#18664: fix(imessage): honor groupConfig regardless of allowlistEnabled
channel: imessage
size: XS
trusted-contributor
Cluster:
Messaging Platform Improvements
## Summary
Fixes #18645 — iMessage group messages treated as DMs when `imsg` omits `is_group` field.
## Problem
In `inbound-processing.ts`, the `treatAsGroupByConfig` check requires `groupListPolicy.allowlistEnabled` to be true:
```typescript
const treatAsGroupByConfig = Boolean(
groupIdCandidate && groupListPolicy.allowlistEnabled && groupListPolicy.groupConfig,
);
```
But `allowlistEnabled` is only `true` when `groupPolicy="allowlist"`. When `groupPolicy="open"` (the default), explicit group configurations under `imessage.groups` are ignored — the chat is treated as a DM even when the admin has explicitly configured it as a group.
## Fix
Remove the `allowlistEnabled` requirement. If there's a `groupConfig` for a `chat_id`, that's an explicit admin declaration that the chat is a group, independent of the `groupPolicy` mode:
```typescript
const treatAsGroupByConfig = Boolean(groupIdCandidate && groupListPolicy.groupConfig);
```
## Impact
**Privacy/Security**: Group conversations can be incorrectly treated as DMs when the `imsg` RPC omits the `is_group` field — this could leak group context to unintended sessions or cause messages to be processed with DM-level permissions.
## Testing
All 26 iMessage tests pass.
<!-- greptile_comment -->
<h3>Greptile Summary</h3>
Removes the `allowlistEnabled` requirement from the `treatAsGroupByConfig` check in `src/imessage/monitor/inbound-processing.ts:134`. When an admin explicitly configures a `chat_id` under `imessage.groups`, that configuration is now honored regardless of the `groupPolicy` mode (open vs allowlist). This fixes a bug where group configurations were ignored when `groupPolicy="open"` (the default), causing group chats to be incorrectly treated as DMs when the iMessage RPC omitted the `is_group` field.
- Correctly decouples explicit group configuration from the allowlist enforcement mechanism
- The downstream allowlist check (line 173) still enforces group allowlist restrictions when needed
- Existing test at line 152-185 validates this exact scenario
<h3>Confidence Score: 5/5</h3>
- This PR is safe to merge with no risk - it's a well-isolated bug fix with existing test coverage
- The fix correctly addresses the issue by removing an overly restrictive condition. The change is minimal (one line removed, comment added), the logic is sound, existing tests validate the behavior, and all 26 iMessage tests pass. The downstream allowlist enforcement at line 173 remains intact, so no security restrictions are weakened.
- No files require special attention
<sub>Last reviewed commit: 96917db</sub>
<!-- greptile_other_comments_section -->
<sub>(1/5) You can manually trigger the agent by mentioning @greptileai in a comment!</sub>
<!-- /greptile_comment -->
Most Similar PRs
#22168: fix(imessage): resolve group sessions without chat identifiers
by AIflow-Labs · 2026-02-20
84.3%
#19435: fix(slack): properly handle group DM (MPIM) events
by Utkarshbhimte · 2026-02-17
81.2%
#5665: fix: match group JIDs in groupAllowFrom allowlist
by koala73 · 2026-01-31
80.8%
#4390: fix(whatsapp): allow media from allowlisted groups without groupAllow…
by Sarang19114 · 2026-01-30
80.5%
#17513: fix(discord): respect groupPolicy in channel config fallback (#4555)
by aronchick · 2026-02-15
79.9%
#11611: feat: separate group-level allowlist from sender-level command auth...
by thisnick · 2026-02-08
79.6%
#6567: fix: include paired users in WhatsApp group sender allowlist
by giannisanni · 2026-02-01
78.9%
#4402: fix: store group messages from non-allowlisted senders as pending c...
by adam91holt · 2026-01-30
77.7%
#3300: changed chat session selection logic in iMessage
by KimEJ · 2026-01-28
77.0%
#16989: fix(telegram): remove duplicate migration call during group->superg...
by AI-Reviewer-QS · 2026-02-15
76.4%