeWhenAccessGroupsOff: "configured",
+  });
+
+  return {
+    decision: access.decision,
+    reason: access.reason,
+    commandAuthorized:
+      access.decision === "allow"
+        ? resolveDmPolicyCommandAuthorization({
+            decision: access.decision,
+            commandAuthorized,
+          })
+        : false,
+    allowMatch,
+  };
+}

package/src/monitor/dm-command-decision.test.ts

@@ -0,0 +1,113 @@
+import { describe, expect, it, vi } from "vitest";
+import type { DiscordDmCommandAccess } from "./dm-command-auth.js";
+import { handleDiscordDmCommandDecision } from "./dm-command-decision.js";
+
+function buildDmAccess(overrides: Partial<DiscordDmCommandAccess>): DiscordDmCommandAccess {
+  return {
+    decision: "allow",
+    reason: "ok",
+    commandAuthorized: true,
+    allowMatch: { allowed: true, matchKey: "123", matchSource: "id" },
+    ...overrides,
+  };
+}
+
+const TEST_ACCOUNT_ID = "default";
+const TEST_SENDER = { id: "123", tag: "alice#0001", name: "alice" };
+
+function createDmDecisionHarness(params?: { pairingCreated?: boolean }) {
+  const onPairingCreated = vi.fn(async () => {});
+  const onUnauthorized = vi.fn(async () => {});
+  const upsertPairingRequest = vi.fn(async () => ({
+    code: "PAIR-1",
+    created: params?.pairingCreated ?? true,
+  }));
+  return { onPairingCreated, onUnauthorized, upsertPairingRequest };
+}
+
+async function runPairingDecision(params?: { pairingCreated?: boolean }) {
+  const harness = createDmDecisionHarness({ pairingCreated: params?.pairingCreated });
+  const allowed = await handleDiscordDmCommandDecision({
+    dmAccess: buildDmAccess({
+      decision: "pairing",
+      commandAuthorized: false,
+      allowMatch: { allowed: false },
+    }),
+    accountId: TEST_ACCOUNT_ID,
+    sender: TEST_SENDER,
+    onPairingCreated: harness.onPairingCreated,
+    onUnauthorized: harness.onUnauthorized,
+    upsertPairingRequest: harness.upsertPairingRequest,
+  });
+  return { allowed, ...harness };
+}
+
+describe("handleDiscordDmCommandDecision", () => {
+  it("returns true for allowed DM access", async () => {
+    const { onPairingCreated, onUnauthorized, upsertPairingRequest } = createDmDecisionHarness();
+
+    const allowed = await handleDiscordDmCommandDecision({
+      dmAccess: buildDmAccess({ decision: "allow" }),
+      accountId: TEST_ACCOUNT_ID,
+      sender: TEST_SENDER,
+      onPairingCreated,
+      onUnauthorized,
+      upsertPairingRequest,
+    });
+
+    expect(allowed).toBe(true);
+    expect(upsertPairingRequest).not.toHaveBeenCalled();
+    expect(onPairingCreated).not.toHaveBeenCalled();
+    expect(onUnauthorized).not.toHaveBeenCalled();
+  });
+
+  it("creates pairing reply for new pairing requests", async () => {
+    const { allowed, onPairingCreated, onUnauthorized, upsertPairingRequest } =
+      await runPairingDecision();
+
+    expect(allowed).toBe(false);
+    expect(upsertPairingRequest).toHaveBeenCalledWith({
+      channel: "discord",
+      id: "123",
+      accountId: TEST_ACCOUNT_ID,
+      meta: {
+        tag: TEST_SENDER.tag,
+        name: TEST_SENDER.name,
+      },
+    });
+    expect(onPairingCreated).toHaveBeenCalledWith("PAIR-1");
+    expect(onUnauthorized).not.toHaveBeenCalled();
+  });
+
+  it("skips pairing reply when pairing request already exists", async () => {
+    const { allowed, onPairingCreated, onUnauthorized } = await runPairingDecision({
+      pairingCreated: false,
+    });
+
+    expect(allowed).toBe(false);
+    expect(onPairingCreated).not.toHaveBeenCalled();
+    expect(onUnauthorized).not.toHaveBeenCalled();
+  });
+
+  it("runs unauthorized handler for blocked DM access", async () => {
+    const { onPairingCreated, onUnauthorized, upsertPairingRequest } = createDmDecisionHarness();
+
+    const allowed = await handleDiscordDmCommandDecision({
+      dmAccess: buildDmAccess({
+        decision: "block",
+        commandAuthorized: false,
+        allowMatch: { allowed: false },
+      }),
+      accountId: TEST_ACCOUNT_ID,
+      sender: TEST_SENDER,
+      onPairingCreated,
+      onUnauthorized,
+      upsertPairingRequest,
+    });
+
+    expect(allowed).toBe(false);
+    expect(onUnauthorized).toHaveBeenCalledTimes(1);
+    expect(upsertPairingRequest).not.toHaveBeenCalled();
+    expect(onPairingCreated).not.toHaveBeenCalled();
+  });
+});

package/src/monitor/dm-command-decision.ts

@@ -0,0 +1,49 @@
+import { createChannelPairingChallengeIssuer } from "openclaw/plugin-sdk/channel-pairing";
+import { upsertChannelPairingRequest } from "openclaw/plugin-sdk/conversation-runtime";
+import type { DiscordDmCommandAccess } from "./dm-command-auth.js";
+
+export async function handleDiscordDmCommandDecision(params: {
+  dmAccess: DiscordDmCommandAccess;
+  accountId: string;
+  sender: {
+    id: string;
+    tag?: string;
+    name?: string;
+  };
+  onPairingCreated: (code: string) => Promise<void>;
+  onUnauthorized: () => Promise<void>;
+  upsertPairingRequest?: typeof upsertChannelPairingRequest;
+}): Promise<boolean> {
+  if (params.dmAccess.decision === "allow") {
+    return true;
+  }
+
+  if (params.dmAccess.decision === "pairing") {
+    const upsertPairingRequest = params.upsertPairingRequest ?? upsertChannelPairingRequest;
+    const result = await createChannelPairingChallengeIssuer({
+      channel: "discord",
+      upsertPairingRequest: async ({ id, meta }) =>
+        await upsertPairingRequest({
+          channel: "discord",
+          id,
+          accountId: params.accountId,
+          meta,
+        }),
+    })({
+      senderId: params.sender.id,
+      senderIdLine: `Your Discord user id: ${params.sender.id}`,
+      meta: {
+        tag: params.sender.tag,
+        name: params.sender.name,
+      },
+      sendPairingReply: async () => {},
+    });
+    if (result.created && result.code) {
+      await params.onPairingCreated(result.code);
+    }
+    return false;
+  }
+
+  await params.onUnauthorized();
+  return false;
+}