Merge cfa640780a into 0df050ff2e

pkg/identity/identity.go

@@ -44,7 +44,16 @@ func MatchAllowed(sender bus.SenderInfo, allowed string) bool {
 		return false
 	}
 
-	// Try canonical match first: "platform:id" format
+	// Keep track of explicit username format
+	isAtUsername := strings.HasPrefix(allowed, "@")
+
+	// Strip leading "@" for username matching
+	trimmed := strings.TrimPrefix(allowed, "@")
+
+	// Try canonical match first: "platform:id" format.
+	// Skip when the entry starts with "@" — the "@" prefix signals a
+	// username or Matrix MXID (e.g. "@alice:matrix.org"), not a platform:id pair.
+	if !isAtUsername {
 		if platform, id, ok := ParseCanonicalID(allowed); ok {
 			// Only treat as canonical if the platform portion looks like a known platform name
 			// (not a pure-numeric string, which could be a compound ID)
@@ -58,12 +67,7 @@ func MatchAllowed(sender bus.SenderInfo, allowed string) bool {
 					sender.PlatformID == id
 			}
 		}
-
-	// Keep track of explicit username format
-	isAtUsername := strings.HasPrefix(allowed, "@")
-
-	// Strip leading "@" for username matching
-	trimmed := strings.TrimPrefix(allowed, "@")
+	}
 
 	// Split compound "id|username" format
 	allowedID := trimmed
@@ -83,6 +87,18 @@ func MatchAllowed(sender bus.SenderInfo, allowed string) bool {
 		return true
 	}
 
+	// Match the full "@"-prefixed entry against PlatformID or Username.
+	// Needed for Matrix MXIDs where both the config entry and the
+	// sender identifiers include the "@" prefix (e.g. "@alice:matrix.org").
+	if isAtUsername {
+		if sender.PlatformID != "" && sender.PlatformID == allowed {
+			return true
+		}
+		if sender.Username != "" && sender.Username == allowed {
+			return true
+		}
+	}
+
 	// Match compound sender format against allowed parts
 	if allowedUser != "" && sender.PlatformID != "" && sender.PlatformID == allowedID {
 		return true

pkg/identity/identity_test.go

@@ -223,6 +223,53 @@ func TestMatchAllowed(t *testing.T) {
 			allowed: "  123456  ",
 			want:    true,
 		},
+		// Matrix MXID matching (issue #2815)
+		// Matrix user IDs look like "@alice:matrix.org" — the colon must
+		// not be misinterpreted as a canonical "platform:id" separator.
+		{
+			name: "matrix MXID with @ prefix matches PlatformID",
+			sender: bus.SenderInfo{
+				Platform:    "matrix",
+				PlatformID:  "@alice:matrix.org",
+				CanonicalID: BuildCanonicalID("matrix", "@alice:matrix.org"),
+				Username:    "@alice:matrix.org",
+			},
+			allowed: "@alice:matrix.org",
+			want:    true,
+		},
+		{
+			name: "matrix MXID without @ prefix matches PlatformID",
+			sender: bus.SenderInfo{
+				Platform:    "matrix",
+				PlatformID:  "@alice:matrix.org",
+				CanonicalID: BuildCanonicalID("matrix", "@alice:matrix.org"),
+				Username:    "@alice:matrix.org",
+			},
+			allowed: "alice:matrix.org",
+			want:    false, // ambiguous — could be a canonical "platform:id" entry
+		},
+		{
+			name: "matrix canonical format matches",
+			sender: bus.SenderInfo{
+				Platform:    "matrix",
+				PlatformID:  "@alice:matrix.org",
+				CanonicalID: BuildCanonicalID("matrix", "@alice:matrix.org"),
+				Username:    "@alice:matrix.org",
+			},
+			allowed: "matrix:@alice:matrix.org",
+			want:    true,
+		},
+		{
+			name: "matrix MXID rejects unlisted sender",
+			sender: bus.SenderInfo{
+				Platform:    "matrix",
+				PlatformID:  "@eve:evil.org",
+				CanonicalID: BuildCanonicalID("matrix", "@eve:evil.org"),
+				Username:    "@eve:evil.org",
+			},
+			allowed: "@alice:matrix.org",
+			want:    false,
+		},
 	}
 
 	for _, tt := range tests {