@openclaw/discord 2026.5.2 → 2026.5.3-beta.2

package/src/monitor/commands.test.ts

@@ -1,24 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { resolveDiscordSlashCommandConfig } from "./commands.js";
-
-describe("resolveDiscordSlashCommandConfig", () => {
-  it("defaults ephemeral to true when undefined", () => {
-    const result = resolveDiscordSlashCommandConfig(undefined);
-    expect(result.ephemeral).toBe(true);
-  });
-
-  it("defaults ephemeral to true when not explicitly false", () => {
-    const result = resolveDiscordSlashCommandConfig({});
-    expect(result.ephemeral).toBe(true);
-  });
-
-  it("sets ephemeral to false when explicitly false", () => {
-    const result = resolveDiscordSlashCommandConfig({ ephemeral: false });
-    expect(result.ephemeral).toBe(false);
-  });
-
-  it("keeps ephemeral true when explicitly true", () => {
-    const result = resolveDiscordSlashCommandConfig({ ephemeral: true });
-    expect(result.ephemeral).toBe(true);
-  });
-});

package/src/monitor/commands.ts

@@ -1,9 +0,0 @@
-import type { DiscordSlashCommandConfig } from "openclaw/plugin-sdk/config-types";
-
-export function resolveDiscordSlashCommandConfig(
-  raw?: DiscordSlashCommandConfig,
-): Required<DiscordSlashCommandConfig> {
-  return {
-    ephemeral: raw?.ephemeral !== false,
-  };
-}

package/src/monitor/dm-command-auth.test.ts

@@ -1,197 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import { resolveDiscordDmCommandAccess } from "./dm-command-auth.js";
-
-const canViewDiscordGuildChannelMock = vi.hoisted(() => vi.fn());
-
-vi.mock("../send.permissions.js", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("../send.permissions.js")>();
-  return {
-    ...actual,
-    canViewDiscordGuildChannel: canViewDiscordGuildChannelMock,
-  };
-});
-
-describe("resolveDiscordDmCommandAccess", () => {
-  const sender = {
-    id: "123",
-    name: "alice",
-    tag: "alice#0001",
-  };
-
-  beforeEach(() => {
-    canViewDiscordGuildChannelMock.mockReset();
-  });
-
-  async function resolveOpenDmAccess(configuredAllowFrom: string[]) {
-    return await resolveDiscordDmCommandAccess({
-      accountId: "default",
-      dmPolicy: "open",
-      configuredAllowFrom,
-      sender,
-      allowNameMatching: false,
-      useAccessGroups: true,
-      readStoreAllowFrom: async () => [],
-    });
-  }
-
-  it("blocks open DMs without allowlist wildcard entries", async () => {
-    const result = await resolveOpenDmAccess([]);
-
-    expect(result.decision).toBe("block");
-    expect(result.commandAuthorized).toBe(false);
-  });
-
-  it("marks command auth true when sender is allowlisted", async () => {
-    const result = await resolveOpenDmAccess(["discord:123"]);
-
-    expect(result.decision).toBe("allow");
-    expect(result.commandAuthorized).toBe(true);
-  });
-
-  it("blocks open DMs when configured allowlist does not match", async () => {
-    const result = await resolveDiscordDmCommandAccess({
-      accountId: "default",
-      dmPolicy: "open",
-      configuredAllowFrom: ["discord:999"],
-      sender,
-      allowNameMatching: false,
-      useAccessGroups: true,
-      readStoreAllowFrom: async () => [],
-    });
-
-    expect(result.decision).toBe("block");
-    expect(result.allowMatch.allowed).toBe(false);
-    expect(result.commandAuthorized).toBe(false);
-  });
-
-  it("returns pairing decision and unauthorized command auth for unknown senders", async () => {
-    const result = await resolveDiscordDmCommandAccess({
-      accountId: "default",
-      dmPolicy: "pairing",
-      configuredAllowFrom: ["discord:456"],
-      sender,
-      allowNameMatching: false,
-      useAccessGroups: true,
-      readStoreAllowFrom: async () => [],
-    });
-
-    expect(result.decision).toBe("pairing");
-    expect(result.commandAuthorized).toBe(false);
-  });
-
-  it("authorizes sender from pairing-store allowlist entries", async () => {
-    const result = await resolveDiscordDmCommandAccess({
-      accountId: "default",
-      dmPolicy: "pairing",
-      configuredAllowFrom: [],
-      sender,
-      allowNameMatching: false,
-      useAccessGroups: true,
-      readStoreAllowFrom: async () => ["discord:123"],
-    });
-
-    expect(result.decision).toBe("allow");
-    expect(result.commandAuthorized).toBe(true);
-  });
-
-  it("authorizes allowlist DMs from a Discord channel audience access group", async () => {
-    canViewDiscordGuildChannelMock.mockResolvedValueOnce(true);
-
-    const result = await resolveDiscordDmCommandAccess({
-      accountId: "default",
-      dmPolicy: "allowlist",
-      configuredAllowFrom: ["accessGroup:maintainers"],
-      sender,
-      allowNameMatching: false,
-      useAccessGroups: true,
-      cfg: {
-        accessGroups: {
-          maintainers: {
-            type: "discord.channelAudience",
-            guildId: "guild-1",
-            channelId: "channel-1",
-          },
-        },
-      },
-      token: "token",
-      readStoreAllowFrom: async () => [],
-    });
-
-    expect(canViewDiscordGuildChannelMock).toHaveBeenCalledWith(
-      "guild-1",
-      "channel-1",
-      "123",
-      expect.objectContaining({ accountId: "default", token: "token" }),
-    );
-    expect(result.decision).toBe("allow");
-    expect(result.commandAuthorized).toBe(true);
-  });
-
-  it("authorizes allowlist DMs from a generic message sender access group", async () => {
-    const result = await resolveDiscordDmCommandAccess({
-      accountId: "default",
-      dmPolicy: "allowlist",
-      configuredAllowFrom: ["accessGroup:owners"],
-      sender,
-      allowNameMatching: false,
-      useAccessGroups: true,
-      cfg: {
-        accessGroups: {
-          owners: {
-            type: "message.senders",
-            members: {
-              discord: ["discord:123"],
-              telegram: ["987"],
-            },
-          },
-        },
-      },
-      readStoreAllowFrom: async () => [],
-    });
-
-    expect(canViewDiscordGuildChannelMock).not.toHaveBeenCalled();
-    expect(result.decision).toBe("allow");
-    expect(result.commandAuthorized).toBe(true);
-  });
-
-  it("fails closed when a Discord channel audience access group lookup rejects", async () => {
-    canViewDiscordGuildChannelMock.mockRejectedValueOnce(new Error("missing intent"));
-
-    const result = await resolveDiscordDmCommandAccess({
-      accountId: "default",
-      dmPolicy: "allowlist",
-      configuredAllowFrom: ["accessGroup:maintainers"],
-      sender,
-      allowNameMatching: false,
-      useAccessGroups: true,
-      cfg: {
-        accessGroups: {
-          maintainers: {
-            type: "discord.channelAudience",
-            guildId: "guild-1",
-            channelId: "channel-1",
-          },
-        },
-      },
-      readStoreAllowFrom: async () => [],
-    });
-
-    expect(result.decision).toBe("block");
-    expect(result.commandAuthorized).toBe(false);
-  });
-
-  it("keeps open DM blocked without wildcard even when access groups are disabled", async () => {
-    const result = await resolveDiscordDmCommandAccess({
-      accountId: "default",
-      dmPolicy: "open",
-      configuredAllowFrom: [],
-      sender,
-      allowNameMatching: false,
-      useAccessGroups: false,
-      readStoreAllowFrom: async () => [],
-    });
-
-    expect(result.decision).toBe("block");
-    expect(result.commandAuthorized).toBe(false);
-  });
-});

package/src/monitor/dm-command-auth.ts

@@ -1,158 +0,0 @@
-import { expandAllowFromWithAccessGroups } from "openclaw/plugin-sdk/command-auth";
-import { resolveCommandAuthorizedFromAuthorizers } from "openclaw/plugin-sdk/command-auth-native";
-import type { OpenClawConfig } from "openclaw/plugin-sdk/config-types";
-import {
-  readStoreAllowFromForDmPolicy,
-  resolveDmGroupAccessWithLists,
-  type DmGroupAccessDecision,
-} from "openclaw/plugin-sdk/security-runtime";
-import type { RequestClient } from "../internal/discord.js";
-import { createDiscordAccessGroupMembershipResolver } from "./access-groups.js";
-import { normalizeDiscordAllowList, resolveDiscordAllowListMatch } from "./allow-list.js";
-
-const DISCORD_ALLOW_LIST_PREFIXES = ["discord:", "user:", "pk:"];
-
-export type DiscordDmPolicy = "open" | "pairing" | "allowlist" | "disabled";
-
-export type DiscordDmCommandAccess = {
-  decision: DmGroupAccessDecision;
-  reason: string;
-  commandAuthorized: boolean;
-  allowMatch: ReturnType<typeof resolveDiscordAllowListMatch> | { allowed: false };
-};
-
-function resolveSenderAllowMatch(params: {
-  allowEntries: string[];
-  sender: { id: string; name?: string; tag?: string };
-  allowNameMatching: boolean;
-}) {
-  const allowList = normalizeDiscordAllowList(params.allowEntries, DISCORD_ALLOW_LIST_PREFIXES);
-  return allowList
-    ? resolveDiscordAllowListMatch({
-        allowList,
-        candidate: params.sender,
-        allowNameMatching: params.allowNameMatching,
-      })
-    : ({ allowed: false } as const);
-}
-
-function resolveDmPolicyCommandAuthorization(params: {
-  decision: DmGroupAccessDecision;
-  commandAuthorized: boolean;
-}) {
-  return params.commandAuthorized;
-}
-
-async function expandAllowFromWithDiscordAccessGroups(params: {
-  cfg?: OpenClawConfig;
-  allowFrom: string[];
-  sender: { id: string };
-  accountId: string;
-  token?: string;
-  rest?: RequestClient;
-}) {
-  return await expandAllowFromWithAccessGroups({
-    cfg: params.cfg,
-    allowFrom: params.allowFrom,
-    channel: "discord",
-    accountId: params.accountId,
-    senderId: params.sender.id,
-    senderAllowEntry: `discord:${params.sender.id}`,
-    isSenderAllowed: (senderId, allowFrom) =>
-      resolveSenderAllowMatch({
-        allowEntries: allowFrom,
-        sender: { id: senderId },
-        allowNameMatching: false,
-      }).allowed,
-    resolveMembership: createDiscordAccessGroupMembershipResolver({
-      token: params.token,
-      rest: params.rest,
-    }),
-  });
-}
-
-export async function resolveDiscordDmCommandAccess(params: {
-  accountId: string;
-  dmPolicy: DiscordDmPolicy;
-  configuredAllowFrom: string[];
-  sender: { id: string; name?: string; tag?: string };
-  allowNameMatching: boolean;
-  useAccessGroups: boolean;
-  cfg?: OpenClawConfig;
-  token?: string;
-  rest?: RequestClient;
-  readStoreAllowFrom?: () => Promise<string[]>;
-}): Promise<DiscordDmCommandAccess> {
-  const storeAllowFrom = params.readStoreAllowFrom
-    ? params.dmPolicy === "open"
-      ? []
-      : await params.readStoreAllowFrom().catch(() => [])
-    : await readStoreAllowFromForDmPolicy({
-        provider: "discord",
-        accountId: params.accountId,
-        dmPolicy: params.dmPolicy,
-        shouldRead: params.dmPolicy !== "open",
-      });
-  const [configuredAllowFrom, effectiveStoreAllowFrom] = await Promise.all([
-    expandAllowFromWithDiscordAccessGroups({
-      cfg: params.cfg,
-      allowFrom: params.configuredAllowFrom,
-      sender: params.sender,
-      accountId: params.accountId,
-      token: params.token,
-      rest: params.rest,
-    }),
-    expandAllowFromWithDiscordAccessGroups({
-      cfg: params.cfg,
-      allowFrom: storeAllowFrom,
-      sender: params.sender,
-      accountId: params.accountId,
-      token: params.token,
-      rest: params.rest,
-    }),
-  ]);
-
-  const access = resolveDmGroupAccessWithLists({
-    isGroup: false,
-    dmPolicy: params.dmPolicy,
-    allowFrom: configuredAllowFrom,
-    groupAllowFrom: [],
-    storeAllowFrom: effectiveStoreAllowFrom,
-    isSenderAllowed: (allowEntries) =>
-      resolveSenderAllowMatch({
-        allowEntries,
-        sender: params.sender,
-        allowNameMatching: params.allowNameMatching,
-      }).allowed,
-  });
-
-  const allowMatch = resolveSenderAllowMatch({
-    allowEntries: access.effectiveAllowFrom,
-    sender: params.sender,
-    allowNameMatching: params.allowNameMatching,
-  });
-
-  const commandAuthorized = resolveCommandAuthorizedFromAuthorizers({
-    useAccessGroups: params.useAccessGroups,
-    authorizers: [
-      {
-        configured: access.effectiveAllowFrom.length > 0,
-        allowed: allowMatch.allowed,
-      },
-    ],
-    modeWhenAccessGroupsOff: "configured",
-  });
-
-  return {
-    decision: access.decision,
-    reason: access.reason,
-    commandAuthorized:
-      access.decision === "allow"
-        ? resolveDmPolicyCommandAuthorization({
-            decision: access.decision,
-            commandAuthorized,
-          })
-        : false,
-    allowMatch,
-  };
-}

package/src/monitor/dm-command-decision.test.ts

@@ -1,113 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import type { DiscordDmCommandAccess } from "./dm-command-auth.js";
-import { handleDiscordDmCommandDecision } from "./dm-command-decision.js";
-
-function buildDmAccess(overrides: Partial<DiscordDmCommandAccess>): DiscordDmCommandAccess {
-  return {
-    decision: "allow",
-    reason: "ok",
-    commandAuthorized: true,
-    allowMatch: { allowed: true, matchKey: "123", matchSource: "id" },
-    ...overrides,
-  };
-}
-
-const TEST_ACCOUNT_ID = "default";
-const TEST_SENDER = { id: "123", tag: "alice#0001", name: "alice" };
-
-function createDmDecisionHarness(params?: { pairingCreated?: boolean }) {
-  const onPairingCreated = vi.fn(async () => {});
-  const onUnauthorized = vi.fn(async () => {});
-  const upsertPairingRequest = vi.fn(async () => ({
-    code: "PAIR-1",
-    created: params?.pairingCreated ?? true,
-  }));
-  return { onPairingCreated, onUnauthorized, upsertPairingRequest };
-}
-
-async function runPairingDecision(params?: { pairingCreated?: boolean }) {
-  const harness = createDmDecisionHarness({ pairingCreated: params?.pairingCreated });
-  const allowed = await handleDiscordDmCommandDecision({
-    dmAccess: buildDmAccess({
-      decision: "pairing",
-      commandAuthorized: false,
-      allowMatch: { allowed: false },
-    }),
-    accountId: TEST_ACCOUNT_ID,
-    sender: TEST_SENDER,
-    onPairingCreated: harness.onPairingCreated,
-    onUnauthorized: harness.onUnauthorized,
-    upsertPairingRequest: harness.upsertPairingRequest,
-  });
-  return { allowed, ...harness };
-}
-
-describe("handleDiscordDmCommandDecision", () => {
-  it("returns true for allowed DM access", async () => {
-    const { onPairingCreated, onUnauthorized, upsertPairingRequest } = createDmDecisionHarness();
-
-    const allowed = await handleDiscordDmCommandDecision({
-      dmAccess: buildDmAccess({ decision: "allow" }),
-      accountId: TEST_ACCOUNT_ID,
-      sender: TEST_SENDER,
-      onPairingCreated,
-      onUnauthorized,
-      upsertPairingRequest,
-    });
-
-    expect(allowed).toBe(true);
-    expect(upsertPairingRequest).not.toHaveBeenCalled();
-    expect(onPairingCreated).not.toHaveBeenCalled();
-    expect(onUnauthorized).not.toHaveBeenCalled();
-  });
-
-  it("creates pairing reply for new pairing requests", async () => {
-    const { allowed, onPairingCreated, onUnauthorized, upsertPairingRequest } =
-      await runPairingDecision();
-
-    expect(allowed).toBe(false);
-    expect(upsertPairingRequest).toHaveBeenCalledWith({
-      channel: "discord",
-      id: "123",
-      accountId: TEST_ACCOUNT_ID,
-      meta: {
-        tag: TEST_SENDER.tag,
-        name: TEST_SENDER.name,
-      },
-    });
-    expect(onPairingCreated).toHaveBeenCalledWith("PAIR-1");
-    expect(onUnauthorized).not.toHaveBeenCalled();
-  });
-
-  it("skips pairing reply when pairing request already exists", async () => {
-    const { allowed, onPairingCreated, onUnauthorized } = await runPairingDecision({
-      pairingCreated: false,
-    });
-
-    expect(allowed).toBe(false);
-    expect(onPairingCreated).not.toHaveBeenCalled();
-    expect(onUnauthorized).not.toHaveBeenCalled();
-  });
-
-  it("runs unauthorized handler for blocked DM access", async () => {
-    const { onPairingCreated, onUnauthorized, upsertPairingRequest } = createDmDecisionHarness();
-
-    const allowed = await handleDiscordDmCommandDecision({
-      dmAccess: buildDmAccess({
-        decision: "block",
-        commandAuthorized: false,
-        allowMatch: { allowed: false },
-      }),
-      accountId: TEST_ACCOUNT_ID,
-      sender: TEST_SENDER,
-      onPairingCreated,
-      onUnauthorized,
-      upsertPairingRequest,
-    });
-
-    expect(allowed).toBe(false);
-    expect(onUnauthorized).toHaveBeenCalledTimes(1);
-    expect(upsertPairingRequest).not.toHaveBeenCalled();
-    expect(onPairingCreated).not.toHaveBeenCalled();
-  });
-});

package/src/monitor/dm-command-decision.ts

@@ -1,49 +0,0 @@
-import { createChannelPairingChallengeIssuer } from "openclaw/plugin-sdk/channel-pairing";
-import { upsertChannelPairingRequest } from "openclaw/plugin-sdk/conversation-runtime";
-import type { DiscordDmCommandAccess } from "./dm-command-auth.js";
-
-export async function handleDiscordDmCommandDecision(params: {
-  dmAccess: DiscordDmCommandAccess;
-  accountId: string;
-  sender: {
-    id: string;
-    tag?: string;
-    name?: string;
-  };
-  onPairingCreated: (code: string) => Promise<void>;
-  onUnauthorized: () => Promise<void>;
-  upsertPairingRequest?: typeof upsertChannelPairingRequest;
-}): Promise<boolean> {
-  if (params.dmAccess.decision === "allow") {
-    return true;
-  }
-
-  if (params.dmAccess.decision === "pairing") {
-    const upsertPairingRequest = params.upsertPairingRequest ?? upsertChannelPairingRequest;
-    const result = await createChannelPairingChallengeIssuer({
-      channel: "discord",
-      upsertPairingRequest: async ({ id, meta }) =>
-        await upsertPairingRequest({
-          channel: "discord",
-          id,
-          accountId: params.accountId,
-          meta,
-        }),
-    })({
-      senderId: params.sender.id,
-      senderIdLine: `Your Discord user id: ${params.sender.id}`,
-      meta: {
-        tag: params.sender.tag,
-        name: params.sender.name,
-      },
-      sendPairingReply: async () => {},
-    });
-    if (result.created && result.code) {
-      await params.onPairingCreated(result.code);
-    }
-    return false;
-  }
-
-  await params.onUnauthorized();
-  return false;
-}