From d3e12cee7e178eff00e283036eebe2147b255fd5 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 17 Apr 2026 09:02:46 +0100
Subject: [PATCH] test: move gateway token cases to unit seam

---
 .../onboard-non-interactive.gateway.test.ts   | 118 ------------------
 .../local/gateway-config.test.ts              |  18 +++
 2 files changed, 18 insertions(+), 118 deletions(-)

diff --git a/src/commands/onboard-non-interactive.gateway.test.ts b/src/commands/onboard-non-interactive.gateway.test.ts
index 01510646785..e5155d6f2e8 100644
--- a/src/commands/onboard-non-interactive.gateway.test.ts
+++ b/src/commands/onboard-non-interactive.gateway.test.ts
@@ -445,124 +445,6 @@ describe("onboard (non-interactive): gateway and remote auth", () => {
     });
   }, 60_000);
 
-  it("uses OPENCLAW_GATEWAY_TOKEN when --gateway-token is omitted", async () => {
-    await withStateDir("state-env-token-", async (stateDir) => {
-      const envToken = "tok_env_fallback_123";
-      const workspace = path.join(stateDir, "openclaw");
-      const prevToken = process.env.OPENCLAW_GATEWAY_TOKEN;
-      process.env.OPENCLAW_GATEWAY_TOKEN = envToken;
-
-      try {
-        await runNonInteractiveSetup(
-          {
-            nonInteractive: true,
-            mode: "local",
-            workspace,
-            authChoice: "skip",
-            skipSkills: true,
-            skipHealth: true,
-            installDaemon: false,
-            gatewayBind: "loopback",
-            gatewayAuth: "token",
-          },
-          runtime,
-        );
-
-        const configPath = resolveStateConfigPath(process.env, stateDir);
-        const cfg = await readJsonFile<{
-          gateway?: { auth?: { mode?: string; token?: string } };
-        }>(configPath);
-
-        expect(cfg?.gateway?.auth?.mode).toBe("token");
-        expect(cfg?.gateway?.auth?.token).toBe(envToken);
-      } finally {
-        if (prevToken === undefined) {
-          delete process.env.OPENCLAW_GATEWAY_TOKEN;
-        } else {
-          process.env.OPENCLAW_GATEWAY_TOKEN = prevToken;
-        }
-      }
-    });
-  }, 60_000);
-
-  it("writes gateway token SecretRef from --gateway-token-ref-env", async () => {
-    await withStateDir("state-env-token-ref-", async (stateDir) => {
-      const envToken = "tok_env_ref_123";
-      const workspace = path.join(stateDir, "openclaw");
-      const prevToken = process.env.OPENCLAW_GATEWAY_TOKEN;
-      process.env.OPENCLAW_GATEWAY_TOKEN = envToken;
-
-      try {
-        await runNonInteractiveSetup(
-          {
-            nonInteractive: true,
-            mode: "local",
-            workspace,
-            authChoice: "skip",
-            skipSkills: true,
-            skipHealth: true,
-            installDaemon: false,
-            gatewayBind: "loopback",
-            gatewayAuth: "token",
-            gatewayTokenRefEnv: "OPENCLAW_GATEWAY_TOKEN",
-          },
-          runtime,
-        );
-
-        const configPath = resolveStateConfigPath(process.env, stateDir);
-        const cfg = await readJsonFile<{
-          gateway?: { auth?: { mode?: string; token?: unknown } };
-        }>(configPath);
-
-        expect(cfg?.gateway?.auth?.mode).toBe("token");
-        expect(cfg?.gateway?.auth?.token).toEqual({
-          source: "env",
-          provider: "default",
-          id: "OPENCLAW_GATEWAY_TOKEN",
-        });
-      } finally {
-        if (prevToken === undefined) {
-          delete process.env.OPENCLAW_GATEWAY_TOKEN;
-        } else {
-          process.env.OPENCLAW_GATEWAY_TOKEN = prevToken;
-        }
-      }
-    });
-  }, 60_000);
-
-  it("fails when --gateway-token-ref-env points to a missing env var", async () => {
-    await withStateDir("state-env-token-ref-missing-", async (stateDir) => {
-      const workspace = path.join(stateDir, "openclaw");
-      const previous = process.env.MISSING_GATEWAY_TOKEN_ENV;
-      delete process.env.MISSING_GATEWAY_TOKEN_ENV;
-      try {
-        await expect(
-          runNonInteractiveSetup(
-            {
-              nonInteractive: true,
-              mode: "local",
-              workspace,
-              authChoice: "skip",
-              skipSkills: true,
-              skipHealth: true,
-              installDaemon: false,
-              gatewayBind: "loopback",
-              gatewayAuth: "token",
-              gatewayTokenRefEnv: "MISSING_GATEWAY_TOKEN_ENV",
-            },
-            runtime,
-          ),
-        ).rejects.toThrow(/MISSING_GATEWAY_TOKEN_ENV/);
-      } finally {
-        if (previous === undefined) {
-          delete process.env.MISSING_GATEWAY_TOKEN_ENV;
-        } else {
-          process.env.MISSING_GATEWAY_TOKEN_ENV = previous;
-        }
-      }
-    });
-  }, 60_000);
-
   it("writes gateway.remote url/token and callGateway uses them", async () => {
     await withStateDir("state-remote-", async (stateDir) => {
       const port = getPseudoPort(30_000);
diff --git a/src/commands/onboard-non-interactive/local/gateway-config.test.ts b/src/commands/onboard-non-interactive/local/gateway-config.test.ts
index aa4b1b90618..e285262b53c 100644
--- a/src/commands/onboard-non-interactive/local/gateway-config.test.ts
+++ b/src/commands/onboard-non-interactive/local/gateway-config.test.ts
@@ -227,4 +227,22 @@ describe("applyNonInteractiveGatewayConfig token resolution chain", () => {
       delete process.env[newRefId];
     }
   });
+
+  it("fails when --gateway-token-ref-env points to a missing env var", () => {
+    const runtime = createRuntime();
+
+    const result = applyNonInteractiveGatewayConfig({
+      nextConfig: {} as OpenClawConfig,
+      opts: { gatewayTokenRefEnv: "MISSING_GATEWAY_TOKEN_ENV" } as OnboardOptions,
+      runtime: runtime as never,
+      defaultPort: 18789,
+    });
+
+    expect(result).toBeNull();
+    expect(runtime.error).toHaveBeenCalledWith(
+      'Environment variable "MISSING_GATEWAY_TOKEN_ENV" is missing or empty.',
+    );
+    expect(runtime.exit).toHaveBeenCalledWith(1);
+    expect(randomToken).not.toHaveBeenCalled();
+  });
 });