fix(gateway): secondary-profile allowlists work and allow-all no longer leaks across profiles (#93522, salvage #93545 + #93605)

[teknium1]

Summary

Secondary-profile allowlists on weixin/yuanbao/signal/wecom group chats work again, and a default profile's GATEWAY_ALLOW_ALL_USERS=true can no longer leak admission into other profiles. Under gateway.multiplex_profiles, these four adapters read DM/group policies and allowlists via raw os.getenv at construction time — bypassing the per-profile secret scope (which deliberately never mutates os.environ), so secondary-profile authz config was invisible (silent drops) and default-profile allow-all was global (fail-open). Fixes #93522.

Changes

• gateway/platforms/weixin.py, yuanbao.py, signal.py, plugins/platforms/wecom/adapter.py: every authorization read (DM/group policy, allowlists, allow-all opt-ins, open-DM opt-in gates) now routes through the profile-scoped secret helpers, matching the existing qqbot pattern
• Yuanbao startup-guard opt-in check and Signal's __init__-snapshotted lists included
• tests/gateway/test_multiplex_profile_authz.py + tests/gateway/test_platform_authz_scope.py: secondary profile env-only allowlist admits its sender; default-profile allow-all does not leak

Validation

	Before	After
Secondary profile allowlist	invisible → messages dropped	admits its sender
Default GATEWAY_ALLOW_ALL_USERS	leaks into all profiles	scoped to its profile
Tests	—	76 passed + 19/19 live E2E (all four adapters under fake profile scope)

Salvaged from #93545 (@chelsealong, earliest) with follow-up from #93605 (@aniruddhaadak80 — signal coverage, allow-all gates, cross-adapter suite); both cherry-picked with authorship preserved.

Infographic

[andrexibiza]

Reviewed exact head 7cb62237ee2656c3ca2bb91fd2b8ea2c881006df against current main a0ca7c19204e514f9590ce3b812e029b315ab9e9 (merge base 7e67f64fcee9340f40a1c6f912fc650aa4984510). Exact-head CI 32702203904, Docker 32702203281, and Nix 32702203232 are all green. The current-main delta since the merge base is in cron/dashboard/console surfaces, not these gateway authz files, so I do not see a composition collision there.

The Weixin/Yuanbao/WeCom/startup-guard changes close the publication gap left on #93545, and the Signal helper does remove the original cross-profile os.environ borrowing. There is still one security blocker on the Signal side, though:

Blocker — a scoped SIGNAL_ALLOWED_USERS miss still becomes wildcard authority before the runner auth gate. In gateway/platforms/signal.py, the constructor now does _sig_secret("SIGNAL_ALLOWED_USERS", "*"). With multiplexing active and a secondary profile scope installed but no SIGNAL_ALLOWED_USERS entry, the scoped read returns the supplied default, so self.dm_allow_from becomes {"*"}. The existing reaction gate treats "*" as authorized, and that reaction path intentionally runs before run.py authorization. Result: profile B no longer inherits profile A's allowlist, but B can still emit the pre-auth 👀 reaction to an arbitrary DM even though B never opted into open access. That is the other side of the same authority boundary: not borrowing another profile is insufficient if absence itself is promoted to wildcard authority.

The regression suite currently cannot catch this. test_helper_does_not_leak_default_env_into_scoped_miss supplies a synthetic "restricted-default" to _sig_secret, while no new test constructs the real SignalAdapter with the production "*" default and drives the pre-auth reaction gate.

Required repair: distinguish unscoped single-profile fallback from installed scoped absence for SIGNAL_ALLOWED_USERS. A scoped miss should produce an empty adapter allowlist; "*" should only mean open when the profile explicitly supplied it (scope/YAML). Add a regression with default-profile SIGNAL_ALLOWED_USERS=* plus a secondary installed scope that omits the key and prove an untrusted DM gets no pre-auth reaction; then prove an explicit * in the secondary profile still opts in. #88559 already contains the useful prior-art shape here: scoped miss → empty, explicit * → open, plus a reaction-path guard. I would salvage that narrow Signal semantic rather than merge the stale broader PR.

One adjacent profile-isolation seam is still visible on this head: SIGNAL_REQUIRE_MENTION remains a raw process-env read; #88559 also scoped that value. I would either compose that tiny residual while this file is open or leave it explicitly owned as follow-up rather than imply all Signal profile-local behavior is now scoped. I am not treating that alone as the merge blocker above; the wildcard/pre-auth reaction path is the concrete security issue.

Topology/provenance otherwise looks right. #93545 is the earlier partial implementation by @chelsealong and its exact salvaged commit 168e2e6e... remains authored by her; #93605 is the completing implementation from issue reporter @aniruddhaadak80 and this exact head remains authored by him. #93639 should become the single delivery owner after the Signal fix; #93545 and #93605 are competing/superseded inputs and should not merge in parallel. #88559 is older, broader, currently non-mergeable prior art for the remaining Signal semantics—not a second merge lane.