File size: 3,722 Bytes
f778c12 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 | // Gateway token drift tests cover daemon detection of gateway token/config mismatches.
import { describe, expect, it } from "vitest";
import type { OpenClawConfig } from "../../config/config.js";
import { resolveGatewayTokenForDriftCheck } from "./gateway-token-drift.js";
describe("resolveGatewayTokenForDriftCheck", () => {
it("prefers persisted config token over shell env", async () => {
const token = await resolveGatewayTokenForDriftCheck({
cfg: {
gateway: {
mode: "local",
auth: {
token: "config-token",
},
},
} as OpenClawConfig,
env: {
OPENCLAW_GATEWAY_TOKEN: "env-token",
} as NodeJS.ProcessEnv,
});
expect(token).toBe("config-token");
});
it("resolves env-backed local gateway token refs from the provided env", async () => {
const token = await resolveGatewayTokenForDriftCheck({
cfg: {
secrets: {
providers: {
default: { source: "env" },
},
},
gateway: {
mode: "local",
auth: {
mode: "token",
token: { source: "env", provider: "default", id: "SERVICE_GATEWAY_TOKEN" },
},
},
} as OpenClawConfig,
env: {
SERVICE_GATEWAY_TOKEN: "service-token",
} as NodeJS.ProcessEnv,
});
expect(token).toBe("service-token");
});
it("throws when an active local token ref is unresolved", async () => {
await expect(
resolveGatewayTokenForDriftCheck({
cfg: {
secrets: {
providers: {
default: { source: "env" },
},
},
gateway: {
mode: "local",
auth: {
mode: "token",
token: { source: "env", provider: "default", id: "MISSING_LOCAL_TOKEN" },
},
remote: {
token: "remote-token",
},
},
} as OpenClawConfig,
env: {} as NodeJS.ProcessEnv,
}),
).rejects.toThrow(/gateway\.auth\.token/i);
});
it("returns undefined when token auth is disabled by mode", async () => {
const token = await resolveGatewayTokenForDriftCheck({
cfg: {
secrets: {
providers: {
default: { source: "env" },
},
},
gateway: {
auth: {
mode: "password",
token: { source: "env", provider: "default", id: "MISSING_LOCAL_TOKEN" },
},
},
} as OpenClawConfig,
env: {} as NodeJS.ProcessEnv,
});
expect(token).toBeUndefined();
});
it("returns undefined when password fallback is active with mode unset and no token candidate", async () => {
const token = await resolveGatewayTokenForDriftCheck({
cfg: {
gateway: {
auth: {
password: "config-password",
},
},
} as OpenClawConfig,
env: {
OPENCLAW_GATEWAY_PASSWORD: "env-password",
} as NodeJS.ProcessEnv,
});
expect(token).toBeUndefined();
});
it("does not skip token resolution when mode is unset and token can win", async () => {
await expect(
resolveGatewayTokenForDriftCheck({
cfg: {
secrets: {
providers: {
default: { source: "env" },
},
},
gateway: {
auth: {
token: { source: "env", provider: "default", id: "MISSING_LOCAL_TOKEN" },
},
},
} as OpenClawConfig,
env: {
OPENCLAW_GATEWAY_PASSWORD: "env-password",
} as NodeJS.ProcessEnv,
}),
).rejects.toThrow(/gateway\.auth\.token/i);
});
});
|