| import { describe, expect, it } from "vitest"; |
| import type { OpenClawConfig } from "../../config/types.openclaw.js"; |
| import { withPluginMetadataSnapshotScope } from "../../plugins/current-plugin-metadata-snapshot.js"; |
| import { createPluginMetadataSnapshotFixture } from "../../plugins/plugin-metadata.test-support.js"; |
| import { |
| createApiKeyCredential, |
| createAuthProfileStoreFixture, |
| } from "../auth-profiles/credential-fixtures.test-support.js"; |
| import { prepareAgentRuntimeAuth } from "./prepare-auth.js"; |
|
|
| function metadata(owner: string) { |
| return createPluginMetadataSnapshotFixture({ |
| plugins: [{ id: owner, providerAuthAliases: { "fixture-alias": owner } }], |
| }); |
| } |
|
|
| describe("prepared auth metadata ownership", () => { |
| it.each([true, false])("uses selected environment evidence (available: %s)", (available) => { |
| const snapshot = (envVar: string) => |
| createPluginMetadataSnapshotFixture({ |
| plugins: [ |
| { |
| id: "fixture-owner", |
| providers: ["fixture-provider"], |
| setup: { |
| requiresRuntime: false, |
| providers: [{ id: "fixture-provider", envVars: [envVar] }], |
| }, |
| }, |
| ], |
| }); |
| const config = {}; |
| const prepared = withPluginMetadataSnapshotScope( |
| snapshot("AMBIENT_PROVIDER_KEY"), |
| () => |
| prepareAgentRuntimeAuth({ |
| provider: "fixture-provider", |
| modelId: "model", |
| config, |
| env: available |
| ? { SELECTED_PROVIDER_KEY: "synthetic" } |
| : { AMBIENT_PROVIDER_KEY: "synthetic" }, |
| metadataSnapshot: snapshot("SELECTED_PROVIDER_KEY"), |
| authProfileStore: { version: 1, profiles: {} }, |
| }), |
| { config, trustConfigIdentity: true }, |
| ); |
|
|
| expect(prepared.attempts[0]?.kind).toBe(available ? "direct" : "implicit"); |
| expect(prepared.plan.credentialSource).toEqual( |
| available |
| ? { kind: "direct", evidence: "environment", authorization: "ambient" } |
| : { kind: "none" }, |
| ); |
| }); |
|
|
| it.each(["user", "user-link", "auto", "binding"] as const)( |
| "selects the prepared owner for %s profiles despite ambient aliases", |
| (selection) => { |
| const selected = metadata("selected-auth"); |
| const ambient = metadata("ambient-auth"); |
| const config: OpenClawConfig = |
| selection === "binding" |
| ? { |
| models: { |
| providers: { |
| "fixture-alias": { baseUrl: "", models: [], apiKey: "fixture:selected" }, |
| }, |
| }, |
| } |
| : {}; |
| const prepare = () => |
| prepareAgentRuntimeAuth({ |
| provider: "fixture-alias", |
| modelId: "model", |
| config, |
| env: {}, |
| metadataSnapshot: selected, |
| authProfileStore: createAuthProfileStoreFixture({ |
| "fixture:ambient": createApiKeyCredential("ambient-auth", "synthetic-ambient"), |
| "fixture:selected": createApiKeyCredential("selected-auth", "synthetic-selected"), |
| }), |
| ...(selection === "user" || selection === "user-link" |
| ? { sessionAuthProfileId: "fixture:selected", sessionAuthProfileSource: selection } |
| : {}), |
| }); |
| const prepared = withPluginMetadataSnapshotScope(ambient, prepare, { |
| config, |
| trustConfigIdentity: true, |
| }); |
|
|
| expect(prepared.plan).toMatchObject({ |
| providerForAuth: "selected-auth", |
| forwardedAuthProfileId: "fixture:selected", |
| forwardedAuthProfileCandidateIds: ["fixture:selected"], |
| }); |
| expect(prepared.attempts.map((attempt) => attempt.profileId)).toEqual(["fixture:selected"]); |
| }, |
| ); |
|
|
| it("treats an empty prepared selection as authoritative", () => { |
| const config = {}; |
| const prepared = withPluginMetadataSnapshotScope( |
| metadata("ambient-auth"), |
| () => |
| prepareAgentRuntimeAuth({ |
| provider: "fixture-alias", |
| modelId: "model", |
| config, |
| env: {}, |
| metadataSnapshot: createPluginMetadataSnapshotFixture(), |
| authProfileStore: createAuthProfileStoreFixture({ |
| "fixture:exact": createApiKeyCredential("fixture-alias", "synthetic-exact"), |
| "fixture:ambient": createApiKeyCredential("ambient-auth", "synthetic-ambient"), |
| }), |
| }), |
| { config, trustConfigIdentity: true }, |
| ); |
|
|
| expect(prepared.attempts.map((attempt) => attempt.profileId)).toEqual(["fixture:exact"]); |
| expect(prepared.plan.forwardedAuthProfileCandidateIds).toEqual(["fixture:exact"]); |
| }); |
| }); |
|
|
