Files
openclaw/src/commands/channel-account-context.test.ts
Josh Avant a2cb81199e secrets: harden read-only SecretRef command paths and diagnostics (#47794)
* secrets: harden read-only SecretRef resolution for status and audit

* CLI: add SecretRef degrade-safe regression coverage

* Docs: align SecretRef status and daemon probe semantics

* Security audit: close SecretRef review gaps

* Security audit: preserve source auth SecretRef configuredness

* changelog

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>

---------

Signed-off-by: joshavant <830519+joshavant@users.noreply.github.com>
2026-03-15 21:55:24 -05:00

115 lines
3.7 KiB
TypeScript

import { describe, expect, it, vi } from "vitest";
import type { ChannelPlugin } from "../channels/plugins/types.js";
import type { OpenClawConfig } from "../config/config.js";
import { resolveDefaultChannelAccountContext } from "./channel-account-context.js";
describe("resolveDefaultChannelAccountContext", () => {
it("uses enabled/configured defaults when hooks are missing", async () => {
const account = { token: "x" };
const plugin = {
id: "demo",
config: {
listAccountIds: () => ["acc-1"],
resolveAccount: () => account,
},
} as unknown as ChannelPlugin;
const result = await resolveDefaultChannelAccountContext(plugin, {} as OpenClawConfig);
expect(result.accountIds).toEqual(["acc-1"]);
expect(result.defaultAccountId).toBe("acc-1");
expect(result.account).toBe(account);
expect(result.enabled).toBe(true);
expect(result.configured).toBe(true);
expect(result.diagnostics).toEqual([]);
expect(result.degraded).toBe(false);
});
it("uses plugin enable/configure hooks", async () => {
const account = { enabled: false };
const isEnabled = vi.fn(() => false);
const isConfigured = vi.fn(async () => false);
const plugin = {
id: "demo",
config: {
listAccountIds: () => ["acc-2"],
resolveAccount: () => account,
isEnabled,
isConfigured,
},
} as unknown as ChannelPlugin;
const result = await resolveDefaultChannelAccountContext(plugin, {} as OpenClawConfig);
expect(isEnabled).toHaveBeenCalledWith(account, {});
expect(isConfigured).toHaveBeenCalledWith(account, {});
expect(result.enabled).toBe(false);
expect(result.configured).toBe(false);
expect(result.diagnostics).toEqual([]);
expect(result.degraded).toBe(false);
});
it("keeps strict mode fail-closed when resolveAccount throws", async () => {
const plugin = {
id: "demo",
config: {
listAccountIds: () => ["acc-err"],
resolveAccount: () => {
throw new Error("missing secret");
},
},
} as unknown as ChannelPlugin;
await expect(resolveDefaultChannelAccountContext(plugin, {} as OpenClawConfig)).rejects.toThrow(
/missing secret/i,
);
});
it("degrades safely in read_only mode when resolveAccount throws", async () => {
const plugin = {
id: "demo",
config: {
listAccountIds: () => ["acc-err"],
resolveAccount: () => {
throw new Error("missing secret");
},
},
} as unknown as ChannelPlugin;
const result = await resolveDefaultChannelAccountContext(plugin, {} as OpenClawConfig, {
mode: "read_only",
commandName: "status",
});
expect(result.enabled).toBe(false);
expect(result.configured).toBe(false);
expect(result.degraded).toBe(true);
expect(result.diagnostics.some((entry) => entry.includes("failed to resolve account"))).toBe(
true,
);
});
it("prefers inspectAccount in read_only mode", async () => {
const inspectAccount = vi.fn(() => ({ configured: true, enabled: true }));
const resolveAccount = vi.fn(() => ({ configured: false, enabled: false }));
const plugin = {
id: "demo",
config: {
listAccountIds: () => ["acc-1"],
inspectAccount,
resolveAccount,
},
} as unknown as ChannelPlugin;
const result = await resolveDefaultChannelAccountContext(plugin, {} as OpenClawConfig, {
mode: "read_only",
});
expect(inspectAccount).toHaveBeenCalled();
expect(resolveAccount).not.toHaveBeenCalled();
expect(result.enabled).toBe(true);
expect(result.configured).toBe(true);
expect(result.degraded).toBe(true);
});
});