feat: add unified IM access policies

plugin-src/host/channels/whatsapp/production.mjs

@@ -6,7 +6,10 @@ import { WhatsappConfigStore } from '../../../../src/channels/whatsapp/config-st
 import { WhatsappHarnessClient } from '../../../../src/channels/whatsapp/harness-client.mjs';
 import { WhatsappStateStore } from '../../../../src/channels/whatsapp/state-store.mjs';
 import { WhatsappController } from '../../../../src/channels/whatsapp/whatsapp-controller.mjs';
-import { WhatsappRuntime } from '../../../../src/channels/whatsapp/whatsapp-runtime.mjs';
+import {
+  WhatsappRuntime,
+  whatsappAccessPolicyIdsEqual,
+} from '../../../../src/channels/whatsapp/whatsapp-runtime.mjs';
 import { createWhatsappWebSession } from '../../../../src/channels/whatsapp/whatsapp-web-session.mjs';
 import {
   BotWorkspaceStore,
@@ -20,6 +23,10 @@ import { createTokenConnectionSupervisor } from '../shared/connection-supervisor
 import { createHarnessCommandExecutor } from '../../harness-command-executor.mjs';
 import { harnessConnection } from '../../harness-connection.mjs';
 import { createHarnessSessionExecutors } from '../../harness-session-coordinator.mjs';
+import {
+  accessPolicyProvider,
+  initialAccessPolicyFor,
+} from '../shared/access-policy-production.mjs';
 
 const AUTH_DIRECTORY_PATTERN = /^[a-f0-9-]{36}$/;
 
@@ -61,6 +68,7 @@ export async function createProductionController(ctx, config = {}, internals = {
   await workspaces.reconcile(configuredBots.map((bot) => bot.botId));
   await Promise.all(configuredBots.map((bot) => workspaces.ensure(bot.botId, {
     defaultAgentPreset: config.agentPreset,
+    initialAccessPolicy: initialAccessPolicyFor('whatsapp', bot),
   })));
   const observedConfigStore = typeof configStore.remove === 'function'
     ? observeBotWorkspaceRemovals(configStore, { workspaces })
@@ -98,7 +106,10 @@ export async function createProductionController(ctx, config = {}, internals = {
     logger,
     createRuntime: async ({ botId, config: botConfig, authDir }) => {
       const state = await stateFor(botId);
-      await workspaces.ensure(botId, { defaultAgentPreset: config.agentPreset });
+      await workspaces.ensure(botId, {
+        defaultAgentPreset: config.agentPreset,
+        initialAccessPolicy: initialAccessPolicyFor('whatsapp', botConfig),
+      });
       const workspaceScope = createBotWorkspaceScope(harness, {
         botId, workspaces, state, agentPresetCatalog,
       });
@@ -108,6 +119,9 @@ export async function createProductionController(ctx, config = {}, internals = {
         harness: workspaceScope.harness,
         state: workspaceScope.state,
         contextEnhancement: { botId, getSettings: () => workspaces.contextEnhancementFor(botId) },
+        accessPolicy: accessPolicyProvider(workspaces, botId, {
+          channel: 'whatsapp', config: botConfig, equals: whatsappAccessPolicyIdsEqual,
+        }),
         replyTimeoutMs: config.replyTimeoutMs ?? 600_000,
         connectTimeoutMs: config.connectTimeoutMs ?? 30_000,
         createSession,

plugin-src/host/channels/whatsapp/rpc.mjs

@@ -1,7 +1,7 @@
 import QRCode from 'qrcode';
 
 import { publicConnectionTestResult } from '../../../../src/channels/shared/connection-test.mjs';
-import { normalizeWhatsappAccessPolicy } from '../../../../src/channels/whatsapp/config-store.mjs';
+import { SET_ACCESS_POLICY_ENDPOINT, validAccessPolicyPayload } from '../shared/access-policy-rpc.mjs';
 import { SET_CONTEXT_ENHANCEMENT_ENDPOINT, validContextEnhancementPayload } from '../shared/context-enhancement-rpc.mjs';
 import { resolveRpcAuthority } from '../../rpc-authority.mjs';
 import { publicWorkspaceError, SET_WORKSPACE_ENDPOINT, validWorkspacePayload } from '../shared/workspace-rpc.mjs';
@@ -15,7 +15,7 @@ export const WHATSAPP_ENDPOINTS = Object.freeze({
   cancelProvisioning: 'provision.cancel',
   reconnectBot: 'bot.reconnect',
   deleteBot: 'bot.delete',
-  setAccessPolicy: 'bot.access-policy.set',
+  setAccessPolicy: SET_ACCESS_POLICY_ENDPOINT,
   setWorkspace: SET_WORKSPACE_ENDPOINT,
   setAgentPreset: SET_AGENT_PRESET_ENDPOINT,
   setContextEnhancement: SET_CONTEXT_ENHANCEMENT_ENDPOINT,
@@ -55,15 +55,8 @@ function payloadFailure(endpoint, payload) {
       && payload.confirm === true ? null : 'bot.delete requires a botId and confirm=true.';
   }
   if (endpoint === WHATSAPP_ENDPOINTS.setAccessPolicy) {
-    if (!exactKeys(payload, ['botId', 'accessMode', 'allowedNumbers'])
-      || Object.keys(payload).length !== 3
-      || !validId(payload.botId)) return '请输入有效的 WhatsApp 访问模式和电话号码。';
-    try {
-      normalizeWhatsappAccessPolicy(payload);
-      return null;
-    } catch {
-      return '请输入有效的 WhatsApp 访问模式和电话号码。';
-    }
+    return validAccessPolicyPayload(payload)
+      ? null : '请提交有效的访问设置。';
   }
   if (endpoint === WHATSAPP_ENDPOINTS.setWorkspace) {
     return validWorkspacePayload(payload)
@@ -111,7 +104,7 @@ async function publicStatus(value, encodeQr) {
 }
 
 export function createWhatsappRpcHandler(controller, { encodeQr = qrDataUrl } = {}) {
-  for (const method of ['status', 'startProvisioning', 'registrationStatus', 'cancelProvisioning', 'reconnectBot', 'deleteBot', 'setAccessPolicy']) {
+  for (const method of ['status', 'startProvisioning', 'registrationStatus', 'cancelProvisioning', 'reconnectBot', 'deleteBot']) {
     if (typeof controller?.[method] !== 'function') {
       throw new TypeError(`A complete WhatsApp controller is required (${method})`);
     }
@@ -191,9 +184,11 @@ export function createWhatsappRpcHandler(controller, { encodeQr = qrDataUrl } =
           cachedEncode,
         );
       } else if (endpoint === WHATSAPP_ENDPOINTS.setAccessPolicy) {
-        value = await publicStatus(
-          await controller.setAccessPolicy(payload.botId, normalizeWhatsappAccessPolicy(payload)),
-          cachedEncode,
+        if (typeof controller.updateAccessPolicy !== 'function') throw new Error('Access policy update is unavailable');
+        value = await controller.updateAccessPolicy(
+          payload.botId,
+          payload.policy,
+          (status) => publicStatus(status, cachedEncode),
         );
       } else {
         value = await publicStatus(await controller.deleteBot(payload.botId), cachedEncode);