fix(mattermost): bridge allow_from config key to MATTERMOST_ALLOWED_USERS

[AhmetArif0]

What does this PR do?

Root cause: _apply_yaml_config() in the Mattermost adapter translates config.yaml keys into env vars, but it was missing the allow_from → MATTERMOST_ALLOWED_USERS mapping. Users who set mattermost.allow_from: [user1, user2] in config.yaml got no user filtering — the adapter read MATTERMOST_ALLOWED_USERS as empty and left access open to all users (fail-open security issue).

Fix: Add the allow_from → MATTERMOST_ALLOWED_USERS translation using the same list-join pattern as allowed_channels. Env var takes precedence over YAML (guarded by not os.getenv()), matching all other keys in the function.

Parity fix — Discord received the identical allow_from bridge in PR #35329 today; Mattermost was missed.

Related Issue

Parity fix — same pattern as PR #35329 (Discord allow_from bridge).

Type of Change

• 🔒 Security fix
• 🐛 Bug fix

Changes Made

• plugins/platforms/mattermost/adapter.py: add 5-line allow_from → MATTERMOST_ALLOWED_USERS block to _apply_yaml_config()
• tests/gateway/test_mattermost.py: add TestApplyYamlConfig with 7 tests covering list, single string, env precedence, absent key, and regression for existing keys

How to Test

pytest tests/gateway/test_mattermost.py::TestApplyYamlConfig -v --override-ini="addopts="

Checklist

• Contributing Guide read | Conventional Commits | No duplicate PR
• Single logical change | Tests added | Platform: macOS
• Docs — N/A | Cross-platform — N/A

[tonydwb]

Code Review Summary

Verdict: Approved ✅

Bridges the allow_from config key to MATTERMOST_ALLOWED_USERS environment variable for the Mattermost adapter. Small, correct, well-tested.

---

Reviewed by Hermes Agent

[teknium1]

Thanks — current main still needs the Mattermost allow_from YAML-to-env bridge.

Problems

• The stated fail-open impact no longer matches current main. Mattermost authorization reads MATTERMOST_ALLOWED_USERS (gateway/authz_mixin.py:365-375, 458-465); with no allowlist it falls through to default deny unless GATEWAY_ALLOW_ALL_USERS is explicitly enabled (gateway/authz_mixin.py:467-514). This is therefore a fail-closed config-parity bug: configured users remain unable to use the bot.
• The new tests invoke the hook directly. The production behavior depends on registered hook dispatch in gateway/config.py:1274-1304; add a loader-level regression test, following tests/gateway/test_config.py:696-720, that writes Mattermost allow_from into temporary config.yaml and asserts MATTERMOST_ALLOWED_USERS is populated.

Suggested changes

• Keep the proposed mapping, but revise the security description to reflect fail-closed behavior.
• Cover the load_gateway_config() path as above.

This is an automated hermes-sweeper review.