fix(whatsapp): allow group ids in allowFrom (#4834)

nanobot/channels/base.py

@@ -224,9 +224,17 @@ class BaseChannel(ABC):
         metadata: dict[str, Any] | None = None,
         session_key: str | None = None,
         is_dm: bool = False,
+        authorization_id: str | None = None,
     ) -> None:
-        """Handle an incoming message: check permissions, issue pairing codes in DMs, or forward to bus."""
-        if not self.is_allowed(sender_id):
+        """Handle a message after checking its authorization subject.
+
+        ``sender_id`` is the identity recorded on the inbound message.  Channels
+        where access is scoped to another entity (for example, a group or room)
+        can pass that entity as ``authorization_id`` without changing the
+        sender's identity.  When omitted, authorization remains sender-based.
+        """
+        permission_id = authorization_id if authorization_id is not None else sender_id
+        if not self.is_allowed(permission_id):
             if is_dm:
                 code = generate_code(self.name, str(sender_id))
                 await self.send(

nanobot/channels/whatsapp.py

@@ -583,7 +583,10 @@ class WhatsAppChannel(BaseChannel):
             "phone": phone_id or None,
             "is_reply_to_bot": self._is_reply_to_bot(message),
         }
-        if not self.is_allowed(sender_id):
+        sender_allowed = self.is_allowed(sender_id)
+        group_allow_id = self._group_allow_id(chat_jid) if is_group else None
+        authorization_id = sender_id if sender_allowed else group_allow_id
+        if authorization_id is None:
             self.logger.info(
                 "Passing unauthorized WhatsApp sender {} to pairing flow "
                 "(phone={}, lid={}, chat={})",
@@ -628,8 +631,17 @@ class WhatsAppChannel(BaseChannel):
             media=media_paths,
             metadata=metadata,
             is_dm=not is_group,
+            authorization_id=authorization_id,
         )
 
+    def _group_allow_id(self, chat_jid: str) -> str | None:
+        if self.is_allowed(chat_jid):
+            return chat_jid
+        bare_chat_id = _bare_jid(chat_jid)
+        if bare_chat_id and bare_chat_id != chat_jid and self.is_allowed(bare_chat_id):
+            return bare_chat_id
+        return None
+
     def _is_addressed_to_bot(self, message: Any) -> bool:
         return self._was_mentioned(message) or self._is_reply_to_bot(message)