Repository navigation
fix(remote-connect): require pairing before IM bots accept a chat - #3879
Merged
Merged
Conversation
Feishu, Telegram and WeChat bots created chat state as paired for any chat that reached the message loop, so an unknown chat could run commands after the first pairing. Authorization now requires the chat's own paired state, outbound paths never create state, wrong pairing codes are rate limited, and legacy persisted paired chats are restored.
3 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Require a chat to be paired before the Feishu, Telegram and WeChat bots act on it.
On
main, the message, image and file paths usestates.entry(chat).or_insert_with(...)withpaired = true, so once the bot loop runs, an unknown chat is treated as paired and can run commands. Outbound paths could also create state for an unpaired chat, and wrong pairing codes were not throttled.pairing_gatedecides what an unpaired chat may do (welcome, pairing code entry) and rate-limits wrong codes.chat_is_pairednever creates state; every inbound and outbound path checks it before addressing a chat.*Platformtraits) let the adapters be tested without network.Type and Areas
Type: bug fix (security)
Areas: assembly core (remote connect IM bots)
Motivation / Impact
Closes an authorization hole in IM bot remote control. Existing paired chats keep working after upgrade.
Verification
cargo test --locked -p openbitfun-core --no-default-features --features remote-connect --lib service::remote_connect::bot(111 passed), including per-bot tests for refusing unknown chats after the first pairing, outbound paths never creating state, wrong-code limits, and legacy persisted pairing restore.Remote scenarios: IM bot remote control, exercised with scripted platform fakes only, not against live Feishu/Telegram/WeChat.
Reviewer Notes
AI-assisted change, lightly tested as listed above. Behavior change: a valid pairing code now re-binds the bot to the chat that presented it.
Checklist