| |
|
|
| import { MAX_DATE_TIMESTAMP_MS } from "@openclaw/normalization-core/number-coercion"; |
| import { isRecord } from "@openclaw/normalization-core/record-coerce"; |
| import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; |
| import type { OpenClawConfig } from "../../config/config.js"; |
| import type { ConfigWriteOptions } from "../../config/io.js"; |
| import type { ProviderPlugin } from "../../plugins/types.js"; |
| import type { RuntimeEnv } from "../../runtime.js"; |
| import { ProviderAuthConfigApplyError } from "../../shared/provider-auth-result.js"; |
|
|
| type AuthRunCall = { |
| agentDir?: string; |
| signal?: AbortSignal; |
| workspaceDir?: string; |
| }; |
|
|
| type ResolvePluginProvidersCall = { |
| config?: unknown; |
| includeUntrustedWorkspacePlugins?: boolean; |
| providerRefs?: string[]; |
| workspaceDir?: string; |
| }; |
|
|
| type PersistProviderAuthCall = { |
| agentDir?: string; |
| profiles?: Array<{ |
| profileId?: string; |
| credential?: { |
| provider?: string; |
| token?: string; |
| tokenRef?: unknown; |
| type?: string; |
| }; |
| }>; |
| }; |
|
|
| function readMockCallArg(mock: { mock: { calls: unknown[][] } }, index = 0): unknown { |
| const value = mock.mock.calls[index]?.[0]; |
| if (!value) { |
| throw new Error("Expected mock call argument"); |
| } |
| return value; |
| } |
|
|
| const mocks = vi.hoisted(() => ({ |
| clackCancel: vi.fn(), |
| clackConfirm: vi.fn(), |
| clackIsCancel: vi.fn((value: unknown) => value === Symbol.for("clack:cancel")), |
| clackPassword: vi.fn(), |
| clackSelect: vi.fn(), |
| clackText: vi.fn(), |
| resolveDefaultAgentId: vi.fn(), |
| resolveAgentDir: vi.fn(), |
| resolveAgentWorkspaceDir: vi.fn(), |
| resolveDefaultAgentWorkspaceDir: vi.fn(), |
| isCliProvider: vi.fn(), |
| upsertAuthProfile: vi.fn(), |
| upsertAuthProfileWithLock: vi.fn(), |
| persistProviderAuthProfilesAfterLogin: vi.fn(), |
| removeProviderAuthProfilesWithLock: vi.fn(), |
| resolvePluginProvidersCore: vi.fn(), |
| createClackPrompter: vi.fn(), |
| loadValidConfigSnapshotOrThrow: vi.fn(), |
| updateConfig: vi.fn(), |
| logConfigUpdated: vi.fn(), |
| openUrl: vi.fn(), |
| isRemoteEnvironment: vi.fn(() => false), |
| validateAnthropicSetupToken: vi.fn<() => string | undefined>(() => undefined), |
| promoteAuthProfileInOrder: vi.fn(), |
| tryImportProviderCredential: vi.fn(), |
| callGateway: vi.fn(), |
| isImplicitLocalGatewayTarget: vi.fn(() => Promise.resolve(true)), |
| resolvePluginSetupProviderCore: vi.fn(), |
| resolvePluginSetupRegistry: vi.fn(), |
| readSecretStoreValue: vi.fn(() => ({ |
| ok: false as const, |
| error: { code: "SECRET_STORE_NOT_FOUND", message: "missing" }, |
| })), |
| writeSecretStoreEntry: vi.fn(), |
| deleteSecretStoreEntry: vi.fn(), |
| })); |
|
|
| vi.mock("../../secrets/store/secret-store.js", () => ({ |
| readSecretStoreValue: mocks.readSecretStoreValue, |
| writeSecretStoreEntry: mocks.writeSecretStoreEntry, |
| deleteSecretStoreEntry: mocks.deleteSecretStoreEntry, |
| })); |
|
|
| vi.mock("../../agents/auth-profiles/profiles.js", () => ({ |
| promoteAuthProfileInOrder: mocks.promoteAuthProfileInOrder, |
| removeProviderAuthProfilesWithLock: mocks.removeProviderAuthProfilesWithLock, |
| upsertAuthProfile: mocks.upsertAuthProfile, |
| upsertAuthProfileWithLock: mocks.upsertAuthProfileWithLock, |
| upsertAuthProfileWithLockOrThrow: mocks.upsertAuthProfileWithLock, |
| })); |
|
|
| vi.mock("../../plugins/provider-auth-persistence.js", () => ({ |
| persistProviderAuthProfilesAfterLogin: mocks.persistProviderAuthProfilesAfterLogin, |
| })); |
|
|
| vi.mock("./auth-credential-import.js", () => ({ |
| tryImportProviderCredential: mocks.tryImportProviderCredential, |
| })); |
|
|
| vi.mock("../../plugins/provider-auth-helpers.js", () => ({ |
| applyAuthProfileConfig: ( |
| cfg: OpenClawConfig, |
| params: { |
| profileId: string; |
| provider: string; |
| mode: "api_key" | "aws-sdk" | "oauth" | "token"; |
| email?: string; |
| displayName?: string; |
| }, |
| ): OpenClawConfig => ({ |
| ...cfg, |
| auth: { |
| ...cfg.auth, |
| profiles: { |
| ...cfg.auth?.profiles, |
| [params.profileId]: { |
| provider: params.provider, |
| mode: params.mode, |
| ...(params.email ? { email: params.email } : {}), |
| ...(params.displayName ? { displayName: params.displayName } : {}), |
| }, |
| }, |
| }, |
| }), |
| })); |
|
|
| vi.mock("@clack/prompts", () => ({ |
| cancel: mocks.clackCancel, |
| confirm: mocks.clackConfirm, |
| isCancel: mocks.clackIsCancel, |
| password: mocks.clackPassword, |
| select: mocks.clackSelect, |
| text: mocks.clackText, |
| })); |
|
|
| vi.mock("../../agents/agent-scope.js", async (importOriginal) => { |
| const actual = await importOriginal<typeof import("../../agents/agent-scope.js")>(); |
| return { |
| ...actual, |
| resolveDefaultAgentId: mocks.resolveDefaultAgentId, |
| resolveAgentDir: mocks.resolveAgentDir, |
| resolveAgentWorkspaceDir: mocks.resolveAgentWorkspaceDir, |
| }; |
| }); |
|
|
| vi.mock("../../agents/workspace.js", () => ({ |
| resolveDefaultAgentWorkspaceDir: mocks.resolveDefaultAgentWorkspaceDir, |
| })); |
|
|
| vi.mock("../../agents/model-selection-cli.js", () => ({ |
| isCliProvider: mocks.isCliProvider, |
| })); |
|
|
| vi.mock("../../plugins/providers.runtime.js", () => ({ |
| resolvePluginProvidersCore: mocks.resolvePluginProvidersCore, |
| })); |
|
|
| vi.mock("../../plugins/setup-registry.js", () => ({ |
| resolvePluginSetupProviderCore: mocks.resolvePluginSetupProviderCore, |
| resolvePluginSetupRegistry: mocks.resolvePluginSetupRegistry, |
| })); |
|
|
| vi.mock("../../wizard/clack-prompter.js", () => ({ |
| createClackPrompter: mocks.createClackPrompter, |
| })); |
|
|
| vi.mock("./shared.js", async (importOriginal) => { |
| const actual = await importOriginal<typeof import("./shared.js")>(); |
| return { |
| ...actual, |
| loadValidConfigSnapshotOrThrow: mocks.loadValidConfigSnapshotOrThrow, |
| updateConfig: mocks.updateConfig, |
| }; |
| }); |
|
|
| vi.mock("../../plugins/install-record-commit.js", () => ({ |
| transformConfigWithPendingPluginInstalls: async (params: { |
| transform: ( |
| current: OpenClawConfig, |
| context: { snapshot: { valid: boolean } }, |
| ) => { nextConfig: OpenClawConfig }; |
| writeOptions?: ConfigWriteOptions; |
| }) => { |
| const next = await mocks.updateConfig( |
| (current: OpenClawConfig) => |
| params.transform(current, { snapshot: { valid: true } }).nextConfig, |
| undefined, |
| params.writeOptions?.beforeCommit, |
| params.writeOptions, |
| ); |
| return { nextConfig: next, result: next }; |
| }, |
| })); |
|
|
| vi.mock("../../config/logging.js", () => ({ |
| logConfigUpdated: mocks.logConfigUpdated, |
| })); |
|
|
| vi.mock("../../infra/browser-open.js", () => ({ |
| openUrl: mocks.openUrl, |
| })); |
|
|
| vi.mock("../../infra/remote-env.js", () => ({ |
| isRemoteEnvironment: mocks.isRemoteEnvironment, |
| })); |
|
|
| vi.mock("../../gateway/call.js", async () => { |
| const requestErrors = await import("../../../packages/gateway-client/src/request-error.js"); |
| return { |
| callGateway: mocks.callGateway, |
| GatewayLocalBackendSharedAuthUnavailableError: class extends Error {}, |
| isGatewayClientRequestError: (error: unknown) => |
| error instanceof requestErrors.GatewayClientRequestError, |
| isImplicitLocalGatewayTarget: mocks.isImplicitLocalGatewayTarget, |
| }; |
| }); |
|
|
| vi.mock("../../plugins/provider-oauth-flow.js", () => ({ |
| createVpsAwareOAuthHandlers: vi.fn(() => ({ |
| onAuth: vi.fn(), |
| onPrompt: vi.fn(), |
| })), |
| })); |
|
|
| vi.mock("../auth-token.js", () => ({ |
| validateAnthropicSetupToken: mocks.validateAnthropicSetupToken, |
| })); |
|
|
| vi.mock("../../plugins/provider-auth-choice-helpers.js", async (importOriginal) => { |
| const actual = |
| await importOriginal<typeof import("../../plugins/provider-auth-choice-helpers.js")>(); |
| const normalize = (value: string | undefined) => value?.trim().toLowerCase() ?? ""; |
| const mergePatch = <T>(base: T, patch: unknown): T => { |
| if (!isRecord(base) || !isRecord(patch)) { |
| return patch as T; |
| } |
| const next: Record<string, unknown> = { ...base }; |
| for (const [key, value] of Object.entries(patch)) { |
| next[key] = mergePatch(next[key], value); |
| } |
| return next as T; |
| }; |
|
|
| return { |
| ...actual, |
| resolveProviderMatch: vi.fn((providers: ProviderPlugin[], rawProvider?: string) => { |
| const requested = normalize(rawProvider); |
| return ( |
| providers.find((provider) => normalize(provider.id) === requested) ?? |
| providers.find((provider) => |
| provider.aliases?.some((alias) => normalize(alias) === requested), |
| ) ?? |
| null |
| ); |
| }), |
| pickAuthMethod: vi.fn((provider: ProviderPlugin, rawMethod?: string) => { |
| const requested = normalize(rawMethod); |
| return ( |
| provider.auth.find((method) => normalize(method.id) === requested) ?? |
| provider.auth.find((method) => normalize(method.label) === requested) ?? |
| null |
| ); |
| }), |
| applyProviderAuthConfigPatch: vi.fn( |
| (cfg: OpenClawConfig, patch: unknown, options?: { replaceDefaultModels?: boolean }) => { |
| const merged = mergePatch(cfg, patch); |
| if (!options?.replaceDefaultModels) { |
| return merged; |
| } |
| const patchModels = (patch as { agents?: { defaults?: { models?: unknown } } })?.agents |
| ?.defaults?.models; |
| return isRecord(patchModels) |
| ? { |
| ...merged, |
| agents: { |
| ...merged.agents, |
| defaults: { |
| ...merged.agents?.defaults, |
| models: patchModels, |
| }, |
| }, |
| } |
| : merged; |
| }, |
| ), |
| applyDefaultModel: vi.fn((cfg: OpenClawConfig, model: string) => ({ |
| ...cfg, |
| agents: { |
| ...cfg.agents, |
| defaults: { |
| ...cfg.agents?.defaults, |
| models: { |
| ...cfg.agents?.defaults?.models, |
| [model]: cfg.agents?.defaults?.models?.[model] ?? {}, |
| }, |
| model: { |
| ...(typeof cfg.agents?.defaults?.model === "object" && |
| "fallbacks" in cfg.agents.defaults.model |
| ? { fallbacks: cfg.agents.defaults.model.fallbacks } |
| : undefined), |
| primary: model, |
| }, |
| }, |
| }, |
| })), |
| }; |
| }); |
|
|
| const { |
| modelsAuthAddCommand, |
| modelsAuthLoginCommand, |
| modelsAuthPasteApiKeyCommand, |
| modelsAuthPasteTokenCommand, |
| modelsAuthSetupTokenCommand, |
| runModelsAuthLoginFlowCore, |
| } = await import("./auth.js"); |
|
|
| function createRuntime(): RuntimeEnv { |
| return { |
| log: vi.fn(), |
| error: vi.fn(), |
| exit: vi.fn(), |
| }; |
| } |
|
|
| function withInteractiveStdin() { |
| const stdin = process.stdin as NodeJS.ReadStream & { isTTY?: boolean }; |
| const hadOwnIsTTY = Object.hasOwn(stdin, "isTTY"); |
| const previousIsTTYDescriptor = Object.getOwnPropertyDescriptor(stdin, "isTTY"); |
| Object.defineProperty(stdin, "isTTY", { |
| configurable: true, |
| enumerable: true, |
| get: () => true, |
| }); |
| return () => { |
| if (previousIsTTYDescriptor) { |
| Object.defineProperty(stdin, "isTTY", previousIsTTYDescriptor); |
| } else if (!hadOwnIsTTY) { |
| delete (stdin as { isTTY?: boolean }).isTTY; |
| } |
| }; |
| } |
|
|
| function withPipedStdin(input: string) { |
| const stdin = process.stdin as NodeJS.ReadStream & { isTTY?: boolean }; |
| const restoreInteractive = withInteractiveStdin(); |
| const previousAsyncIteratorDescriptor = Object.getOwnPropertyDescriptor( |
| stdin, |
| Symbol.asyncIterator, |
| ); |
| Object.defineProperty(stdin, "isTTY", { |
| configurable: true, |
| enumerable: true, |
| get: () => false, |
| }); |
| Object.defineProperty(stdin, Symbol.asyncIterator, { |
| configurable: true, |
| async *value() { |
| yield input; |
| }, |
| }); |
| return () => { |
| if (previousAsyncIteratorDescriptor) { |
| Object.defineProperty(stdin, Symbol.asyncIterator, previousAsyncIteratorDescriptor); |
| } else { |
| Reflect.deleteProperty(stdin, Symbol.asyncIterator); |
| } |
| restoreInteractive(); |
| }; |
| } |
|
|
| function createProvider(params: { |
| id: string; |
| label?: string; |
| auth?: ProviderPlugin["auth"]; |
| run: NonNullable<ProviderPlugin["auth"]>[number]["run"]; |
| }): ProviderPlugin { |
| return { |
| id: params.id, |
| label: params.label ?? params.id, |
| auth: params.auth ?? [ |
| { |
| id: "oauth", |
| label: "OAuth", |
| kind: "oauth", |
| run: params.run, |
| }, |
| ], |
| }; |
| } |
|
|
| describe("modelsAuthLoginCommand", () => { |
| let restoreStdin: (() => void) | null = null; |
| let currentConfig: OpenClawConfig; |
| let lastUpdatedConfig: OpenClawConfig | null; |
| let runProviderAuth: ReturnType<typeof vi.fn>; |
|
|
| beforeEach(() => { |
| vi.clearAllMocks(); |
| restoreStdin = withInteractiveStdin(); |
| currentConfig = {}; |
| lastUpdatedConfig = null; |
| mocks.clackCancel.mockReset(); |
| mocks.clackConfirm.mockReset(); |
| mocks.clackIsCancel.mockImplementation( |
| (value: unknown) => value === Symbol.for("clack:cancel"), |
| ); |
| mocks.clackPassword.mockReset(); |
| mocks.clackSelect.mockReset(); |
| mocks.clackText.mockReset(); |
| mocks.validateAnthropicSetupToken.mockReset(); |
| mocks.validateAnthropicSetupToken.mockReturnValue(undefined); |
| mocks.upsertAuthProfileWithLock.mockReset(); |
| mocks.upsertAuthProfileWithLock.mockResolvedValue({ version: 1, profiles: {} }); |
| mocks.persistProviderAuthProfilesAfterLogin.mockReset(); |
| mocks.persistProviderAuthProfilesAfterLogin.mockImplementation( |
| async (params: PersistProviderAuthCall) => params.profiles ?? [], |
| ); |
| mocks.promoteAuthProfileInOrder.mockReset(); |
| mocks.promoteAuthProfileInOrder.mockResolvedValue({ |
| ok: true, |
| value: { version: 1, profiles: {} }, |
| }); |
| mocks.tryImportProviderCredential.mockReset(); |
| mocks.tryImportProviderCredential.mockResolvedValue(undefined); |
| mocks.removeProviderAuthProfilesWithLock.mockReset(); |
| mocks.removeProviderAuthProfilesWithLock.mockResolvedValue({ version: 1, profiles: {} }); |
|
|
| mocks.resolveDefaultAgentId.mockReturnValue("main"); |
| mocks.resolveAgentDir.mockReturnValue("/tmp/openclaw/agents/main"); |
| mocks.resolveAgentWorkspaceDir.mockReturnValue("/tmp/openclaw/workspace"); |
| mocks.resolveDefaultAgentWorkspaceDir.mockReturnValue("/tmp/openclaw/workspace"); |
| mocks.isRemoteEnvironment.mockReturnValue(false); |
| mocks.isCliProvider.mockReturnValue(false); |
| mocks.resolvePluginSetupProviderCore.mockReturnValue(undefined); |
| mocks.resolvePluginSetupRegistry.mockReturnValue({ |
| providers: [], |
| cliBackends: [], |
| configMigrations: [], |
| autoEnableProbes: [], |
| diagnostics: [], |
| }); |
| mocks.loadValidConfigSnapshotOrThrow.mockImplementation(async () => ({ |
| sourceConfig: structuredClone(currentConfig), |
| runtimeConfig: structuredClone(currentConfig), |
| })); |
| mocks.updateConfig.mockImplementation( |
| async ( |
| mutator: (cfg: OpenClawConfig) => OpenClawConfig, |
| _selectModelRefs: unknown, |
| beforeCommit?: ConfigWriteOptions["beforeCommit"], |
| writeOptions?: ConfigWriteOptions, |
| ) => { |
| const nextConfig = mutator(currentConfig); |
| await beforeCommit?.(); |
| writeOptions?.assertCurrent?.(); |
| lastUpdatedConfig = nextConfig; |
| currentConfig = lastUpdatedConfig; |
| return lastUpdatedConfig; |
| }, |
| ); |
| mocks.createClackPrompter.mockReturnValue({ |
| note: vi.fn(async () => {}), |
| select: vi.fn().mockResolvedValue("keep"), |
| }); |
| runProviderAuth = vi.fn().mockResolvedValue({ |
| profiles: [ |
| { |
| profileId: "openai:user@example.com", |
| credential: { |
| type: "oauth", |
| provider: "openai", |
| access: "access-token", |
| refresh: "refresh-token", |
| expires: Date.now() + 60_000, |
| email: "user@example.com", |
| }, |
| }, |
| ], |
| defaultModel: "openai/gpt-5.5", |
| }); |
| mocks.resolvePluginProvidersCore.mockReturnValue([ |
| createProvider({ |
| id: "openai", |
| label: "OpenAI Codex", |
| run: runProviderAuth as ProviderPlugin["auth"][number]["run"], |
| }), |
| ]); |
| mocks.callGateway.mockReset(); |
| mocks.callGateway.mockResolvedValue({ refreshed: true }); |
| }); |
|
|
| afterEach(() => { |
| restoreStdin?.(); |
| restoreStdin = null; |
| }); |
|
|
| function useCoderAgentConfig() { |
| currentConfig = { |
| agents: { |
| list: [{ id: "main" }, { id: "coder", workspace: "/tmp/openclaw/workspaces/coder" }], |
| }, |
| }; |
| const originalConfig = currentConfig; |
| mocks.resolveAgentDir.mockImplementation((_cfg: OpenClawConfig, agentId: string) => |
| agentId === "coder" ? "/tmp/openclaw/agents/coder" : "/tmp/openclaw/agents/main", |
| ); |
| mocks.resolveAgentWorkspaceDir.mockImplementation((_cfg: OpenClawConfig, agentId: string) => |
| agentId === "coder" ? "/tmp/openclaw/workspaces/coder" : "/tmp/openclaw/workspace", |
| ); |
| return originalConfig; |
| } |
|
|
| it("runs plugin-owned openai login", async () => { |
| const runtime = createRuntime(); |
|
|
| const result = await runModelsAuthLoginFlowCore({ |
| provider: "openai", |
| runtime, |
| prompter: mocks.createClackPrompter(), |
| }); |
|
|
| expect(result).toMatchObject({ authRefresh: "refreshed" }); |
| expect(runProviderAuth).toHaveBeenCalledOnce(); |
| const persistCall = readMockCallArg( |
| mocks.persistProviderAuthProfilesAfterLogin, |
| ) as PersistProviderAuthCall; |
| expect(persistCall.profiles?.[0]?.profileId).toBe("openai:user@example.com"); |
| expect(persistCall.profiles?.[0]?.credential?.type).toBe("oauth"); |
| expect(persistCall.profiles?.[0]?.credential?.provider).toBe("openai"); |
| expect(persistCall.agentDir).toBe("/tmp/openclaw/agents/main"); |
| expect(mocks.promoteAuthProfileInOrder).toHaveBeenCalledWith({ |
| agentDir: "/tmp/openclaw/agents/main", |
| provider: "openai", |
| profileId: "openai:user@example.com", |
| createIfMissing: false, |
| }); |
| expect(mocks.updateConfig).not.toHaveBeenCalled(); |
| expect(mocks.logConfigUpdated).not.toHaveBeenCalled(); |
| expect(lastUpdatedConfig).toBeNull(); |
| expect(runtime.log).toHaveBeenCalledWith( |
| "Auth profile: openai:user@example.com (openai/oauth)", |
| ); |
| expect(runtime.log).toHaveBeenCalledWith( |
| "Default model available: openai/gpt-5.5 (current default unchanged; run openclaw models set openai/gpt-5.5 to apply)", |
| ); |
| expect(runtime.log).toHaveBeenCalledWith( |
| "Tip: Codex-capable models can use native Codex web search. Configure the `web_search` tool with `openclaw configure --section web`. Docs: https://docs.openclaw.ai/tools/web", |
| ); |
| expect(mocks.callGateway).toHaveBeenCalledWith( |
| expect.objectContaining({ |
| params: { operation: "login", agentId: "main" }, |
| }), |
| ); |
| }); |
|
|
| it("persists a named login profile and promotes that same profile", async () => { |
| const runtime = createRuntime(); |
|
|
| await modelsAuthLoginCommand({ provider: "openai", profileId: "openai:work" }, runtime); |
|
|
| expect(mocks.persistProviderAuthProfilesAfterLogin).toHaveBeenCalledWith( |
| expect.objectContaining({ |
| profiles: [ |
| expect.objectContaining({ |
| profileId: "openai:work", |
| credential: expect.objectContaining({ provider: "openai", type: "oauth" }), |
| }), |
| ], |
| }), |
| ); |
| expect(mocks.promoteAuthProfileInOrder).toHaveBeenCalledWith( |
| expect.objectContaining({ provider: "openai", profileId: "openai:work" }), |
| ); |
| expect(runtime.log).toHaveBeenCalledWith("Auth profile: openai:work (openai/oauth)"); |
| }); |
|
|
| it("rejects a named login with multiple returned profiles before persisting", async () => { |
| runProviderAuth.mockResolvedValueOnce({ |
| profiles: [ |
| { |
| profileId: "openai:one", |
| credential: { type: "api_key", provider: "openai", key: "synthetic-one" }, |
| }, |
| { |
| profileId: "openai:two", |
| credential: { type: "api_key", provider: "openai", key: "synthetic-two" }, |
| }, |
| ], |
| }); |
|
|
| await expect( |
| modelsAuthLoginCommand({ provider: "openai", profileId: "openai:work" }, createRuntime()), |
| ).rejects.toThrow("--profile-id requires exactly one returned auth profile"); |
| expect(mocks.persistProviderAuthProfilesAfterLogin).not.toHaveBeenCalled(); |
| expect(mocks.promoteAuthProfileInOrder).not.toHaveBeenCalled(); |
| expect(mocks.updateConfig).not.toHaveBeenCalled(); |
| expect(mocks.callGateway).not.toHaveBeenCalled(); |
| }); |
|
|
| it("keeps the prior auth profile when protected storage is unavailable", async () => { |
| const runtime = createRuntime(); |
| runProviderAuth.mockResolvedValueOnce({ |
| profiles: [ |
| { |
| profileId: "github-copilot:github", |
| credential: { |
| type: "token", |
| provider: "github-copilot", |
| token: "synthetic-device-token", |
| }, |
| secretStorage: { |
| kind: "store", |
| namePrefix: "GITHUB_COPILOT_TOKEN", |
| }, |
| }, |
| ], |
| }); |
| mocks.resolvePluginProvidersCore.mockReturnValue([ |
| createProvider({ |
| id: "github-copilot", |
| label: "GitHub Copilot", |
| run: runProviderAuth as ProviderPlugin["auth"][number]["run"], |
| }), |
| ]); |
| mocks.persistProviderAuthProfilesAfterLogin.mockRejectedValueOnce( |
| new Error("Could not write the protected secret store"), |
| ); |
|
|
| await expect(modelsAuthLoginCommand({ provider: "github-copilot" }, runtime)).rejects.toThrow( |
| "Could not write the protected secret store", |
| ); |
|
|
| expect(mocks.persistProviderAuthProfilesAfterLogin).toHaveBeenCalledOnce(); |
| expect(mocks.promoteAuthProfileInOrder).not.toHaveBeenCalled(); |
| }); |
|
|
| it.each([ |
| { connected: true, outcome: "gateway-rejected", target: "running" }, |
| { connected: false, outcome: "gateway-unreachable", target: "local" }, |
| ])( |
| "keeps saved login credentials when refresh is $outcome", |
| async ({ connected, outcome, target }) => { |
| const runtime = createRuntime(); |
| mocks.callGateway.mockImplementationOnce(async (options: { onHelloOk?: () => void }) => { |
| if (connected) { |
| options.onHelloOk?.(); |
| } |
| throw new Error("refresh rejected"); |
| }); |
|
|
| await expect( |
| runModelsAuthLoginFlowCore({ |
| provider: "openai", |
| runtime, |
| prompter: mocks.createClackPrompter(), |
| }), |
| ).resolves.toMatchObject({ authRefresh: outcome }); |
|
|
| expect(mocks.persistProviderAuthProfilesAfterLogin).toHaveBeenCalledOnce(); |
| expect(mocks.callGateway).toHaveBeenCalledWith( |
| expect.objectContaining({ |
| params: { operation: "login", agentId: "main" }, |
| }), |
| ); |
| expect(runtime.error).toHaveBeenCalledWith( |
| `Warning: Model auth changes were saved, but the ${target} Gateway could not refresh them. Run \`openclaw gateway restart\` to apply the saved changes.`, |
| ); |
| }, |
| ); |
|
|
| it.each([ |
| { source: "new", profileId: "openai:user@example.com" }, |
| { source: "imported", profileId: "openai:imported" }, |
| ])( |
| "retains the $source profile and model-access choice after direct refresh fails", |
| async ({ source, profileId }) => { |
| currentConfig = { |
| agents: { |
| defaults: { model: "other/current", modelPolicy: { allow: ["other/current"] } }, |
| }, |
| }; |
| if (source === "imported") { |
| mocks.tryImportProviderCredential.mockResolvedValueOnce({ |
| profileId, |
| provider: "openai", |
| mode: "oauth", |
| configUpdated: false, |
| }); |
| } |
| const onModelAccessRequested = vi.fn(); |
| const result = await runModelsAuthLoginFlowCore({ |
| provider: "openai", |
| runtime: createRuntime(), |
| prompter: mocks.createClackPrompter(), |
| refreshAfterLogin: async () => { |
| throw new Error("Auth publication failed."); |
| }, |
| onModelAccessRequested, |
| }); |
| expect(result).toMatchObject({ |
| authRefresh: "gateway-rejected", |
| profiles: [{ profileId, provider: "openai", mode: "oauth" }], |
| }); |
| expect(onModelAccessRequested).toHaveBeenCalledExactlyOnceWith( |
| expect.objectContaining({ |
| provider: "openai", |
| policy: { path: "agents.defaults.modelPolicy.allow", refs: ["other/current"] }, |
| }), |
| ); |
| expect(currentConfig.agents?.defaults).toEqual({ |
| model: "other/current", |
| modelPolicy: { allow: ["other/current"] }, |
| }); |
| }, |
| ); |
|
|
| it.each(["cancelled", "revoked"] as const)( |
| "does not complete a saved login when authority is %s during a rejected refresh", |
| async (reason) => { |
| const controller = new AbortController(); |
| let current = true; |
| const onModelAccessRequested = vi.fn(); |
| await expect( |
| runModelsAuthLoginFlowCore({ |
| provider: "openai", |
| runtime: createRuntime(), |
| prompter: mocks.createClackPrompter(), |
| signal: controller.signal, |
| assertCurrent: () => { |
| if (!current) { |
| throw new Error("Login authority ended."); |
| } |
| }, |
| refreshAfterLogin: async () => { |
| if (reason === "cancelled") { |
| controller.abort(new Error("Login authority ended.")); |
| } else { |
| current = false; |
| } |
| throw new Error("Auth publication failed."); |
| }, |
| onModelAccessRequested, |
| }), |
| ).rejects.toThrow("Login authority ended."); |
| expect(onModelAccessRequested).not.toHaveBeenCalled(); |
| }, |
| ); |
|
|
| it("returns the refresh outcome after importing a provider credential", async () => { |
| mocks.tryImportProviderCredential.mockResolvedValueOnce({ |
| profileId: "openai:imported", |
| provider: "openai", |
| mode: "oauth", |
| configUpdated: false, |
| }); |
| mocks.callGateway.mockImplementationOnce(async (options: { onHelloOk?: () => void }) => { |
| options.onHelloOk?.(); |
| throw new Error("refresh rejected"); |
| }); |
|
|
| const result = await runModelsAuthLoginFlowCore({ |
| provider: "openai", |
| runtime: createRuntime(), |
| prompter: mocks.createClackPrompter(), |
| }); |
|
|
| expect(result).toMatchObject({ |
| imported: true, |
| authRefresh: "gateway-rejected", |
| profiles: [{ profileId: "openai:imported", provider: "openai", mode: "oauth" }], |
| }); |
| expect(runProviderAuth).not.toHaveBeenCalled(); |
| expect(mocks.persistProviderAuthProfilesAfterLogin).not.toHaveBeenCalled(); |
| expect(mocks.promoteAuthProfileInOrder).toHaveBeenCalledWith( |
| expect.objectContaining({ |
| profileId: "openai:imported", |
| }), |
| ); |
| }); |
|
|
| it("identifies a config failure after credentials are saved and preserves its cause", async () => { |
| const cause = new Error("config write failed"); |
| runProviderAuth.mockResolvedValueOnce({ |
| profiles: [ |
| { |
| profileId: "openai:saved", |
| credential: { type: "token", provider: "openai", token: "fixture-token" }, |
| }, |
| ], |
| configPatch: { logging: { level: "debug" } }, |
| }); |
| mocks.updateConfig.mockRejectedValueOnce(cause); |
|
|
| const login = runModelsAuthLoginFlowCore({ |
| provider: "openai", |
| runtime: createRuntime(), |
| prompter: mocks.createClackPrompter(), |
| }); |
| await expect(login).rejects.toBeInstanceOf(ProviderAuthConfigApplyError); |
| await expect(login).rejects.toMatchObject({ |
| name: "ProviderAuthConfigApplyError", |
| message: "Credentials saved, but provider settings could not be applied: config write failed", |
| cause, |
| }); |
| expect(mocks.persistProviderAuthProfilesAfterLogin).toHaveBeenCalledOnce(); |
| expect(mocks.callGateway).not.toHaveBeenCalled(); |
| }); |
|
|
| it("creates store order for relogin when configured profiles would shadow the new profile", async () => { |
| const runtime = createRuntime(); |
| currentConfig = { |
| auth: { |
| profiles: { |
| "openai:old-login": { |
| provider: "openai", |
| mode: "oauth", |
| }, |
| }, |
| }, |
| }; |
|
|
| await modelsAuthLoginCommand({ provider: "openai" }, runtime); |
|
|
| expect(mocks.updateConfig).not.toHaveBeenCalled(); |
| expect(mocks.promoteAuthProfileInOrder).toHaveBeenCalledWith({ |
| agentDir: "/tmp/openclaw/agents/main", |
| provider: "openai", |
| profileId: "openai:user@example.com", |
| createIfMissing: true, |
| createFromOrder: ["openai:old-login"], |
| }); |
| }); |
|
|
| it("defaults OpenAI login to ChatGPT OAuth when API key is also available", async () => { |
| const runtime = createRuntime(); |
| const initialConfig = currentConfig; |
| const runOauthAuth = vi.fn().mockResolvedValue({ |
| profiles: [ |
| { |
| profileId: "openai:user@example.com", |
| credential: { |
| type: "oauth", |
| provider: "openai", |
| access: "access-token", |
| refresh: "refresh-token", |
| expires: Date.now() + 60_000, |
| email: "user@example.com", |
| }, |
| }, |
| ], |
| }); |
| const runApiKeyAuth = vi.fn().mockResolvedValue({ profiles: [] }); |
| const select = vi.fn(); |
| mocks.createClackPrompter.mockReturnValue({ |
| note: vi.fn(async () => {}), |
| select, |
| }); |
| mocks.resolvePluginProvidersCore.mockReturnValue([ |
| createProvider({ |
| id: "openai", |
| label: "OpenAI runtime", |
| run: runApiKeyAuth as ProviderPlugin["auth"][number]["run"], |
| auth: [ |
| { |
| id: "api-key", |
| label: "OpenAI API Key", |
| kind: "api_key", |
| run: runApiKeyAuth, |
| }, |
| ], |
| }), |
| ]); |
| mocks.resolvePluginSetupProviderCore.mockReturnValue( |
| createProvider({ |
| id: "openai", |
| label: "OpenAI", |
| run: runOauthAuth as ProviderPlugin["auth"][number]["run"], |
| auth: [ |
| { |
| id: "oauth", |
| label: "ChatGPT Login", |
| kind: "oauth", |
| run: runOauthAuth, |
| }, |
| { |
| id: "api-key", |
| label: "OpenAI API Key", |
| kind: "api_key", |
| run: runApiKeyAuth, |
| }, |
| ], |
| }), |
| ); |
|
|
| await modelsAuthLoginCommand({ provider: "openai" }, runtime); |
|
|
| expect(mocks.resolvePluginSetupProviderCore).toHaveBeenCalledWith({ |
| provider: "openai", |
| config: initialConfig, |
| workspaceDir: "/tmp/openclaw/workspace", |
| }); |
| expect(runOauthAuth).toHaveBeenCalledOnce(); |
| expect(runApiKeyAuth).not.toHaveBeenCalled(); |
| expect(select).not.toHaveBeenCalled(); |
| }); |
|
|
| it("honors --method api-key for OpenAI login", async () => { |
| const runtime = createRuntime(); |
| const runOauthAuth = vi.fn().mockResolvedValue({ profiles: [] }); |
| const runApiKeyAuth = vi.fn().mockResolvedValue({ profiles: [] }); |
| mocks.resolvePluginProvidersCore.mockReturnValue([ |
| createProvider({ |
| id: "openai", |
| label: "OpenAI runtime", |
| run: runApiKeyAuth as ProviderPlugin["auth"][number]["run"], |
| auth: [ |
| { |
| id: "api-key", |
| label: "OpenAI API Key", |
| kind: "api_key", |
| run: runApiKeyAuth, |
| }, |
| ], |
| }), |
| ]); |
| mocks.resolvePluginSetupProviderCore.mockReturnValue( |
| createProvider({ |
| id: "openai", |
| label: "OpenAI", |
| run: runOauthAuth as ProviderPlugin["auth"][number]["run"], |
| auth: [ |
| { |
| id: "oauth", |
| label: "ChatGPT Login", |
| kind: "oauth", |
| run: runOauthAuth, |
| }, |
| { |
| id: "api-key", |
| label: "OpenAI API Key", |
| kind: "api_key", |
| run: runApiKeyAuth, |
| }, |
| ], |
| }), |
| ); |
|
|
| await modelsAuthLoginCommand({ provider: "openai", method: "api-key" }, runtime); |
|
|
| expect(runOauthAuth).not.toHaveBeenCalled(); |
| expect(runApiKeyAuth).toHaveBeenCalledOnce(); |
| }); |
|
|
| it("prompts when a provider exposes multiple non-OAuth login methods", async () => { |
| const runtime = createRuntime(); |
| const runApiKeyAuth = vi.fn().mockResolvedValue({ profiles: [] }); |
| const runCliAuth = vi.fn().mockResolvedValue({ profiles: [] }); |
| const select = vi.fn().mockResolvedValue("cli"); |
| mocks.createClackPrompter.mockReturnValue({ |
| note: vi.fn(async () => {}), |
| select, |
| }); |
| mocks.resolvePluginProvidersCore.mockReturnValue([ |
| createProvider({ |
| id: "anthropic", |
| label: "Anthropic", |
| run: runApiKeyAuth as ProviderPlugin["auth"][number]["run"], |
| auth: [ |
| { |
| id: "api-key", |
| label: "Anthropic API Key", |
| kind: "api_key", |
| run: runApiKeyAuth, |
| }, |
| { |
| id: "cli", |
| label: "Claude CLI", |
| kind: "custom", |
| run: runCliAuth, |
| }, |
| ], |
| }), |
| ]); |
|
|
| await modelsAuthLoginCommand({ provider: "anthropic" }, runtime); |
|
|
| expect(select).toHaveBeenCalledWith({ |
| message: "Auth method for Anthropic", |
| options: [ |
| { |
| value: "api-key", |
| label: "Anthropic API Key", |
| hint: undefined, |
| }, |
| { |
| value: "cli", |
| label: "Claude CLI", |
| hint: undefined, |
| }, |
| ], |
| }); |
| expect(runApiKeyAuth).not.toHaveBeenCalled(); |
| expect(runCliAuth).toHaveBeenCalledOnce(); |
| }); |
|
|
| it("shows local agent scope before provider auth login", async () => { |
| const runtime = createRuntime(); |
| const originalConfig = useCoderAgentConfig(); |
| const note = vi.fn(async () => {}); |
| mocks.createClackPrompter.mockReturnValue({ note, select: vi.fn() }); |
|
|
| await modelsAuthLoginCommand({ provider: "openai", agent: "coder" }, runtime); |
|
|
| expect(note).toHaveBeenCalledWith( |
| [ |
| "Scope: System / agent", |
| "Agent: coder", |
| "Location: the machine running OpenClaw", |
| "For personal model accounts on a Gateway, run openclaw models accounts login --help.", |
| ].join("\n"), |
| "Provider sign-in", |
| ); |
| expect(note.mock.invocationCallOrder[0]).toBeLessThan( |
| runProviderAuth.mock.invocationCallOrder[0]!, |
| ); |
| expect(mocks.resolveDefaultAgentId).not.toHaveBeenCalled(); |
| expect(mocks.resolveAgentDir).toHaveBeenCalledWith(originalConfig, "coder"); |
| const authRunCall = readMockCallArg(runProviderAuth) as AuthRunCall; |
| expect(authRunCall.agentDir).toBe("/tmp/openclaw/agents/coder"); |
| expect(authRunCall.workspaceDir).toBe("/tmp/openclaw/workspaces/coder"); |
| expect( |
| (readMockCallArg(mocks.persistProviderAuthProfilesAfterLogin) as PersistProviderAuthCall) |
| .agentDir, |
| ).toBe("/tmp/openclaw/agents/coder"); |
| expect(mocks.callGateway).toHaveBeenCalledWith( |
| expect.objectContaining({ |
| params: { operation: "login", agentId: "coder" }, |
| }), |
| ); |
| }); |
|
|
| it("forwards an app-owned cancellation signal to provider auth", async () => { |
| const runtime = createRuntime(); |
| const abortController = new AbortController(); |
|
|
| await runModelsAuthLoginFlowCore({ |
| provider: "openai", |
| method: "oauth", |
| config: currentConfig, |
| runtime, |
| prompter: mocks.createClackPrompter(), |
| signal: abortController.signal, |
| }); |
|
|
| expect((readMockCallArg(runProviderAuth) as AuthRunCall).signal).toBe(abortController.signal); |
| }); |
|
|
| it("refreshes saved credentials before presenting provider notes", async () => { |
| const note = vi.fn(async (_message: string, title?: string) => { |
| if (title === "Provider notes") { |
| throw new Error("note delivery failed"); |
| } |
| }); |
| mocks.createClackPrompter.mockReturnValue({ note, select: vi.fn() }); |
| runProviderAuth.mockResolvedValue({ |
| profiles: [ |
| { |
| profileId: "openai:proof", |
| credential: { type: "token", provider: "openai", token: "fixture-token" }, |
| }, |
| ], |
| notes: ["Provider sign-in details"], |
| }); |
| await expect(modelsAuthLoginCommand({ provider: "openai" }, createRuntime())).rejects.toThrow( |
| "note delivery failed", |
| ); |
| expect(mocks.callGateway).toHaveBeenCalledWith( |
| expect.objectContaining({ |
| method: "models.authRefresh", |
| params: { operation: "login", agentId: "main" }, |
| }), |
| ); |
| }); |
|
|
| it("does not persist credentials returned after app-owned cancellation", async () => { |
| const runtime = createRuntime(); |
| const abortController = new AbortController(); |
| const cancellation = new Error("Login was replaced"); |
| runProviderAuth.mockImplementationOnce(() => { |
| abortController.abort(cancellation); |
| return { |
| profiles: [ |
| { |
| profileId: "openai:late@example.com", |
| credential: { |
| type: "oauth", |
| provider: "openai", |
| access: "late-access-token", |
| refresh: "late-refresh-token", |
| expires: Date.now() + 60_000, |
| }, |
| }, |
| ], |
| }; |
| }); |
|
|
| await expect( |
| runModelsAuthLoginFlowCore({ |
| provider: "openai", |
| method: "oauth", |
| config: currentConfig, |
| runtime, |
| prompter: mocks.createClackPrompter(), |
| signal: abortController.signal, |
| }), |
| ).rejects.toBe(cancellation); |
|
|
| expect(mocks.upsertAuthProfileWithLock).not.toHaveBeenCalled(); |
| expect(mocks.persistProviderAuthProfilesAfterLogin).not.toHaveBeenCalled(); |
| expect(mocks.promoteAuthProfileInOrder).not.toHaveBeenCalled(); |
| expect(mocks.updateConfig).not.toHaveBeenCalled(); |
| }); |
|
|
| it("loads the owning plugin for an explicit provider even in a clean config", async () => { |
| const runtime = createRuntime(); |
| const runClaudeCliMigration = vi.fn().mockResolvedValue({ |
| profiles: [], |
| defaultModel: "claude-cli/claude-sonnet-4-6", |
| configPatch: { |
| agents: { |
| defaults: { |
| models: { |
| "claude-cli/claude-sonnet-4-6": {}, |
| }, |
| }, |
| }, |
| }, |
| }); |
| mocks.resolvePluginProvidersCore.mockImplementation( |
| (params: ResolvePluginProvidersCall | undefined) => |
| params?.providerRefs?.[0] === "anthropic" |
| ? [ |
| { |
| id: "anthropic", |
| label: "Anthropic", |
| auth: [ |
| { |
| id: "cli", |
| label: "Claude CLI", |
| kind: "custom", |
| run: runClaudeCliMigration, |
| }, |
| ], |
| }, |
| ] |
| : [], |
| ); |
|
|
| await modelsAuthLoginCommand( |
| { provider: "anthropic", method: "cli", setDefault: true }, |
| runtime, |
| ); |
|
|
| const providerResolutionCall = readMockCallArg( |
| mocks.resolvePluginProvidersCore, |
| ) as ResolvePluginProvidersCall; |
| expect(providerResolutionCall.config).toEqual({}); |
| expect(providerResolutionCall.workspaceDir).toBe("/tmp/openclaw/workspace"); |
| expect(providerResolutionCall.includeUntrustedWorkspacePlugins).toBe(false); |
| expect(providerResolutionCall.providerRefs).toEqual(["anthropic"]); |
| expect(runClaudeCliMigration).toHaveBeenCalledOnce(); |
| expect(mocks.upsertAuthProfileWithLock).not.toHaveBeenCalled(); |
| expect(lastUpdatedConfig?.agents?.defaults?.model).toEqual({ |
| primary: "claude-cli/claude-sonnet-4-6", |
| }); |
| expect(lastUpdatedConfig?.agents?.defaults?.models).toEqual({ |
| "claude-cli/claude-sonnet-4-6": {}, |
| }); |
| expect(runtime.log).toHaveBeenCalledWith("Default model set to claude-cli/claude-sonnet-4-6"); |
| }); |
|
|
| it("runs the requested anthropic cli auth method with the full login context", async () => { |
| const runtime = createRuntime(); |
| currentConfig = { |
| agents: { |
| defaults: { |
| model: { |
| primary: "anthropic/claude-sonnet-4-6", |
| fallbacks: ["anthropic/claude-opus-4-6", "openai/gpt-5.2"], |
| }, |
| models: { |
| "anthropic/claude-sonnet-4-6": { alias: "Sonnet" }, |
| "anthropic/claude-opus-4-6": { alias: "Opus" }, |
| "openai/gpt-5.2": {}, |
| }, |
| }, |
| }, |
| }; |
| const note = vi.fn(async () => {}); |
| const select = vi.fn(); |
| mocks.createClackPrompter.mockReturnValue({ |
| note, |
| select, |
| }); |
| const runApiKeyAuth = vi.fn(); |
| const runClaudeCliMigration = vi.fn().mockImplementation(async (ctx) => { |
| expect(ctx.config).toEqual(currentConfig); |
| expect(ctx.agentDir).toBe("/tmp/openclaw/agents/main"); |
| expect(ctx.workspaceDir).toBe("/tmp/openclaw/workspace"); |
| expect(ctx.prompter.note).toBe(note); |
| expect(ctx.prompter.select).toBe(select); |
| expect(ctx.runtime).toBe(runtime); |
| expect(ctx.env).toBe(process.env); |
| expect(ctx.allowSecretRefPrompt).toBe(false); |
| expect(ctx.isRemote).toBe(false); |
| await ctx.openUrl("https://example.com/auth"); |
| expect(mocks.openUrl).toHaveBeenCalledWith("https://example.com/auth"); |
| expect(ctx.oauth.createVpsAwareHandlers).toBeTypeOf("function"); |
| return { |
| profiles: [], |
| defaultModel: "claude-cli/claude-sonnet-4-6", |
| configPatch: { |
| agents: { |
| defaults: { |
| model: { |
| primary: "claude-cli/claude-sonnet-4-6", |
| fallbacks: ["claude-cli/claude-opus-4-6", "openai/gpt-5.2"], |
| }, |
| models: { |
| "claude-cli/claude-sonnet-4-6": { alias: "Sonnet" }, |
| "claude-cli/claude-opus-4-6": { alias: "Opus" }, |
| "openai/gpt-5.2": {}, |
| }, |
| }, |
| }, |
| }, |
| replaceDefaultModels: true, |
| notes: [ |
| "Claude CLI auth detected; switched Anthropic model selection to the local Claude CLI backend.", |
| "Existing Anthropic auth profiles are kept for rollback.", |
| ], |
| }; |
| }); |
| mocks.resolvePluginProvidersCore.mockReturnValue([ |
| { |
| id: "anthropic", |
| label: "Anthropic", |
| auth: [ |
| { |
| id: "cli", |
| label: "Claude CLI", |
| kind: "custom", |
| run: runClaudeCliMigration, |
| }, |
| { |
| id: "api-key", |
| label: "Anthropic API key", |
| kind: "api_key", |
| run: runApiKeyAuth, |
| }, |
| ], |
| }, |
| ]); |
|
|
| await modelsAuthLoginCommand( |
| { provider: "anthropic", method: "cli", setDefault: true }, |
| runtime, |
| ); |
|
|
| expect(runClaudeCliMigration).toHaveBeenCalledOnce(); |
| expect(runApiKeyAuth).not.toHaveBeenCalled(); |
| expect(mocks.upsertAuthProfileWithLock).not.toHaveBeenCalled(); |
| expect(lastUpdatedConfig?.agents?.defaults?.model).toEqual({ |
| primary: "claude-cli/claude-sonnet-4-6", |
| fallbacks: ["claude-cli/claude-opus-4-6", "openai/gpt-5.2"], |
| }); |
| expect(lastUpdatedConfig?.agents?.defaults?.models).toEqual({ |
| "claude-cli/claude-sonnet-4-6": { alias: "Sonnet" }, |
| "claude-cli/claude-opus-4-6": { alias: "Opus" }, |
| "openai/gpt-5.2": {}, |
| }); |
| expect(note).toHaveBeenCalledWith( |
| [ |
| "Claude CLI auth detected; switched Anthropic model selection to the local Claude CLI backend.", |
| "Existing Anthropic auth profiles are kept for rollback.", |
| ].join("\n"), |
| "Provider notes", |
| ); |
| expect(runtime.log).toHaveBeenCalledWith("Default model set to claude-cli/claude-sonnet-4-6"); |
| }); |
|
|
| it("preserves other providers' allowlist entries on an openai OAuth login", async () => { |
| const runtime = createRuntime(); |
| const existingModels = { |
| "anthropic/claude-sonnet-4-6": { alias: "sonnet" }, |
| "anthropic/claude-opus-4-6": { alias: "opus" }, |
| "moonshot/kimi-k2.5": { alias: "kimi" }, |
| "openai/gpt-5.5": { alias: "gpt55" }, |
| }; |
| currentConfig = { agents: { defaults: { models: existingModels } } }; |
| runProviderAuth.mockResolvedValue({ |
| profiles: [ |
| { |
| profileId: "openai:user@example.com", |
| credential: { |
| type: "oauth", |
| provider: "openai", |
| access: "a", |
| refresh: "r", |
| expires: Date.now() + 60_000, |
| email: "user@example.com", |
| }, |
| }, |
| ], |
| configPatch: { agents: { defaults: { models: { "openai/gpt-5.5": {} } } } }, |
| defaultModel: "openai/gpt-5.5", |
| }); |
|
|
| await modelsAuthLoginCommand({ provider: "openai" }, runtime); |
|
|
| expect(currentConfig.agents?.defaults?.models).toEqual(existingModels); |
| }); |
|
|
| it.each([ |
| { name: "an absent model", model: undefined }, |
| { name: "a model string", model: "openai/gpt-5.4" }, |
| { name: "a primary and fallbacks", model: { primary: "openai/gpt-5.4", fallbacks: [] } }, |
| { name: "fallbacks without a primary", model: { fallbacks: ["openai/gpt-5.4"] } }, |
| ])("preserves $name when login omits --set-default", async ({ model }) => { |
| const runtime = createRuntime(); |
| currentConfig = { |
| agents: { |
| defaults: { |
| ...(model === undefined ? {} : { model }), |
| models: { |
| "openai/gpt-5.4": {}, |
| "anthropic/claude-sonnet-4-6": {}, |
| }, |
| }, |
| }, |
| }; |
| runProviderAuth.mockResolvedValue({ |
| profiles: [ |
| { |
| profileId: "openai:default", |
| credential: { type: "api_key", provider: "openai", key: "sk-demo" }, |
| }, |
| ], |
| configPatch: { |
| agents: { |
| defaults: { |
| model: { primary: "openai/gpt-5.5" }, |
| models: { "openai/gpt-5.5": { alias: "GPT" } }, |
| }, |
| }, |
| }, |
| defaultModel: "openai/gpt-5.5", |
| }); |
| mocks.resolvePluginProvidersCore.mockReturnValue([ |
| createProvider({ |
| id: "openai", |
| label: "OpenAI", |
| run: runProviderAuth as ProviderPlugin["auth"][number]["run"], |
| }), |
| ]); |
|
|
| await modelsAuthLoginCommand({ provider: "openai" }, runtime); |
|
|
| expect(currentConfig.agents?.defaults?.model).toEqual(model); |
| if (model === undefined) { |
| expect(currentConfig.agents?.defaults).not.toHaveProperty("model"); |
| } |
| expect(currentConfig.agents?.defaults?.models).toEqual({ |
| "openai/gpt-5.4": {}, |
| "anthropic/claude-sonnet-4-6": {}, |
| }); |
| expect(currentConfig.auth).toBeUndefined(); |
| expect(runtime.log).toHaveBeenCalledWith( |
| "Default model available: openai/gpt-5.5 (current default unchanged; run openclaw models set openai/gpt-5.5 to apply)", |
| ); |
| }); |
|
|
| it("normalizes retired Google Gemini login defaults before config writes", async () => { |
| const runtime = createRuntime(); |
| runProviderAuth.mockResolvedValue({ |
| profiles: [ |
| { |
| profileId: "google:default", |
| credential: { type: "api_key", provider: "google", key: "gemini-demo" }, |
| }, |
| ], |
| defaultModel: "google/gemini-3-pro-preview", |
| }); |
| mocks.resolvePluginProvidersCore.mockReturnValue([ |
| createProvider({ |
| id: "google", |
| label: "Google", |
| run: runProviderAuth as ProviderPlugin["auth"][number]["run"], |
| }), |
| ]); |
|
|
| await modelsAuthLoginCommand({ provider: "google", setDefault: true }, runtime); |
|
|
| expect(lastUpdatedConfig?.agents?.defaults?.model).toEqual({ |
| primary: "google/gemini-3.1-pro-preview", |
| }); |
| expect(lastUpdatedConfig?.agents?.defaults?.models).toEqual({ |
| "google/gemini-3.1-pro-preview": {}, |
| }); |
| expect(runtime.log).toHaveBeenCalledWith("Default model set to google/gemini-3.1-pro-preview"); |
| }); |
|
|
| it("overwrites an existing primary when login uses --set-default", async () => { |
| const runtime = createRuntime(); |
| currentConfig = { |
| agents: { |
| defaults: { |
| model: { primary: "anthropic/claude-opus-4-6" }, |
| models: { "anthropic/claude-opus-4-6": {} }, |
| }, |
| }, |
| }; |
|
|
| await modelsAuthLoginCommand({ provider: "openai", setDefault: true }, runtime); |
|
|
| expect(lastUpdatedConfig?.agents?.defaults?.model).toEqual({ |
| primary: "openai/gpt-5.5", |
| }); |
| expect(lastUpdatedConfig?.agents?.defaults?.models).toEqual({ |
| "anthropic/claude-opus-4-6": {}, |
| }); |
| expect(runtime.log).toHaveBeenCalledWith("Default model set to openai/gpt-5.5"); |
| }); |
|
|
| it("leaves stored auth state untouched when provider login fails", async () => { |
| const runtime = createRuntime(); |
| const loginFailure = new Error("provider rejected login"); |
| runProviderAuth.mockRejectedValueOnce(loginFailure); |
|
|
| await expect(modelsAuthLoginCommand({ provider: "openai" }, runtime)).rejects.toBe( |
| loginFailure, |
| ); |
|
|
| expect(runProviderAuth).toHaveBeenCalledOnce(); |
| expect(mocks.persistProviderAuthProfilesAfterLogin).not.toHaveBeenCalled(); |
| expect(mocks.upsertAuthProfileWithLock).not.toHaveBeenCalled(); |
| }); |
|
|
| it("--force purges cached profiles for the provider before login", async () => { |
| const runtime = createRuntime(); |
|
|
| await modelsAuthLoginCommand({ provider: "openai", force: true }, runtime); |
|
|
| expect(mocks.removeProviderAuthProfilesWithLock).toHaveBeenCalledWith({ |
| cfg: expect.any(Object), |
| provider: "openai", |
| agentDir: "/tmp/openclaw/agents/main", |
| }); |
| expect(runProviderAuth).toHaveBeenCalledOnce(); |
| expect(runtime.log).toHaveBeenCalledWith( |
| expect.stringContaining('Removed cached auth profiles for provider "openai"'), |
| ); |
| expect(mocks.callGateway).toHaveBeenCalledTimes(2); |
| }); |
|
|
| it("--force refreshes after the purge when replacement login fails", async () => { |
| const runtime = createRuntime(); |
| runProviderAuth.mockRejectedValueOnce(new Error("provider rejected login")); |
|
|
| await expect( |
| modelsAuthLoginCommand({ provider: "openai", force: true }, runtime), |
| ).rejects.toThrow("provider rejected login"); |
|
|
| expect(mocks.removeProviderAuthProfilesWithLock).toHaveBeenCalledOnce(); |
| expect(mocks.callGateway).toHaveBeenCalledOnce(); |
| expect(mocks.removeProviderAuthProfilesWithLock.mock.invocationCallOrder[0]).toBeLessThan( |
| mocks.callGateway.mock.invocationCallOrder[0]!, |
| ); |
| expect(mocks.callGateway.mock.invocationCallOrder[0]).toBeLessThan( |
| runProviderAuth.mock.invocationCallOrder[0]!, |
| ); |
| }); |
|
|
| it("--force does not purge when omitted", async () => { |
| const runtime = createRuntime(); |
|
|
| await modelsAuthLoginCommand({ provider: "openai" }, runtime); |
|
|
| expect(mocks.removeProviderAuthProfilesWithLock).not.toHaveBeenCalled(); |
| expect(runProviderAuth).toHaveBeenCalledOnce(); |
| }); |
|
|
| it("--force fails before login when purge throws", async () => { |
| const runtime = createRuntime(); |
| mocks.removeProviderAuthProfilesWithLock.mockRejectedValueOnce(new Error("disk full")); |
|
|
| await expect( |
| modelsAuthLoginCommand({ provider: "openai", force: true }, runtime), |
| ).rejects.toThrow('Could not clear cached profiles for "openai" before re-login: disk full'); |
|
|
| expect(runtime.error).not.toHaveBeenCalled(); |
| expect(runProviderAuth).not.toHaveBeenCalled(); |
| }); |
|
|
| it("--force fails before login when purge cannot update the profile store", async () => { |
| const runtime = createRuntime(); |
| mocks.removeProviderAuthProfilesWithLock.mockResolvedValueOnce(null); |
|
|
| await expect( |
| modelsAuthLoginCommand({ provider: "openai", force: true }, runtime), |
| ).rejects.toThrow( |
| 'Could not clear cached profiles for "openai" before re-login: auth store is busy; close other OpenClaw commands using this state directory and retry', |
| ); |
|
|
| expect(runtime.error).not.toHaveBeenCalled(); |
| expect(runProviderAuth).not.toHaveBeenCalled(); |
| }); |
|
|
| it.each([undefined, true])( |
| "rejects unknown auth methods without login or purge (force=%s)", |
| async (force) => { |
| const runtime = createRuntime(); |
| const runOauthAuth = vi.fn().mockResolvedValue({ profiles: [] }); |
| const runApiKeyAuth = vi.fn().mockResolvedValue({ profiles: [] }); |
| mocks.resolvePluginSetupProviderCore.mockReturnValue( |
| createProvider({ |
| id: "openai", |
| label: "OpenAI", |
| run: runOauthAuth as ProviderPlugin["auth"][number]["run"], |
| auth: [ |
| { |
| id: "oauth", |
| label: "ChatGPT Login", |
| kind: "oauth", |
| run: runOauthAuth, |
| }, |
| { |
| id: "api-key", |
| label: "OpenAI API Key", |
| kind: "api_key", |
| run: runApiKeyAuth, |
| }, |
| ], |
| }), |
| ); |
|
|
| await expect( |
| modelsAuthLoginCommand({ provider: "openai", method: "api_key", force }, runtime), |
| ).rejects.toThrow("Unknown auth method"); |
|
|
| expect(mocks.removeProviderAuthProfilesWithLock).not.toHaveBeenCalled(); |
| expect(runOauthAuth).not.toHaveBeenCalled(); |
| expect(runApiKeyAuth).not.toHaveBeenCalled(); |
| }, |
| ); |
|
|
| it("reports loaded plugin providers when requested provider is unavailable", async () => { |
| const runtime = createRuntime(); |
|
|
| await expect(modelsAuthLoginCommand({ provider: "anthropic" }, runtime)).rejects.toThrow( |
| 'Unknown provider "anthropic". Loaded providers: openai. Verify plugins via `openclaw plugins list --json`.', |
| ); |
| }); |
|
|
| it("opens the provider picker when a CLI backend has no provider auth method", async () => { |
| const runtime = createRuntime(); |
| const prompter = { |
| note: vi.fn(async () => {}), |
| select: vi.fn(async () => "openai"), |
| }; |
| mocks.createClackPrompter.mockReturnValue(prompter); |
| mocks.isCliProvider.mockImplementation((provider: string) => provider === "claude-cli"); |
| const openaiProvider = createProvider({ |
| id: "openai", |
| label: "OpenAI Codex", |
| run: runProviderAuth as ProviderPlugin["auth"][number]["run"], |
| }); |
| mocks.resolvePluginProvidersCore.mockImplementation( |
| (params: ResolvePluginProvidersCall | undefined) => |
| params?.providerRefs?.includes("claude-cli") ? [] : [openaiProvider], |
| ); |
|
|
| await modelsAuthLoginCommand({ provider: "claude-cli" }, runtime); |
|
|
| expect(prompter.note).toHaveBeenCalledWith( |
| 'Provider "claude-cli" uses its own CLI login. Select a provider with an OpenClaw auth flow.', |
| "Provider auth", |
| ); |
| expect(prompter.select).toHaveBeenCalledWith( |
| expect.objectContaining({ message: "Select a provider" }), |
| ); |
| expect(runProviderAuth).toHaveBeenCalledOnce(); |
| expect(mocks.resolvePluginProvidersCore).toHaveBeenNthCalledWith( |
| 1, |
| expect.objectContaining({ providerRefs: ["claude-cli"] }), |
| ); |
| expect(mocks.resolvePluginProvidersCore).toHaveBeenNthCalledWith( |
| 2, |
| expect.not.objectContaining({ providerRefs: expect.anything() }), |
| ); |
| }); |
|
|
| it.each(["openai-codex", "codex-cli"])( |
| "rejects retired manual auth provider %s", |
| async (provider) => { |
| await expect(modelsAuthLoginCommand({ provider }, createRuntime())).rejects.toThrow( |
| `"${provider}" is a legacy provider ID; use --provider openai.`, |
| ); |
| }, |
| ); |
|
|
| it("does not persist a cancelled manual token entry", async () => { |
| const runtime = createRuntime(); |
| const exitSpy = vi.spyOn(process, "exit").mockImplementation((( |
| code?: string | number | null, |
| ) => { |
| throw new Error(`exit:${String(code ?? "")}`); |
| }) as typeof process.exit); |
| try { |
| const cancelSymbol = Symbol.for("clack:cancel"); |
| mocks.clackPassword.mockResolvedValue(cancelSymbol); |
| mocks.clackIsCancel.mockImplementation((value: unknown) => value === cancelSymbol); |
|
|
| await expect(modelsAuthPasteTokenCommand({ provider: "openai" }, runtime)).rejects.toThrow( |
| "exit:0", |
| ); |
|
|
| expect(mocks.upsertAuthProfileWithLock).not.toHaveBeenCalled(); |
| expect(mocks.updateConfig).not.toHaveBeenCalled(); |
| expect(mocks.logConfigUpdated).not.toHaveBeenCalled(); |
| } finally { |
| exitSpy.mockRestore(); |
| } |
| }); |
|
|
| it("reads the pasted token through the masked password prompt", async () => { |
| const runtime = createRuntime(); |
| mocks.clackPassword.mockResolvedValue("openai-token"); |
|
|
| await modelsAuthPasteTokenCommand({ provider: "openai" }, runtime); |
|
|
| expect(mocks.clackPassword).toHaveBeenCalledTimes(1); |
| expect(mocks.clackText).not.toHaveBeenCalled(); |
| expect(mocks.upsertAuthProfileWithLock).toHaveBeenCalledWith( |
| expect.objectContaining({ |
| credential: expect.objectContaining({ type: "token", token: "openai-token" }), |
| }), |
| ); |
| expect(mocks.callGateway).toHaveBeenCalledWith( |
| expect.objectContaining({ |
| params: { operation: "login", agentId: "main" }, |
| }), |
| ); |
| }); |
|
|
| it("writes pasted Anthropic setup-tokens and logs the preference note", async () => { |
| const runtime = createRuntime(); |
| mocks.clackPassword.mockResolvedValue(`sk-ant-oat01-${"a".repeat(80)}`); |
|
|
| await modelsAuthPasteTokenCommand({ provider: "anthropic" }, runtime); |
|
|
| expect(mocks.upsertAuthProfileWithLock).toHaveBeenCalledWith({ |
| profileId: "anthropic:manual", |
| credential: { |
| type: "token", |
| provider: "anthropic", |
| token: `sk-ant-oat01-${"a".repeat(80)}`, |
| }, |
| agentDir: "/tmp/openclaw/agents/main", |
| }); |
| expect(runtime.log).toHaveBeenCalledWith( |
| "Anthropic setup-token auth is supported in OpenClaw.", |
| ); |
| expect(runtime.log).toHaveBeenCalledWith( |
| "OpenClaw prefers Claude CLI reuse when it is available on the host.", |
| ); |
| expect(runtime.log).toHaveBeenCalledWith( |
| "Anthropic staff told us this OpenClaw path is allowed again.", |
| ); |
| }); |
|
|
| it("writes pasted tokens to the requested agent store", async () => { |
| const runtime = createRuntime(); |
| useCoderAgentConfig(); |
| mocks.clackPassword.mockResolvedValue("openai-token"); |
|
|
| await modelsAuthPasteTokenCommand({ provider: "openai", agent: "coder" }, runtime); |
|
|
| expect(mocks.resolveDefaultAgentId).not.toHaveBeenCalled(); |
| expect(mocks.upsertAuthProfileWithLock).toHaveBeenCalledWith({ |
| profileId: "openai:manual", |
| credential: { |
| type: "token", |
| provider: "openai", |
| token: "openai-token", |
| }, |
| agentDir: "/tmp/openclaw/agents/coder", |
| }); |
| expect(mocks.callGateway).toHaveBeenCalledWith( |
| expect.objectContaining({ |
| params: { operation: "login", agentId: "coder" }, |
| }), |
| ); |
| }); |
|
|
| it("rejects pasted token expiries that cannot fit in the Date timestamp range", async () => { |
| const runtime = createRuntime(); |
| const nowSpy = vi.spyOn(Date, "now").mockReturnValue(MAX_DATE_TIMESTAMP_MS); |
| mocks.clackPassword.mockResolvedValue("openai-token"); |
| try { |
| await expect( |
| modelsAuthPasteTokenCommand({ provider: "openai", expiresIn: "1ms" }, runtime), |
| ).rejects.toThrow("resulting token expiry is outside Date range"); |
| } finally { |
| nowSpy.mockRestore(); |
| } |
|
|
| expect(mocks.upsertAuthProfileWithLock).not.toHaveBeenCalled(); |
| expect(mocks.updateConfig).not.toHaveBeenCalled(); |
| }); |
|
|
| it("rejects OpenAI API keys pasted as OpenAI Codex token material", async () => { |
| const runtime = createRuntime(); |
| const validateMessages: string[] = []; |
| mocks.clackPassword.mockImplementation( |
| async (params: { validate?: (value: string) => string | undefined }) => { |
| const message = params.validate?.("sk-openai-chatgpt-api-key-value"); |
| if (message) { |
| validateMessages.push(message); |
| throw new Error(message); |
| } |
| return "sk-openai-chatgpt-api-key-value"; |
| }, |
| ); |
|
|
| await expect(modelsAuthPasteTokenCommand({ provider: "openai" }, runtime)).rejects.toThrow( |
| "paste-api-key --provider openai", |
| ); |
|
|
| expect(validateMessages).toEqual([ |
| "That looks like an OpenAI API key. Use openclaw models auth paste-api-key --provider openai for API-key auth.", |
| ]); |
| expect(mocks.upsertAuthProfileWithLock).not.toHaveBeenCalled(); |
| expect(mocks.updateConfig).not.toHaveBeenCalled(); |
| }); |
|
|
| it("rejects piped OpenAI API keys as OpenAI Codex token material", async () => { |
| const runtime = createRuntime(); |
| restoreStdin?.(); |
| restoreStdin = withPipedStdin("sk-openai-chatgpt-api-key-value\n"); |
|
|
| await expect(modelsAuthPasteTokenCommand({ provider: "openai" }, runtime)).rejects.toThrow( |
| "paste-api-key --provider openai", |
| ); |
|
|
| expect(mocks.clackPassword).not.toHaveBeenCalled(); |
| expect(mocks.upsertAuthProfileWithLock).not.toHaveBeenCalled(); |
| expect(mocks.updateConfig).not.toHaveBeenCalled(); |
| }); |
|
|
| it("rejects line-wrapped piped OpenAI API keys as OpenAI Codex token material", async () => { |
| const runtime = createRuntime(); |
| restoreStdin?.(); |
| restoreStdin = withPipedStdin("sk-openai-\nchat-api-key-value\n"); |
|
|
| await expect(modelsAuthPasteTokenCommand({ provider: "openai" }, runtime)).rejects.toThrow( |
| "paste-api-key --provider openai", |
| ); |
|
|
| expect(mocks.clackPassword).not.toHaveBeenCalled(); |
| expect(mocks.upsertAuthProfileWithLock).not.toHaveBeenCalled(); |
| expect(mocks.updateConfig).not.toHaveBeenCalled(); |
| }); |
|
|
| it("rejects oversized piped auth input before buffering it", async () => { |
| const runtime = createRuntime(); |
| restoreStdin?.(); |
| const oversized = "x".repeat(1024 * 1024 + 1); |
| restoreStdin = withPipedStdin(oversized); |
|
|
| await expect(modelsAuthPasteApiKeyCommand({ provider: "openai" }, runtime)).rejects.toThrow( |
| "Piped auth input exceeds 1048576 bytes.", |
| ); |
|
|
| expect(mocks.clackPassword).not.toHaveBeenCalled(); |
| expect(mocks.upsertAuthProfileWithLock).not.toHaveBeenCalled(); |
| expect(mocks.updateConfig).not.toHaveBeenCalled(); |
| }); |
|
|
| it("writes pasted API keys to the requested agent store", async () => { |
| const runtime = createRuntime(); |
| useCoderAgentConfig(); |
| mocks.clackPassword.mockResolvedValue("sk-openai-chatgpt-api-key-value"); |
|
|
| await modelsAuthPasteApiKeyCommand({ provider: "openai", agent: "coder" }, runtime); |
|
|
| expect(mocks.resolveDefaultAgentId).not.toHaveBeenCalled(); |
| expect(mocks.upsertAuthProfileWithLock).toHaveBeenCalledWith({ |
| profileId: "openai:manual", |
| credential: { |
| type: "api_key", |
| provider: "openai", |
| key: "sk-openai-chatgpt-api-key-value", |
| }, |
| agentDir: "/tmp/openclaw/agents/coder", |
| preserveApiKeyMetadata: true, |
| validateCurrentCredential: expect.any(Function), |
| }); |
| expect(lastUpdatedConfig?.auth?.profiles?.["openai:manual"]).toEqual({ |
| provider: "openai", |
| mode: "api_key", |
| }); |
| expect(runtime.log).toHaveBeenCalledWith("Auth profile: openai:manual (openai/api_key)"); |
| expect(runtime.error).toHaveBeenCalledWith( |
| expect.stringContaining("Gateway has not confirmed applying the provider settings"), |
| ); |
| expect(mocks.callGateway).toHaveBeenCalledWith( |
| expect.objectContaining({ |
| params: { operation: "login", agentId: "coder" }, |
| }), |
| ); |
| }); |
|
|
| it("writes piped OpenAI Codex API keys to API-key profiles", async () => { |
| const runtime = createRuntime(); |
| restoreStdin?.(); |
| restoreStdin = withPipedStdin("sk-openai-chatgpt-api-key-value\n"); |
|
|
| await modelsAuthPasteApiKeyCommand({ provider: "openai" }, runtime); |
|
|
| expect(mocks.clackPassword).not.toHaveBeenCalled(); |
| expect(mocks.upsertAuthProfileWithLock).toHaveBeenCalledWith({ |
| profileId: "openai:manual", |
| credential: { |
| type: "api_key", |
| provider: "openai", |
| key: "sk-openai-chatgpt-api-key-value", |
| }, |
| agentDir: "/tmp/openclaw/agents/main", |
| preserveApiKeyMetadata: true, |
| validateCurrentCredential: expect.any(Function), |
| }); |
| expect(lastUpdatedConfig?.auth?.profiles?.["openai:manual"]).toEqual({ |
| provider: "openai", |
| mode: "api_key", |
| }); |
| }); |
|
|
| it("normalizes line-wrapped piped OpenAI Codex API keys before storing", async () => { |
| const runtime = createRuntime(); |
| restoreStdin?.(); |
| restoreStdin = withPipedStdin("sk-openai-\nchat-api-key-value\n"); |
|
|
| await modelsAuthPasteApiKeyCommand({ provider: "openai" }, runtime); |
|
|
| expect(mocks.clackPassword).not.toHaveBeenCalled(); |
| expect(mocks.upsertAuthProfileWithLock).toHaveBeenCalledWith({ |
| profileId: "openai:manual", |
| credential: { |
| type: "api_key", |
| provider: "openai", |
| key: "sk-openai-chat-api-key-value", |
| }, |
| agentDir: "/tmp/openclaw/agents/main", |
| preserveApiKeyMetadata: true, |
| validateCurrentCredential: expect.any(Function), |
| }); |
| expect(lastUpdatedConfig?.auth?.profiles?.["openai:manual"]).toEqual({ |
| provider: "openai", |
| mode: "api_key", |
| }); |
| }); |
|
|
| it("rejects token material pasted into the OpenAI Codex API-key command", async () => { |
| const runtime = createRuntime(); |
| const jwtLikeToken = ["eyJhbGciOiJub25l", "eyJzdWIiOiJjb2RleCJ9", "signature123456"].join("."); |
| const validateMessages: string[] = []; |
| mocks.clackPassword.mockImplementation( |
| async (params: { validate?: (value: string) => string | undefined }) => { |
| const message = params.validate?.(jwtLikeToken); |
| if (message) { |
| validateMessages.push(message); |
| throw new Error(message); |
| } |
| return jwtLikeToken; |
| }, |
| ); |
|
|
| await expect(modelsAuthPasteApiKeyCommand({ provider: "openai" }, runtime)).rejects.toThrow( |
| "paste-token --provider openai", |
| ); |
|
|
| expect(validateMessages).toEqual([ |
| "That looks like token or OAuth material, not an OpenAI API key. Use openclaw models auth paste-token --provider openai for token auth material.", |
| ]); |
| expect(mocks.upsertAuthProfileWithLock).not.toHaveBeenCalled(); |
| expect(mocks.updateConfig).not.toHaveBeenCalled(); |
| }); |
|
|
| it("rejects an unknown agent before prompting for pasted tokens", async () => { |
| const runtime = createRuntime(); |
| currentConfig = { agents: { list: [{ id: "main" }] } }; |
|
|
| await expect( |
| modelsAuthPasteTokenCommand({ provider: "openai", agent: "missing" }, runtime), |
| ).rejects.toThrow( |
| 'Unknown agent id "missing". Use "openclaw agents list" to see configured agents.', |
| ); |
|
|
| expect(mocks.clackPassword).not.toHaveBeenCalled(); |
| expect(mocks.upsertAuthProfileWithLock).not.toHaveBeenCalled(); |
| expect(mocks.updateConfig).not.toHaveBeenCalled(); |
| }); |
|
|
| it("runs token auth for any token-capable provider plugin", async () => { |
| const runtime = createRuntime(); |
| const runTokenAuth = vi.fn().mockResolvedValue({ |
| profiles: [ |
| { |
| profileId: "moonshot:token", |
| credential: { |
| type: "token", |
| provider: "moonshot", |
| token: "moonshot-token", |
| }, |
| }, |
| ], |
| }); |
| mocks.resolvePluginProvidersCore.mockReturnValue([ |
| { |
| id: "moonshot", |
| label: "Moonshot", |
| auth: [ |
| { |
| id: "setup-token", |
| label: "setup-token", |
| kind: "token", |
| run: runTokenAuth, |
| }, |
| ], |
| }, |
| ]); |
|
|
| await modelsAuthSetupTokenCommand({ provider: "moonshot", yes: true }, runtime); |
|
|
| expect(runTokenAuth).toHaveBeenCalledOnce(); |
| expect(mocks.persistProviderAuthProfilesAfterLogin).toHaveBeenCalledWith( |
| expect.objectContaining({ |
| profiles: [ |
| { |
| profileId: "moonshot:token", |
| credential: { |
| type: "token", |
| provider: "moonshot", |
| token: "moonshot-token", |
| }, |
| }, |
| ], |
| agentDir: "/tmp/openclaw/agents/main", |
| }), |
| ); |
| }); |
|
|
| it("uses the requested agent store for setup-token provider auth", async () => { |
| const runtime = createRuntime(); |
| useCoderAgentConfig(); |
| const runTokenAuth = vi.fn().mockResolvedValue({ |
| profiles: [ |
| { |
| profileId: "moonshot:token", |
| credential: { |
| type: "token", |
| provider: "moonshot", |
| token: "moonshot-token", |
| }, |
| }, |
| ], |
| }); |
| mocks.resolvePluginProvidersCore.mockReturnValue([ |
| { |
| id: "moonshot", |
| label: "Moonshot", |
| auth: [ |
| { |
| id: "setup-token", |
| label: "setup-token", |
| kind: "token", |
| run: runTokenAuth, |
| }, |
| ], |
| }, |
| ]); |
|
|
| await modelsAuthSetupTokenCommand({ provider: "moonshot", yes: true, agent: "coder" }, runtime); |
|
|
| expect(mocks.resolveDefaultAgentId).not.toHaveBeenCalled(); |
| const tokenAuthCall = readMockCallArg(runTokenAuth) as AuthRunCall; |
| expect(tokenAuthCall.agentDir).toBe("/tmp/openclaw/agents/coder"); |
| expect(tokenAuthCall.workspaceDir).toBe("/tmp/openclaw/workspaces/coder"); |
| expect( |
| (readMockCallArg(mocks.persistProviderAuthProfilesAfterLogin) as PersistProviderAuthCall) |
| .agentDir, |
| ).toBe("/tmp/openclaw/agents/coder"); |
| }); |
|
|
| it("uses the requested agent store for interactive token auth add", async () => { |
| const runtime = createRuntime(); |
| useCoderAgentConfig(); |
| const runTokenAuth = vi.fn().mockResolvedValue({ |
| configPatch: { logging: { level: "debug" } }, |
| profiles: [ |
| { |
| profileId: "moonshot:token", |
| credential: { |
| type: "token", |
| provider: "moonshot", |
| token: "moonshot-token", |
| }, |
| }, |
| ], |
| }); |
| mocks.resolvePluginProvidersCore.mockReturnValue([ |
| { |
| id: "moonshot", |
| label: "Moonshot", |
| auth: [ |
| { |
| id: "setup-token", |
| label: "setup-token", |
| kind: "token", |
| run: runTokenAuth, |
| }, |
| ], |
| }, |
| ]); |
| mocks.clackSelect.mockResolvedValueOnce("moonshot").mockResolvedValueOnce("setup-token"); |
|
|
| await modelsAuthAddCommand({ agent: "coder" }, runtime); |
|
|
| expect(lastUpdatedConfig?.logging?.level).toBe("debug"); |
| expect(mocks.resolveDefaultAgentId).not.toHaveBeenCalled(); |
| const tokenAuthCall = readMockCallArg(runTokenAuth) as AuthRunCall; |
| expect(tokenAuthCall.agentDir).toBe("/tmp/openclaw/agents/coder"); |
| expect(tokenAuthCall.workspaceDir).toBe("/tmp/openclaw/workspaces/coder"); |
| expect( |
| (readMockCallArg(mocks.persistProviderAuthProfilesAfterLogin) as PersistProviderAuthCall) |
| .agentDir, |
| ).toBe("/tmp/openclaw/agents/coder"); |
| }); |
|
|
| it("keeps the requested agent store when interactive auth add falls back to paste-token", async () => { |
| const runtime = createRuntime(); |
| useCoderAgentConfig(); |
| mocks.resolvePluginProvidersCore.mockReturnValue([]); |
| mocks.clackSelect.mockResolvedValue("custom"); |
| mocks.clackText.mockResolvedValueOnce("openai").mockResolvedValueOnce("openai:manual"); |
| mocks.clackPassword.mockResolvedValue("openai-token"); |
| mocks.clackConfirm.mockResolvedValue(false); |
|
|
| await modelsAuthAddCommand({ agent: "coder" }, runtime); |
|
|
| expect(mocks.resolveDefaultAgentId).not.toHaveBeenCalled(); |
| expect(mocks.upsertAuthProfileWithLock).toHaveBeenCalledWith({ |
| profileId: "openai:manual", |
| credential: { |
| type: "token", |
| provider: "openai", |
| token: "openai-token", |
| }, |
| agentDir: "/tmp/openclaw/agents/coder", |
| }); |
| }); |
| }); |
| |
|
|
