feat(chatto): add allowed-user helper for interactive prompts

adapter.py

@@ -1768,6 +1768,24 @@ class ChattoAdapter(BasePlatformAdapter):
             login = user.login if user else None
         return login is not None and login in allowed
 
+    def _is_allowed_user_id(self, user_id: str) -> bool:
+        """Whether a Chatto user identified only by id may talk to the agent.
+
+        Lighter than ``_check_auth``: callers such as reaction routing hold
+        only an actor id, not a ``User`` or ``MessageEvent``. Consults the
+        same ``CHATTO_ALLOWED_USERS`` / ``CHATTO_ALLOW_ALL_USERS`` settings,
+        including a login looked up from ``_user_cache`` when the id itself
+        is not listed. Fail-closed when neither setting allows anyone.
+        """
+        if self.chatto_config.allow_all_users.value:
+            return True
+        allowed = self.chatto_config.allowed_users.value
+        if user_id in allowed:
+            return True
+        user = self._user_cache.get(user_id)
+        login = user.login if user is not None else None
+        return login is not None and login in allowed
+
     def _evict_roster(self, room_id: str) -> None:
         """Drop all roster state for a room.
 

test_adapter.py

@@ -5613,3 +5613,13 @@ class TestPluginToolHandlers:
         result = json.loads(raw)
         assert result["success"] is True
         client.post_message.assert_awaited()
+
+
+class TestInteractivePromptAuth:
+    """Allowed-user helper for reaction-driven interactive prompts."""
+
+    def test_interactive_prompt_auth_fail_closed(self):
+        adapter = _make_adapter()
+        adapter.chatto_config.allow_all_users.value = False
+        adapter.chatto_config.allowed_users.value = []
+        assert adapter._is_allowed_user_id("user-1") is False