fix(auth): accept oauthRef profiles for runtime auth · openclaw/openclaw@df4aac8

Recent Commits to openclaw:main

obviyus · 2026-05-14 · via Recent Commits to openclaw:main

Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,7 @@ import {`
`12`	`12`	`bridgeCodexAppServerStartOptions,`
`13`	`13`	`refreshCodexAppServerAuthTokens,`
`14`	`14`	`resolveCodexAppServerAuthAccountCacheKey,`
	`15`	`+resolveCodexAppServerAuthProfileId,`
`15`	`16`	`resolveCodexAppServerHomeDir,`
`16`	`17`	`resolveCodexAppServerNativeHomeDir,`
`17`	`18`	`} from "./auth-bridge.js";`
`@@ -651,6 +652,30 @@ describe("bridgeCodexAppServerStartOptions", () => {`
`651`	`652`	`}`
`652`	`653`	`});`
`653`	`654`
	`655`	`+it("selects an oauthRef-backed Codex profile for app-server login", () => {`
	`656`	`+expect(`
	`657`	`+resolveCodexAppServerAuthProfileId({`
	`658`	`+store: {`
	`659`	`+version: 1,`
	`660`	`+profiles: {`
	`661`	`+"openai-codex:default": {`
	`662`	`+type: "oauth",`
	`663`	`+provider: "openai-codex",`
	`664`	`+access: "",`
	`665`	`+refresh: "",`
	`666`	`+expires: Date.now() + 60_000,`
	`667`	`+oauthRef: {`
	`668`	`+source: "openclaw-credentials",`
	`669`	`+provider: "openai-codex",`
	`670`	`+id: "0123456789abcdef0123456789abcdef",`
	`671`	`+},`
	`672`	`+},`
	`673`	`+},`
	`674`	`+},`
	`675`	`+}),`
	`676`	`+).toBe("openai-codex:default");`
	`677`	`+});`
	`678`	`+`
`654`	`679`	`it("applies native Codex CLI OAuth when no OpenClaw auth profile exists", async () => {`
`655`	`680`	`const root = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-codex-app-server-"));`
`656`	`681`	`const agentDir = path.join(root, "agent");`

Original file line number	Diff line number	Diff line change
`@@ -103,4 +103,23 @@ describe("evaluateStoredCredentialEligibility", () => {`
`103`	`103`	`});`
`104`	`104`	`expect(result).toEqual({ eligible: false, reasonCode: "invalid_expires" });`
`105`	`105`	`});`
	`106`	`+`
	`107`	`+it("marks oauth with oauthRef as eligible", () => {`
	`108`	`+const result = evaluateStoredCredentialEligibility({`
	`109`	`+credential: {`
	`110`	`+type: "oauth",`
	`111`	`+provider: "openai-codex",`
	`112`	`+access: "",`
	`113`	`+refresh: "",`
	`114`	`+expires: now + 60_000,`
	`115`	`+oauthRef: {`
	`116`	`+source: "openclaw-credentials",`
	`117`	`+provider: "openai-codex",`
	`118`	`+id: "0123456789abcdef0123456789abcdef",`
	`119`	`+},`
	`120`	`+},`
	`121`	`+ now,`
	`122`	`+});`
	`123`	`+expect(result).toEqual({ eligible: true, reasonCode: "ok" });`
	`124`	`+});`
`106`	`125`	`});`

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,5 @@`
`1`	`1`	`import { coerceSecretRef, normalizeSecretInputString } from "../../config/types.secrets.js";`
`2`		`-import type { AuthProfileCredential, OAuthCredential } from "./types.js";`
	`2`	`+import type { AuthProfileCredential, OAuthCredential, OAuthCredentialRef } from "./types.js";`
`3`	`3`
`4`	`4`	`export type AuthCredentialReasonCode =`
`5`	`5`	`\| "ok"`
`@@ -69,6 +69,15 @@ function hasConfiguredSecretString(value: unknown): boolean {`
`69`	`69`	`return normalizeSecretInputString(value) !== undefined;`
`70`	`70`	`}`
`71`	`71`
	`72`	`+function hasConfiguredOAuthRef(value: OAuthCredentialRef \| undefined): boolean {`
	`73`	`+return (`
	`74`	`+value?.source === "openclaw-credentials" &&`
	`75`	`+value.provider === "openai-codex" &&`
	`76`	`+typeof value.id === "string" &&`
	`77`	`+/^[a-f0-9]{32}$/.test(value.id)`
	`78`	`+);`
	`79`	`+}`
	`80`	`+`
`72`	`81`	`export function evaluateStoredCredentialEligibility(params: {`
`73`	`82`	`credential: AuthProfileCredential;`
`74`	`83`	`now?: number;`
`@@ -104,7 +113,8 @@ export function evaluateStoredCredentialEligibility(params: {`
`104`	`113`
`105`	`114`	`if (`
`106`	`115`	`normalizeSecretInputString(credential.access) === undefined &&`
`107`		`-normalizeSecretInputString(credential.refresh) === undefined`
	`116`	`+normalizeSecretInputString(credential.refresh) === undefined &&`
	`117`	`+!hasConfiguredOAuthRef(credential.oauthRef)`
`108`	`118`	`) {`
`109`	`119`	`return { eligible: false, reasonCode: "missing_credential" };`
`110`	`120`	`}`

Original file line number	Diff line number	Diff line change
`@@ -276,6 +276,33 @@ describe("resolveAuthProfileOrder", () => {`
`276`	`276`	`expect(order).toEqual(["openai-codex:personal", "openai:backup"]);`
`277`	`277`	`});`
`278`	`278`
	`279`	`+it("lets Codex auth discover oauthRef-backed OAuth profiles", async () => {`
	`280`	`+const store: AuthProfileStore = {`
	`281`	`+version: 1,`
	`282`	`+profiles: {`
	`283`	`+"openai-codex:personal": {`
	`284`	`+type: "oauth",`
	`285`	`+provider: "openai-codex",`
	`286`	`+access: "",`
	`287`	`+refresh: "",`
	`288`	`+expires: Date.now() + 60_000,`
	`289`	`+oauthRef: {`
	`290`	`+source: "openclaw-credentials",`
	`291`	`+provider: "openai-codex",`
	`292`	`+id: "0123456789abcdef0123456789abcdef",`
	`293`	`+},`
	`294`	`+},`
	`295`	`+},`
	`296`	`+};`
	`297`	`+`
	`298`	`+const order = resolveAuthProfileOrder({`
	`299`	`+ store,`
	`300`	`+provider: "openai-codex",`
	`301`	`+});`
	`302`	`+`
	`303`	`+expect(order).toEqual(["openai-codex:personal"]);`
	`304`	`+});`
	`305`	`+`
`279`	`306`	`it("preserves native Codex profiles before OpenAI alias API-key order", async () => {`
`280`	`307`	`const store: AuthProfileStore = {`
`281`	`308`	`version: 1,`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。