resolveGatewayAuthTokenForService,

shouldRequireGatewayTokenForInstall,

} from "./doctor-gateway-auth-token.js";

import { resolveGatewayInstallToken } from "./gateway-install-token.js";

const envVar = (...parts: string[]) => parts.join("_");

);

expect(required).toBe(true);

});

it("blocks install token resolution for tailscale serve with explicit no-auth", async () => {

const resolved = await resolveGatewayInstallToken({

config: {

gateway: {

auth: { mode: "none" },

tailscale: { mode: "serve" },

},

} as OpenClawConfig,

env: {} as NodeJS.ProcessEnv,

});

expect(resolved.token).toBeUndefined();

expect(resolved.unavailableReason).toBe(

"gateway.auth.mode=none cannot be used with gateway.tailscale.mode=serve; configure token, password, or trusted-proxy auth before exposing the gateway through Tailscale",

);

});

});

import { hasAmbiguousGatewayAuthModeConfig } from "../gateway/auth-mode-policy.js";

import { resolveGatewayAuthToken } from "../gateway/auth-token-resolution.js";

import { resolveGatewayAuth } from "../gateway/auth.js";

import {

formatUnsafeGatewayTailscaleNoAuthMessage,

isUnsafeGatewayTailscaleNoAuth,

} from "../shared/gateway-tailscale-auth-policy.js";

import { normalizeOptionalString } from "../shared/string-coerce.js";

import {

readConfigFileSnapshotForWrite,

env: options.env,

tailscaleMode: cfg.gateway?.tailscale?.mode ?? "off",

});

const tailscaleMode = cfg.gateway?.tailscale?.mode ?? "off";

if (isUnsafeGatewayTailscaleNoAuth({ authMode: resolvedAuth.mode, tailscaleMode })) {

return {

token: undefined,

tokenRefConfigured: false,

unavailableReason: formatUnsafeGatewayTailscaleNoAuthMessage(tailscaleMode),

warnings,

};

}

const needsToken =

shouldRequireGatewayTokenForInstall(cfg, options.env) && !resolvedAuth.allowTailscale;

if (!needsToken) {

expect(funnelRes.ok).toBe(true);

});

it("rejects explicit no-auth when tailscale serve or funnel exposes the gateway", () => {

const serveRes = validateConfigObject({

gateway: {

bind: "loopback",

auth: { mode: "none" },

tailscale: { mode: "serve" },

},

});

expect(serveRes.ok).toBe(false);

if (!serveRes.ok) {

expect(serveRes.issues).toEqual([

{

path: "gateway.auth.mode",

message:

"gateway.auth.mode=none cannot be used with gateway.tailscale.mode=serve; configure token, password, or trusted-proxy auth before exposing the gateway through Tailscale",

},

]);

}

const funnelRes = validateConfigObject({

gateway: {

bind: "loopback",

auth: { mode: "none" },

tailscale: { mode: "funnel" },

},

});

expect(funnelRes.ok).toBe(false);

if (!funnelRes.ok) {

expect(funnelRes.issues).toEqual([

{

path: "gateway.auth.mode",

message:

"gateway.tailscale.mode=funnel requires gateway.auth.mode=password; auth.mode=none cannot be used when exposing the gateway through Tailscale Funnel",

},

]);

}

});

it("allows explicit no-auth for loopback-only gateway config", () => {

const res = validateConfigObject({

gateway: {

bind: "loopback",

auth: { mode: "none" },

tailscale: { mode: "off" },

},

});

expect(res.ok).toBe(true);

});

it("accepts custom loopback bind host with tailscale serve/funnel", () => {

const res = validateConfigObject({

gateway: {

isPathWithinRoot,

isWindowsAbsolutePath,

} from "../shared/avatar-policy.js";

import {

formatUnsafeGatewayTailscaleNoAuthMessage,

isUnsafeGatewayTailscaleNoAuth,

} from "../shared/gateway-tailscale-auth-policy.js";

import { isCanonicalDottedDecimalIPv4, isLoopbackIpAddress } from "../shared/net/ip.js";

import { normalizeLowercaseStringOrEmpty } from "../shared/string-coerce.js";

import { isRecord, resolveUserPath } from "../utils.js";

];

}

function validateGatewayTailscaleAuth(config: OpenClawConfig): ConfigValidationIssue[] {

const tailscaleMode = config.gateway?.tailscale?.mode ?? "off";

if (!isUnsafeGatewayTailscaleNoAuth({ authMode: config.gateway?.auth?.mode, tailscaleMode })) {

return [];

}

return [

{

path: "gateway.auth.mode",

message: formatUnsafeGatewayTailscaleNoAuthMessage(tailscaleMode),

},

];

}

/**

* Validates config without applying runtime defaults.

* Use this when you need the raw validated config (e.g., for writing back to file).

if (gatewayTailscaleBindIssues.length > 0) {

return { ok: false, issues: gatewayTailscaleBindIssues };

}

const gatewayTailscaleAuthIssues = validateGatewayTailscaleAuth(validatedConfig);

if (gatewayTailscaleAuthIssues.length > 0) {

return { ok: false, issues: gatewayTailscaleAuthIssues };

}

return {

ok: true,

config: validatedConfig,

).rejects.toThrow(/refusing to bind gateway/);

});

it("rejects tailscale serve with explicit no-auth", async () => {

await expect(

resolveGatewayRuntimeConfig({

cfg: {

gateway: {

auth: { mode: "none" },

tailscale: { mode: "serve" },

},

},

port: 18789,

}),

).rejects.toThrow("gateway.auth.mode=none cannot be used with gateway.tailscale.mode=serve");

});

it("respects explicit loopback config even inside a container", async () => {

const fs = require("node:fs");

vi.spyOn(fs, "accessSync").mockImplementation(() => undefined); // /.dockerenv exists

const result = await resolveGatewayRuntimeConfig({

cfg: {

gateway: {

auth: { mode: "none" },

auth: TOKEN_AUTH,

tailscale: { mode: "serve" },

},

},

GatewayTailscaleConfig,

} from "../config/types.gateway.js";

import type { OpenClawConfig } from "../config/types.openclaw.js";

import {

formatUnsafeGatewayTailscaleNoAuthMessage,

isUnsafeGatewayTailscaleNoAuth,

} from "../shared/gateway-tailscale-auth-policy.js";

import {

assertGatewayAuthConfigured,

type ResolvedGatewayAuth,

"tailscale funnel requires gateway auth mode=password (set gateway.auth.password or OPENCLAW_GATEWAY_PASSWORD)",

);

}

if (isUnsafeGatewayTailscaleNoAuth({ authMode, tailscaleMode })) {

throw new Error(formatUnsafeGatewayTailscaleNoAuthMessage(tailscaleMode));

}

if (tailscaleMode !== "off" && !isLoopbackHost(bindHost)) {

throw new Error("tailscale serve/funnel requires gateway bind=loopback (127.0.0.1)");

}

import type { GatewayAuthMode, GatewayTailscaleMode } from "../config/types.gateway.js";

export function isUnsafeGatewayTailscaleNoAuth(params: {

authMode?: GatewayAuthMode;

tailscaleMode?: GatewayTailscaleMode;

}): boolean {

return (

params.authMode === "none" &&

(params.tailscaleMode === "serve" || params.tailscaleMode === "funnel")

);

}

export function formatUnsafeGatewayTailscaleNoAuthMessage(

tailscaleMode: GatewayTailscaleMode,

): string {

if (tailscaleMode === "funnel") {

return "gateway.tailscale.mode=funnel requires gateway.auth.mode=password; auth.mode=none cannot be used when exposing the gateway through Tailscale Funnel";

}

return `gateway.auth.mode=none cannot be used with gateway.tailscale.mode=${tailscaleMode}; configure token, password, or trusted-proxy auth before exposing the gateway through Tailscale`;

}