fix(agents): redact oauth refresh errors · openclaw/openclaw@c818a9f

Recent Commits to openclaw:main

vincentkoc · 2026-05-17 · via Recent Commits to openclaw:main

Original file line number	Diff line number	Diff line change
`@@ -153,6 +153,40 @@ describe("OAuthManagerRefreshError", () => {`
`153`	`153`	`expect(serialized).not.toContain("store-access");`
`154`	`154`	`expect(serialized).not.toContain("store-refresh");`
`155`	`155`	`});`
	`156`	`+`
	`157`	`+it("redacts credential secrets from the refresh error message", () => {`
	`158`	`+const refreshedStore: AuthProfileStore = {`
	`159`	`+version: 1,`
	`160`	`+profiles: {`
	`161`	`+"openai-codex:default": createCredential({`
	`162`	`+access: "store-access",`
	`163`	`+refresh: "store-refresh",`
	`164`	`+idToken: "store-id-token",`
	`165`	`+}),`
	`166`	`+},`
	`167`	`+};`
	`168`	`+const error = new OAuthManagerRefreshError({`
	`169`	`+credential: createCredential({`
	`170`	`+access: "error-access",`
	`171`	`+refresh: "error-refresh",`
	`172`	`+idToken: "error-id-token",`
	`173`	`+}),`
	`174`	`+profileId: "openai-codex:default",`
	`175`	`+ refreshedStore,`
	`176`	`+cause: new Error(`
	`177`	`+"refresh rejected error-access error-refresh error-id-token store-access store-refresh store-id-token",`
	`178`	`+),`
	`179`	`+});`
	`180`	`+`
	`181`	`+expect(error.message).toContain("refresh rejected");`
	`182`	`+expect(error.message).not.toContain("error-access");`
	`183`	`+expect(error.message).not.toContain("error-refresh");`
	`184`	`+expect(error.message).not.toContain("error-id-token");`
	`185`	`+expect(error.message).not.toContain("store-access");`
	`186`	`+expect(error.message).not.toContain("store-refresh");`
	`187`	`+expect(error.message).not.toContain("store-id-token");`
	`188`	`+expect(error.message.match(/\[redacted\]/g)?.length).toBe(6);`
	`189`	`+});`
`156`	`190`	`});`
`157`	`191`
`158`	`192`	`describe("createOAuthManager", () => {`

Original file line number	Diff line number	Diff line change
`@@ -80,10 +80,17 @@ export class OAuthManagerRefreshError extends Error {`
`80`	`80`	`structuredCause?.code === "refresh_contention" && structuredCause.cause`
`81`	`81`	`? structuredCause.cause`
`82`	`82`	`: params.cause;`
`83`		`-super(`
`84`		-`OAuth token refresh failed for ${params.credential.provider}: ${formatErrorMessage(params.cause)}`,
`85`		`-{ cause: delegatedCause },`
	`83`	`+const storedCredential = params.refreshedStore.profiles[params.profileId];`
	`84`	`+const causeMessage = redactOAuthCredentialSecrets(`
	`85`	`+formatErrorMessage(params.cause),`
	`86`	`+collectOAuthCredentialSecrets(`
	`87`	`+params.credential,`
	`88`	`+storedCredential?.type === "oauth" ? storedCredential : undefined,`
	`89`	`+),`
`86`	`90`	`);`
	`91`	+super(`OAuth token refresh failed for ${params.credential.provider}: ${causeMessage}`, {
	`92`	`+cause: delegatedCause,`
	`93`	`+});`
`87`	`94`	`this.name = "OAuthManagerRefreshError";`
`88`	`95`	`this.#credential = params.credential;`
`89`	`96`	`this.profileId = params.profileId;`
`@@ -154,6 +161,28 @@ function canReuseOAuthCredentialAfterRefreshFailure(params: {`
`154`	`161`	`return !params.forceRefresh \|\| hasOAuthCredentialChanged(params.attempted, params.candidate);`
`155`	`162`	`}`
`156`	`163`
	`164`	`+function collectOAuthCredentialSecrets(`
	`165`	`+ ...credentials: Array<OAuthCredential \| undefined>`
	`166`	`+): string[] {`
	`167`	`+const secrets = new Set<string>();`
	`168`	`+for (const credential of credentials) {`
	`169`	`+for (const secret of [credential?.access, credential?.refresh, credential?.idToken]) {`
	`170`	`+if (secret) {`
	`171`	`+secrets.add(secret);`
	`172`	`+}`
	`173`	`+}`
	`174`	`+}`
	`175`	`+return Array.from(secrets);`
	`176`	`+}`
	`177`	`+`
	`178`	`+function redactOAuthCredentialSecrets(message: string, secrets: string[]): string {`
	`179`	`+let redacted = message;`
	`180`	`+for (const secret of secrets) {`
	`181`	`+redacted = redacted.split(secret).join("[redacted]");`
	`182`	`+}`
	`183`	`+return redacted;`
	`184`	`+}`
	`185`	`+`
`157`	`186`	`async function loadFreshStoredOAuthCredential(params: {`
`158`	`187`	`profileId: string;`
`159`	`188`	`agentDir?: string;`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main