fix(line): require wildcard for open dm policy

extensions/line/src/config-schema.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from "vitest";
+import { LineConfigSchema } from "./config-schema.js";
+
+describe("LineConfigSchema", () => {
+  it('rejects dmPolicy="open" without wildcard allowFrom', () => {
+    const result = LineConfigSchema.safeParse({
+      channelAccessToken: "token",
+      channelSecret: "secret",
+      dmPolicy: "open",
+    });
+
+    expect(result.success).toBe(false);
+    expect(result.error.issues).toEqual([
+      expect.objectContaining({
+        path: ["allowFrom"],
+        message: 'channels.line.dmPolicy="open" requires channels.line.allowFrom to include "*"',
+      }),
+    ]);
+  });
+
+  it('accepts dmPolicy="open" with wildcard allowFrom', () => {
+    const result = LineConfigSchema.safeParse({
+      channelAccessToken: "token",
+      channelSecret: "secret",
+      dmPolicy: "open",
+      allowFrom: ["*"],
+    });
+
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects account dmPolicy="open" without wildcard allowFrom', () => {
+    const result = LineConfigSchema.safeParse({
+      accounts: {
+        work: {
+          channelAccessToken: "token",
+          channelSecret: "secret",
+          dmPolicy: "open",
+        },
+      },
+    });
+
+    expect(result.success).toBe(false);
+    expect(result.error.issues).toEqual([
+      expect.objectContaining({
+        path: ["accounts", "work", "allowFrom"],
+        message: 'channels.line.dmPolicy="open" requires channels.line.allowFrom to include "*"',
+      }),
+    ]);
+  });
+});

extensions/line/src/config-schema.ts

@@ -1,4 +1,8 @@
-import { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-schema";
+import {
+  buildChannelConfigSchema,
+  requireOpenAllowFrom,
+} from "openclaw/plugin-sdk/channel-config-schema";
+import { requireChannelOpenAllowFrom } from "openclaw/plugin-sdk/extension-shared";
 import { z } from "openclaw/plugin-sdk/zod";
 
 const DmPolicySchema = z.enum(["open", "allowlist", "pairing", "disabled"]);
@@ -15,7 +19,7 @@ const ThreadBindingsSchema = z
   })
   .strict();
 
-const LineCommonConfigSchema = z.object({
+const LineCommonConfigSchemaBase = z.object({
   enabled: z.boolean().optional(),
   channelAccessToken: z.string().optional(),
   channelSecret: z.string().optional(),
@@ -42,15 +46,35 @@ const LineGroupConfigSchema = z
   })
   .strict();
 
-const LineAccountConfigSchema = LineCommonConfigSchema.extend({
+const LineAccountConfigSchema = LineCommonConfigSchemaBase.extend({
   groups: z.record(z.string(), LineGroupConfigSchema.optional()).optional(),
-}).strict();
+})
+  .strict()
+  .superRefine((value, ctx) => {
+    requireChannelOpenAllowFrom({
+      channel: "line",
+      policy: value.dmPolicy,
+      allowFrom: value.allowFrom,
+      ctx,
+      requireOpenAllowFrom,
+    });
+  });
 
-export const LineConfigSchema = LineCommonConfigSchema.extend({
+export const LineConfigSchema = LineCommonConfigSchemaBase.extend({
   accounts: z.record(z.string(), LineAccountConfigSchema.optional()).optional(),
   defaultAccount: z.string().optional(),
   groups: z.record(z.string(), LineGroupConfigSchema.optional()).optional(),
-}).strict();
+})
+  .strict()
+  .superRefine((value, ctx) => {
+    requireChannelOpenAllowFrom({
+      channel: "line",
+      policy: value.dmPolicy,
+      allowFrom: value.allowFrom,
+      ctx,
+      requireOpenAllowFrom,
+    });
+  });
 
 export const LineChannelConfigSchema = buildChannelConfigSchema(LineConfigSchema);