@openclaw/synology-chat 2026.5.9-beta.1 → 2026.5.10-beta.2

package/dist/api.js

@@ -1,3 +1,3 @@
-import { n as setSynologyRuntime, t as synologyChatPlugin } from "./channel-eRS88UFd.js";
+import { n as setSynologyRuntime, t as synologyChatPlugin } from "./channel-IPqYKUxY.js";
 import { t as collectSynologyChatSecurityAuditFindings } from "./security-audit-Zu_nkF2x.js";
 export { collectSynologyChatSecurityAuditFindings, setSynologyRuntime, synologyChatPlugin };

package/dist/{channel-eRS88UFd.js → channel-IPqYKUxY.js}

@@ -21,6 +21,7 @@ import { beginWebhookRequestPipelineOrReject, createFixedWindowRateLimiter, crea
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 import { buildAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import * as querystring from "node:querystring";
+import { resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
 import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
 //#region extensions/synology-chat/src/approval-auth.ts
 function normalizeSynologyChatApproverId(value) {
@@ -394,37 +395,23 @@ function validateToken(received, expected) {
 	if (!received || !expected) return false;
 	return safeEqualSecret(received, expected);
 }
-/**
-* Check if a user ID is in the allowed list.
-* Allowlist mode must be explicit; empty lists should not match any user.
-*/
-function checkUserAllowed(userId, allowedUserIds) {
-	if (allowedUserIds.length === 0) return false;
-	if (allowedUserIds.includes("*")) return true;
-	return allowedUserIds.includes(userId);
-}
-/**
-* Resolve DM authorization for a sender across all DM policy modes.
-* Keeps policy semantics in one place so webhook/startup behavior stays consistent.
-*/
-function authorizeUserForDm(userId, dmPolicy, allowedUserIds) {
-	if (dmPolicy === "disabled") return {
-		allowed: false,
-		reason: "disabled"
-	};
-	if (dmPolicy === "open") return checkUserAllowed(userId, allowedUserIds) ? { allowed: true } : {
-		allowed: false,
-		reason: "not-allowlisted"
-	};
-	if (allowedUserIds.length === 0) return {
-		allowed: false,
-		reason: "allowlist-empty"
-	};
-	if (!checkUserAllowed(userId, allowedUserIds)) return {
-		allowed: false,
-		reason: "not-allowlisted"
-	};
-	return { allowed: true };
+async function authorizeUserForDmWithIngress(params) {
+	return await resolveStableChannelMessageIngress({
+		channelId: "synology-chat",
+		accountId: params.accountId,
+		identity: {
+			key: "sender-id",
+			entryIdPrefix: "synology-chat-entry"
+		},
+		subject: { stableId: params.userId },
+		conversation: {
+			kind: "direct",
+			id: "direct"
+		},
+		event: { mayPair: false },
+		dmPolicy: params.dmPolicy,
+		allowFrom: params.allowedUserIds
+	});
 }
 /**
 * Sanitize user input to prevent prompt injection attacks.
@@ -722,7 +709,7 @@ async function parseWebhookPayloadRequest(params) {
 		payload
 	};
 }
-function authorizeSynologyWebhook(params) {
+async function authorizeSynologyWebhook(params) {
 	const invalidTokenRateLimitKey = getSynologyWebhookInvalidTokenRateLimitKey(params.req);
 	if (params.invalidTokenRateLimiter.isLocked(invalidTokenRateLimitKey)) {
 		params.log?.warn(`Rate limit exceeded for remote IP: ${invalidTokenRateLimitKey}`);
@@ -748,14 +735,19 @@ function authorizeSynologyWebhook(params) {
 			error: "Invalid token"
 		};
 	}
-	const auth = authorizeUserForDm(params.payload.user_id, params.account.dmPolicy, params.account.allowedUserIds);
-	if (!auth.allowed) {
-		if (auth.reason === "disabled") return {
+	const auth = await authorizeUserForDmWithIngress({
+		accountId: params.account.accountId,
+		userId: params.payload.user_id,
+		dmPolicy: params.account.dmPolicy,
+		allowedUserIds: params.account.allowedUserIds
+	});
+	if (!auth.senderAccess.allowed) {
+		if (auth.senderAccess.reasonCode === "dm_policy_disabled") return {
 			ok: false,
 			statusCode: 403,
 			error: "DMs are disabled"
 		};
-		if (auth.reason === "allowlist-empty") {
+		if (params.account.dmPolicy === "allowlist" && params.account.allowedUserIds.length === 0) {
 			params.log?.warn("Synology Chat allowlist is empty while dmPolicy=allowlist; rejecting message");
 			return {
 				ok: false,
@@ -780,7 +772,7 @@ function authorizeSynologyWebhook(params) {
 	}
 	return {
 		ok: true,
-		commandAuthorized: auth.allowed
+		commandAuthorized: auth.senderAccess.allowed
 	};
 }
 function sanitizeSynologyWebhookText(payload) {
@@ -791,7 +783,7 @@ function sanitizeSynologyWebhookText(payload) {
 async function parseAndAuthorizeSynologyWebhook(params) {
 	const parsed = await parseWebhookPayloadRequest(params);
 	if (!parsed.ok) return { ok: false };
-	const authorized = authorizeSynologyWebhook({
+	const authorized = await authorizeSynologyWebhook({
 		req: params.req,
 		account: params.account,
 		payload: parsed.payload,

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as synologyChatPlugin } from "./channel-eRS88UFd.js";
+import { t as synologyChatPlugin } from "./channel-IPqYKUxY.js";
 export { synologyChatPlugin };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/synology-chat",
-  "version": "2026.5.9-beta.1",
+  "version": "2026.5.10-beta.2",
   "description": "Synology Chat channel plugin for OpenClaw",
   "repository": {
     "type": "git",
@@ -30,10 +30,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.5.9-beta.1"
+      "pluginApi": ">=2026.5.10-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.5.9-beta.1"
+      "openclawVersion": "2026.5.10-beta.2"
     },
     "release": {
       "publishToClawHub": true,
@@ -49,7 +49,7 @@
     "openclaw.plugin.json"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.5.9-beta.1"
+    "openclaw": ">=2026.5.10-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {