hermes - 💡(How to fix) Fix [Bug]: DISCORD_ALLOWED_ROLES ignored by gateway _is_user_authorized — role-authorized users get 'Unauthorized user' rejection

Description

DISCORD_ALLOWED_ROLES is checked in the Discord adapter (_is_user_allowed, adapter.py:2235) but not in the gateway-level _is_user_authorized (run.py:6438). This means users authorized via role pass the adapter gate but are then rejected by the gateway, producing:

gateway.run: Unauthorized user: <user_id> (<username>) on discord

Two-layer auth mismatch

_is_user_authorized only reads DISCORD_ALLOWED_USERS via platform_env_map. DISCORD_ALLOWED_ROLES is never consulted at the gateway layer.

Steps to reproduce

1. Set DISCORD_ALLOWED_ROLES=<role_id> (no DISCORD_ALLOWED_USERS set)
2. Send a Discord message as a user with that role
3. Observe Unauthorized user warning in logs despite role match

Workaround

Add user ID explicitly to DISCORD_ALLOWED_USERS.

Proposed fix

Add role_authorized: bool = False field to SessionSource. Discord adapter sets it True when _is_user_allowed passes via role (not user ID). Gateway's _is_user_authorized checks source.role_authorized as an additional allow condition.

This keeps the role resolution logic in the adapter (where guild/member context exists) while letting the gateway trust the adapter's decision.

Related

• plugins/platforms/discord/adapter.py:678 — DISCORD_ALLOWED_ROLES parsing
• plugins/platforms/discord/adapter.py:2235 — _is_user_allowed (checks roles)
• gateway/run.py:6438 — _is_user_authorized (does not check roles)