@openclaw/whatsapp 2026.5.2 → 2026.5.3-beta.2

package/src/identity.ts

@@ -1,164 +0,0 @@
-import { jidToE164, normalizeE164 } from "./text-runtime.js";
-
-const WHATSAPP_LID_RE = /@(lid|hosted\.lid)$/i;
-
-export type WhatsAppIdentity = {
-  jid?: string | null;
-  lid?: string | null;
-  e164?: string | null;
-  name?: string | null;
-  label?: string | null;
-};
-
-export type WhatsAppSelfIdentity = {
-  jid?: string | null;
-  lid?: string | null;
-  e164?: string | null;
-};
-
-export type WhatsAppReplyContext = {
-  id?: string;
-  body: string;
-  sender?: WhatsAppIdentity | null;
-};
-
-type LegacySenderLike = {
-  sender?: WhatsAppIdentity;
-  senderJid?: string;
-  senderE164?: string;
-  senderName?: string;
-};
-
-type LegacySelfLike = {
-  self?: WhatsAppSelfIdentity;
-  selfJid?: string | null;
-  selfLid?: string | null;
-  selfE164?: string | null;
-};
-
-type LegacyReplyLike = {
-  replyTo?: WhatsAppReplyContext;
-  replyToId?: string;
-  replyToBody?: string;
-  replyToSender?: string;
-  replyToSenderJid?: string;
-  replyToSenderE164?: string;
-};
-
-type LegacyMentionsLike = {
-  mentions?: string[];
-  mentionedJids?: string[];
-};
-
-function normalizeDeviceScopedJid(jid: string | null | undefined): string | null {
-  return jid ? jid.replace(/:\d+/, "") : null;
-}
-
-function isLidJid(jid: string | null | undefined): boolean {
-  return Boolean(jid && WHATSAPP_LID_RE.test(jid));
-}
-
-export function resolveComparableIdentity(
-  identity: WhatsAppIdentity | WhatsAppSelfIdentity | null | undefined,
-  authDir?: string,
-): WhatsAppIdentity {
-  const rawJid = normalizeDeviceScopedJid(identity?.jid);
-  const rawLid = normalizeDeviceScopedJid(identity?.lid);
-  const lid = rawLid ?? (isLidJid(rawJid) ? rawJid : null);
-  const jid = rawJid && !isLidJid(rawJid) ? rawJid : null;
-  const e164 =
-    identity?.e164 != null
-      ? normalizeE164(identity.e164)
-      : ((jid ? jidToE164(jid, authDir ? { authDir } : undefined) : null) ??
-        (lid ? jidToE164(lid, authDir ? { authDir } : undefined) : null));
-  return {
-    ...identity,
-    jid,
-    lid,
-    e164,
-  };
-}
-
-export function getComparableIdentityValues(
-  identity: WhatsAppIdentity | WhatsAppSelfIdentity | null | undefined,
-): string[] {
-  const resolved = resolveComparableIdentity(identity);
-  return [resolved.e164, resolved.jid, resolved.lid].filter((value): value is string =>
-    Boolean(value),
-  );
-}
-
-export function identitiesOverlap(
-  left: WhatsAppIdentity | WhatsAppSelfIdentity | null | undefined,
-  right: WhatsAppIdentity | WhatsAppSelfIdentity | null | undefined,
-): boolean {
-  const leftValues = new Set(getComparableIdentityValues(left));
-  if (leftValues.size === 0) {
-    return false;
-  }
-  return getComparableIdentityValues(right).some((value) => leftValues.has(value));
-}
-
-export function getSenderIdentity(msg: LegacySenderLike, authDir?: string): WhatsAppIdentity {
-  return resolveComparableIdentity(
-    msg.sender ?? {
-      jid: msg.senderJid ?? null,
-      e164: msg.senderE164 ?? null,
-      name: msg.senderName ?? null,
-    },
-    authDir,
-  );
-}
-
-export function getSelfIdentity(msg: LegacySelfLike, authDir?: string): WhatsAppSelfIdentity {
-  return resolveComparableIdentity(
-    msg.self ?? {
-      jid: msg.selfJid ?? null,
-      lid: msg.selfLid ?? null,
-      e164: msg.selfE164 ?? null,
-    },
-    authDir,
-  );
-}
-
-export function getReplyContext(
-  msg: LegacyReplyLike,
-  authDir?: string,
-): WhatsAppReplyContext | null {
-  if (msg.replyTo) {
-    return {
-      ...msg.replyTo,
-      sender: resolveComparableIdentity(msg.replyTo.sender, authDir),
-    };
-  }
-  if (!msg.replyToBody) {
-    return null;
-  }
-  return {
-    id: msg.replyToId,
-    body: msg.replyToBody,
-    sender: resolveComparableIdentity(
-      {
-        jid: msg.replyToSenderJid ?? null,
-        e164: msg.replyToSenderE164 ?? null,
-        label: msg.replyToSender ?? null,
-      },
-      authDir,
-    ),
-  };
-}
-
-function getMentionJids(msg: LegacyMentionsLike): string[] {
-  return msg.mentions ?? msg.mentionedJids ?? [];
-}
-
-export function getMentionIdentities(
-  msg: LegacyMentionsLike,
-  authDir?: string,
-): WhatsAppIdentity[] {
-  return getMentionJids(msg).map((jid) => resolveComparableIdentity({ jid }, authDir));
-}
-
-export function getPrimaryIdentityId(identity: WhatsAppIdentity | null | undefined): string | null {
-  return identity?.e164 || identity?.jid?.trim() || identity?.lid || null;
-}

package/src/inbound/access-control.test-harness.ts

@@ -1,37 +0,0 @@
-import { beforeEach, vi } from "vitest";
-import {
-  type AsyncMock,
-  loadConfigMock,
-  readAllowFromStoreMock,
-  resetPairingSecurityMocks,
-  upsertPairingRequestMock,
-} from "../pairing-security.test-harness.js";
-
-export const sendMessageMock = vi.fn() as AsyncMock;
-export { readAllowFromStoreMock, upsertPairingRequestMock };
-
-let config: Record<string, unknown> = {};
-
-export function setAccessControlTestConfig(next: Record<string, unknown>): void {
-  config = next;
-  loadConfigMock.mockReturnValue(config);
-}
-
-export function getAccessControlTestConfig(): Record<string, unknown> {
-  return config;
-}
-
-export function setupAccessControlTestHarness(): void {
-  beforeEach(() => {
-    config = {
-      channels: {
-        whatsapp: {
-          dmPolicy: "pairing",
-          allowFrom: [],
-        },
-      },
-    };
-    sendMessageMock.mockReset().mockResolvedValue(undefined);
-    resetPairingSecurityMocks(config);
-  });
-}

package/src/inbound/access-control.test.ts

@@ -1,375 +0,0 @@
-import { beforeAll, describe, expect, it } from "vitest";
-import {
-  readAllowFromStoreMock,
-  sendMessageMock,
-  getAccessControlTestConfig,
-  setAccessControlTestConfig,
-  setupAccessControlTestHarness,
-  upsertPairingRequestMock,
-} from "./access-control.test-harness.js";
-
-setupAccessControlTestHarness();
-let checkInboundAccessControl: typeof import("./access-control.js").checkInboundAccessControl;
-let resolveWhatsAppCommandAuthorized: typeof import("../inbound-policy.js").resolveWhatsAppCommandAuthorized;
-
-beforeAll(async () => {
-  ({ checkInboundAccessControl } = await import("./access-control.js"));
-  ({ resolveWhatsAppCommandAuthorized } = await import("../inbound-policy.js"));
-});
-
-async function checkUnauthorizedWorkDmSender() {
-  return checkInboundAccessControl({
-    cfg: getAccessControlTestConfig() as never,
-    accountId: "work",
-    from: "+15550001111",
-    selfE164: "+15550009999",
-    senderE164: "+15550001111",
-    group: false,
-    pushName: "Stranger",
-    isFromMe: false,
-    sock: { sendMessage: sendMessageMock },
-    remoteJid: "15550001111@s.whatsapp.net",
-  });
-}
-
-function expectSilentlyBlocked(result: { allowed: boolean }) {
-  expect(result.allowed).toBe(false);
-  expect(upsertPairingRequestMock).not.toHaveBeenCalled();
-  expect(sendMessageMock).not.toHaveBeenCalled();
-}
-
-async function checkCommandAuthorizedForDm(params: {
-  cfg: Record<string, unknown>;
-  accountId?: string;
-  from?: string;
-  senderE164?: string;
-  selfE164?: string;
-}) {
-  return await resolveWhatsAppCommandAuthorized({
-    cfg: params.cfg as never,
-    msg: {
-      accountId: params.accountId ?? "work",
-      chatType: "direct",
-      from: params.from ?? "+15550001111",
-      senderE164: params.senderE164 ?? params.from ?? "+15550001111",
-      selfE164: params.selfE164 ?? "+15550009999",
-      body: "/status",
-      to: params.selfE164 ?? "+15550009999",
-    } as never,
-  });
-}
-
-async function checkCommandAuthorizedForGroup(params: {
-  cfg: Record<string, unknown>;
-  accountId?: string;
-  from?: string;
-  senderE164?: string;
-  selfE164?: string;
-}) {
-  return await resolveWhatsAppCommandAuthorized({
-    cfg: params.cfg as never,
-    msg: {
-      accountId: params.accountId ?? "work",
-      chatType: "group",
-      from: params.from ?? "120363401234567890@g.us",
-      conversationId: params.from ?? "120363401234567890@g.us",
-      chatId: params.from ?? "120363401234567890@g.us",
-      senderE164: params.senderE164 ?? "+15550001111",
-      selfE164: params.selfE164 ?? "+15550009999",
-      body: "/status",
-      to: params.selfE164 ?? "+15550009999",
-    } as never,
-  });
-}
-
-describe("checkInboundAccessControl pairing grace", () => {
-  async function runPairingGraceCase(messageTimestampMs: number) {
-    const connectedAtMs = 1_000_000;
-    return await checkInboundAccessControl({
-      cfg: getAccessControlTestConfig() as never,
-      accountId: "default",
-      from: "+15550001111",
-      selfE164: "+15550009999",
-      senderE164: "+15550001111",
-      group: false,
-      pushName: "Sam",
-      isFromMe: false,
-      messageTimestampMs,
-      connectedAtMs,
-      pairingGraceMs: 30_000,
-      sock: { sendMessage: sendMessageMock },
-      remoteJid: "15550001111@s.whatsapp.net",
-    });
-  }
-
-  it("suppresses pairing replies for historical DMs on connect", async () => {
-    const result = await runPairingGraceCase(1_000_000 - 31_000);
-
-    expect(result.allowed).toBe(false);
-    expect(upsertPairingRequestMock).not.toHaveBeenCalled();
-    expect(sendMessageMock).not.toHaveBeenCalled();
-  });
-
-  it("sends pairing replies for live DMs", async () => {
-    const result = await runPairingGraceCase(1_000_000 - 10_000);
-
-    expect(result.allowed).toBe(false);
-    expect(upsertPairingRequestMock).toHaveBeenCalled();
-    expect(sendMessageMock).toHaveBeenCalled();
-  });
-});
-
-describe("WhatsApp dmPolicy precedence", () => {
-  it("uses account-level dmPolicy instead of channel-level (#8736)", async () => {
-    // Channel-level says "pairing" but the account-level says "allowlist".
-    // The account-level override should take precedence, so an unauthorized
-    // sender should be blocked silently (no pairing reply).
-    const cfg = {
-      channels: {
-        whatsapp: {
-          dmPolicy: "pairing",
-          accounts: {
-            work: {
-              dmPolicy: "allowlist",
-              allowFrom: ["+15559999999"],
-            },
-          },
-        },
-      },
-    };
-    setAccessControlTestConfig(cfg);
-
-    const result = await checkUnauthorizedWorkDmSender();
-    const commandAuthorized = await checkCommandAuthorizedForDm({ cfg });
-    expectSilentlyBlocked(result);
-    expect(commandAuthorized).toBe(false);
-  });
-
-  it("inherits channel-level dmPolicy when account-level dmPolicy is unset", async () => {
-    // Account has allowFrom set, but no dmPolicy override. Should inherit the channel default.
-    // With dmPolicy=allowlist, unauthorized senders are silently blocked.
-    const cfg = {
-      channels: {
-        whatsapp: {
-          dmPolicy: "allowlist",
-          accounts: {
-            work: {
-              allowFrom: ["+15559999999"],
-            },
-          },
-        },
-      },
-    };
-    setAccessControlTestConfig(cfg);
-
-    const result = await checkUnauthorizedWorkDmSender();
-    const commandAuthorized = await checkCommandAuthorizedForDm({ cfg });
-    expectSilentlyBlocked(result);
-    expect(commandAuthorized).toBe(false);
-  });
-
-  it("does not merge persisted pairing approvals in allowlist mode", async () => {
-    const cfg = {
-      channels: {
-        whatsapp: {
-          dmPolicy: "allowlist",
-          accounts: {
-            work: {
-              allowFrom: ["+15559999999"],
-            },
-          },
-        },
-      },
-    };
-    setAccessControlTestConfig(cfg);
-    readAllowFromStoreMock.mockResolvedValue(["+15550001111"]);
-
-    const result = await checkUnauthorizedWorkDmSender();
-    const commandAuthorized = await checkCommandAuthorizedForDm({ cfg });
-
-    expectSilentlyBlocked(result);
-    expect(commandAuthorized).toBe(false);
-    expect(readAllowFromStoreMock).not.toHaveBeenCalled();
-  });
-
-  it("always allows same-phone DMs even when allowFrom is restrictive", async () => {
-    const cfg = {
-      channels: {
-        whatsapp: {
-          dmPolicy: "pairing",
-          allowFrom: ["+15550001111"],
-        },
-      },
-    };
-    setAccessControlTestConfig(cfg);
-
-    const result = await checkInboundAccessControl({
-      cfg: getAccessControlTestConfig() as never,
-      accountId: "default",
-      from: "+15550009999",
-      selfE164: "+15550009999",
-      senderE164: "+15550009999",
-      group: false,
-      pushName: "Owner",
-      isFromMe: false,
-      sock: { sendMessage: sendMessageMock },
-      remoteJid: "15550009999@s.whatsapp.net",
-    });
-    const commandAuthorized = await checkCommandAuthorizedForDm({
-      cfg,
-      accountId: "default",
-      from: "+15550009999",
-      senderE164: "+15550009999",
-      selfE164: "+15550009999",
-    });
-
-    expect(result.allowed).toBe(true);
-    expect(commandAuthorized).toBe(true);
-    expect(upsertPairingRequestMock).not.toHaveBeenCalled();
-    expect(sendMessageMock).not.toHaveBeenCalled();
-  });
-
-  it("allows DMs from generic message sender access groups", async () => {
-    const cfg = {
-      accessGroups: {
-        owners: {
-          type: "message.senders",
-          members: {
-            whatsapp: ["+15550001111"],
-          },
-        },
-      },
-      channels: {
-        whatsapp: {
-          dmPolicy: "allowlist",
-          accounts: {
-            work: {
-              allowFrom: ["accessGroup:owners"],
-            },
-          },
-        },
-      },
-    };
-    setAccessControlTestConfig(cfg);
-
-    const result = await checkInboundAccessControl({
-      cfg: getAccessControlTestConfig() as never,
-      accountId: "work",
-      from: "+15550001111",
-      selfE164: "+15550009999",
-      senderE164: "+15550001111",
-      group: false,
-      pushName: "Sam",
-      isFromMe: false,
-      sock: { sendMessage: sendMessageMock },
-      remoteJid: "15550001111@s.whatsapp.net",
-    });
-    const commandAuthorized = await checkCommandAuthorizedForDm({ cfg });
-
-    expect(result.allowed).toBe(true);
-    expect(commandAuthorized).toBe(true);
-    expect(upsertPairingRequestMock).not.toHaveBeenCalled();
-    expect(sendMessageMock).not.toHaveBeenCalled();
-  });
-
-  it("allows group messages from generic message sender access groups", async () => {
-    const cfg = {
-      accessGroups: {
-        operators: {
-          type: "message.senders",
-          members: {
-            whatsapp: ["+15550001111"],
-          },
-        },
-      },
-      channels: {
-        whatsapp: {
-          dmPolicy: "allowlist",
-          groupPolicy: "allowlist",
-          groupAllowFrom: ["accessGroup:operators"],
-          accounts: {
-            work: {
-              allowFrom: ["+15559999999"],
-            },
-          },
-        },
-      },
-    };
-    setAccessControlTestConfig(cfg);
-
-    const result = await checkInboundAccessControl({
-      cfg: getAccessControlTestConfig() as never,
-      accountId: "work",
-      from: "120363401234567890@g.us",
-      selfE164: "+15550009999",
-      senderE164: "+15550001111",
-      group: true,
-      pushName: "Sam",
-      isFromMe: false,
-      sock: { sendMessage: sendMessageMock },
-      remoteJid: "120363401234567890@g.us",
-    });
-    const commandAuthorized = await checkCommandAuthorizedForGroup({ cfg });
-
-    expect(result.allowed).toBe(true);
-    expect(commandAuthorized).toBe(true);
-    expect(upsertPairingRequestMock).not.toHaveBeenCalled();
-    expect(sendMessageMock).not.toHaveBeenCalled();
-  });
-
-  it("does not broaden self-chat mode to every paired DM when allowFrom is empty", async () => {
-    const cfg = {
-      channels: {
-        whatsapp: {
-          dmPolicy: "pairing",
-          allowFrom: [],
-        },
-      },
-    };
-    setAccessControlTestConfig(cfg);
-
-    const result = await checkInboundAccessControl({
-      cfg: getAccessControlTestConfig() as never,
-      accountId: "default",
-      from: "+15550001111",
-      selfE164: "+15550009999",
-      senderE164: "+15550001111",
-      group: false,
-      pushName: "Sam",
-      isFromMe: false,
-      sock: { sendMessage: sendMessageMock },
-      remoteJid: "15550001111@s.whatsapp.net",
-    });
-
-    expect(result.allowed).toBe(false);
-    expect(result.isSelfChat).toBe(false);
-  });
-
-  it("treats same-phone DMs as self-chat only when explicitly configured", async () => {
-    const cfg = {
-      channels: {
-        whatsapp: {
-          dmPolicy: "pairing",
-          allowFrom: ["+15550009999"],
-        },
-      },
-    };
-    setAccessControlTestConfig(cfg);
-
-    const result = await checkInboundAccessControl({
-      cfg: getAccessControlTestConfig() as never,
-      accountId: "default",
-      from: "+15550009999",
-      selfE164: "+15550009999",
-      senderE164: "+15550009999",
-      group: false,
-      pushName: "Owner",
-      isFromMe: false,
-      sock: { sendMessage: sendMessageMock },
-      remoteJid: "15550009999@s.whatsapp.net",
-    });
-
-    expect(result.allowed).toBe(true);
-    expect(result.isSelfChat).toBe(true);
-  });
-});