# WeCom Bot DM Permission Configuration

## The "仅创建者可使用" Problem

When non-admin users try to DM the bot, they get "仅创建者可使用" (only creator can use). This is caused by TWO layers of permission:

### Layer 1: WeCom Platform (message never reaches Hermes)

**Two different paths depending on bot type:**

| Bot Type | Visibility Path |
|----------|----------------|
| **智能机器人** (Smart Bot) | 协作 → 智能机器人 → 点机器人名 → 右上角「…」→ 可见范围 |
| **自建应用** (Custom App) | 应用管理 → 机器人 → [机器人名] → 编辑 → 可见范围 |

- Default: "仅创建者"
- Fix: 改为 "所有成员" 或添加指定成员

⚠️ **智能机器人在「协作」菜单下，不在「应用管理」里。走错入口看不到可见范围设置。**

### Layer 2: Hermes Gateway Authorization (`gateway/run.py` `_is_user_authorized()`)

Authorization check order (line 5562-5600):

```
1. Per-platform ALLOW_ALL (e.g. WECOM_ALLOW_ALL_USERS=true) → RETURN TRUE  ← FIRST CHECK
2. Per-platform allowlist (e.g. WECOM_ALLOWED_USERS) → check membership
3. Pairing store (ALWAYS checked) → if paired, RETURN TRUE
4. Global GATEWAY_ALLOW_ALL_USERS → if true, RETURN TRUE
5. Default: DENY
```

**Key insight**: If `WECOM_ALLOW_ALL_USERS=true` (env var OR `.env`), Hermes authorizes EVERYONE at step 1. The pairing store, allowlists, and global flags are never even reached. "仅创建者可使用" must be a WeCom platform-level block, not Hermes.

The adapter-level `dm_policy` config (`config.yaml` → `platforms.wecom.extra.dm_policy`) is a separate, earlier filter in the WeCom adapter (`gateway/platforms/wecom.py` line 838-843):
- `open` — always True
- `allowlist` — checks `_allow_from`
- `disabled` — always False

## Diagnostic Commands

```bash
# Check current WeCom env vars
grep WECOM ~/.hermes/.env

# Check pairing store
ls ~/.hermes/platforms/pairing/

# List available send targets (shows who the bot can reach)
send_message action=list

# Check gateway logs for WeCom DM activity
grep -i 'wecom.*dm\|wecom.*user\|inbound.*wecom' ~/.hermes/logs/gateway.log | tail -20
```

## Resolution Flow

1. **Check Hermes side first**: `grep WECOM_ALLOW_ALL_USERS ~/.hermes/.env` → should be `true`
2. **Check WeCom platform**: Go to the correct visibility path (see Layer 1 above) → ensure it's not "仅创建者"
3. **Verify connectivity**: Have the blocked user send ANY message to the bot. Then check gateway logs to see if the message reached Hermes.
4. If message appears in logs → Hermes received it, reply should work. If not → message blocked at WeCom platform level.
5. If reply fails with `errcode 846601` → bot is in URL callback mode, must switch back to WebSocket mode.