mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-24 16:54:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

fix(slack): gate message files before metadata fetch

Browse source
This commit is contained in:
dsad 2026-06-30 02:43:15 +03:00 • committed by Teknium
parent 856b604b4a
commit e1883df75e
No known key found for this signature in database
2 changed files with 57 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

25
plugins/platforms/slack/adapter.py
View file

@ -3942,22 +3942,25 @@ class SlackAdapter(BasePlatformAdapter):
# both as DM-style persistent conversations.
is_one_to_one_dm = channel_type == "im"
# Early auth check: reject unauthorized users before any API calls
# (thread context fetch, user name resolution, file downloads).
# Pattern matches Telegram fix #54164 — gate at the adapter level
# BEFORE event construction consumes resources.
if user_id:
# Reject unauthorized users before thread lookups, name resolution,
# or file downloads. The final gateway runner auth check happens
# after MessageEvent construction, so adapter-side media fetches need
# the same auth chain up front.
_runner = getattr(getattr(self, "_message_handler", None), "__self__", None)
_auth_fn = getattr(_runner, "_is_user_authorized", None)
if user_id and callable(_auth_fn):
_source = self.build_source(
chat_id=channel_id, chat_name="",
chat_id=channel_id,
chat_name="",
chat_type="dm" if is_dm else "group",
user_id=user_id, user_name="",
user_id=user_id,
user_name="",
)
_runner = getattr(getattr(self, "_message_handler", None), "__self__", None)
_auth_fn = getattr(_runner, "_is_user_authorized", None)
if callable(_auth_fn) and not _auth_fn(_source):
if not _auth_fn(_source):
logger.warning(
"[Slack] Early reject of unauthorized user %s in channel %s",
user_id, channel_id,
user_id,
channel_id,
)
return