storkit: merge 389_story_whatsapp_phone_number_allowlist_authorization

server/src/chat/transport/matrix/config.rs

@@ -114,6 +114,14 @@ pub struct BotConfig {
     #[serde(default)]
     pub twilio_whatsapp_number: Option<String>,
 
+    /// Phone numbers allowed to interact with the bot when using WhatsApp.
+    /// When non-empty, only listed numbers can send commands; all others are
+    /// silently ignored. When empty or absent, all numbers are allowed
+    /// (backwards compatible — open by default, unlike Matrix which is
+    /// fail-closed).
+    #[serde(default)]
+    pub whatsapp_allowed_phones: Vec<String>,
+
     // ── Slack Bot API fields ─────────────────────────────────────────
     // These are only required when `transport = "slack"`.
 
@@ -1010,4 +1018,40 @@ slack_signing_secret = "secret123"
         .unwrap();
         assert!(BotConfig::load(tmp.path()).is_none());
     }
+
+    #[test]
+    fn whatsapp_allowed_phones_defaults_to_empty_when_absent() {
+        let config: BotConfig = toml::from_str(
+            r#"
+enabled = true
+transport = "whatsapp"
+whatsapp_provider = "meta"
+whatsapp_phone_number_id = "123"
+whatsapp_access_token = "tok"
+whatsapp_verify_token = "ver"
+"#,
+        )
+        .unwrap();
+        assert!(config.whatsapp_allowed_phones.is_empty());
+    }
+
+    #[test]
+    fn whatsapp_allowed_phones_deserializes_list() {
+        let config: BotConfig = toml::from_str(
+            r#"
+enabled = true
+transport = "whatsapp"
+whatsapp_provider = "meta"
+whatsapp_phone_number_id = "123"
+whatsapp_access_token = "tok"
+whatsapp_verify_token = "ver"
+whatsapp_allowed_phones = ["+15551234567", "+15559876543"]
+"#,
+        )
+        .unwrap();
+        assert_eq!(
+            config.whatsapp_allowed_phones,
+            vec!["+15551234567", "+15559876543"]
+        );
+    }
 }