hermes - 💡(How to fix) Fix fix(feishu): card approval buttons use _allow_group_message instead of _is_interactive_operator_authorized, rejecting all users in DM

Description

Feishu card approval buttons always return "Unauthorized approval click" in DM

When a user clicks an approval card button (e.g., "Always Approve", "Deny") sent via Feishu bot DM, the gateway logs show:

WARNING gateway.platforms.feishu: [Feishu] Unauthorized approval click by ou_xxx

The button click is silently ignored and no approval resolution occurs.

Root Cause

In gateway/platforms/feishu.py, the method _handle_approval_card_action() (around line 2600) calls self._allow_group_message() to check authorization:

if not self._allow_group_message(sender_id, state.get("chat_id", ""), is_bot=False):
    logger.warning("[Feishu] Unauthorized approval click by %s", open_id or "<unknown>")
    return P2CardActionTriggerResponse() if P2CardActionTriggerResponse else None

_allow_group_message() is designed for group message admission policy — it uses FEISHU_GROUP_POLICY (default "allowlist"). When FEISHU_ALLOWED_USERS is not configured, the allowlist is empty, which means everyone is rejected, even in DM context.

The Fix

This release (v2026.6.5) introduced a proper function _is_interactive_operator_authorized() at line 2575 that handles card action authorization correctly:

def _is_interactive_operator_authorized(self, open_id: str) -> bool:
    """Return whether this card-action operator may answer gated prompts."""
    normalized = str(open_id or "").strip()
    if not normalized:
        return False
    allowed_ids = set(self._admins) | set(self._allowed_group_users)
    if not allowed_ids:
        return True  # No restrictions → allow everyone
    return "*" in allowed_ids or normalized in allowed_ids

However, _handle_approval_card_action() was not updated to use this new function. Two other card handlers (_handle_update_prompt_card_action ~L2658 and another at ~L2690) were correctly updated, but the main approval handler was missed.

Fix

Replace the _allow_group_message call with _is_interactive_operator_authorized:

-        if not self._allow_group_message(sender_id, state.get("chat_id", ""), is_bot=False):
+        if not self._is_interactive_operator_authorized(open_id):
             logger.warning("[Feishu] Unauthorized approval click by %s", open_id or "<unknown>")
             return P2CardActionTriggerResponse() if P2CardActionTriggerResponse else None