fix: fail closed missing provider group policy across message channels (#23367) (thanks @bmendonca3)

This commit is contained in:
Peter Steinberger
2026-02-22 12:17:44 +01:00
parent 78c3c2a542
commit 777817392d
45 changed files with 420 additions and 75 deletions

View File

@@ -18,12 +18,12 @@ describe("resolveSlackRuntimeGroupPolicy", () => {
expect(resolved.providerMissingFallbackApplied).toBe(false);
});
it("respects explicit global defaults", () => {
it("ignores explicit global defaults when provider config is missing", () => {
const resolved = __testing.resolveSlackRuntimeGroupPolicy({
providerConfigPresent: false,
defaultGroupPolicy: "open",
});
expect(resolved.groupPolicy).toBe("open");
expect(resolved.providerMissingFallbackApplied).toBe(false);
expect(resolved.groupPolicy).toBe("allowlist");
expect(resolved.providerMissingFallbackApplied).toBe(true);
});
});

View File

@@ -10,6 +10,7 @@ import {
summarizeMapping,
} from "../../channels/allowlists/resolve-utils.js";
import { loadConfig } from "../../config/config.js";
import { resolveRuntimeGroupPolicy } from "../../config/runtime-group-policy.js";
import type { SessionScope } from "../../config/sessions.js";
import type { GroupPolicy } from "../../config/types.base.js";
import { warn } from "../../globals.js";
@@ -50,15 +51,13 @@ function resolveSlackRuntimeGroupPolicy(params: {
groupPolicy: GroupPolicy;
providerMissingFallbackApplied: boolean;
} {
const groupPolicy =
params.groupPolicy ??
params.defaultGroupPolicy ??
(params.providerConfigPresent ? "open" : "allowlist");
const providerMissingFallbackApplied =
!params.providerConfigPresent &&
params.groupPolicy === undefined &&
params.defaultGroupPolicy === undefined;
return { groupPolicy, providerMissingFallbackApplied };
return resolveRuntimeGroupPolicy({
providerConfigPresent: params.providerConfigPresent,
groupPolicy: params.groupPolicy,
defaultGroupPolicy: params.defaultGroupPolicy,
configuredFallbackPolicy: "open",
missingProviderFallbackPolicy: "allowlist",
});
}
function parseApiAppIdFromAppToken(raw?: string) {