security: enforce approval ownership on every transport, not just Slack - #567
Open
coderdailyone wants to merge 1 commit into
Open
Conversation
The human-approval workflow validated the resolver ONLY on the Slack
lane: both _resolve_inbox_reply and _on_interaction gated protected
items (approval/directory/plan) behind _slack_actor_owns_item only when
platform == "slack". A reply or button arriving over Telegram resolved
protected items with NO owner or channel-binding check at all, and items
mirrored to a Slack inbox were resolvable from Telegram — bypassing
Slack's owner enforcement entirely.
Fix: a single _actor_owns_protected_item gate used by both paths for all
transports:
- cross-transport is refused (an item bound to one channel is only
resolvable from that channel; an in-app-only item is not remotely
resolvable);
- Slack defers to the existing owner + bound-channel check;
- no other transport has an approval-owner model, so it cannot resolve
protected items remotely — they stay pending for in-app resolution.
Questions and free-text answers are unchanged: still answerable by any
allow-listed member on any transport.
Fixes andrewyng#519
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CLxsdFGXjdztTRNHjNgPXP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #519.
The human-approval workflow validated the resolver only on the Slack lane: both
_resolve_inbox_reply(channel replies) and_on_interaction(button clicks) gated protected items (approval/directory/plan) behind_slack_actor_owns_itemonly whenplatform == "slack". So:Change
A single
_actor_owns_protected_itemgate, used by both resolution paths for all transports:_slack_actor_owns_item);Questions and free-text answers are unchanged: still answerable by any allow-listed member on any transport.
Tests
New
tests/test_telegram_approval_bypass.py:pending; the button is rejected via the gateway);Verified the three bypass tests fail on
main(Telegram resolves the protected item) and pass with the fix. Existingtest_slack_approval_owners(all 10) and the inbox/routing/connector suites stay green (90 in the regression run).🤖 Generated with Claude Code
https://claude.ai/code/session_01CLxsdFGXjdztTRNHjNgPXP