// Gateway auth config utilities materialize token/password SecretRefs only for

// the auth mode that can actually consume them.

import type { GatewayAuthConfig } from "../config/types.gateway.js";

import type { OpenClawConfig } from "../config/types.openclaw.js";

import { hasConfiguredSecretInput, resolveSecretInputRef } from "../config/types.secrets.js";

if (!value) {

return params.cfg;

}

// Mutate a clone so startup validation can materialize secrets without

// altering the caller's raw config object.

const nextConfig = structuredClone(params.cfg);

nextConfig.gateway ??= {};

nextConfig.gateway.auth ??= {};

// Covers gateway auth mode validation when token and password inputs are both

// configured directly or via secret defaults.

import { describe, expect, it } from "vitest";

import type { OpenClawConfig } from "../config/config.js";

import {

// Gateway auth mode policy rejects ambiguous token+password config before

// credential resolution can choose the wrong side.

import type { OpenClawConfig } from "../config/types.openclaw.js";

import { hasConfiguredSecretInput } from "../config/types.secrets.js";

// Gateway auth token resolution applies explicit/config/SecretRef/env

// precedence with caller-controlled env fallback behavior.

import type { OpenClawConfig } from "../config/types.openclaw.js";

import { resolveSecretInputRef } from "../config/types.secrets.js";

import { trimToUndefined } from "./credentials.js";

// Explicit connection policy decides when CLI gateway calls can avoid reading

// config because URL and auth were fully supplied by flags.

import type { OpenClawConfig } from "../config/types.openclaw.js";

import { trimToUndefined, type ExplicitGatewayAuth } from "./credentials.js";

// Gateway input allowlist helpers normalize optional hostname allowlists while

// keeping "unset" distinct from "deny all".

import { normalizeTrimmedStringList } from "@openclaw/normalization-core/string-normalization";

/**

// Covers gateway protected-path canonicalization for repeated encoding,

// malformed encodings, dot segments, and plugin route prefixes.

import { describe, expect, it } from "vitest";

import {

PROTECTED_PLUGIN_ROUTE_PREFIXES,

// Gateway path security canonicalizes repeatedly encoded paths and protects

// plugin HTTP routes even under malformed encoding.

import { normalizeLowercaseStringOrEmpty } from "@openclaw/normalization-core/string-coerce";

type SecurityPathCanonicalization = {