refactor: share native approval delivery helpers

src/plugin-sdk/approval-delivery-helpers.test.ts

@@ -0,0 +1,121 @@
+import { describe, expect, it, vi } from "vitest";
+import { createApproverRestrictedNativeApprovalAdapter } from "./approval-delivery-helpers.js";
+
+describe("createApproverRestrictedNativeApprovalAdapter", () => {
+  it("uses approver-restricted authorization for exec and plugin commands", () => {
+    const adapter = createApproverRestrictedNativeApprovalAdapter({
+      channel: "discord",
+      channelLabel: "Discord",
+      listAccountIds: () => ["work"],
+      hasApprovers: ({ accountId }) => accountId === "work",
+      isExecAuthorizedSender: ({ senderId }) => senderId === "exec-owner",
+      isPluginAuthorizedSender: ({ senderId }) => senderId === "plugin-owner",
+      isNativeDeliveryEnabled: () => true,
+      resolveNativeDeliveryMode: () => "dm",
+    });
+
+    expect(
+      adapter.authorizeCommand({
+        cfg: {} as never,
+        accountId: "work",
+        senderId: "exec-owner",
+        kind: "exec",
+      }),
+    ).toEqual({ authorized: true });
+
+    expect(
+      adapter.authorizeCommand({
+        cfg: {} as never,
+        accountId: "work",
+        senderId: "plugin-owner",
+        kind: "plugin",
+      }),
+    ).toEqual({ authorized: true });
+
+    expect(
+      adapter.authorizeCommand({
+        cfg: {} as never,
+        accountId: "work",
+        senderId: "someone-else",
+        kind: "plugin",
+      }),
+    ).toEqual({
+      authorized: false,
+      reason: "❌ You are not authorized to approve plugin requests on Discord.",
+    });
+  });
+
+  it("reports initiating-surface state and DM routing from configured approvers", () => {
+    const adapter = createApproverRestrictedNativeApprovalAdapter({
+      channel: "telegram",
+      channelLabel: "Telegram",
+      listAccountIds: () => ["dm-only", "channel-only", "disabled", "no-approvers"],
+      hasApprovers: ({ accountId }) => accountId !== "no-approvers",
+      isExecAuthorizedSender: () => true,
+      isNativeDeliveryEnabled: ({ accountId }) => accountId !== "disabled",
+      resolveNativeDeliveryMode: ({ accountId }) =>
+        accountId === "channel-only" ? "channel" : "dm",
+    });
+
+    expect(adapter.getInitiatingSurfaceState({ cfg: {} as never, accountId: "dm-only" })).toEqual({
+      kind: "enabled",
+    });
+    expect(
+      adapter.getInitiatingSurfaceState({ cfg: {} as never, accountId: "no-approvers" }),
+    ).toEqual({ kind: "disabled" });
+    expect(adapter.hasConfiguredDmRoute({ cfg: {} as never })).toBe(true);
+  });
+
+  it("suppresses forwarding fallback only for matching native-delivery surfaces", () => {
+    const isNativeDeliveryEnabled = vi.fn(
+      ({ accountId }: { accountId?: string | null }) => accountId === "topic-1",
+    );
+    const adapter = createApproverRestrictedNativeApprovalAdapter({
+      channel: "telegram",
+      channelLabel: "Telegram",
+      listAccountIds: () => [],
+      hasApprovers: () => true,
+      isExecAuthorizedSender: () => true,
+      isNativeDeliveryEnabled,
+      resolveNativeDeliveryMode: () => "both",
+      requireMatchingTurnSourceChannel: true,
+      resolveSuppressionAccountId: ({ request }) =>
+        request.request.turnSourceAccountId?.trim() || undefined,
+    });
+
+    expect(
+      adapter.shouldSuppressForwardingFallback({
+        cfg: {} as never,
+        target: { channel: "telegram" },
+        request: {
+          request: { turnSourceChannel: "telegram", turnSourceAccountId: " topic-1 " },
+        } as never,
+      }),
+    ).toBe(true);
+
+    expect(
+      adapter.shouldSuppressForwardingFallback({
+        cfg: {} as never,
+        target: { channel: "telegram" },
+        request: {
+          request: { turnSourceChannel: "slack", turnSourceAccountId: "topic-1" },
+        } as never,
+      }),
+    ).toBe(false);
+
+    expect(
+      adapter.shouldSuppressForwardingFallback({
+        cfg: {} as never,
+        target: { channel: "slack" },
+        request: {
+          request: { turnSourceChannel: "telegram", turnSourceAccountId: "topic-1" },
+        } as never,
+      }),
+    ).toBe(false);
+
+    expect(isNativeDeliveryEnabled).toHaveBeenCalledWith({
+      cfg: {} as never,
+      accountId: "topic-1",
+    });
+  });
+});

src/plugin-sdk/approval-delivery-helpers.ts

@@ -0,0 +1,99 @@
+import type { OpenClawConfig } from "./config-runtime.js";
+import { normalizeMessageChannel } from "./routing.js";
+
+type ApprovalKind = "exec" | "plugin";
+type NativeApprovalDeliveryMode = "dm" | "channel" | "both";
+
+type ApprovalAdapterParams = {
+  cfg: OpenClawConfig;
+  accountId?: string | null;
+  senderId?: string | null;
+};
+
+type DeliverySuppressionParams = {
+  cfg: OpenClawConfig;
+  target: { channel: string; accountId?: string | null };
+  request: { request: { turnSourceChannel?: string | null; turnSourceAccountId?: string | null } };
+};
+
+export function createApproverRestrictedNativeApprovalAdapter(params: {
+  channel: string;
+  channelLabel: string;
+  listAccountIds: (cfg: OpenClawConfig) => string[];
+  hasApprovers: (params: ApprovalAdapterParams) => boolean;
+  isExecAuthorizedSender: (params: ApprovalAdapterParams) => boolean;
+  isPluginAuthorizedSender?: (params: ApprovalAdapterParams) => boolean;
+  isNativeDeliveryEnabled: (params: { cfg: OpenClawConfig; accountId?: string | null }) => boolean;
+  resolveNativeDeliveryMode: (params: {
+    cfg: OpenClawConfig;
+    accountId?: string | null;
+  }) => NativeApprovalDeliveryMode;
+  requireMatchingTurnSourceChannel?: boolean;
+  resolveSuppressionAccountId?: (params: DeliverySuppressionParams) => string | undefined;
+}) {
+  const pluginSenderAuth = params.isPluginAuthorizedSender ?? params.isExecAuthorizedSender;
+
+  return {
+    authorizeCommand: ({
+      cfg,
+      accountId,
+      senderId,
+      kind,
+    }: {
+      cfg: OpenClawConfig;
+      accountId?: string | null;
+      senderId?: string | null;
+      kind: ApprovalKind;
+    }) => {
+      const authorized =
+        kind === "plugin"
+          ? pluginSenderAuth({ cfg, accountId, senderId })
+          : params.isExecAuthorizedSender({ cfg, accountId, senderId });
+      return authorized
+        ? { authorized: true }
+        : {
+            authorized: false,
+            reason: `❌ You are not authorized to approve ${kind} requests on ${params.channelLabel}.`,
+          };
+    },
+    getInitiatingSurfaceState: ({
+      cfg,
+      accountId,
+    }: {
+      cfg: OpenClawConfig;
+      accountId?: string | null;
+    }) =>
+      params.hasApprovers({ cfg, accountId })
+        ? ({ kind: "enabled" } as const)
+        : ({ kind: "disabled" } as const),
+    hasConfiguredDmRoute: ({ cfg }: { cfg: OpenClawConfig }) =>
+      params.listAccountIds(cfg).some((accountId) => {
+        if (!params.hasApprovers({ cfg, accountId })) {
+          return false;
+        }
+        if (!params.isNativeDeliveryEnabled({ cfg, accountId })) {
+          return false;
+        }
+        const target = params.resolveNativeDeliveryMode({ cfg, accountId });
+        return target === "dm" || target === "both";
+      }),
+    shouldSuppressForwardingFallback: (input: DeliverySuppressionParams) => {
+      const channel = normalizeMessageChannel(input.target.channel) ?? input.target.channel;
+      if (channel !== params.channel) {
+        return false;
+      }
+      if (params.requireMatchingTurnSourceChannel) {
+        const turnSourceChannel = normalizeMessageChannel(input.request.request.turnSourceChannel);
+        if (turnSourceChannel !== params.channel) {
+          return false;
+        }
+      }
+      const resolvedAccountId = params.resolveSuppressionAccountId?.(input);
+      const accountId =
+        (resolvedAccountId === undefined
+          ? input.target.accountId?.trim()
+          : resolvedAccountId.trim()) || undefined;
+      return params.isNativeDeliveryEnabled({ cfg: input.cfg, accountId });
+    },
+  };
+}

src/plugin-sdk/approval-runtime.ts

@@ -31,3 +31,4 @@ export {
   type PluginApprovalRequestPayload,
   type PluginApprovalResolved,
 } from "../infra/plugin-approvals.js";
+export { createApproverRestrictedNativeApprovalAdapter } from "./approval-delivery-helpers.js";