From 55ebdce9c3e055acdf385b0e5be111b60bc74339 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Sat, 14 Mar 2026 02:00:38 +0000
Subject: [PATCH] refactor: share open allowFrom config checks

---
 extensions/irc/src/config-schema.ts           | 13 +++++-----
 extensions/mattermost/src/config-schema.ts    | 15 ++++++-----
 .../nextcloud-talk/src/config-schema.ts       | 15 ++++++-----
 extensions/shared/config-schema-helpers.ts    | 25 +++++++++++++++++++
 4 files changed, 46 insertions(+), 22 deletions(-)
 create mode 100644 extensions/shared/config-schema-helpers.ts

diff --git a/extensions/irc/src/config-schema.ts b/extensions/irc/src/config-schema.ts
index aa37b596cd1..8b9625b5bc4 100644
--- a/extensions/irc/src/config-schema.ts
+++ b/extensions/irc/src/config-schema.ts
@@ -9,6 +9,7 @@ import {
   requireOpenAllowFrom,
 } from "openclaw/plugin-sdk/irc";
 import { z } from "zod";
+import { requireChannelOpenAllowFrom } from "../../shared/config-schema-helpers.js";
 
 const IrcGroupSchema = z
   .object({
@@ -69,12 +70,12 @@ export const IrcAccountSchemaBase = z
   .strict();
 
 export const IrcAccountSchema = IrcAccountSchemaBase.superRefine((value, ctx) => {
-  requireOpenAllowFrom({
+  requireChannelOpenAllowFrom({
+    channel: "irc",
     policy: value.dmPolicy,
     allowFrom: value.allowFrom,
     ctx,
-    path: ["allowFrom"],
-    message: 'channels.irc.dmPolicy="open" requires channels.irc.allowFrom to include "*"',
+    requireOpenAllowFrom,
   });
 });
 
@@ -82,11 +83,11 @@ export const IrcConfigSchema = IrcAccountSchemaBase.extend({
   accounts: z.record(z.string(), IrcAccountSchema.optional()).optional(),
   defaultAccount: z.string().optional(),
 }).superRefine((value, ctx) => {
-  requireOpenAllowFrom({
+  requireChannelOpenAllowFrom({
+    channel: "irc",
     policy: value.dmPolicy,
     allowFrom: value.allowFrom,
     ctx,
-    path: ["allowFrom"],
-    message: 'channels.irc.dmPolicy="open" requires channels.irc.allowFrom to include "*"',
+    requireOpenAllowFrom,
   });
 });
diff --git a/extensions/mattermost/src/config-schema.ts b/extensions/mattermost/src/config-schema.ts
index 43dd7ede8d2..16ee615454c 100644
--- a/extensions/mattermost/src/config-schema.ts
+++ b/extensions/mattermost/src/config-schema.ts
@@ -6,6 +6,7 @@ import {
   requireOpenAllowFrom,
 } from "openclaw/plugin-sdk/mattermost";
 import { z } from "zod";
+import { requireChannelOpenAllowFrom } from "../../shared/config-schema-helpers.js";
 import { buildSecretInputSchema } from "./secret-input.js";
 
 const MattermostSlashCommandsSchema = z
@@ -61,13 +62,12 @@ const MattermostAccountSchemaBase = z
   .strict();
 
 const MattermostAccountSchema = MattermostAccountSchemaBase.superRefine((value, ctx) => {
-  requireOpenAllowFrom({
+  requireChannelOpenAllowFrom({
+    channel: "mattermost",
     policy: value.dmPolicy,
     allowFrom: value.allowFrom,
     ctx,
-    path: ["allowFrom"],
-    message:
-      'channels.mattermost.dmPolicy="open" requires channels.mattermost.allowFrom to include "*"',
+    requireOpenAllowFrom,
   });
 });
 
@@ -75,12 +75,11 @@ export const MattermostConfigSchema = MattermostAccountSchemaBase.extend({
   accounts: z.record(z.string(), MattermostAccountSchema.optional()).optional(),
   defaultAccount: z.string().optional(),
 }).superRefine((value, ctx) => {
-  requireOpenAllowFrom({
+  requireChannelOpenAllowFrom({
+    channel: "mattermost",
     policy: value.dmPolicy,
     allowFrom: value.allowFrom,
     ctx,
-    path: ["allowFrom"],
-    message:
-      'channels.mattermost.dmPolicy="open" requires channels.mattermost.allowFrom to include "*"',
+    requireOpenAllowFrom,
   });
 });
diff --git a/extensions/nextcloud-talk/src/config-schema.ts b/extensions/nextcloud-talk/src/config-schema.ts
index 5ab3e632d22..85cb14ff213 100644
--- a/extensions/nextcloud-talk/src/config-schema.ts
+++ b/extensions/nextcloud-talk/src/config-schema.ts
@@ -9,6 +9,7 @@ import {
   requireOpenAllowFrom,
 } from "openclaw/plugin-sdk/nextcloud-talk";
 import { z } from "zod";
+import { requireChannelOpenAllowFrom } from "../../shared/config-schema-helpers.js";
 import { buildSecretInputSchema } from "./secret-input.js";
 
 export const NextcloudTalkRoomSchema = z
@@ -48,13 +49,12 @@ export const NextcloudTalkAccountSchemaBase = z
 
 export const NextcloudTalkAccountSchema = NextcloudTalkAccountSchemaBase.superRefine(
   (value, ctx) => {
-    requireOpenAllowFrom({
+    requireChannelOpenAllowFrom({
+      channel: "nextcloud-talk",
       policy: value.dmPolicy,
       allowFrom: value.allowFrom,
       ctx,
-      path: ["allowFrom"],
-      message:
-        'channels.nextcloud-talk.dmPolicy="open" requires channels.nextcloud-talk.allowFrom to include "*"',
+      requireOpenAllowFrom,
     });
   },
 );
@@ -63,12 +63,11 @@ export const NextcloudTalkConfigSchema = NextcloudTalkAccountSchemaBase.extend({
   accounts: z.record(z.string(), NextcloudTalkAccountSchema.optional()).optional(),
   defaultAccount: z.string().optional(),
 }).superRefine((value, ctx) => {
-  requireOpenAllowFrom({
+  requireChannelOpenAllowFrom({
+    channel: "nextcloud-talk",
     policy: value.dmPolicy,
     allowFrom: value.allowFrom,
     ctx,
-    path: ["allowFrom"],
-    message:
-      'channels.nextcloud-talk.dmPolicy="open" requires channels.nextcloud-talk.allowFrom to include "*"',
+    requireOpenAllowFrom,
   });
 });
diff --git a/extensions/shared/config-schema-helpers.ts b/extensions/shared/config-schema-helpers.ts
new file mode 100644
index 00000000000..869e98a0763
--- /dev/null
+++ b/extensions/shared/config-schema-helpers.ts
@@ -0,0 +1,25 @@
+import type { z } from "zod";
+
+type RequireOpenAllowFromFn = (params: {
+  policy: unknown;
+  allowFrom: unknown;
+  ctx: z.RefinementCtx;
+  path: string[];
+  message: string;
+}) => void;
+
+export function requireChannelOpenAllowFrom(params: {
+  channel: string;
+  policy: unknown;
+  allowFrom: unknown;
+  ctx: z.RefinementCtx;
+  requireOpenAllowFrom: RequireOpenAllowFromFn;
+}) {
+  params.requireOpenAllowFrom({
+    policy: params.policy,
+    allowFrom: params.allowFrom,
+    ctx: params.ctx,
+    path: ["allowFrom"],
+    message: `channels.${params.channel}.dmPolicy="open" requires channels.${params.channel}.allowFrom to include "*"`,
+  });
+}