Resurrects the x-fabric-system-key bypass + isSystem branch on POST
/channels/:id/messages, dropped in ca20df7 when dialectic stopped
broadcasting topic lifecycle events to Fabric. Re-enabling now because
Fabric.OpenclawPlugin's close-sub-discussion needs to write a callback
into a parent channel as a system-authored message (not as the closing
host), with an optional precision wakeup so the recruitment workflow can
resume immediately after an interview sub-discussion closes.
Three coupled bits:
1. ApiKeyGuard pre-Bearer bypass: when x-fabric-system-key matches
FABRIC_BACKEND_GUILD_COMMANDS_SYNC_KEY, set req.isSystem=true and
skip the Bearer check. Intentionally reuses the existing commands
sync env — same shared secret, same consumer (the OpenclawPlugin
reads channels.fabric.commandsSyncKey for both paths). One less env
to rotate, one less secret to manage.
2. messaging.controller POST /channels/:id/messages adds an isSystem
branch (runs before the participant gate):
- Looks up the channel directly (not via assertParticipant).
- Persists with sentinel author 00000000-0000-0000-0000-000000000000,
same UUID the old impl used.
- Translates <@user.name:NAME> mentions like the regular path.
- When wakeupUserId is set, delivers via emitMessageTargeted so that
exactly that one recipient receives wakeup=true; everyone else gets
wakeup=false. When omitted, delivers via emitMessageCreated with an
empty wakeUserIds set so nobody is woken — silent system log.
Two intentional differences from the 985b06a original:
- No xType=announce restriction. The original was limited to announce
because that was Dialectic's only use case; we now need this on dm /
general / discuss / etc. for the sub-discussion callback. Closed
channels are still rejected (409) on both paths.
- The wakeupUserId field is new — old impl only ever sent silent
announces.
3. DTO carries wakeupUserId? optional string. Ignored on the regular
user-bearer path; load-bearing on the system path.
Shared helper: extracted commands.controller's private safeEqual into
src/common/safe-equal.ts so api-key.guard.ts can use the same constant-
time check. Vitest spec covers equal / inequal / length-mismatch / empty
cases. Existing unit tests still pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hzhang
340eed8aa3