fix(minimax): reject unsafe oauth expiry · openclaw/openc...

Recent Commits to openclaw:main

steipete · 2026-05-30 · via Recent Commits to openclaw:main

Original file line number	Diff line number	Diff line change
`@@ -13,4 +13,10 @@ describe("normalizeOAuthExpires", () => {`
`13`	`13`	`it("preserves absolute millisecond timestamps", () => {`
`14`	`14`	`expect(normalizeOAuthExpires(1_700_000_000_000)).toBe(1_700_000_000_000);`
`15`	`15`	`});`
	`16`	`+`
	`17`	`+it("rejects unsafe and malformed expiry values", () => {`
	`18`	`+expect(normalizeOAuthExpires(Number.POSITIVE_INFINITY)).toBeUndefined();`
	`19`	`+expect(normalizeOAuthExpires(Number.MAX_SAFE_INTEGER + 1)).toBeUndefined();`
	`20`	`+expect(normalizeOAuthExpires("3600s")).toBeUndefined();`
	`21`	`+});`
`16`	`22`	`});`

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`	`1`	`import { randomBytes, randomUUID } from "node:crypto";`
	`2`	`+import { resolveExpiresAtMsFromDurationOrEpoch } from "openclaw/plugin-sdk/number-runtime";`
`2`	`3`	`import { generatePkceVerifierChallenge, toFormUrlEncoded } from "openclaw/plugin-sdk/provider-auth";`
`3`	`4`	`import { ensureGlobalUndiciEnvProxyDispatcher } from "openclaw/plugin-sdk/runtime-env";`
`4`	`5`
`@@ -57,14 +58,12 @@ type TokenResult =`
`57`	`58`	* Normalize MiniMax token endpoint `expired_in` values to the auth-profile
`58`	`59`	`* contract: absolute Unix milliseconds.`
`59`	`60`	`*/`
`60`		`-export function normalizeOAuthExpires(expiredIn: number, now = Date.now()): number {`
`61`		`-if (expiredIn < MINIMAX_RELATIVE_EXPIRY_SECONDS_THRESHOLD) {`
`62`		`-return now + expiredIn * 1000;`
`63`		`-}`
`64`		`-if (expiredIn < MINIMAX_ABSOLUTE_EXPIRY_MS_THRESHOLD) {`
`65`		`-return expiredIn * 1000;`
`66`		`-}`
`67`		`-return expiredIn;`
	`61`	`+export function normalizeOAuthExpires(expiredIn: unknown, now = Date.now()): number \| undefined {`
	`62`	`+return resolveExpiresAtMsFromDurationOrEpoch(expiredIn, {`
	`63`	`+nowMs: now,`
	`64`	`+relativeSecondsThreshold: MINIMAX_RELATIVE_EXPIRY_SECONDS_THRESHOLD,`
	`65`	`+absoluteMillisecondsThreshold: MINIMAX_ABSOLUTE_EXPIRY_MS_THRESHOLD,`
	`66`	`+});`
`68`	`67`	`}`
`69`	`68`
`70`	`69`	`function generatePkce(): { verifier: string; challenge: string; state: string } {`
`@@ -165,7 +164,7 @@ async function pollOAuthToken(params: {`
`165`	`164`	`status: string;`
`166`	`165`	`access_token?: string \| null;`
`167`	`166`	`refresh_token?: string \| null;`
`168`		`-expired_in?: number \| null;`
	`167`	`+expired_in?: unknown;`
`169`	`168`	`token_type?: string;`
`170`	`169`	`resource_url?: string;`
`171`	`170`	`notification_message?: string;`
`@@ -182,13 +181,17 @@ async function pollOAuthToken(params: {`
`182`	`181`	`if (!tokenPayload.access_token \|\| !tokenPayload.refresh_token \|\| !tokenPayload.expired_in) {`
`183`	`182`	`return { status: "error", message: "MiniMax OAuth returned incomplete token payload." };`
`184`	`183`	`}`
	`184`	`+const expires = normalizeOAuthExpires(tokenPayload.expired_in);`
	`185`	`+if (expires === undefined) {`
	`186`	`+return { status: "error", message: "MiniMax OAuth returned invalid token expiry." };`
	`187`	`+}`
`185`	`188`
`186`	`189`	`return {`
`187`	`190`	`status: "success",`
`188`	`191`	`token: {`
`189`	`192`	`access: tokenPayload.access_token,`
`190`	`193`	`refresh: tokenPayload.refresh_token,`
`191`		`-expires: normalizeOAuthExpires(tokenPayload.expired_in),`
	`194`	`+ expires,`
`192`	`195`	`resourceUrl: tokenPayload.resource_url,`
`193`	`196`	`notification_message: tokenPayload.notification_message,`
`194`	`197`	`},`

Original file line number	Diff line number	Diff line change
`@@ -7,5 +7,6 @@ export {`
`7`	`7`	`positiveSecondsToSafeMilliseconds,`
`8`	`8`	`nonNegativeSecondsToSafeMilliseconds,`
`9`	`9`	`resolveExpiresAtMsFromDurationSeconds,`
	`10`	`+resolveExpiresAtMsFromDurationOrEpoch,`
`10`	`11`	`resolveExpiresAtMsFromEpochSeconds,`
`11`	`12`	`} from "../shared/number-coercion.js";`

Original file line number	Diff line number	Diff line change
`@@ -13,6 +13,7 @@ export {`
`13`	`13`	`positiveSecondsToSafeMilliseconds,`
`14`	`14`	`nonNegativeSecondsToSafeMilliseconds,`
`15`	`15`	`resolveExpiresAtMsFromDurationSeconds,`
	`16`	`+resolveExpiresAtMsFromDurationOrEpoch,`
`16`	`17`	`resolveExpiresAtMsFromEpochSeconds,`
`17`	`18`	`} from "../shared/number-coercion.js";`
`18`	`19`	`export { MAX_TCP_PORT, parseTcpPort } from "../infra/tcp-port.js";`

Original file line number	Diff line number	Diff line change
`@@ -8,6 +8,7 @@ import {`
`8`	`8`	`positiveSecondsToSafeMilliseconds,`
`9`	`9`	`resolveIntegerOption,`
`10`	`10`	`resolveExpiresAtMsFromDurationSeconds,`
	`11`	`+resolveExpiresAtMsFromDurationOrEpoch,`
`11`	`12`	`resolveExpiresAtMsFromEpochSeconds,`
`12`	`13`	`resolveNonNegativeIntegerOption,`
`13`	`14`	`resolveOptionalIntegerOption,`
`@@ -100,6 +101,16 @@ describe("number-coercion", () => {`
`100`	`101`	`expect(resolveExpiresAtMsFromEpochSeconds("1e309")).toBeUndefined();`
`101`	`102`	`});`
`102`	`103`
	`104`	`+test("mixed expiry helper handles relative seconds, epoch seconds, and absolute milliseconds", () => {`
	`105`	`+expect(resolveExpiresAtMsFromDurationOrEpoch(86_400, { nowMs: 1_700_000_000_000 })).toBe(`
	`106`	`+1_700_086_400_000,`
	`107`	`+);`
	`108`	`+expect(resolveExpiresAtMsFromDurationOrEpoch(1_700_000_000)).toBe(1_700_000_000_000);`
	`109`	`+expect(resolveExpiresAtMsFromDurationOrEpoch(1_700_000_000_000)).toBe(1_700_000_000_000);`
	`110`	`+expect(resolveExpiresAtMsFromDurationOrEpoch(Number.POSITIVE_INFINITY)).toBeUndefined();`
	`111`	`+expect(resolveExpiresAtMsFromDurationOrEpoch(Number.MAX_SAFE_INTEGER + 1)).toBeUndefined();`
	`112`	`+});`
	`113`	`+`
`103`	`114`	`test("integer option helpers floor finite values and fall back for non-finite values", () => {`
`104`	`115`	`expect(resolveIntegerOption(7.9, 1, { min: 1, max: 10 })).toBe(7);`
`105`	`116`	`expect(resolveIntegerOption(Number.NaN, 4.9, { min: 1 })).toBe(4);`

Original file line number	Diff line number	Diff line change
`@@ -180,3 +180,26 @@ export function resolveExpiresAtMsFromEpochSeconds(`
`180`	`180`	`const expiresAt = epochMs - (opts.bufferMs ?? 0);`
`181`	`181`	`return Number.isSafeInteger(expiresAt) ? expiresAt : undefined;`
`182`	`182`	`}`
	`183`	`+`
	`184`	`+export function resolveExpiresAtMsFromDurationOrEpoch(`
	`185`	`+value: unknown,`
	`186`	`+opts: {`
	`187`	`+nowMs?: number;`
	`188`	`+relativeSecondsThreshold?: number;`
	`189`	`+absoluteMillisecondsThreshold?: number;`
	`190`	`+} = {},`
	`191`	`+): number \| undefined {`
	`192`	`+const parsed = parseStrictPositiveInteger(value);`
	`193`	`+if (parsed === undefined) {`
	`194`	`+return undefined;`
	`195`	`+}`
	`196`	`+const relativeSecondsThreshold = opts.relativeSecondsThreshold ?? 1_000_000_000;`
	`197`	`+if (parsed < relativeSecondsThreshold) {`
	`198`	`+return resolveExpiresAtMsFromDurationSeconds(parsed, { nowMs: opts.nowMs });`
	`199`	`+}`
	`200`	`+const absoluteMillisecondsThreshold = opts.absoluteMillisecondsThreshold ?? 1_000_000_000_000;`
	`201`	`+if (parsed < absoluteMillisecondsThreshold) {`
	`202`	`+return positiveSecondsToSafeMilliseconds(parsed);`
	`203`	`+}`
	`204`	`+return parsed;`
	`205`	`+}`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main