Function detectAccessControlMisconfiguration

layers/foundation-scan.ts:734–779

(config: OpenClawConfig)

}

function detectAccessControlMisconfiguration(config: OpenClawConfig): string | null {
  const root = getRecord(config);
  if (!root) {
    return null;
  }

  const session = getRecord(root.session);
  const dmScope = session ? getString(session.dmScope)?.toLowerCase() : null;
  const allowedDmScopes = new Set(["per-channel-peer", "per-peer", "private"]);
  const broadDmScope = !dmScope || !allowedDmScopes.has(dmScope);

  const gateway = getRecord(root.gateway);
  const nodes = gateway ? getRecord(gateway.nodes) : null;
  const denyCommands = nodes ? getStringArray(nodes.denyCommands) : null;
  const denyListMissing = !denyCommands;

  const denySet = new Set((denyCommands ?? []).map((command) => command.toLowerCase()));
  const requiredSensitiveCommands = [
    "camera.snap",
    "camera.clip",
    "screen.record",
    "contacts.add",
    "calendar.add",
    "reminders.add",
    "sms.send",
  ];

  const missingCommands = requiredSensitiveCommands.filter((command) => !denySet.has(command));
  const weakDenyList = denyListMissing || missingCommands.length > 0;

  if (broadDmScope && weakDenyList) {
    if (denyListMissing) {
      return [
        "Category: Access Control",
        `Reason: session.dmScope is '${dmScope ?? "(missing)"}' and gateway.nodes.denyCommands is missing.`,
      ].join("\n");
    }

    return [
      "Category: Access Control",
      `Reason: session.dmScope is '${dmScope ?? "(missing)"}' and deny list misses: ${missingCommands.join(", ")}.`,
    ].join("\n");
  }

  return null;
}


async function scanSkillDirectory(