fix(auth): coerce persisted device auth tokens · openclaw/openclaw@9518d1f

Recent Commits to openclaw:main

vincentkoc · 2026-05-31 · via Recent Commits to openclaw:main

Original file line number	Diff line number	Diff line change
`@@ -77,6 +77,36 @@ describe("infra/device-auth-store", () => {`
`77`	`77`	`});`
`78`	`78`	`});`
`79`	`79`
	`80`	`+it("normalizes raw persisted token metadata while reading from disk", async () => {`
	`81`	`+await withTempDir("openclaw-device-auth-", async (stateDir) => {`
	`82`	`+const env = createEnv(stateDir);`
	`83`	`+await fs.mkdir(path.dirname(deviceAuthFile(stateDir)), { recursive: true });`
	`84`	`+await fs.writeFile(`
	`85`	`+deviceAuthFile(stateDir),`
	`86`	`+JSON.stringify({`
	`87`	`+version: 1,`
	`88`	`+deviceId: "device-1",`
	`89`	`+tokens: {`
	`90`	`+" operator ": {`
	`91`	`+token: "operator-token",`
	`92`	`+role: { nested: "bad" },`
	`93`	`+scopes: ["operator.write", "operator.read", 42],`
	`94`	`+updatedAtMs: "bad-time",`
	`95`	`+},`
	`96`	`+},`
	`97`	`+}) + "\n",`
	`98`	`+"utf8",`
	`99`	`+);`
	`100`	`+`
	`101`	`+expect(loadDeviceAuthToken({ deviceId: "device-1", role: "operator", env })).toEqual({`
	`102`	`+token: "operator-token",`
	`103`	`+role: "operator",`
	`104`	`+scopes: ["operator.read", "operator.write"],`
	`105`	`+updatedAtMs: 0,`
	`106`	`+});`
	`107`	`+});`
	`108`	`+});`
	`109`	`+`
`80`	`110`	`it("clears only the requested role and leaves unrelated tokens intact", async () => {`
`81`	`111`	`await withTempDir("openclaw-device-auth-", async (stateDir) => {`
`82`	`112`	`const env = createEnv(stateDir);`

Original file line number	Diff line number	Diff line change
`@@ -3,62 +3,19 @@ import path from "node:path";`
`3`	`3`	`import { resolveStateDir } from "../config/paths.js";`
`4`	`4`	`import {`
`5`	`5`	`clearDeviceAuthTokenFromStore,`
	`6`	`+coerceDeviceAuthStore,`
`6`	`7`	`type DeviceAuthEntry,`
	`8`	`+type DeviceAuthStore,`
`7`	`9`	`loadDeviceAuthTokenFromStore,`
`8`	`10`	`storeDeviceAuthTokenInStore,`
`9`	`11`	`} from "../shared/device-auth-store.js";`
`10`		`-import type { DeviceAuthStore } from "../shared/device-auth.js";`
`11`	`12`	`import { privateFileStoreSync } from "./private-file-store.js";`
`12`	`13`
`13`	`14`	`const DEVICE_AUTH_FILE = "device-auth.json";`
`14`	`15`
`15`	`16`	`type StoreCacheEntry = { store: DeviceAuthStore \| null; mtimeMs: number; size: number };`
`16`	`17`	`const storeReadCache = new Map<string, StoreCacheEntry>();`
`17`	`18`
`18`		`-function isRecord(value: unknown): value is Record<string, unknown> {`
`19`		`-return Boolean(value) && typeof value === "object" && !Array.isArray(value);`
`20`		`-}`
`21`		`-`
`22`		`-function parseDeviceAuthEntry(role: string, value: unknown): DeviceAuthEntry \| null {`
`23`		`-if (`
`24`		`-!isRecord(value) \|\|`
`25`		`-typeof value.token !== "string" \|\|`
`26`		`-!Array.isArray(value.scopes) \|\|`
`27`		`-!value.scopes.every((scope) => typeof scope === "string") \|\|`
`28`		`-typeof value.updatedAtMs !== "number" \|\|`
`29`		`-!Number.isFinite(value.updatedAtMs)`
`30`		`-) {`
`31`		`-return null;`
`32`		`-}`
`33`		`-return {`
`34`		`-token: value.token,`
`35`		`- role,`
`36`		`-scopes: value.scopes,`
`37`		`-updatedAtMs: value.updatedAtMs,`
`38`		`-};`
`39`		`-}`
`40`		`-`
`41`		`-function parseDeviceAuthStore(value: unknown): DeviceAuthStore \| null {`
`42`		`-if (!isRecord(value) \|\| value.version !== 1 \|\| typeof value.deviceId !== "string") {`
`43`		`-return null;`
`44`		`-}`
`45`		`-if (!isRecord(value.tokens)) {`
`46`		`-return null;`
`47`		`-}`
`48`		`-const tokens: Record<string, DeviceAuthEntry> = {};`
`49`		`-for (const [role, rawEntry] of Object.entries(value.tokens)) {`
`50`		`-const entry = parseDeviceAuthEntry(role, rawEntry);`
`51`		`-if (entry) {`
`52`		`-tokens[role] = entry;`
`53`		`-}`
`54`		`-}`
`55`		`-return {`
`56`		`-version: 1,`
`57`		`-deviceId: value.deviceId,`
`58`		`- tokens,`
`59`		`-};`
`60`		`-}`
`61`		`-`
`62`	`19`	`function storeCacheHit(`
`63`	`20`	`cached: StoreCacheEntry \| undefined,`
`64`	`21`	`stat: { mtimeMs: number; size: number },`
`@@ -90,7 +47,7 @@ function readStore(filePath: string): DeviceAuthStore \| null {`
`90`	`47`	`const parsed = privateFileStoreSync(path.dirname(filePath)).readJsonIfExists(`
`91`	`48`	`path.basename(filePath),`
`92`	`49`	`);`
`93`		`-const store = parseDeviceAuthStore(parsed);`
	`50`	`+const store = coerceDeviceAuthStore(parsed);`
`94`	`51`	`storeReadCache.set(filePath, { store, mtimeMs: stat.mtimeMs, size: stat.size });`
`95`	`52`	`return store;`
`96`	`53`	`} catch {`

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,7 @@`
`1`	`1`	`import { describe, expect, it, vi } from "vitest";`
`2`	`2`	`import {`
`3`	`3`	`clearDeviceAuthTokenFromStore,`
	`4`	`+coerceDeviceAuthStore,`
`4`	`5`	`loadDeviceAuthTokenFromStore,`
`5`	`6`	`storeDeviceAuthTokenInStore,`
`6`	`7`	`type DeviceAuthStoreAdapter,`
`@@ -113,6 +114,43 @@ describe("device-auth-store", () => {`
`113`	`114`	`});`
`114`	`115`	`});`
`115`	`116`
	`117`	`+it("coerces raw persisted stores into canonical token maps", () => {`
	`118`	`+expect(`
	`119`	`+coerceDeviceAuthStore({`
	`120`	`+version: 1,`
	`121`	`+deviceId: "device-1",`
	`122`	`+tokens: {`
	`123`	`+" operator ": {`
	`124`	`+token: "operator-token",`
	`125`	`+role: { nested: "bad" },`
	`126`	`+scopes: ["operator.write", "operator.read", 42],`
	`127`	`+updatedAtMs: "bad-time",`
	`128`	`+},`
	`129`	`+broken: {`
	`130`	`+token: 123,`
	`131`	`+role: "broken",`
	`132`	`+scopes: [],`
	`133`	`+updatedAtMs: 1,`
	`134`	`+},`
	`135`	`+},`
	`136`	`+}),`
	`137`	`+).toEqual({`
	`138`	`+version: 1,`
	`139`	`+deviceId: "device-1",`
	`140`	`+tokens: {`
	`141`	`+operator: {`
	`142`	`+token: "operator-token",`
	`143`	`+role: "operator",`
	`144`	`+scopes: ["operator.read", "operator.write"],`
	`145`	`+updatedAtMs: 0,`
	`146`	`+},`
	`147`	`+},`
	`148`	`+});`
	`149`	`+`
	`150`	`+expect(coerceDeviceAuthStore({ version: 2, deviceId: "device-1", tokens: {} })).toBeNull();`
	`151`	`+expect(coerceDeviceAuthStore({ version: 1, deviceId: "device-1", tokens: [] })).toBeNull();`
	`152`	`+});`
	`153`	`+`
`116`	`154`	`it("stores normalized roles and deduped sorted scopes while preserving same-device tokens", () => {`
`117`	`155`	`vi.spyOn(Date, "now").mockReturnValue(1234);`
`118`	`156`	`const { adapter, writes, readStore } = createAdapter({`

Original file line number	Diff line number	Diff line change
`@@ -45,6 +45,20 @@ function copyCanonicalDeviceAuthTokens(`
`45`	`45`	`return out;`
`46`	`46`	`}`
`47`	`47`
	`48`	`+export function coerceDeviceAuthStore(value: unknown): DeviceAuthStore \| null {`
	`49`	`+if (!isRecord(value) \|\| value.version !== 1 \|\| typeof value.deviceId !== "string") {`
	`50`	`+return null;`
	`51`	`+}`
	`52`	`+if (!isRecord(value.tokens)) {`
	`53`	`+return null;`
	`54`	`+}`
	`55`	`+return {`
	`56`	`+version: 1,`
	`57`	`+deviceId: value.deviceId,`
	`58`	`+tokens: copyCanonicalDeviceAuthTokens(value.tokens),`
	`59`	`+};`
	`60`	`+}`
	`61`	`+`
`48`	`62`	`export function loadDeviceAuthTokenFromStore(params: {`
`49`	`63`	`adapter: DeviceAuthStoreAdapter;`
`50`	`64`	`deviceId: string;`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main