Files
openclaw/src/auto-reply/reply/commands-context.ts
Gustavo Madeira Santana 392bbddf29 Security: owner-only tools + command auth hardening (#9202)
* Security: gate whatsapp_login by sender auth

* Security: treat undefined senderAuthorized as unauthorized (opt-in)

* fix: gate whatsapp_login to owner senders (#8768) (thanks @victormier)

* fix: add explicit owner allowlist for tools (#8768) (thanks @victormier)

* fix: normalize escaped newlines in send actions (#8768) (thanks @victormier)

---------

Co-authored-by: Victor Mier <victormier@gmail.com>
2026-02-04 19:49:36 -05:00

46 lines
1.5 KiB
TypeScript

import type { OpenClawConfig } from "../../config/config.js";
import type { MsgContext } from "../templating.js";
import type { CommandContext } from "./commands-types.js";
import { resolveCommandAuthorization } from "../command-auth.js";
import { normalizeCommandBody } from "../commands-registry.js";
import { stripMentions } from "./mentions.js";
export function buildCommandContext(params: {
ctx: MsgContext;
cfg: OpenClawConfig;
agentId?: string;
sessionKey?: string;
isGroup: boolean;
triggerBodyNormalized: string;
commandAuthorized: boolean;
}): CommandContext {
const { ctx, cfg, agentId, sessionKey, isGroup, triggerBodyNormalized } = params;
const auth = resolveCommandAuthorization({
ctx,
cfg,
commandAuthorized: params.commandAuthorized,
});
const surface = (ctx.Surface ?? ctx.Provider ?? "").trim().toLowerCase();
const channel = (ctx.Provider ?? surface).trim().toLowerCase();
const abortKey = sessionKey ?? (auth.from || undefined) ?? (auth.to || undefined);
const rawBodyNormalized = triggerBodyNormalized;
const commandBodyNormalized = normalizeCommandBody(
isGroup ? stripMentions(rawBodyNormalized, ctx, cfg, agentId) : rawBodyNormalized,
);
return {
surface,
channel,
channelId: auth.providerId,
ownerList: auth.ownerList,
senderIsOwner: auth.senderIsOwner,
isAuthorizedSender: auth.isAuthorizedSender,
senderId: auth.senderId,
abortKey,
rawBodyNormalized,
commandBodyNormalized,
from: auth.from,
to: auth.to,
};
}