mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-26 17:38:36 +00:00
222772ad61
The DingTalk docs offer gateway.platforms.dingtalk.extra.allowed_users
as the config.yaml alternative to DINGTALK_ALLOWED_USERS. The adapter
honors it (_load_allowed_users reads PlatformConfig.extra), but gateway
authorization (_is_user_authorized in gateway/authz_mixin.py) only
consults the env var, and load_gateway_config() bridged the allowlist
to the env var only from a top-level dingtalk: block. A nested-only
allowlist therefore passed the adapter and was then denied at the
gateway - listed users fell through to pairing/default-deny in DMs.
Extend the DingTalk YAML->env bridge to fall back to the merged nested
platform config (gateway.platforms / platforms), mirroring the existing
platforms.discord.extra.allow_from precedent. Precedence is unchanged:
an explicit DINGTALK_ALLOWED_USERS env var still wins, then the
top-level dingtalk: block, then the nested extra.
Also correct the docs' claim that the two allowlists are "merged" when
both are set - that behavior never existed (the doc line came from a
docs-only sweep); the effective result is the intersection of the two
gates, so the docs now recommend configuring one or the other.
Repro (before): config.yaml containing only the nested allowlist ->
adapter._is_user_allowed("user-id-1") is True but
runner._is_user_authorized(...) is False. After: both True; unlisted
users are still denied.
|
||
|---|---|---|
| .. | ||
| bluebubbles.md | ||
| dingtalk.md | ||
| discord.md | ||
| email.md | ||
| feishu.md | ||
| google_chat.md | ||
| homeassistant.md | ||
| index.md | ||
| line.md | ||
| matrix.md | ||
| mattermost.md | ||
| msgraph-webhook.md | ||
| ntfy.md | ||
| open-webui.md | ||
| qqbot.md | ||
| signal.md | ||
| simplex.md | ||
| slack.md | ||
| sms.md | ||
| teams-meetings.md | ||
| teams.md | ||
| telegram.md | ||
| webhooks.md | ||
| wecom-callback.md | ||
| wecom.md | ||
| weixin.md | ||
| whatsapp.md | ||
| yuanbao.md | ||