fix(gateway): add Signal to platform_group_user_env_map for group message auth

[tilllt]

What

Adds Platform.SIGNAL: "SIGNAL_GROUP_ALLOWED_USERS" to platform_group_user_env_map in gateway/authz_mixin.py.

Why

Signal group messages that pass the adapter-level filter (group allowlist + mention check) are rejected by _is_user_authorized() because Platform.SIGNAL is missing from platform_group_user_env_map. When SIGNAL_ALLOWED_USERS is set (e.g. to restrict DM access), the auth layer only checks the sender against SIGNAL_ALLOWED_USERS and skips the adapter-policy path — effectively blocking all group messages from known senders.

Fix

Adding Platform.SIGNAL: "SIGNAL_GROUP_ALLOWED_USERS" makes the authorization layer also check the group-specific sender allowlist for Signal group messages, consistent with Telegram's TELEGRAM_GROUP_ALLOWED_USERS handling. Users can then add sender phone numbers to SIGNAL_GROUP_ALLOWED_USERS alongside the group IDs already there.

How to test

1. Set SIGNAL_GROUP_ALLOWED_USERS=<group_id>,<sender_number> in .env
2. Have a known sender mention the bot in the group
3. The message should now be authorized instead of being silently dropped

Related

Fixes #58175

Platforms tested

• Linux (Debian) — code change is a one-line dict entry, no platform-specific behavior

[alt-glitch]

This was generated by AI during triage.

Duplicate of #44706 (earliest open canonical) — both add the same Platform.SIGNAL: "SIGNAL_GROUP_ALLOWED_USERS" entry to platform_group_user_env_map in gateway/authz_mixin.py to authorize Signal group senders. Same one-line mechanism as #52240 (also a duplicate of #44706). All three fix #58175; a maintainer should pick one. Related: #58175, #52240.

[tonydwb]

Code Review Summary

Verdict: LGTM (token read-only; formal approval deferred to maintainer)

One-line fix: adds Platform.SIGNAL: "SIGNAL_GROUP_ALLOWED_USERS" to platform_group_user_env_map in gateway/authz_mixin.py. Without this, Signal group messages that pass the adapter-level filter were rejected by _is_user_authorized() because Signal was missing from the group-user env map.

Looks Good

• Minimal, targeted change
• Clear root cause in PR description

---

Reviewed by Hermes Agent

[tonydwb]

Code Review Summary

Verdict: Comment (token read-only; formal approval not possible)

One-line fix: adds Platform.SIGNAL: "SIGNAL_GROUP_ALLOWED_USERS" to platform_group_user_env_map so Signal group messages are authorized against the group-specific sender allowlist, consistent with Telegram.

• Clean single-file, single-line fix
• Well-documented root cause and behavior change

---

Reviewed by Hermes Agent