fix(synology-chat): scope DM sessions by account

steipete · steipete · commit ce19a41f526b · 2026-03-22T09:21:05.000-07:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -203,6 +203,7 @@ Docs: https://docs.openclaw.ai
 - Agents/prompt composition: append bootstrap truncation warnings to the current-turn prompt and add regression coverage for stable system-prompt cache invariants. (#49237) Thanks @scoootscooob.
 - Gateway/auth: add regression coverage that keeps device-less trusted-proxy Control UI sessions off privileged pairing approval RPCs. Thanks @vincentkoc.
 - Plugins/runtime-api: pin extension runtime-api export surfaces with explicit guardrail coverage so future surface creep becomes a deliberate diff. Thanks @vincentkoc.
+- Synology Chat/multi-account: scope direct-message sessions by account and sender so identical webhook `user_id` values on different Synology accounts no longer share transcript or delivery state.
 - Telegram/security: add regression coverage proving pinned fallback host overrides stay bound to Telegram and delegate non-matching hostnames back to the original lookup path. Thanks @vincentkoc.
 - Secrets/exec refs: require explicit `--allow-exec` for `secrets apply` write plans that contain exec SecretRefs/providers, and align audit/configure/apply dry-run behavior to skip exec checks unless opted in to prevent unexpected command side effects. (#49417) Thanks @restriction and @joshavant.
 - Tools/image generation: add bundled fal image generation support so `image_generate` can target `fal/*` models with `FAL_KEY`, including single-image edit flows via FLUX image-to-image. Thanks @vincentkoc.
diff --git a/docs/channels/synology-chat.md b/docs/channels/synology-chat.md
@@ -100,6 +100,8 @@ Media sends are supported by URL-based file delivery.
 
 Multiple Synology Chat accounts are supported under `channels.synology-chat.accounts`.
 Each account can override token, incoming URL, webhook path, DM policy, and limits.
+Direct-message sessions are isolated per account and user, so the same numeric `user_id`
+on two different Synology accounts does not share transcript state.
 
 ```json5
 {
diff --git a/extensions/synology-chat/src/channel.integration.test.ts b/extensions/synology-chat/src/channel.integration.test.ts
@@ -2,7 +2,9 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import {
   dispatchReplyWithBufferedBlockDispatcher,
+  finalizeInboundContextMock,
   registerPluginHttpRouteMock,
+  resolveAgentRouteMock,
 } from "./channel.test-mocks.js";
 import { makeFormBody, makeReq, makeRes } from "./test-http-utils.js";
 
@@ -17,6 +19,8 @@ describe("Synology channel wiring integration", () => {
   beforeEach(() => {
     registerPluginHttpRouteMock.mockClear();
     dispatchReplyWithBufferedBlockDispatcher.mockClear();
+    finalizeInboundContextMock.mockClear();
+    resolveAgentRouteMock.mockClear();
   });
 
   it("registers real webhook handler with resolved account config and enforces allowlist", async () => {
@@ -73,4 +77,101 @@ describe("Synology channel wiring integration", () => {
     abortController.abort();
     await started;
   });
+
+  it("isolates same user_id across different accounts", async () => {
+    const plugin = createSynologyChatPlugin();
+    const alphaAbortController = new AbortController();
+    const betaAbortController = new AbortController();
+    const cfg = {
+      channels: {
+        "synology-chat": {
+          enabled: true,
+          accounts: {
+            alpha: {
+              enabled: true,
+              token: "token-alpha",
+              incomingUrl: "https://nas.example.com/incoming-alpha",
+              webhookPath: "/webhook/synology-alpha",
+              dmPolicy: "open",
+            },
+            beta: {
+              enabled: true,
+              token: "token-beta",
+              incomingUrl: "https://nas.example.com/incoming-beta",
+              webhookPath: "/webhook/synology-beta",
+              dmPolicy: "open",
+            },
+          },
+        },
+      },
+      session: {
+        dmScope: "main",
+      },
+    };
+
+    const alphaStarted = plugin.gateway.startAccount({
+      cfg,
+      accountId: "alpha",
+      log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
+      abortSignal: alphaAbortController.signal,
+    });
+    const betaStarted = plugin.gateway.startAccount({
+      cfg,
+      accountId: "beta",
+      log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
+      abortSignal: betaAbortController.signal,
+    });
+
+    expect(registerPluginHttpRouteMock).toHaveBeenCalledTimes(2);
+    const alphaRoute = registerPluginHttpRouteMock.mock.calls[0]?.[0];
+    const betaRoute = registerPluginHttpRouteMock.mock.calls[1]?.[0];
+    if (!alphaRoute || !betaRoute) {
+      throw new Error("Expected both Synology Chat routes to register");
+    }
+
+    const alphaReq = makeReq(
+      "POST",
+      makeFormBody({
+        token: "token-alpha",
+        user_id: "123",
+        username: "alice",
+        text: "alpha secret",
+      }),
+    );
+    const alphaRes = makeRes();
+    await alphaRoute.handler(alphaReq, alphaRes);
+
+    const betaReq = makeReq(
+      "POST",
+      makeFormBody({
+        token: "token-beta",
+        user_id: "123",
+        username: "bob",
+        text: "beta secret",
+      }),
+    );
+    const betaRes = makeRes();
+    await betaRoute.handler(betaReq, betaRes);
+
+    expect(alphaRes._status).toBe(204);
+    expect(betaRes._status).toBe(204);
+    expect(dispatchReplyWithBufferedBlockDispatcher).toHaveBeenCalledTimes(2);
+    expect(finalizeInboundContextMock).toHaveBeenCalledTimes(2);
+
+    const alphaCtx = finalizeInboundContextMock.mock.calls[0]?.[0];
+    const betaCtx = finalizeInboundContextMock.mock.calls[1]?.[0];
+    expect(alphaCtx).toMatchObject({
+      AccountId: "alpha",
+      SessionKey: "agent:agent-alpha:synology-chat:alpha:direct:123",
+    });
+    expect(betaCtx).toMatchObject({
+      AccountId: "beta",
+      SessionKey: "agent:agent-beta:synology-chat:beta:direct:123",
+    });
+
+    alphaAbortController.abort();
+    betaAbortController.abort();
+    await alphaStarted;
+    await betaStarted;
+  });
 });
diff --git a/extensions/synology-chat/src/channel.test-mocks.ts b/extensions/synology-chat/src/channel.test-mocks.ts
@@ -15,6 +15,19 @@ export const registerPluginHttpRouteMock: Mock<(params: RegisteredRoute) => () =
 export const dispatchReplyWithBufferedBlockDispatcher: Mock<
   () => Promise<{ counts: Record<string, number> }>
 > = vi.fn().mockResolvedValue({ counts: {} });
+export const finalizeInboundContextMock: Mock<
+  (ctx: Record<string, unknown>) => Record<string, unknown>
+> = vi.fn((ctx) => ctx);
+export const resolveAgentRouteMock: Mock<
+  (params: { accountId?: string }) => { agentId: string; sessionKey: string; accountId: string }
+> = vi.fn((params) => {
+  const accountId = params.accountId?.trim() || "default";
+  return {
+    agentId: `agent-${accountId}`,
+    sessionKey: `agent:agent-${accountId}:main`,
+    accountId,
+  };
+});
 
 async function readRequestBodyWithLimitForTest(req: IncomingMessage): Promise<string> {
   return await new Promise<string>((resolve, reject) => {
@@ -62,13 +75,18 @@ vi.mock("openclaw/plugin-sdk/webhook-ingress", async () => {
 vi.mock("./client.js", () => ({
   sendMessage: vi.fn().mockResolvedValue(true),
   sendFileUrl: vi.fn().mockResolvedValue(true),
+  resolveChatUserId: vi.fn().mockResolvedValue(undefined),
 }));
 
 vi.mock("./runtime.js", () => ({
   getSynologyRuntime: vi.fn(() => ({
     config: { loadConfig: vi.fn().mockResolvedValue({}) },
     channel: {
+      routing: {
+        resolveAgentRoute: resolveAgentRouteMock,
+      },
       reply: {
+        finalizeInboundContext: finalizeInboundContextMock,
         dispatchReplyWithBufferedBlockDispatcher,
       },
     },
diff --git a/extensions/synology-chat/src/channel.ts b/extensions/synology-chat/src/channel.ts
@@ -22,6 +22,7 @@ import { z } from "zod";
 import { listAccountIds, resolveAccount } from "./accounts.js";
 import { sendMessage, sendFileUrl } from "./client.js";
 import { getSynologyRuntime } from "./runtime.js";
+import { buildSynologyChatInboundSessionKey } from "./session-key.js";
 import { synologyChatSetupAdapter, synologyChatSetupWizard } from "./setup-surface.js";
 import type { ResolvedSynologyChatAccount } from "./types.js";
 import { createWebhookHandler } from "./webhook-handler.js";
@@ -246,6 +247,21 @@ export function createSynologyChatPlugin() {
             // The Chat API user_id (for sending) may differ from the webhook
             // user_id (used for sessions/pairing). Use chatUserId for API calls.
             const sendUserId = msg.chatUserId ?? msg.from;
+            const route = rt.channel.routing.resolveAgentRoute({
+              cfg: currentCfg,
+              channel: CHANNEL_ID,
+              accountId: account.accountId,
+              peer: {
+                kind: "direct",
+                id: msg.from,
+              },
+            });
+            const sessionKey = buildSynologyChatInboundSessionKey({
+              agentId: route.agentId,
+              accountId: account.accountId,
+              userId: msg.from,
+              identityLinks: currentCfg.session?.identityLinks,
+            });
 
             // Build MsgContext using SDK's finalizeInboundContext for proper normalization
             const msgCtx = rt.channel.reply.finalizeInboundContext({
@@ -254,7 +270,7 @@ export function createSynologyChatPlugin() {
               CommandBody: msg.body,
               From: `synology-chat:${msg.from}`,
               To: `synology-chat:${msg.from}`,
-              SessionKey: msg.sessionKey,
+              SessionKey: sessionKey,
               AccountId: account.accountId,
               OriginatingChannel: CHANNEL_ID,
               OriginatingTo: `synology-chat:${msg.from}`,
diff --git a/extensions/synology-chat/src/session-key.test.ts b/extensions/synology-chat/src/session-key.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from "vitest";
+import { buildSynologyChatInboundSessionKey } from "./session-key.js";
+
+describe("buildSynologyChatInboundSessionKey", () => {
+  it("isolates direct-message sessions by account and user", () => {
+    const alpha = buildSynologyChatInboundSessionKey({
+      agentId: "main",
+      accountId: "alpha",
+      userId: "123",
+    });
+    const beta = buildSynologyChatInboundSessionKey({
+      agentId: "main",
+      accountId: "beta",
+      userId: "123",
+    });
+    const otherUser = buildSynologyChatInboundSessionKey({
+      agentId: "main",
+      accountId: "alpha",
+      userId: "456",
+    });
+
+    expect(alpha).toBe("agent:main:synology-chat:alpha:direct:123");
+    expect(beta).toBe("agent:main:synology-chat:beta:direct:123");
+    expect(otherUser).toBe("agent:main:synology-chat:alpha:direct:456");
+    expect(alpha).not.toBe(beta);
+    expect(alpha).not.toBe(otherUser);
+  });
+});
diff --git a/extensions/synology-chat/src/session-key.ts b/extensions/synology-chat/src/session-key.ts
@@ -0,0 +1,21 @@
+import { buildAgentSessionKey } from "openclaw/plugin-sdk/core";
+
+const CHANNEL_ID = "synology-chat";
+
+export function buildSynologyChatInboundSessionKey(params: {
+  agentId: string;
+  accountId: string;
+  userId: string;
+  identityLinks?: Record<string, string[]>;
+}): string {
+  return buildAgentSessionKey({
+    agentId: params.agentId,
+    channel: CHANNEL_ID,
+    accountId: params.accountId,
+    peer: { kind: "direct", id: params.userId },
+    // Synology Chat supports multiple independent accounts on one gateway.
+    // Keep direct-message sessions isolated per account and user.
+    dmScope: "per-account-channel-peer",
+    identityLinks: params.identityLinks,
+  });
+}
diff --git a/extensions/synology-chat/src/webhook-handler.ts b/extensions/synology-chat/src/webhook-handler.ts
@@ -225,7 +225,6 @@ export interface WebhookHandlerDeps {
     senderName: string;
     provider: string;
     chatType: string;
-    sessionKey: string;
     accountId: string;
     commandAuthorized: boolean;
     /** Chat API user_id for sending replies (may differ from webhook user_id) */
@@ -358,14 +357,12 @@ export function createWebhookHandler(deps: WebhookHandlerDeps) {
         );
       }
 
-      const sessionKey = `synology-chat-${payload.user_id}`;
       const deliverPromise = deliver({
         body: cleanText,
         from: payload.user_id,
         senderName: payload.username,
         provider: "synology-chat",
         chatType: "direct",
-        sessionKey,
         accountId: account.accountId,
         commandAuthorized: auth.allowed,
         chatUserId: replyUserId,

Original file line number	Diff line number	Diff line change
`@@ -100,6 +100,8 @@ Media sends are supported by URL-based file delivery.`
`100`	`100`
`101`	`101`	Multiple Synology Chat accounts are supported under `channels.synology-chat.accounts`.
`102`	`102`	`Each account can override token, incoming URL, webhook path, DM policy, and limits.`
	`103`	+Direct-message sessions are isolated per account and user, so the same numeric `user_id`
	`104`	`+on two different Synology accounts does not share transcript state.`
`103`	`105`
`104`	`106`	```json5
`105`	`107`	`{`