mercury-agent 0.8.0 → 0.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",

package/src/core/global-admin.ts

@@ -2,10 +2,23 @@
  * Check if a caller is a global admin (configured in mercury.yaml / env).
  * Global admins are identified by `config.admins` and `config.dmAutoSpaceAdminIds`.
  * Platform-specific ID prefixes, + signs, and @domain suffixes are normalized.
+ *
+ * WhatsApp callers arrive canonicalized to their phone JID, but older configs
+ * may still list the LID digits (or vice versa when no mapping was known at
+ * config time). When an alias lookup is provided, the caller's learned
+ * LID↔phone counterpart is matched against the configured ids too.
  */
+
+/** Subset of Db used to resolve WhatsApp LID↔phone pairs. */
+export interface WaAliasLookup {
+  getWaPnForLid(lid: string): string | null;
+  getWaLidForPn(pn: string): string | null;
+}
+
 export function isGlobalAdmin(
   callerId: string,
   config: { admins?: string; dmAutoSpaceAdminIds?: string },
+  aliases?: WaAliasLookup,
 ): boolean {
   const globalAdmins = [
     ...(config.admins
@@ -28,9 +41,20 @@ export function isGlobalAdmin(
       .replace(/^[+]+/, "")
       .replace(/@.*$/, "");
 
-  const callerNormalized = normalize(callerId);
+  const callerCandidates = new Set([normalize(callerId)]);
+
+  if (aliases) {
+    const jid = callerId.replace(/^[^:]+:/, "");
+    if (jid.endsWith("@s.whatsapp.net")) {
+      const lid = aliases.getWaLidForPn(jid);
+      if (lid) callerCandidates.add(normalize(lid));
+    } else if (jid.endsWith("@lid")) {
+      const pn = aliases.getWaPnForLid(jid);
+      if (pn) callerCandidates.add(normalize(pn));
+    }
+  }
 
   return globalAdmins.some(
-    (id) => id === callerId || normalize(id) === callerNormalized,
+    (id) => id === callerId || callerCandidates.has(normalize(id)),
   );
 }

package/src/core/routes/broadcast.ts

@@ -7,13 +7,13 @@ export const broadcast = new Hono<Env>();
 
 broadcast.post("/", async (c) => {
   const { callerId } = getAuth(c);
-  const { config, runtime } = getApiCtx(c);
+  const { config, db, runtime } = getApiCtx(c);
 
   if (!config.dmAutoSpaceEnabled) {
     return c.json({ error: "dm_auto_space is not enabled" }, 503);
   }
 
-  if (!isGlobalAdmin(callerId, config)) {
+  if (!isGlobalAdmin(callerId, config, db)) {
     logger.warn("Broadcast denied — caller is not a global admin", {
       callerId,
     });

package/src/core/routes/character.ts

@@ -11,7 +11,7 @@ character.get("/", (c) => {
   const { callerId } = getAuth(c);
   const { config, db } = getApiCtx(c);
 
-  if (!isGlobalAdmin(callerId, config)) {
+  if (!isGlobalAdmin(callerId, config, db)) {
     logger.warn("Character get denied — caller is not a global admin", {
       callerId,
     });
@@ -28,7 +28,7 @@ character.put("/", async (c) => {
   const { callerId } = getAuth(c);
   const { config, db } = getApiCtx(c);
 
-  if (!isGlobalAdmin(callerId, config)) {
+  if (!isGlobalAdmin(callerId, config, db)) {
     logger.warn("Character set denied — caller is not a global admin", {
       callerId,
     });
@@ -57,7 +57,7 @@ character.delete("/", (c) => {
   const { callerId } = getAuth(c);
   const { config, db } = getApiCtx(c);
 
-  if (!isGlobalAdmin(callerId, config)) {
+  if (!isGlobalAdmin(callerId, config, db)) {
     logger.warn("Character clear denied — caller is not a global admin", {
       callerId,
     });

package/src/core/routes/send.ts

@@ -13,9 +13,9 @@ export const send = new Hono<Env>();
 
 send.post("/", async (c) => {
   const { callerId } = getAuth(c);
-  const { config, runtime } = getApiCtx(c);
+  const { config, db, runtime } = getApiCtx(c);
 
-  if (!isGlobalAdmin(callerId, config)) {
+  if (!isGlobalAdmin(callerId, config, db)) {
     logger.warn("Direct send denied — caller is not a global admin", {
       callerId,
     });