fix(qqbot): validate token expiry lifetimes · openclaw/openclaw@91ecd96

Recent Commits to openclaw:main

steipete · 2026-05-29 · via Recent Commits to openclaw:main

File tree

extensions/qqbot/src/engine/api

Original file line number	Diff line number	Diff line change
`@@ -4,6 +4,7 @@ import { TokenManager } from "./token.js";`
`4`	`4`	`describe("QQBot token manager", () => {`
`5`	`5`	`afterEach(() => {`
`6`	`6`	`vi.unstubAllGlobals();`
	`7`	`+vi.useRealTimers();`
`7`	`8`	`});`
`8`	`9`
`9`	`10`	`it("wraps malformed access token JSON", async () => {`
`@@ -21,4 +22,45 @@ describe("QQBot token manager", () => {`
`21`	`22`	`"QQBot access_token response was malformed JSON",`
`22`	`23`	`);`
`23`	`24`	`});`
	`25`	`+`
	`26`	`+it("does not cache access tokens forever when expires_in is unsafe", async () => {`
	`27`	`+vi.useFakeTimers();`
	`28`	`+vi.setSystemTime(new Date("2026-05-29T12:00:00.000Z"));`
	`29`	`+vi.stubGlobal(`
	`30`	`+"fetch",`
	`31`	`+vi.fn().mockResolvedValue(`
	`32`	`+new Response('{"access_token":"token-1","expires_in":1e309}', {`
	`33`	`+status: 200,`
	`34`	`+headers: { "content-type": "application/json" },`
	`35`	`+}),`
	`36`	`+),`
	`37`	`+);`
	`38`	`+`
	`39`	`+const manager = new TokenManager();`
	`40`	`+await expect(manager.getAccessToken("app-id", "secret")).resolves.toBe("token-1");`
	`41`	`+`
	`42`	`+const status = manager.getStatus("app-id");`
	`43`	`+expect(status.status).toBe("valid");`
	`44`	`+expect(status.expiresAt).toBe(Date.now() + 7200 * 1000);`
	`45`	`+});`
	`46`	`+`
	`47`	`+it("does not extend explicit non-positive token lifetimes", async () => {`
	`48`	`+vi.useFakeTimers();`
	`49`	`+vi.setSystemTime(new Date("2026-05-29T12:00:00.000Z"));`
	`50`	`+const fetch = vi.fn().mockResolvedValue(`
	`51`	`+new Response('{"access_token":"token-1","expires_in":0}', {`
	`52`	`+status: 200,`
	`53`	`+headers: { "content-type": "application/json" },`
	`54`	`+}),`
	`55`	`+);`
	`56`	`+vi.stubGlobal("fetch", fetch);`
	`57`	`+`
	`58`	`+const manager = new TokenManager();`
	`59`	`+await expect(manager.getAccessToken("app-id", "secret")).resolves.toBe("token-1");`
	`60`	`+`
	`61`	`+expect(manager.getStatus("app-id")).toEqual({`
	`62`	`+status: "expired",`
	`63`	`+expiresAt: Date.now(),`
	`64`	`+});`
	`65`	`+});`
`24`	`66`	`});`

Original file line number	Diff line number	Diff line change
`@@ -6,10 +6,12 @@`
`6`	`6`	`* globals, fully supporting multi-account concurrent operation.`
`7`	`7`	`*/`
`8`	`8`
	`9`	`+import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";`
`9`	`10`	`import type { EngineLogger } from "../types.js";`
`10`	`11`	`import { formatErrorMessage } from "../utils/format.js";`
`11`	`12`
`12`	`13`	`const TOKEN_URL = "https://bots.qq.com/app/getAppAccessToken";`
	`14`	`+const DEFAULT_TOKEN_EXPIRES_IN_SECONDS = 7200;`
`13`	`15`
`14`	`16`	`interface CachedToken {`
`15`	`17`	`token: string;`
`@@ -24,6 +26,17 @@ interface BackgroundRefreshOptions {`
`24`	`26`	`retryDelayMs?: number;`
`25`	`27`	`}`
`26`	`28`
	`29`	`+function resolveTokenExpiresInSeconds(value: unknown): number {`
	`30`	`+const parsed = parseStrictPositiveInteger(value);`
	`31`	`+if (parsed !== undefined) {`
	`32`	`+return parsed;`
	`33`	`+}`
	`34`	`+if (value == null \|\| (typeof value === "number" && !Number.isFinite(value))) {`
	`35`	`+return DEFAULT_TOKEN_EXPIRES_IN_SECONDS;`
	`36`	`+}`
	`37`	`+return 0;`
	`38`	`+}`
	`39`	`+`
`27`	`40`	`/**`
`28`	`41`	`* Per-appId token manager with caching, singleflight, and background refresh.`
`29`	`42`	`*`
`@@ -239,7 +252,7 @@ export class TokenManager {`
`239`	`252`	`const logBody = rawBody.replace(/"access_token"\s:\s"[^"]+"/g, '"access_token": "***"');`
`240`	`253`	this.logger?.debug?.(`[qqbot:token:${appId}] <<< Body: ${logBody}`);
`241`	`254`
`242`		`-let data: { access_token?: string; expires_in?: number };`
	`255`	`+let data: { access_token?: string; expires_in?: unknown };`
`243`	`256`	`try {`
`244`	`257`	`data = JSON.parse(rawBody);`
`245`	`258`	`} catch {`
`@@ -250,7 +263,7 @@ export class TokenManager {`
`250`	`263`	throw new Error(`Failed to get access_token: ${JSON.stringify(data)}`);
`251`	`264`	`}`
`252`	`265`
`253`		`-const expiresAt = Date.now() + (data.expires_in ?? 7200) * 1000;`
	`266`	`+const expiresAt = Date.now() + resolveTokenExpiresInSeconds(data.expires_in) * 1000;`
`254`	`267`	`this.cache.set(appId, { token: data.access_token, expiresAt, appId });`
`255`	`268`	`this.logger?.debug?.(`
`256`	`269`	`[qqbot:token:${appId}] Cached, expires at: ${new Date(expiresAt).toISOString()}`,

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main

File tree