Skip to content

Config: refresh bundled channel metadata and config doc baselines#116

Merged
linfangw merged 1 commit into
mainfrom
v2026.4.1-2
Apr 2, 2026
Merged

Config: refresh bundled channel metadata and config doc baselines#116
linfangw merged 1 commit into
mainfrom
v2026.4.1-2

Conversation

@linfangw

@linfangw linfangw commented Apr 2, 2026

Copy link
Copy Markdown
Member

No description provided.

@linfangw
linfangw merged commit 92ce24b into main Apr 2, 2026
2 of 9 checks passed

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces configuration metadata for a new X (Twitter) channel plugin, defining its schema for credentials, polling intervals, and access control. The review feedback suggests improving security by allowing sensitive credentials to be loaded from external secret providers (such as environment variables or files) rather than just plaintext strings. Additionally, it is recommended to allow both strings and numbers in the 'allowFrom' and 'actionsAllowFrom' fields to ensure consistency with other plugins and better handle numeric user IDs.

Comment on lines +14738 to +14740
consumerKey: {
type: "string",
},

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

For better security, credentials like consumerKey should support being loaded from a secrets provider (e.g., environment variables, files) instead of only accepting a plaintext string. This prevents storing sensitive information directly in the configuration file.

This applies to consumerSecret, accessToken, and accessTokenSecret as well, both at the top level and within each entry under accounts.

You can follow the pattern used by other plugins in this file, like discord's token property:

{
  "anyOf": [
    {
      "type": "string"
    },
    {
      "oneOf": [
        {
          "type": "object",
          "properties": {
            "source": { "type": "string", "const": "env" },
            "provider": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$" },
            "id": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]{0,127}$" }
          },
          "required": ["source", "provider", "id"],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "source": { "type": "string", "const": "file" },
            "provider": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$" },
            "id": { "type": "string" }
          },
          "required": ["source", "provider", "id"],
          "additionalProperties": false
        },
        {
          "type": "object",
          "properties": {
            "source": { "type": "string", "const": "exec" },
            "provider": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$" },
            "id": { "type": "string" }
          },
          "required": ["source", "provider", "id"],
          "additionalProperties": false
        }
      ]
    }
  ]
}

Comment on lines +14756 to +14758
items: {
type: "string",
},

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

For consistency with other channel plugins like discord and bluebubbles, allowFrom should probably allow an array of strings or numbers. This would make the configuration more robust if a user provides a numeric user ID as a number instead of a string. This also applies to actionsAllowFrom and the corresponding properties under accounts.

          items: {
            anyOf: [
              {
                type: "string"
              },
              {
                type: "number"
              }
            ]
          }

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant