openclaw/src/config/types.secrets.resolution.test.ts

// Verifies secret resolution config types and defaults.
import { describe, expect, it } from "vitest";
import {
  isUnresolvedSecretInputError,
  normalizeResolvedSecretInputString,
  parseLegacySecretRefEnvMarker,
  resolveSecretInputString,
  UnresolvedSecretInputError,
} from "./types.secrets.js";

describe("resolveSecretInputString", () => {
  it("returns available for non-empty string values", () => {
    expect(
      resolveSecretInputString({
        value: "  abc123  ",
        path: "models.providers.openai.apiKey",
      }),
    ).toEqual({
      status: "available",
      value: "abc123",
      ref: null,
    });
  });

  it("returns configured_unavailable for unresolved refs in inspect mode", () => {
    expect(
      resolveSecretInputString({
        value: { source: "env", provider: "default", id: "OPENAI_API_KEY" },
        path: "models.providers.openai.apiKey",
        mode: "inspect",
      }),
    ).toEqual({
      status: "configured_unavailable",
      value: undefined,
      ref: { source: "env", provider: "default", id: "OPENAI_API_KEY" },
    });
  });

  it("uses explicit refValue in inspect mode", () => {
    expect(
      resolveSecretInputString({
        value: "",
        refValue: { source: "env", provider: "default", id: "OPENAI_API_KEY" },
        path: "profiles.default.key",
        mode: "inspect",
      }),
    ).toEqual({
      status: "configured_unavailable",
      value: undefined,
      ref: { source: "env", provider: "default", id: "OPENAI_API_KEY" },
    });
  });

  it("returns missing when no value or ref is configured", () => {
    expect(
      resolveSecretInputString({
        value: "",
        path: "models.providers.openai.apiKey",
        mode: "inspect",
      }),
    ).toEqual({
      status: "missing",
      value: undefined,
      ref: null,
    });
  });

  it("throws for unresolved refs in strict mode", () => {
    expect(() =>
      resolveSecretInputString({
        value: { source: "env", provider: "default", id: "OPENAI_API_KEY" },
        path: "models.providers.openai.apiKey",
      }),
    ).toThrow(/unresolved SecretRef/);
  });

  it("throws a typed unresolved SecretRef error in strict mode", () => {
    let thrown: unknown;
    try {
      resolveSecretInputString({
        value: { source: "env", provider: "default", id: "OPENAI_API_KEY" },
        path: "models.providers.openai.apiKey",
      });
    } catch (error) {
      thrown = error;
    }

    expect(thrown).toBeInstanceOf(UnresolvedSecretInputError);
    expect(isUnresolvedSecretInputError(thrown)).toBe(true);
    expect(thrown).toMatchObject({
      path: "models.providers.openai.apiKey",
      ref: { source: "env", provider: "default", id: "OPENAI_API_KEY" },
    });
  });
});

describe("normalizeResolvedSecretInputString", () => {
  it("keeps strict unresolved-ref behavior", () => {
    expect(() =>
      normalizeResolvedSecretInputString({
        value: { source: "env", provider: "default", id: "OPENAI_API_KEY" },
        path: "models.providers.openai.apiKey",
      }),
    ).toThrow(/unresolved SecretRef/);
  });
});

describe("parseLegacySecretRefEnvMarker", () => {
  it("parses legacy env marker strings without making them valid SecretInput strings", () => {
    expect(parseLegacySecretRefEnvMarker("secretref-env:OPENAI_API_KEY")).toEqual({
      source: "env",
      provider: "default",
      id: "OPENAI_API_KEY",
    });
    expect(parseLegacySecretRefEnvMarker("__env__:BAILIAN_API_KEY")).toEqual({
      source: "env",
      provider: "default",
      id: "BAILIAN_API_KEY",
    });
    expect(parseLegacySecretRefEnvMarker("secretref-env:not-valid")).toBeNull();
    expect(
      resolveSecretInputString({
        value: "secretref-env:OPENAI_API_KEY",
        path: "models.providers.openai.apiKey",
        mode: "inspect",
      }),
    ).toEqual({
      status: "available",
      value: "secretref-env:OPENAI_API_KEY",
      ref: null,
    });
  });
});