import type { OpenClawConfig } from "../config/config.js";

import {

resolveGatewayConnectionAuth,

resolveGatewayConnectionAuthFromConfig,

type GatewayConnectionAuthOptions,

} from "./connection-auth.js";

env,

...options,

});

const syncResolved = resolveGatewayConnectionAuthFromConfig({

cfg: cfgLocal,

env,

...options,

});

expect(asyncResolved).toEqual(expected);

expect(syncResolved).toEqual(expected);

});

it("resolves local SecretRef token when OPENCLAW env is absent", async () => {

localTokenPrecedence: "config-first",

}),

).rejects.toThrow("gateway.auth.token");

expect(() =>

resolveGatewayConnectionAuthFromConfig({

cfg: config,

env,

localTokenPrecedence: "config-first",

}),

).toThrow("gateway.auth.token");

});

it("throws when config-first password SecretRef cannot resolve even if env password exists", async () => {

localPasswordPrecedence: "config-first", // pragma: allowlist secret

}),

).rejects.toThrow("gateway.auth.password");

expect(() =>

resolveGatewayConnectionAuthFromConfig({

cfg: config,

env,

localPasswordPrecedence: "config-first", // pragma: allowlist secret

}),

).toThrow("gateway.auth.password");

});

});