test: cover trusted-proxy secret surfaces · openclaw/open...

Recent Commits to openclaw:main

steipete · 2026-04-28 · via Recent Commits to openclaw:main

Original file line number	Diff line number	Diff line change
`@@ -139,7 +139,8 @@ export function createGatewayCredentialPlan(params: {`
`139`	`139`	`gateway?.tailscale?.mode === "serve" \|\| gateway?.tailscale?.mode === "funnel";`
`140`	`140`	`const remoteConfiguredSurface = remoteMode \|\| remoteUrlConfigured \|\| tailscaleRemoteExposure;`
`141`	`141`	`const remoteTokenFallbackActive = localTokenCanWin && !envToken && !localToken.configured;`
`142`		`-const remotePasswordFallbackActive = !envPassword && !localPassword.configured && passwordCanWin;`
	`142`	`+const remotePasswordFallbackActive =`
	`143`	`+authMode !== "trusted-proxy" && !envPassword && !localPassword.configured && passwordCanWin;`
`143`	`144`
`144`	`145`	`return {`
`145`	`146`	`configuredMode: gateway?.mode === "remote" ? "remote" : "local",`

Original file line number	Diff line number	Diff line change
`@@ -309,6 +309,28 @@ describe("resolveGatewayCredentialsFromConfig", () => {`
`309`	`309`	`});`
`310`	`310`	`});`
`311`	`311`
	`312`	`+it("does not use remote password as trusted-proxy local fallback", () => {`
	`313`	`+const resolved = resolveGatewayCredentialsFromConfig({`
	`314`	`+cfg: cfg({`
	`315`	`+gateway: {`
	`316`	`+mode: "local",`
	`317`	`+auth: {`
	`318`	`+mode: "trusted-proxy",`
	`319`	`+},`
	`320`	`+remote: {`
	`321`	`+password: "remote-password", // pragma: allowlist secret`
	`322`	`+},`
	`323`	`+},`
	`324`	`+}),`
	`325`	`+env: {} as NodeJS.ProcessEnv,`
	`326`	`+});`
	`327`	`+`
	`328`	`+expect(resolved).toEqual({`
	`329`	`+token: undefined,`
	`330`	`+password: undefined,`
	`331`	`+});`
	`332`	`+});`
	`333`	`+`
`312`	`334`	`it("keeps local credentials ahead of remote fallback in local mode", () => {`
`313`	`335`	`const resolved = resolveGatewayCredentialsFromConfig({`
`314`	`336`	`cfg: cfg({`

Original file line number	Diff line number	Diff line change
`@@ -110,7 +110,9 @@ function resolveLocalGatewayCredentials(params: {`
`110`	`110`	`: params.plan.remoteToken.value;`
`111`	`111`	`const fallbackPassword = params.plan.localPassword.configured`
`112`	`112`	`? params.plan.localPassword.value`
`113`		`- : params.plan.remotePassword.value;`
	`113`	`+ : params.plan.authMode === "trusted-proxy"`
	`114`	`+ ? undefined`
	`115`	`+ : params.plan.remotePassword.value;`
`114`	`116`	`const localResolved = resolveGatewayCredentialsFromValues({`
`115`	`117`	`configToken: fallbackToken,`
`116`	`118`	`configPassword: fallbackPassword,`

Original file line number	Diff line number	Diff line change
`@@ -87,6 +87,23 @@ describe("evaluateGatewayAuthSurfaceStates", () => {`
`87`	`87`	`});`
`88`	`88`	`});`
`89`	`89`
	`90`	`+it("marks gateway.auth.password active when trusted-proxy mode is explicit", () => {`
	`91`	`+const states = evaluate({`
	`92`	`+gateway: {`
	`93`	`+auth: {`
	`94`	`+mode: "trusted-proxy",`
	`95`	`+password: envRef("GW_AUTH_PASSWORD"),`
	`96`	`+},`
	`97`	`+},`
	`98`	`+} as OpenClawConfig);`
	`99`	`+`
	`100`	`+expect(states["gateway.auth.password"]).toMatchObject({`
	`101`	`+hasSecretRef: true,`
	`102`	`+active: true,`
	`103`	`+reason: "no token source can win, so password auth can win.",`
	`104`	`+});`
	`105`	`+});`
	`106`	`+`
`90`	`107`	`it("marks gateway.auth.password inactive when env token is configured", () => {`
`91`	`108`	`const states = evaluate(`
`92`	`109`	`{`
`@@ -197,4 +214,24 @@ describe("evaluateGatewayAuthSurfaceStates", () => {`
`197`	`214`	`reason: 'password auth cannot win with gateway.auth.mode="token".',`
`198`	`215`	`});`
`199`	`216`	`});`
	`217`	`+`
	`218`	`+it("marks gateway.remote.password inactive as a trusted-proxy local fallback", () => {`
	`219`	`+const states = evaluate({`
	`220`	`+gateway: {`
	`221`	`+mode: "local",`
	`222`	`+auth: {`
	`223`	`+mode: "trusted-proxy",`
	`224`	`+},`
	`225`	`+remote: {`
	`226`	`+password: envRef("GW_REMOTE_PASSWORD"),`
	`227`	`+},`
	`228`	`+},`
	`229`	`+} as OpenClawConfig);`
	`230`	`+`
	`231`	`+expect(states["gateway.remote.password"]).toMatchObject({`
	`232`	`+hasSecretRef: true,`
	`233`	`+active: false,`
	`234`	`+reason: "remote password fallback is not active.",`
	`235`	`+});`
	`236`	`+});`
`200`	`237`	`});`

Original file line number	Diff line number	Diff line change
`@@ -19,6 +19,20 @@ async function expectInactiveGatewayPassword(config: unknown): Promise<void> {`
`19`	`19`	`expect(snapshot.warnings.map((warning) => warning.path)).toContain("gateway.auth.password");`
`20`	`20`	`}`
`21`	`21`
	`22`	`+async function expectActiveGatewayPassword(config: unknown): Promise<void> {`
	`23`	`+const snapshot = await prepareSecretsRuntimeSnapshot({`
	`24`	`+config: asConfig(config),`
	`25`	`+env: {`
	`26`	`+GATEWAY_PASSWORD_REF: "resolved-gateway-password",`
	`27`	`+},`
	`28`	`+agentDirs: ["/tmp/openclaw-agent-main"],`
	`29`	`+loadAuthStore: () => ({ version: 1, profiles: {} }),`
	`30`	`+});`
	`31`	`+`
	`32`	`+expect(snapshot.config.gateway?.auth?.password).toBe("resolved-gateway-password");`
	`33`	`+expect(snapshot.warnings.map((warning) => warning.path)).not.toContain("gateway.auth.password");`
	`34`	`+}`
	`35`	`+`
`22`	`36`	`describe("secrets runtime gateway local surfaces", () => {`
`23`	`37`	`it("treats gateway.remote refs as inactive when local auth credentials are configured", async () => {`
`24`	`38`	`const snapshot = await prepareSecretsRuntimeSnapshot({`
`@@ -139,8 +153,8 @@ describe("secrets runtime gateway local surfaces", () => {`
`139`	`153`	`).rejects.toThrow(/MISSING_GATEWAY_TOKEN_REF/);`
`140`	`154`	`});`
`141`	`155`
`142`		`-it("treats gateway.auth.password ref as inactive when auth mode is trusted-proxy", async () => {`
`143`		`-await expectInactiveGatewayPassword({`
	`156`	`+it("treats gateway.auth.password ref as active when auth mode is trusted-proxy", async () => {`
	`157`	`+await expectActiveGatewayPassword({`
`144`	`158`	`gateway: {`
`145`	`159`	`auth: {`
`146`	`160`	`mode: "trusted-proxy",`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main