@@ -18,7 +18,10 @@ import { loadGatewayRuntimeConfigSchema } from "../../config/runtime-schema.js";
1818import { lookupConfigSchema, type ConfigSchemaResponse } from "../../config/schema.js";
1919import type { ConfigValidationIssue, OpenClawConfig } from "../../config/types.openclaw.js";
2020import { formatErrorMessage } from "../../infra/errors.js";
21-import { prepareSecretsRuntimeSnapshot } from "../../secrets/runtime.js";
21+import {
22+prepareSecretsRuntimeSnapshot,
23+type PreparedSecretsRuntimeSnapshot,
24+} from "../../secrets/runtime.js";
2225import { diffConfigPaths } from "../config-reload.js";
2326import {
2427formatControlPlaneActor,
@@ -40,6 +43,7 @@ import {
4043import { resolveBaseHashParam } from "./base-hash.js";
4144import {
4245commitGatewayConfigWrite,
46+didActiveSharedGatewayAuthChange,
4347didSharedGatewayAuthChange,
4448resolveGatewayConfigPath,
4549resolveGatewayConfigRestartWriteResult,
@@ -234,13 +238,12 @@ function summarizeConfigValidationIssues(issues: ReadonlyArray<ConfigValidationI
234238async function ensureResolvableSecretRefsOrRespond(params: {
235239config: OpenClawConfig;
236240respond: RespondFn;
237-}): Promise<boolean> {
241+}): Promise<PreparedSecretsRuntimeSnapshot | null> {
238242try {
239-await prepareSecretsRuntimeSnapshot({
243+return await prepareSecretsRuntimeSnapshot({
240244config: params.config,
241245includeAuthStoreRefs: false,
242246});
243-return true;
244247} catch (error) {
245248const details = formatErrorMessage(error);
246249params.respond(
@@ -251,7 +254,7 @@ async function ensureResolvableSecretRefsOrRespond(params: {
251254`invalid config: active SecretRef resolution failed (${details})`,
252255),
253256);
254-return false;
257+return null;
255258}
256259}
257260@@ -415,7 +418,11 @@ export const configHandlers: GatewayRequestHandlers = {
415418);
416419return;
417420}
418-if (!(await ensureResolvableSecretRefsOrRespond({ config: validated.config, respond }))) {
421+const preparedSecretsSnapshot = await ensureResolvableSecretRefsOrRespond({
422+config: validated.config,
423+ respond,
424+});
425+if (!preparedSecretsSnapshot) {
419426return;
420427}
421428const changedPaths = diffConfigPaths(snapshot.config, validated.config);
@@ -447,10 +454,12 @@ export const configHandlers: GatewayRequestHandlers = {
447454);
448455// Compare before the write so we invalidate clients authenticated against the
449456// previous shared secret immediately after the config update succeeds.
450-const disconnectSharedAuthClients = didSharedGatewayAuthChange(
451-snapshot.config,
452-validated.config,
453-);
457+const disconnectSharedAuthClients =
458+didSharedGatewayAuthChange(snapshot.config, validated.config) ||
459+didActiveSharedGatewayAuthChange({
460+fallbackPrev: snapshot.config,
461+next: preparedSecretsSnapshot.config,
462+});
454463const writeResult = await commitGatewayConfigWrite({
455464 snapshot,
456465 writeOptions,
@@ -497,7 +506,11 @@ export const configHandlers: GatewayRequestHandlers = {
497506if (!parsed) {
498507return;
499508}
500-if (!(await ensureResolvableSecretRefsOrRespond({ config: parsed.config, respond }))) {
509+const preparedSecretsSnapshot = await ensureResolvableSecretRefsOrRespond({
510+config: parsed.config,
511+ respond,
512+});
513+if (!preparedSecretsSnapshot) {
501514return;
502515}
503516const changedPaths = diffConfigPaths(snapshot.config, parsed.config);
@@ -507,7 +520,12 @@ export const configHandlers: GatewayRequestHandlers = {
507520);
508521// Compare before the write so we invalidate clients authenticated against the
509522// previous shared secret immediately after the config update succeeds.
510-const disconnectSharedAuthClients = didSharedGatewayAuthChange(snapshot.config, parsed.config);
523+const disconnectSharedAuthClients =
524+didSharedGatewayAuthChange(snapshot.config, parsed.config) ||
525+didActiveSharedGatewayAuthChange({
526+fallbackPrev: snapshot.config,
527+next: preparedSecretsSnapshot.config,
528+});
511529const writeResult = await commitGatewayConfigWrite({
512530 snapshot,
513531 writeOptions,
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。