fix(browser): require admin scope for browser request

Co-authored-by: RichardCao <RichardCao@users.noreply.github.com>
This commit is contained in:
Peter Steinberger
2026-04-25 05:12:04 +01:00
parent b84e57fca3
commit 6602092a40
5 changed files with 32 additions and 5 deletions

View File

@@ -118,6 +118,17 @@ describe("browser plugin", () => {
});
});
it("registers browser.request as an admin gateway method", () => {
const { api, registerGatewayMethod } = createApi();
registerBrowserPlugin(api);
expect(registerGatewayMethod).toHaveBeenCalledWith(
"browser.request",
runtimeApiMocks.handleBrowserGatewayRequest,
{ scope: "operator.admin" },
);
});
it("declares setup auto-enable reasons for browser config surfaces", () => {
const probe = registerBrowserAutoEnableProbe();

View File

@@ -34,7 +34,7 @@ export function registerBrowserPlugin(api: OpenClawPluginApi) {
})) as OpenClawPluginToolFactory);
api.registerCli(({ program }) => registerBrowserCli(program), { commands: ["browser"] });
api.registerGatewayMethod("browser.request", handleBrowserGatewayRequest, {
scope: "operator.write",
scope: "operator.admin",
});
api.registerService(createBrowserPluginService());
}