fix: gate /activation to owners in groups

2026-01-05 02:03:02 +01:00
parent f871563f37
commit 17422608b2
2 changed files with 50 additions and 27 deletions
--- a/src/auto-reply/reply/commands.ts
+++ b/src/auto-reply/reply/commands.ts
@@ -165,7 +165,23 @@ export async function handleCommands(params: {
        reply: { text: "⚙️ Group activation only applies to group chats." },
      };
    }
-    if (!command.isAuthorizedSender) {
+    const activationOwnerList =
+      command.ownerList.length > 0
+        ? command.ownerList
+        : command.isWhatsAppSurface && command.to
+          ? [normalizeE164(command.to)]
+          : [];
+    const activationSenderE164 = command.senderE164
+      ? normalizeE164(command.senderE164)
+      : "";
+    const isActivationOwner =
+      Boolean(activationSenderE164) &&
+      activationOwnerList.includes(activationSenderE164);
+
+    if (
+      !command.isAuthorizedSender ||
+      (command.isWhatsAppSurface && !isActivationOwner)
+    ) {
      logVerbose(
        `Ignoring /activation from unauthorized sender in group: ${command.senderE164 || "<unknown>"}`,
      );