Files
openclaw/src/agents/model-auth-label.ts
Cui Chen e8cb0484ce fix(security): strip partial API token from status labels (#33262)
Merged via squash.

Prepared head SHA: 5fe81704e6
Co-authored-by: cu1ch3n <80438676+cu1ch3n@users.noreply.github.com>
Co-authored-by: grp06 <1573959+grp06@users.noreply.github.com>
Reviewed-by: @grp06
2026-03-03 15:11:49 -08:00

69 lines
2.0 KiB
TypeScript

import type { OpenClawConfig } from "../config/config.js";
import type { SessionEntry } from "../config/sessions.js";
import {
ensureAuthProfileStore,
resolveAuthProfileDisplayLabel,
resolveAuthProfileOrder,
} from "./auth-profiles.js";
import { getCustomProviderApiKey, resolveEnvApiKey } from "./model-auth.js";
import { normalizeProviderId } from "./model-selection.js";
export function resolveModelAuthLabel(params: {
provider?: string;
cfg?: OpenClawConfig;
sessionEntry?: SessionEntry;
agentDir?: string;
}): string | undefined {
const resolvedProvider = params.provider?.trim();
if (!resolvedProvider) {
return undefined;
}
const providerKey = normalizeProviderId(resolvedProvider);
const store = ensureAuthProfileStore(params.agentDir, {
allowKeychainPrompt: false,
});
const profileOverride = params.sessionEntry?.authProfileOverride?.trim();
const order = resolveAuthProfileOrder({
cfg: params.cfg,
store,
provider: providerKey,
preferredProfile: profileOverride,
});
const candidates = [profileOverride, ...order].filter(Boolean) as string[];
for (const profileId of candidates) {
const profile = store.profiles[profileId];
if (!profile || normalizeProviderId(profile.provider) !== providerKey) {
continue;
}
const label = resolveAuthProfileDisplayLabel({
cfg: params.cfg,
store,
profileId,
});
if (profile.type === "oauth") {
return `oauth${label ? ` (${label})` : ""}`;
}
if (profile.type === "token") {
return `token${label ? ` (${label})` : ""}`;
}
return `api-key${label ? ` (${label})` : ""}`;
}
const envKey = resolveEnvApiKey(providerKey);
if (envKey?.apiKey) {
if (envKey.source.includes("OAUTH_TOKEN")) {
return `oauth (${envKey.source})`;
}
return `api-key (${envKey.source})`;
}
const customKey = getCustomProviderApiKey(params.cfg, providerKey);
if (customKey) {
return `api-key (models.json)`;
}
return "unknown";
}