PR #78665: fix(telegram): expand access group allowlists

• Repository: openclaw/openclaw
• Author: hclsys
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/78665

Description (problem / solution / changelog)

Summary

• Reuse the existing access-group expansion helper for Telegram DM and group sender allowlists before numeric sender matching.
• Keep accessGroup:<name> entries configured without warning as invalid Telegram sender IDs, while unmatched/missing groups still fail closed.
• Add Telegram dispatch regressions for direct messages and group messages using channels.telegram.allowFrom: [\"accessGroup:admins\"].

Real behavior proof

Behavior or issue addressed: Fixes #78660, where documented Telegram accessGroup:<name> allowFrom entries were accepted by config/docs but normalized as invalid nonnumeric Telegram sender IDs before runtime authorization could match them.

Real environment tested: Local OpenClaw source runtime on Ubuntu/Linux, using node --import tsx to invoke the actual Telegram runtime allowlist helpers outside Vitest/CI.

Exact steps or command run after this patch:

• node --import tsx - <<'EOF' ... import { normalizeAllowFrom } from './extensions/telegram/src/bot-access.ts'; import { resolveTelegramEffectiveDmAllow, resolveTelegramEffectiveGroupAllow } from './extensions/telegram/src/bot/helpers.ts'; ... EOF
• pnpm test extensions/telegram/src/bot.create-telegram-bot.test.ts extensions/telegram/src/dm-access.test.ts extensions/telegram/src/group-access.base-access.test.ts src/plugin-sdk/command-auth.test.ts
• pnpm exec oxfmt --check --threads=1 extensions/telegram/src/bot-access.ts extensions/telegram/src/bot/helpers.ts extensions/telegram/src/bot-message-context.ts extensions/telegram/src/bot-handlers.runtime.ts extensions/telegram/src/bot-native-commands.ts extensions/telegram/src/group-access.base-access.test.ts extensions/telegram/src/bot.create-telegram-bot.test.ts CHANGELOG.md
• pnpm check:changed
• git diff --check

Evidence after fix: Console output from node --import tsx against the OpenClaw Telegram source runtime:

{
  "raw": { "entries": [], "hasEntries": true, "invalidEntries": [] },
  "dm": { "entries": ["123456789"], "hasEntries": true, "invalidEntries": [] },
  "group": { "entries": ["123456789"], "hasEntries": true, "invalidEntries": [] }
}

Observed result after fix: The literal Telegram allowlist alias remains configured without invalid-entry output, and the same sender is expanded into both direct-message and group effective allowlists before authorization.

What was not tested: Live Telegram Bot API delivery against a real Telegram account.

Supplemental local checks

• pnpm test extensions/telegram/src/bot.create-telegram-bot.test.ts extensions/telegram/src/dm-access.test.ts extensions/telegram/src/group-access.base-access.test.ts src/plugin-sdk/command-auth.test.ts passed 2 Vitest shards: unit-fast had 1 file / 5 tests passed; extension-telegram had 3 files / 93 tests passed.
• pnpm exec oxfmt --check ..., pnpm check:changed, and git diff --check exited 0.

Pre-implement audit

• Existing-helper check: reused expandAllowFromWithAccessGroups / parseAccessGroupAllowFromEntry; no new access-group parser or membership model.
• Shared-caller check: normalizeAllowFrom remains numeric/wildcard based and only stops warning for accessGroup:*; Telegram DM/group call sites explicitly expand before authorization.
• Broader rival scan: live PR search for #78660 / Telegram accessGroup allowFrom returned no open competing PR.

Fixes #78660

Changed files

• CHANGELOG.md (modified, +1/-0)
• extensions/telegram/src/bot-access.ts (modified, +4/-1)
• extensions/telegram/src/bot-handlers.runtime.ts (modified, +30/-18)
• extensions/telegram/src/bot-message-context.ts (modified, +13/-3)
• extensions/telegram/src/bot-native-commands.ts (modified, +10/-4)
• extensions/telegram/src/bot.create-telegram-bot.test.ts (modified, +53/-0)
• extensions/telegram/src/bot/helpers.ts (modified, +65/-2)
• extensions/telegram/src/group-access.base-access.test.ts (modified, +11/-0)

PR #78675: docs(telegram): clarify access group allowlists

• Repository: openclaw/openclaw
• Author: hclsys
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/78675

Description (problem / solution / changelog)

Summary

• Document that Telegram allowFrom and groupAllowFrom accept accessGroup:<name> aliases.
• Preserve the numeric Telegram sender-ID guidance for accessGroups.<name>.members.telegram.
• Clarify that missing access groups fail closed and unrelated nonnumeric group sender entries are ignored.

Refs #78660. Runtime support is already on current main via b6ae0b83a6; this PR fixes the remaining Telegram channel docs mismatch called out on #78665.

Real behavior proof

After-fix terminal output from this branch:

$ pnpm check:docs
Docs formatting clean (603 files).
Docs MDX check passed (618 files, 2590ms).
checked_internal_links=4214
broken_links=0

$ git diff --check
# passed

$ pnpm test extensions/telegram/src/bot.create-telegram-bot.test.ts extensions/telegram/src/dm-access.test.ts extensions/telegram/src/group-access.base-access.test.ts src/plugin-sdk/command-auth.test.ts
[test] passed 2 Vitest shards in 14.48s

The docs page now states that accessGroup:<name> aliases are valid for Telegram allowFrom and groupAllowFrom, while the Telegram entries inside accessGroups.<name>.members.telegram must remain numeric sender IDs and missing groups fail closed.

Risk

Docs-only change. No runtime behavior or config parsing changed.

Changed files

• docs/channels/access-groups.md (modified, +1/-1)
• docs/channels/telegram.md (modified, +5/-3)