mirror of
https://github.com/openclaw/openclaw.git
synced 2026-05-04 19:20:21 +00:00
* secrets: harden read-only SecretRef resolution for status and audit * CLI: add SecretRef degrade-safe regression coverage * Docs: align SecretRef status and daemon probe semantics * Security audit: close SecretRef review gaps * Security audit: preserve source auth SecretRef configuredness * changelog Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com> --------- Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>
115 lines
3.7 KiB
TypeScript
115 lines
3.7 KiB
TypeScript
import { describe, expect, it, vi } from "vitest";
|
|
import type { ChannelPlugin } from "../channels/plugins/types.js";
|
|
import type { OpenClawConfig } from "../config/config.js";
|
|
import { resolveDefaultChannelAccountContext } from "./channel-account-context.js";
|
|
|
|
describe("resolveDefaultChannelAccountContext", () => {
|
|
it("uses enabled/configured defaults when hooks are missing", async () => {
|
|
const account = { token: "x" };
|
|
const plugin = {
|
|
id: "demo",
|
|
config: {
|
|
listAccountIds: () => ["acc-1"],
|
|
resolveAccount: () => account,
|
|
},
|
|
} as unknown as ChannelPlugin;
|
|
|
|
const result = await resolveDefaultChannelAccountContext(plugin, {} as OpenClawConfig);
|
|
|
|
expect(result.accountIds).toEqual(["acc-1"]);
|
|
expect(result.defaultAccountId).toBe("acc-1");
|
|
expect(result.account).toBe(account);
|
|
expect(result.enabled).toBe(true);
|
|
expect(result.configured).toBe(true);
|
|
expect(result.diagnostics).toEqual([]);
|
|
expect(result.degraded).toBe(false);
|
|
});
|
|
|
|
it("uses plugin enable/configure hooks", async () => {
|
|
const account = { enabled: false };
|
|
const isEnabled = vi.fn(() => false);
|
|
const isConfigured = vi.fn(async () => false);
|
|
const plugin = {
|
|
id: "demo",
|
|
config: {
|
|
listAccountIds: () => ["acc-2"],
|
|
resolveAccount: () => account,
|
|
isEnabled,
|
|
isConfigured,
|
|
},
|
|
} as unknown as ChannelPlugin;
|
|
|
|
const result = await resolveDefaultChannelAccountContext(plugin, {} as OpenClawConfig);
|
|
|
|
expect(isEnabled).toHaveBeenCalledWith(account, {});
|
|
expect(isConfigured).toHaveBeenCalledWith(account, {});
|
|
expect(result.enabled).toBe(false);
|
|
expect(result.configured).toBe(false);
|
|
expect(result.diagnostics).toEqual([]);
|
|
expect(result.degraded).toBe(false);
|
|
});
|
|
|
|
it("keeps strict mode fail-closed when resolveAccount throws", async () => {
|
|
const plugin = {
|
|
id: "demo",
|
|
config: {
|
|
listAccountIds: () => ["acc-err"],
|
|
resolveAccount: () => {
|
|
throw new Error("missing secret");
|
|
},
|
|
},
|
|
} as unknown as ChannelPlugin;
|
|
|
|
await expect(resolveDefaultChannelAccountContext(plugin, {} as OpenClawConfig)).rejects.toThrow(
|
|
/missing secret/i,
|
|
);
|
|
});
|
|
|
|
it("degrades safely in read_only mode when resolveAccount throws", async () => {
|
|
const plugin = {
|
|
id: "demo",
|
|
config: {
|
|
listAccountIds: () => ["acc-err"],
|
|
resolveAccount: () => {
|
|
throw new Error("missing secret");
|
|
},
|
|
},
|
|
} as unknown as ChannelPlugin;
|
|
|
|
const result = await resolveDefaultChannelAccountContext(plugin, {} as OpenClawConfig, {
|
|
mode: "read_only",
|
|
commandName: "status",
|
|
});
|
|
|
|
expect(result.enabled).toBe(false);
|
|
expect(result.configured).toBe(false);
|
|
expect(result.degraded).toBe(true);
|
|
expect(result.diagnostics.some((entry) => entry.includes("failed to resolve account"))).toBe(
|
|
true,
|
|
);
|
|
});
|
|
|
|
it("prefers inspectAccount in read_only mode", async () => {
|
|
const inspectAccount = vi.fn(() => ({ configured: true, enabled: true }));
|
|
const resolveAccount = vi.fn(() => ({ configured: false, enabled: false }));
|
|
const plugin = {
|
|
id: "demo",
|
|
config: {
|
|
listAccountIds: () => ["acc-1"],
|
|
inspectAccount,
|
|
resolveAccount,
|
|
},
|
|
} as unknown as ChannelPlugin;
|
|
|
|
const result = await resolveDefaultChannelAccountContext(plugin, {} as OpenClawConfig, {
|
|
mode: "read_only",
|
|
});
|
|
|
|
expect(inspectAccount).toHaveBeenCalled();
|
|
expect(resolveAccount).not.toHaveBeenCalled();
|
|
expect(result.enabled).toBe(true);
|
|
expect(result.configured).toBe(true);
|
|
expect(result.degraded).toBe(true);
|
|
});
|
|
});
|