Route sensitive group commands to the owner privately (#73872)

* fix(commands): route sensitive group approvals privately

* fix(commands): require owner private routes

* test(commands): cover owner-derived Telegram diagnostics routing
This commit is contained in:
pashpashpash
2026-04-28 17:27:18 -07:00
committed by GitHub
parent e94e9347a4
commit 4aa8da3756
10 changed files with 500 additions and 44 deletions

View File

@@ -165,6 +165,25 @@ describe("telegram exec approvals", () => {
expect(isTelegramExecApprovalApprover({ cfg, senderId: "67890" })).toBe(true);
});
it("does not require explicit Telegram exec approvers when command owner identifies the Telegram operator", () => {
const cfg = {
...buildConfig(),
commands: {
ownerAllowFrom: ["telegram:12345"],
},
} as OpenClawConfig;
expect(cfg.channels?.telegram?.execApprovals?.approvers).toBeUndefined();
expect(getTelegramExecApprovalApprovers({ cfg })).toEqual(["12345"]);
expect(isTelegramExecApprovalClientEnabled({ cfg })).toBe(true);
expect(
shouldHandleTelegramExecApprovalRequest({
cfg,
request: makeForeignChannelApprovalRequest({ id: "discord-diagnostics" }),
}),
).toBe(true);
});
it("does not infer approvers from Telegram chat allowlists", () => {
const cfg = buildConfig(
{ enabled: true },