github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-08 06:41:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(core): dedupe shared config and runtime helpers

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-16 14:52:03 +00:00
parent 544ffbcf7b
commit 04892ee230
68 changed files with 1966 additions and 2018 deletions
Download Patch File Download Diff File Expand all files Collapse all files

169
src/security/fix.test.ts
View File

@@ -24,6 +24,47 @@ describe("security fix", () => {
return dir;
};
const createFixEnv = (stateDir: string, configPath: string) => ({
...process.env,
OPENCLAW_STATE_DIR: stateDir,
OPENCLAW_CONFIG_PATH: configPath,
});
const writeJsonConfig = async (configPath: string, config: Record<string, unknown>) => {
await fs.writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf-8");
};
const writeWhatsAppConfig = async (configPath: string, whatsapp: Record<string, unknown>) => {
await writeJsonConfig(configPath, {
channels: {
whatsapp,
},
});
};
const readParsedConfig = async (configPath: string) =>
JSON.parse(await fs.readFile(configPath, "utf-8")) as Record<string, unknown>;
const runFixAndReadChannels = async (stateDir: string, configPath: string) => {
const env = createFixEnv(stateDir, configPath);
const res = await fixSecurityFootguns({ env, stateDir, configPath });
const parsed = await readParsedConfig(configPath);
return {
res,
channels: parsed.channels as Record<string, Record<string, unknown>>,
};
};
const writeWhatsAppAllowFromStore = async (stateDir: string, allowFrom: string[]) => {
const credsDir = path.join(stateDir, "credentials");
await fs.mkdir(credsDir, { recursive: true });
await fs.writeFile(
path.join(credsDir, "whatsapp-allowFrom.json"),
`${JSON.stringify({ version: 1, allowFrom }, null, 2)}\n`,
"utf-8",
);
};
beforeAll(async () => {
fixtureRoot = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-security-fix-suite-"));
});
@@ -39,39 +80,20 @@ describe("security fix", () => {
await fs.chmod(stateDir, 0o755);
const configPath = path.join(stateDir, "openclaw.json");
await fs.writeFile(
configPath,
`${JSON.stringify(
{
channels: {
telegram: { groupPolicy: "open" },
whatsapp: { groupPolicy: "open" },
discord: { groupPolicy: "open" },
signal: { groupPolicy: "open" },
imessage: { groupPolicy: "open" },
},
logging: { redactSensitive: "off" },
},
null,
2,
)}\n`,
"utf-8",
);
await writeJsonConfig(configPath, {
channels: {
telegram: { groupPolicy: "open" },
whatsapp: { groupPolicy: "open" },
discord: { groupPolicy: "open" },
signal: { groupPolicy: "open" },
imessage: { groupPolicy: "open" },
},
logging: { redactSensitive: "off" },
});
await fs.chmod(configPath, 0o644);
const credsDir = path.join(stateDir, "credentials");
await fs.mkdir(credsDir, { recursive: true });
await fs.writeFile(
path.join(credsDir, "whatsapp-allowFrom.json"),
`${JSON.stringify({ version: 1, allowFrom: [" +15551234567 "] }, null, 2)}\n`,
"utf-8",
);
const env = {
...process.env,
OPENCLAW_STATE_DIR: stateDir,
OPENCLAW_CONFIG_PATH: configPath,
};
await writeWhatsAppAllowFromStore(stateDir, [" +15551234567 "]);
const env = createFixEnv(stateDir, configPath);
const res = await fixSecurityFootguns({ env, stateDir, configPath });
expect(res.ok).toBe(true);
@@ -93,7 +115,7 @@ describe("security fix", () => {
const configMode = (await fs.stat(configPath)).mode & 0o777;
expectPerms(configMode, 0o600);
const parsed = JSON.parse(await fs.readFile(configPath, "utf-8")) as Record<string, unknown>;
const parsed = await readParsedConfig(configPath);
const channels = parsed.channels as Record<string, Record<string, unknown>>;
expect(channels.telegram.groupPolicy).toBe("allowlist");
expect(channels.whatsapp.groupPolicy).toBe("allowlist");
@@ -108,43 +130,16 @@ describe("security fix", () => {
const stateDir = await createStateDir("per-account");
const configPath = path.join(stateDir, "openclaw.json");
await fs.writeFile(
configPath,
`${JSON.stringify(
{
channels: {
whatsapp: {
accounts: {
a1: { groupPolicy: "open" },
},
},
},
},
null,
2,
)}\n`,
"utf-8",
);
await writeWhatsAppConfig(configPath, {
accounts: {
a1: { groupPolicy: "open" },
},
});
const credsDir = path.join(stateDir, "credentials");
await fs.mkdir(credsDir, { recursive: true });
await fs.writeFile(
path.join(credsDir, "whatsapp-allowFrom.json"),
`${JSON.stringify({ version: 1, allowFrom: ["+15550001111"] }, null, 2)}\n`,
"utf-8",
);
const env = {
...process.env,
OPENCLAW_STATE_DIR: stateDir,
OPENCLAW_CONFIG_PATH: configPath,
};
const res = await fixSecurityFootguns({ env, stateDir, configPath });
await writeWhatsAppAllowFromStore(stateDir, ["+15550001111"]);
const { res, channels } = await runFixAndReadChannels(stateDir, configPath);
expect(res.ok).toBe(true);
const parsed = JSON.parse(await fs.readFile(configPath, "utf-8")) as Record<string, unknown>;
const channels = parsed.channels as Record<string, Record<string, unknown>>;
const whatsapp = channels.whatsapp;
const accounts = whatsapp.accounts as Record<string, Record<string, unknown>>;
@@ -156,39 +151,15 @@ describe("security fix", () => {
const stateDir = await createStateDir("no-seed");
const configPath = path.join(stateDir, "openclaw.json");
await fs.writeFile(
configPath,
`${JSON.stringify(
{
channels: {
whatsapp: { groupPolicy: "open", allowFrom: ["+15552223333"] },
},
},
null,
2,
)}\n`,
"utf-8",
);
await writeWhatsAppConfig(configPath, {
groupPolicy: "open",
allowFrom: ["+15552223333"],
});
const credsDir = path.join(stateDir, "credentials");
await fs.mkdir(credsDir, { recursive: true });
await fs.writeFile(
path.join(credsDir, "whatsapp-allowFrom.json"),
`${JSON.stringify({ version: 1, allowFrom: ["+15550001111"] }, null, 2)}\n`,
"utf-8",
);
const env = {
...process.env,
OPENCLAW_STATE_DIR: stateDir,
OPENCLAW_CONFIG_PATH: configPath,
};
const res = await fixSecurityFootguns({ env, stateDir, configPath });
await writeWhatsAppAllowFromStore(stateDir, ["+15550001111"]);
const { res, channels } = await runFixAndReadChannels(stateDir, configPath);
expect(res.ok).toBe(true);
const parsed = JSON.parse(await fs.readFile(configPath, "utf-8")) as Record<string, unknown>;
const channels = parsed.channels as Record<string, Record<string, unknown>>;
expect(channels.whatsapp.groupPolicy).toBe("allowlist");
expect(channels.whatsapp.groupAllowFrom).toBeUndefined();
});
@@ -201,11 +172,7 @@ describe("security fix", () => {
await fs.writeFile(configPath, "{ this is not json }\n", "utf-8");
await fs.chmod(configPath, 0o644);
const env = {
...process.env,
OPENCLAW_STATE_DIR: stateDir,
OPENCLAW_CONFIG_PATH: configPath,
};
const env = createFixEnv(stateDir, configPath);
const res = await fixSecurityFootguns({ env, stateDir, configPath });
expect(res.ok).toBe(false);