vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-04-28 09:33:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Gateway: tighten forwarded client and pairing guards (#46800)

Browse Source 
* Gateway: tighten forwarded client and pairing guards

* Gateway: make device approval scope checks atomic

* Gateway: preserve device approval baseDir compatibility
This commit is contained in:
Vincent Koc
2026-03-15 10:50:49 -07:00
committed by GitHub
parent 132e459009
commit fc2d29ea92
7 changed files with 252 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/gateway/server-methods/devices.ts
View File

@@ -94,7 +94,7 @@ export const deviceHandlers: GatewayRequestHandlers = {
undefined,
);
},
"device.pair.approve": async ({ params, respond, context }) => {
"device.pair.approve": async ({ params, respond, context, client }) => {
if (!validateDevicePairApproveParams(params)) {
respond(
false,
@@ -109,11 +109,20 @@ export const deviceHandlers: GatewayRequestHandlers = {
return;
}
const { requestId } = params as { requestId: string };
const approved = await approveDevicePairing(requestId);
const callerScopes = Array.isArray(client?.connect?.scopes) ? client.connect.scopes : [];
const approved = await approveDevicePairing(requestId, { callerScopes });
if (!approved) {
respond(false, undefined, errorShape(ErrorCodes.INVALID_REQUEST, "unknown requestId"));
return;
}
if (approved.status === "forbidden") {
respond(
false,
undefined,
errorShape(ErrorCodes.INVALID_REQUEST, `missing scope: ${approved.missingScope}`),
);
return;
}
context.logGateway.info(
`device pairing approved device=${approved.device.deviceId} role=${approved.device.role ?? "unknown"}`,
);