test: move gateway rpc/local suites out of e2e

src/gateway/server.talk-config.test.ts

@@ -0,0 +1,127 @@
+import { describe, expect, it } from "vitest";
+import {
+  connectOk,
+  installGatewayTestHooks,
+  readConnectChallengeNonce,
+  rpcReq,
+} from "./test-helpers.js";
+import { withServer } from "./test-with-server.js";
+
+installGatewayTestHooks({ scope: "suite" });
+
+async function createFreshOperatorDevice(scopes: string[], nonce: string) {
+  const { randomUUID } = await import("node:crypto");
+  const { tmpdir } = await import("node:os");
+  const { join } = await import("node:path");
+  const { buildDeviceAuthPayload } = await import("./device-auth.js");
+  const { loadOrCreateDeviceIdentity, publicKeyRawBase64UrlFromPem, signDevicePayload } =
+    await import("../infra/device-identity.js");
+
+  const identity = loadOrCreateDeviceIdentity(
+    join(tmpdir(), `openclaw-talk-config-${randomUUID()}.json`),
+  );
+  const signedAtMs = Date.now();
+  const payload = buildDeviceAuthPayload({
+    deviceId: identity.deviceId,
+    clientId: "test",
+    clientMode: "test",
+    role: "operator",
+    scopes,
+    signedAtMs,
+    token: "secret",
+    nonce,
+  });
+
+  return {
+    id: identity.deviceId,
+    publicKey: publicKeyRawBase64UrlFromPem(identity.publicKeyPem),
+    signature: signDevicePayload(identity.privateKeyPem, payload),
+    signedAt: signedAtMs,
+    nonce,
+  };
+}
+
+describe("gateway talk.config", () => {
+  it("returns redacted talk config for read scope", async () => {
+    const { writeConfigFile } = await import("../config/config.js");
+    await writeConfigFile({
+      talk: {
+        voiceId: "voice-123",
+        apiKey: "secret-key-abc",
+      },
+      session: {
+        mainKey: "main-test",
+      },
+      ui: {
+        seamColor: "#112233",
+      },
+    });
+
+    await withServer(async (ws) => {
+      const nonce = await readConnectChallengeNonce(ws);
+      expect(nonce).toBeTruthy();
+      await connectOk(ws, {
+        token: "secret",
+        scopes: ["operator.read"],
+        device: await createFreshOperatorDevice(["operator.read"], String(nonce)),
+      });
+      const res = await rpcReq<{ config?: { talk?: { apiKey?: string; voiceId?: string } } }>(
+        ws,
+        "talk.config",
+        {},
+      );
+      expect(res.ok).toBe(true);
+      expect(res.payload?.config?.talk?.voiceId).toBe("voice-123");
+      expect(res.payload?.config?.talk?.apiKey).toBe("__OPENCLAW_REDACTED__");
+    });
+  });
+
+  it("requires operator.talk.secrets for includeSecrets", async () => {
+    const { writeConfigFile } = await import("../config/config.js");
+    await writeConfigFile({
+      talk: {
+        apiKey: "secret-key-abc",
+      },
+    });
+
+    await withServer(async (ws) => {
+      const nonce = await readConnectChallengeNonce(ws);
+      expect(nonce).toBeTruthy();
+      await connectOk(ws, {
+        token: "secret",
+        scopes: ["operator.read"],
+        device: await createFreshOperatorDevice(["operator.read"], String(nonce)),
+      });
+      const res = await rpcReq(ws, "talk.config", { includeSecrets: true });
+      expect(res.ok).toBe(false);
+      expect(res.error?.message).toContain("missing scope: operator.talk.secrets");
+    });
+  });
+
+  it("returns secrets for operator.talk.secrets scope", async () => {
+    const { writeConfigFile } = await import("../config/config.js");
+    await writeConfigFile({
+      talk: {
+        apiKey: "secret-key-abc",
+      },
+    });
+
+    await withServer(async (ws) => {
+      const nonce = await readConnectChallengeNonce(ws);
+      expect(nonce).toBeTruthy();
+      await connectOk(ws, {
+        token: "secret",
+        scopes: ["operator.read", "operator.write", "operator.talk.secrets"],
+        device: await createFreshOperatorDevice(
+          ["operator.read", "operator.write", "operator.talk.secrets"],
+          String(nonce),
+        ),
+      });
+      const res = await rpcReq<{ config?: { talk?: { apiKey?: string } } }>(ws, "talk.config", {
+        includeSecrets: true,
+      });
+      expect(res.ok).toBe(true);
+      expect(res.payload?.config?.talk?.apiKey).toBe("secret-key-abc");
+    });
+  });
+});