Ben Barclay 72ae163250 fix(relay): authorize relay-delivered events by delivery, not source.platform (#52306) ... * fix(relay): authorize relay-delivered events by delivery, not source.platform The #52190 upstream-authz fix keyed _is_user_authorized off source.platform via _adapter_authorization_is_upstream(source.platform). But a relay *message* inbound carries the UNDERLYING platform (source.platform == discord/telegram/...), NOT Platform.RELAY, because ws_transport._event_from_wire maps the connector's wire payload (platform="discord") straight onto SessionSource for session-keying and egress. The relay adapter is registered only under Platform.RELAY, so adapters.get(Platform.DISCORD) misses, the trusted-upstream branch is skipped, and the user hits the env-allowlist default-deny: WARNING gateway.run: Unauthorized user: <id> (<name>) on discord (Live staging bug: alpha tester linked successfully, then every follow-up DM was silently dropped.) Fix: the authentic trust signal is that the event was delivered over the per-instance-authenticated relay WS, not which platform it underlies. Add a wire-INVISIBLE SessionSource.delivered_via_upstream_relay flag, stamped by the relay transport in _event_from_wire, and authorize on it. The flag is excluded from to_dict/from_dict so a peer can neither forge it across the wire nor have it restored from persistence. The existing adapter-flag check is retained for events whose source.platform IS Platform.RELAY (interaction-passthrough). A direct Discord event on a multiplexing gateway (direct + relay adapters) is unmarked and still default-denies. * fix(relay): use identity check on delivery marker to avoid MagicMock fail-open A MagicMock() source (used by test_signal.py and other gateway tests) auto- vivifies source.delivered_via_upstream_relay as a truthy Mock, which a bare truthiness check would treat as authorized — flipping test_signal_in_allowlist_maps from False to True. The marker is a real bool on SessionSource, so check 'is True' explicitly: refuses to authorize any non-bool stand-in, defensive against accidental fail-open.		2026-06-25 14:21:09 +10:00
..
__init__.py	feat(relay): Phase 5 Unit C — wake primitive (gateway side) (#51595)	2026-06-24 11:00:11 +10:00
adapter.py	fix(relay): re-attach DM author user_id on outbound for connector egress	2026-06-25 12:43:54 +10:00
auth.py	feat(relay): connector⇄gateway channel auth + signed-HTTP inbound receiver + enroll CLI (#48147)	2026-06-18 12:01:54 +10:00
descriptor.py	feat(relay): derive descriptor from PlatformEntry	2026-06-17 16:37:45 -07:00
transport.py	feat(relay): Phase 5 §5.3 going-idle / buffered-flip primitive (gateway side) (#51572)	2026-06-24 09:50:30 +10:00
ws_transport.py	fix(relay): authorize relay-delivered events by delivery, not source.platform (#52306)	2026-06-25 14:21:09 +10:00