mirror of
https://github.com/openclaw/openclaw.git
synced 2026-05-09 09:07:39 +00:00
feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)
* feat(secrets): expand secret target coverage and gateway tooling * docs(secrets): align gateway and CLI secret docs * chore(protocol): regenerate swift gateway models for secrets methods * fix(config): restore talk apiKey fallback and stabilize runner test * ci(windows): reduce test worker count for shard stability * ci(windows): raise node heap for test shard stability * test(feishu): make proxy env precedence assertion windows-safe * fix(gateway): resolve auth password SecretInput refs for clients * fix(gateway): resolve remote SecretInput credentials for clients * fix(secrets): skip inactive refs in command snapshot assignments * fix(secrets): scope gateway.remote refs to effective auth surfaces * fix(secrets): ignore memory defaults when enabled agents disable search * fix(secrets): honor Google Chat serviceAccountRef inheritance * fix(secrets): address tsgo errors in command and gateway collectors * fix(secrets): avoid auth-store load in providers-only configure * fix(gateway): defer local password ref resolution by precedence * fix(secrets): gate telegram webhook secret refs by webhook mode * fix(secrets): gate slack signing secret refs to http mode * fix(secrets): skip telegram botToken refs when tokenFile is set * fix(secrets): gate discord pluralkit refs by enabled flag * fix(secrets): gate discord voice tts refs by voice enabled * test(secrets): make runtime fixture modes explicit * fix(cli): resolve local qr password secret refs * fix(cli): fail when gateway leaves command refs unresolved * fix(gateway): fail when local password SecretRef is unresolved * fix(gateway): fail when required remote SecretRefs are unresolved * fix(gateway): resolve local password refs only when password can win * fix(cli): skip local password SecretRef resolution on qr token override * test(gateway): cast SecretRef fixtures to OpenClawConfig * test(secrets): activate mode-gated targets in runtime coverage fixture * fix(cron): support SecretInput webhook tokens safely * fix(bluebubbles): support SecretInput passwords across config paths * fix(msteams): make appPassword SecretInput-safe in onboarding/token paths * fix(bluebubbles): align SecretInput schema helper typing * fix(cli): clarify secrets.resolve version-skew errors * refactor(secrets): return structured inactive paths from secrets.resolve * refactor(gateway): type onboarding secret writes as SecretInput * chore(protocol): regenerate swift models for secrets.resolve * feat(secrets): expand extension credential secretref support * fix(secrets): gate web-search refs by active provider * fix(onboarding): detect SecretRef credentials in extension status * fix(onboarding): allow keeping existing ref in secret prompt * fix(onboarding): resolve gateway password SecretRefs for probe and tui * fix(onboarding): honor secret-input-mode for local gateway auth * fix(acp): resolve gateway SecretInput credentials * fix(secrets): gate gateway.remote refs to remote surfaces * test(secrets): cover pattern matching and inactive array refs * docs(secrets): clarify secrets.resolve and remote active surfaces * fix(bluebubbles): keep existing SecretRef during onboarding * fix(tests): resolve CI type errors in new SecretRef coverage * fix(extensions): replace raw fetch with SSRF-guarded fetch * test(secrets): mark gateway remote targets active in runtime coverage * test(infra): normalize home-prefix expectation across platforms * fix(cli): only resolve local qr password refs in password mode * test(cli): cover local qr token mode with unresolved password ref * docs(cli): clarify local qr password ref resolution behavior * refactor(extensions): reuse sdk SecretInput helpers * fix(wizard): resolve onboarding env-template secrets before plaintext * fix(cli): surface secrets.resolve diagnostics in memory and qr * test(secrets): repair post-rebase runtime and fixtures * fix(gateway): skip remote password ref resolution when token wins * fix(secrets): treat tailscale remote gateway refs as active * fix(gateway): allow remote password fallback when token ref is unresolved * fix(gateway): ignore stale local password refs for none and trusted-proxy * fix(gateway): skip remote secret ref resolution on local call paths * test(cli): cover qr remote tailscale secret ref resolution * fix(secrets): align gateway password active-surface with auth inference * fix(cli): resolve inferred local gateway password refs in qr * fix(gateway): prefer resolvable remote password over token ref pre-resolution * test(gateway): cover none and trusted-proxy stale password refs * docs(secrets): sync qr and gateway active-surface behavior * fix: restore stability blockers from pre-release audit * Secrets: fix collector/runtime precedence contradictions * docs: align secrets and web credential docs * fix(rebase): resolve integration regressions after main rebase * fix(node-host): resolve gateway secret refs for auth * fix(secrets): harden secretinput runtime readers * gateway: skip inactive auth secretref resolution * cli: avoid gateway preflight for inactive secret refs * extensions: allow unresolved refs in onboarding status * tests: fix qr-cli module mock hoist ordering * Security: align audit checks with SecretInput resolution * Gateway: resolve local-mode remote fallback secret refs * Node host: avoid resolving inactive password secret refs * Secrets runtime: mark Slack appToken inactive for HTTP mode * secrets: keep inactive gateway remote refs non-blocking * cli: include agent memory secret targets in runtime resolution * docs(secrets): sync docs with active-surface and web search behavior * fix(secrets): keep telegram top-level token refs active for blank account tokens * fix(daemon): resolve gateway password secret refs for probe auth * fix(secrets): skip IRC NickServ ref resolution when NickServ is disabled * fix(secrets): align token inheritance and exec timeout defaults * docs(secrets): clarify active-surface notes in cli docs * cli: require secrets.resolve gateway capability * gateway: log auth secret surface diagnostics * secrets: remove dead provider resolver module * fix(secrets): restore gateway auth precedence and fallback resolution * fix(tests): align plugin runtime mock typings --------- Co-authored-by: Peter Steinberger <steipete@gmail.com>
This commit is contained in:
Josh Avant
@@ -20,6 +20,7 @@ export type SetupChannelsOptions = {
|
||||
skipConfirm?: boolean;
|
||||
quickstartDefaults?: boolean;
|
||||
initialSelection?: ChannelId[];
|
||||
secretInputMode?: "plaintext" | "ref";
|
||||
};
|
||||
|
||||
export type PromptAccountIdParams = {
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
import type { OpenClawConfig } from "../../../config/config.js";
|
||||
import type { DiscordGuildEntry } from "../../../config/types.discord.js";
|
||||
import { hasConfiguredSecretInput } from "../../../config/types.secrets.js";
|
||||
import {
|
||||
listDiscordAccountIds,
|
||||
resolveDefaultDiscordAccountId,
|
||||
@@ -23,7 +24,7 @@ import {
|
||||
noteChannelLookupSummary,
|
||||
patchChannelConfigForAccount,
|
||||
promptLegacyChannelAllowFrom,
|
||||
promptSingleChannelToken,
|
||||
promptSingleChannelSecretInput,
|
||||
resolveAccountIdForConfigure,
|
||||
resolveOnboardingAccountId,
|
||||
setAccountGroupPolicyForChannel,
|
||||
@@ -146,9 +147,10 @@ const dmPolicy: ChannelOnboardingDmPolicy = {
|
||||
export const discordOnboardingAdapter: ChannelOnboardingAdapter = {
|
||||
channel,
|
||||
getStatus: async ({ cfg }) => {
|
||||
const configured = listDiscordAccountIds(cfg).some((accountId) =>
|
||||
Boolean(resolveDiscordAccount({ cfg, accountId }).token),
|
||||
);
|
||||
const configured = listDiscordAccountIds(cfg).some((accountId) => {
|
||||
const account = resolveDiscordAccount({ cfg, accountId });
|
||||
return Boolean(account.token) || hasConfiguredSecretInput(account.config.token);
|
||||
});
|
||||
return {
|
||||
channel,
|
||||
configured,
|
||||
@@ -157,7 +159,7 @@ export const discordOnboardingAdapter: ChannelOnboardingAdapter = {
|
||||
quickstartScore: configured ? 2 : 1,
|
||||
};
|
||||
},
|
||||
configure: async ({ cfg, prompter, accountOverrides, shouldPromptAccountIds }) => {
|
||||
configure: async ({ cfg, prompter, options, accountOverrides, shouldPromptAccountIds }) => {
|
||||
const defaultDiscordAccountId = resolveDefaultDiscordAccountId(cfg);
|
||||
const discordAccountId = await resolveAccountIdForConfigure({
|
||||
cfg,
|
||||
@@ -174,33 +176,50 @@ export const discordOnboardingAdapter: ChannelOnboardingAdapter = {
|
||||
cfg: next,
|
||||
accountId: discordAccountId,
|
||||
});
|
||||
const accountConfigured = Boolean(resolvedAccount.token);
|
||||
const hasConfigToken = hasConfiguredSecretInput(resolvedAccount.config.token);
|
||||
const accountConfigured = Boolean(resolvedAccount.token) || hasConfigToken;
|
||||
const allowEnv = discordAccountId === DEFAULT_ACCOUNT_ID;
|
||||
const canUseEnv =
|
||||
allowEnv && !resolvedAccount.config.token && Boolean(process.env.DISCORD_BOT_TOKEN?.trim());
|
||||
const hasConfigToken = Boolean(resolvedAccount.config.token);
|
||||
const canUseEnv = allowEnv && !hasConfigToken && Boolean(process.env.DISCORD_BOT_TOKEN?.trim());
|
||||
|
||||
if (!accountConfigured) {
|
||||
await noteDiscordTokenHelp(prompter);
|
||||
}
|
||||
|
||||
const tokenResult = await promptSingleChannelToken({
|
||||
const tokenResult = await promptSingleChannelSecretInput({
|
||||
cfg: next,
|
||||
prompter,
|
||||
providerHint: "discord",
|
||||
credentialLabel: "Discord bot token",
|
||||
secretInputMode: options?.secretInputMode,
|
||||
accountConfigured,
|
||||
canUseEnv,
|
||||
hasConfigToken,
|
||||
envPrompt: "DISCORD_BOT_TOKEN detected. Use env var?",
|
||||
keepPrompt: "Discord token already configured. Keep it?",
|
||||
inputPrompt: "Enter Discord bot token",
|
||||
preferredEnvVar: allowEnv ? "DISCORD_BOT_TOKEN" : undefined,
|
||||
});
|
||||
|
||||
next = applySingleTokenPromptResult({
|
||||
cfg: next,
|
||||
channel: "discord",
|
||||
accountId: discordAccountId,
|
||||
tokenPatchKey: "token",
|
||||
tokenResult,
|
||||
});
|
||||
let resolvedTokenForAllowlist: string | undefined;
|
||||
if (tokenResult.action === "use-env") {
|
||||
next = applySingleTokenPromptResult({
|
||||
cfg: next,
|
||||
channel: "discord",
|
||||
accountId: discordAccountId,
|
||||
tokenPatchKey: "token",
|
||||
tokenResult: { useEnv: true, token: null },
|
||||
});
|
||||
resolvedTokenForAllowlist = process.env.DISCORD_BOT_TOKEN?.trim() || undefined;
|
||||
} else if (tokenResult.action === "set") {
|
||||
next = applySingleTokenPromptResult({
|
||||
cfg: next,
|
||||
channel: "discord",
|
||||
accountId: discordAccountId,
|
||||
tokenPatchKey: "token",
|
||||
tokenResult: { useEnv: false, token: tokenResult.value },
|
||||
});
|
||||
resolvedTokenForAllowlist = tokenResult.resolvedValue;
|
||||
}
|
||||
|
||||
const currentEntries = Object.entries(resolvedAccount.config.guilds ?? {}).flatMap(
|
||||
([guildKey, value]) => {
|
||||
@@ -237,10 +256,11 @@ export const discordOnboardingAdapter: ChannelOnboardingAdapter = {
|
||||
input,
|
||||
resolved: false,
|
||||
}));
|
||||
if (accountWithTokens.token && entries.length > 0) {
|
||||
const activeToken = accountWithTokens.token || resolvedTokenForAllowlist || "";
|
||||
if (activeToken && entries.length > 0) {
|
||||
try {
|
||||
resolved = await resolveDiscordChannelAllowlist({
|
||||
token: accountWithTokens.token,
|
||||
token: activeToken,
|
||||
entries,
|
||||
});
|
||||
const resolvedChannels = resolved.filter((entry) => entry.resolved && entry.channelId);
|
||||
|
||||
@@ -19,6 +19,7 @@ import {
|
||||
promptLegacyChannelAllowFrom,
|
||||
parseOnboardingEntriesWithParser,
|
||||
promptParsedAllowFromForScopedChannel,
|
||||
promptSingleChannelSecretInput,
|
||||
promptSingleChannelToken,
|
||||
promptResolvedAllowFrom,
|
||||
resolveAccountIdForConfigure,
|
||||
@@ -287,6 +288,96 @@ describe("promptSingleChannelToken", () => {
|
||||
});
|
||||
});
|
||||
|
||||
describe("promptSingleChannelSecretInput", () => {
|
||||
it("returns use-env action when plaintext mode selects env fallback", async () => {
|
||||
const prompter = {
|
||||
select: vi.fn(async () => "plaintext"),
|
||||
confirm: vi.fn(async () => true),
|
||||
text: vi.fn(async () => ""),
|
||||
note: vi.fn(async () => undefined),
|
||||
};
|
||||
|
||||
const result = await promptSingleChannelSecretInput({
|
||||
cfg: {},
|
||||
// oxlint-disable-next-line typescript/no-explicit-any
|
||||
prompter: prompter as any,
|
||||
providerHint: "telegram",
|
||||
credentialLabel: "Telegram bot token",
|
||||
accountConfigured: false,
|
||||
canUseEnv: true,
|
||||
hasConfigToken: false,
|
||||
envPrompt: "use env",
|
||||
keepPrompt: "keep",
|
||||
inputPrompt: "token",
|
||||
preferredEnvVar: "TELEGRAM_BOT_TOKEN",
|
||||
});
|
||||
|
||||
expect(result).toEqual({ action: "use-env" });
|
||||
});
|
||||
|
||||
it("returns ref + resolved value when external env ref is selected", async () => {
|
||||
process.env.OPENCLAW_TEST_TOKEN = "secret-token";
|
||||
const prompter = {
|
||||
select: vi.fn().mockResolvedValueOnce("ref").mockResolvedValueOnce("env"),
|
||||
confirm: vi.fn(async () => false),
|
||||
text: vi.fn(async () => "OPENCLAW_TEST_TOKEN"),
|
||||
note: vi.fn(async () => undefined),
|
||||
};
|
||||
|
||||
const result = await promptSingleChannelSecretInput({
|
||||
cfg: {},
|
||||
// oxlint-disable-next-line typescript/no-explicit-any
|
||||
prompter: prompter as any,
|
||||
providerHint: "discord",
|
||||
credentialLabel: "Discord bot token",
|
||||
accountConfigured: false,
|
||||
canUseEnv: false,
|
||||
hasConfigToken: false,
|
||||
envPrompt: "use env",
|
||||
keepPrompt: "keep",
|
||||
inputPrompt: "token",
|
||||
preferredEnvVar: "OPENCLAW_TEST_TOKEN",
|
||||
});
|
||||
|
||||
expect(result).toEqual({
|
||||
action: "set",
|
||||
value: {
|
||||
source: "env",
|
||||
provider: "default",
|
||||
id: "OPENCLAW_TEST_TOKEN",
|
||||
},
|
||||
resolvedValue: "secret-token",
|
||||
});
|
||||
});
|
||||
|
||||
it("returns keep action when ref mode keeps an existing configured ref", async () => {
|
||||
const prompter = {
|
||||
select: vi.fn(async () => "ref"),
|
||||
confirm: vi.fn(async () => true),
|
||||
text: vi.fn(async () => ""),
|
||||
note: vi.fn(async () => undefined),
|
||||
};
|
||||
|
||||
const result = await promptSingleChannelSecretInput({
|
||||
cfg: {},
|
||||
// oxlint-disable-next-line typescript/no-explicit-any
|
||||
prompter: prompter as any,
|
||||
providerHint: "telegram",
|
||||
credentialLabel: "Telegram bot token",
|
||||
accountConfigured: true,
|
||||
canUseEnv: false,
|
||||
hasConfigToken: true,
|
||||
envPrompt: "use env",
|
||||
keepPrompt: "keep",
|
||||
inputPrompt: "token",
|
||||
preferredEnvVar: "TELEGRAM_BOT_TOKEN",
|
||||
});
|
||||
|
||||
expect(result).toEqual({ action: "keep" });
|
||||
expect(prompter.text).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
|
||||
describe("applySingleTokenPromptResult", () => {
|
||||
it("writes env selection as an empty patch on target account", () => {
|
||||
const next = applySingleTokenPromptResult({
|
||||
|
||||
@@ -1,5 +1,10 @@
|
||||
import {
|
||||
promptSecretRefForOnboarding,
|
||||
resolveSecretInputModeForEnvSelection,
|
||||
} from "../../../commands/auth-choice.apply-helpers.js";
|
||||
import type { OpenClawConfig } from "../../../config/config.js";
|
||||
import type { DmPolicy, GroupPolicy } from "../../../config/types.js";
|
||||
import type { SecretInput } from "../../../config/types.secrets.js";
|
||||
import { promptAccountId as promptAccountIdSdk } from "../../../plugin-sdk/onboarding.js";
|
||||
import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "../../../routing/session-key.js";
|
||||
import type { WizardPrompter } from "../../../wizard/prompts.js";
|
||||
@@ -355,7 +360,7 @@ export function applySingleTokenPromptResult(params: {
|
||||
tokenPatchKey: "token" | "botToken";
|
||||
tokenResult: {
|
||||
useEnv: boolean;
|
||||
token: string | null;
|
||||
token: SecretInput | null;
|
||||
};
|
||||
}): OpenClawConfig {
|
||||
let next = params.cfg;
|
||||
@@ -419,6 +424,87 @@ export async function promptSingleChannelToken(params: {
|
||||
return { useEnv: false, token: await promptToken() };
|
||||
}
|
||||
|
||||
export type SingleChannelSecretInputPromptResult =
|
||||
| { action: "keep" }
|
||||
| { action: "use-env" }
|
||||
| { action: "set"; value: SecretInput; resolvedValue: string };
|
||||
|
||||
export async function promptSingleChannelSecretInput(params: {
|
||||
cfg: OpenClawConfig;
|
||||
prompter: Pick<WizardPrompter, "confirm" | "text" | "select" | "note">;
|
||||
providerHint: string;
|
||||
credentialLabel: string;
|
||||
secretInputMode?: "plaintext" | "ref";
|
||||
accountConfigured: boolean;
|
||||
canUseEnv: boolean;
|
||||
hasConfigToken: boolean;
|
||||
envPrompt: string;
|
||||
keepPrompt: string;
|
||||
inputPrompt: string;
|
||||
preferredEnvVar?: string;
|
||||
}): Promise<SingleChannelSecretInputPromptResult> {
|
||||
const selectedMode = await resolveSecretInputModeForEnvSelection({
|
||||
prompter: params.prompter as WizardPrompter,
|
||||
explicitMode: params.secretInputMode,
|
||||
copy: {
|
||||
modeMessage: `How do you want to provide this ${params.credentialLabel}?`,
|
||||
plaintextLabel: `Enter ${params.credentialLabel}`,
|
||||
plaintextHint: "Stores the credential directly in OpenClaw config",
|
||||
refLabel: "Use external secret provider",
|
||||
refHint: "Stores a reference to env or configured external secret providers",
|
||||
},
|
||||
});
|
||||
|
||||
if (selectedMode === "plaintext") {
|
||||
const plainResult = await promptSingleChannelToken({
|
||||
prompter: params.prompter,
|
||||
accountConfigured: params.accountConfigured,
|
||||
canUseEnv: params.canUseEnv,
|
||||
hasConfigToken: params.hasConfigToken,
|
||||
envPrompt: params.envPrompt,
|
||||
keepPrompt: params.keepPrompt,
|
||||
inputPrompt: params.inputPrompt,
|
||||
});
|
||||
if (plainResult.useEnv) {
|
||||
return { action: "use-env" };
|
||||
}
|
||||
if (plainResult.token) {
|
||||
return { action: "set", value: plainResult.token, resolvedValue: plainResult.token };
|
||||
}
|
||||
return { action: "keep" };
|
||||
}
|
||||
|
||||
if (params.hasConfigToken && params.accountConfigured) {
|
||||
const keep = await params.prompter.confirm({
|
||||
message: params.keepPrompt,
|
||||
initialValue: true,
|
||||
});
|
||||
if (keep) {
|
||||
return { action: "keep" };
|
||||
}
|
||||
}
|
||||
|
||||
const resolved = await promptSecretRefForOnboarding({
|
||||
provider: params.providerHint,
|
||||
config: params.cfg,
|
||||
prompter: params.prompter as WizardPrompter,
|
||||
preferredEnvVar: params.preferredEnvVar,
|
||||
copy: {
|
||||
sourceMessage: `Where is this ${params.credentialLabel} stored?`,
|
||||
envVarPlaceholder: params.preferredEnvVar ?? "OPENCLAW_SECRET",
|
||||
envVarFormatError:
|
||||
'Use an env var name like "OPENCLAW_SECRET" (uppercase letters, numbers, underscores).',
|
||||
noProvidersMessage:
|
||||
"No file/exec secret providers are configured yet. Add one under secrets.providers, or select Environment variable.",
|
||||
},
|
||||
});
|
||||
return {
|
||||
action: "set",
|
||||
value: resolved.ref,
|
||||
resolvedValue: resolved.resolvedValue,
|
||||
};
|
||||
}
|
||||
|
||||
type ParsedAllowFromResult = { entries: string[]; error?: string };
|
||||
|
||||
export async function promptParsedAllowFromForScopedChannel(params: {
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
import type { OpenClawConfig } from "../../../config/config.js";
|
||||
import { hasConfiguredSecretInput } from "../../../config/types.secrets.js";
|
||||
import { DEFAULT_ACCOUNT_ID } from "../../../routing/session-key.js";
|
||||
import {
|
||||
listSlackAccountIds,
|
||||
@@ -17,6 +18,7 @@ import {
|
||||
noteChannelLookupSummary,
|
||||
patchChannelConfigForAccount,
|
||||
promptLegacyChannelAllowFrom,
|
||||
promptSingleChannelSecretInput,
|
||||
resolveAccountIdForConfigure,
|
||||
resolveOnboardingAccountId,
|
||||
setAccountGroupPolicyForChannel,
|
||||
@@ -114,25 +116,6 @@ async function noteSlackTokenHelp(prompter: WizardPrompter, botName: string): Pr
|
||||
);
|
||||
}
|
||||
|
||||
async function promptSlackTokens(prompter: WizardPrompter): Promise<{
|
||||
botToken: string;
|
||||
appToken: string;
|
||||
}> {
|
||||
const botToken = String(
|
||||
await prompter.text({
|
||||
message: "Enter Slack bot token (xoxb-...)",
|
||||
validate: (value) => (value?.trim() ? undefined : "Required"),
|
||||
}),
|
||||
).trim();
|
||||
const appToken = String(
|
||||
await prompter.text({
|
||||
message: "Enter Slack app token (xapp-...)",
|
||||
validate: (value) => (value?.trim() ? undefined : "Required"),
|
||||
}),
|
||||
).trim();
|
||||
return { botToken, appToken };
|
||||
}
|
||||
|
||||
function setSlackChannelAllowlist(
|
||||
cfg: OpenClawConfig,
|
||||
accountId: string,
|
||||
@@ -217,7 +200,11 @@ export const slackOnboardingAdapter: ChannelOnboardingAdapter = {
|
||||
getStatus: async ({ cfg }) => {
|
||||
const configured = listSlackAccountIds(cfg).some((accountId) => {
|
||||
const account = resolveSlackAccount({ cfg, accountId });
|
||||
return Boolean(account.botToken && account.appToken);
|
||||
const hasBotToken =
|
||||
Boolean(account.botToken) || hasConfiguredSecretInput(account.config.botToken);
|
||||
const hasAppToken =
|
||||
Boolean(account.appToken) || hasConfiguredSecretInput(account.config.appToken);
|
||||
return hasBotToken && hasAppToken;
|
||||
});
|
||||
return {
|
||||
channel,
|
||||
@@ -227,7 +214,7 @@ export const slackOnboardingAdapter: ChannelOnboardingAdapter = {
|
||||
quickstartScore: configured ? 2 : 1,
|
||||
};
|
||||
},
|
||||
configure: async ({ cfg, prompter, accountOverrides, shouldPromptAccountIds }) => {
|
||||
configure: async ({ cfg, prompter, options, accountOverrides, shouldPromptAccountIds }) => {
|
||||
const defaultSlackAccountId = resolveDefaultSlackAccountId(cfg);
|
||||
const slackAccountId = await resolveAccountIdForConfigure({
|
||||
cfg,
|
||||
@@ -244,18 +231,17 @@ export const slackOnboardingAdapter: ChannelOnboardingAdapter = {
|
||||
cfg: next,
|
||||
accountId: slackAccountId,
|
||||
});
|
||||
const accountConfigured = Boolean(resolvedAccount.botToken && resolvedAccount.appToken);
|
||||
const hasConfiguredBotToken = hasConfiguredSecretInput(resolvedAccount.config.botToken);
|
||||
const hasConfiguredAppToken = hasConfiguredSecretInput(resolvedAccount.config.appToken);
|
||||
const hasConfigTokens = hasConfiguredBotToken && hasConfiguredAppToken;
|
||||
const accountConfigured =
|
||||
Boolean(resolvedAccount.botToken && resolvedAccount.appToken) || hasConfigTokens;
|
||||
const allowEnv = slackAccountId === DEFAULT_ACCOUNT_ID;
|
||||
const canUseEnv =
|
||||
allowEnv &&
|
||||
Boolean(process.env.SLACK_BOT_TOKEN?.trim()) &&
|
||||
Boolean(process.env.SLACK_APP_TOKEN?.trim());
|
||||
const hasConfigTokens = Boolean(
|
||||
resolvedAccount.config.botToken && resolvedAccount.config.appToken,
|
||||
);
|
||||
|
||||
let botToken: string | null = null;
|
||||
let appToken: string | null = null;
|
||||
const canUseBotEnv =
|
||||
allowEnv && !hasConfiguredBotToken && Boolean(process.env.SLACK_BOT_TOKEN?.trim());
|
||||
const canUseAppEnv =
|
||||
allowEnv && !hasConfiguredAppToken && Boolean(process.env.SLACK_APP_TOKEN?.trim());
|
||||
let resolvedBotTokenForAllowlist = resolvedAccount.botToken;
|
||||
const slackBotName = String(
|
||||
await prompter.text({
|
||||
message: "Slack bot display name (used for manifest)",
|
||||
@@ -265,39 +251,52 @@ export const slackOnboardingAdapter: ChannelOnboardingAdapter = {
|
||||
if (!accountConfigured) {
|
||||
await noteSlackTokenHelp(prompter, slackBotName);
|
||||
}
|
||||
if (canUseEnv && (!resolvedAccount.config.botToken || !resolvedAccount.config.appToken)) {
|
||||
const keepEnv = await prompter.confirm({
|
||||
message: "SLACK_BOT_TOKEN + SLACK_APP_TOKEN detected. Use env vars?",
|
||||
initialValue: true,
|
||||
});
|
||||
if (keepEnv) {
|
||||
next = patchChannelConfigForAccount({
|
||||
cfg: next,
|
||||
channel: "slack",
|
||||
accountId: slackAccountId,
|
||||
patch: {},
|
||||
});
|
||||
} else {
|
||||
({ botToken, appToken } = await promptSlackTokens(prompter));
|
||||
}
|
||||
} else if (hasConfigTokens) {
|
||||
const keep = await prompter.confirm({
|
||||
message: "Slack tokens already configured. Keep them?",
|
||||
initialValue: true,
|
||||
});
|
||||
if (!keep) {
|
||||
({ botToken, appToken } = await promptSlackTokens(prompter));
|
||||
}
|
||||
} else {
|
||||
({ botToken, appToken } = await promptSlackTokens(prompter));
|
||||
}
|
||||
|
||||
if (botToken && appToken) {
|
||||
const botTokenResult = await promptSingleChannelSecretInput({
|
||||
cfg: next,
|
||||
prompter,
|
||||
providerHint: "slack-bot",
|
||||
credentialLabel: "Slack bot token",
|
||||
secretInputMode: options?.secretInputMode,
|
||||
accountConfigured: Boolean(resolvedAccount.botToken) || hasConfiguredBotToken,
|
||||
canUseEnv: canUseBotEnv,
|
||||
hasConfigToken: hasConfiguredBotToken,
|
||||
envPrompt: "SLACK_BOT_TOKEN detected. Use env var?",
|
||||
keepPrompt: "Slack bot token already configured. Keep it?",
|
||||
inputPrompt: "Enter Slack bot token (xoxb-...)",
|
||||
preferredEnvVar: allowEnv ? "SLACK_BOT_TOKEN" : undefined,
|
||||
});
|
||||
if (botTokenResult.action === "use-env") {
|
||||
resolvedBotTokenForAllowlist = process.env.SLACK_BOT_TOKEN?.trim() || undefined;
|
||||
} else if (botTokenResult.action === "set") {
|
||||
next = patchChannelConfigForAccount({
|
||||
cfg: next,
|
||||
channel: "slack",
|
||||
accountId: slackAccountId,
|
||||
patch: { botToken, appToken },
|
||||
patch: { botToken: botTokenResult.value },
|
||||
});
|
||||
resolvedBotTokenForAllowlist = botTokenResult.resolvedValue;
|
||||
}
|
||||
|
||||
const appTokenResult = await promptSingleChannelSecretInput({
|
||||
cfg: next,
|
||||
prompter,
|
||||
providerHint: "slack-app",
|
||||
credentialLabel: "Slack app token",
|
||||
secretInputMode: options?.secretInputMode,
|
||||
accountConfigured: Boolean(resolvedAccount.appToken) || hasConfiguredAppToken,
|
||||
canUseEnv: canUseAppEnv,
|
||||
hasConfigToken: hasConfiguredAppToken,
|
||||
envPrompt: "SLACK_APP_TOKEN detected. Use env var?",
|
||||
keepPrompt: "Slack app token already configured. Keep it?",
|
||||
inputPrompt: "Enter Slack app token (xapp-...)",
|
||||
preferredEnvVar: allowEnv ? "SLACK_APP_TOKEN" : undefined,
|
||||
});
|
||||
if (appTokenResult.action === "set") {
|
||||
next = patchChannelConfigForAccount({
|
||||
cfg: next,
|
||||
channel: "slack",
|
||||
accountId: slackAccountId,
|
||||
patch: { appToken: appTokenResult.value },
|
||||
});
|
||||
}
|
||||
|
||||
@@ -324,10 +323,11 @@ export const slackOnboardingAdapter: ChannelOnboardingAdapter = {
|
||||
cfg,
|
||||
accountId: slackAccountId,
|
||||
});
|
||||
if (accountWithTokens.botToken && entries.length > 0) {
|
||||
const activeBotToken = accountWithTokens.botToken || resolvedBotTokenForAllowlist || "";
|
||||
if (activeBotToken && entries.length > 0) {
|
||||
try {
|
||||
const resolved = await resolveSlackChannelAllowlist({
|
||||
token: accountWithTokens.botToken,
|
||||
token: activeBotToken,
|
||||
entries,
|
||||
});
|
||||
const resolvedKeys = resolved
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
import { formatCliCommand } from "../../../cli/command-format.js";
|
||||
import type { OpenClawConfig } from "../../../config/config.js";
|
||||
import { hasConfiguredSecretInput } from "../../../config/types.secrets.js";
|
||||
import { DEFAULT_ACCOUNT_ID } from "../../../routing/session-key.js";
|
||||
import {
|
||||
listTelegramAccountIds,
|
||||
@@ -13,7 +14,7 @@ import type { ChannelOnboardingAdapter, ChannelOnboardingDmPolicy } from "../onb
|
||||
import {
|
||||
applySingleTokenPromptResult,
|
||||
patchChannelConfigForAccount,
|
||||
promptSingleChannelToken,
|
||||
promptSingleChannelSecretInput,
|
||||
promptResolvedAllowFrom,
|
||||
resolveAccountIdForConfigure,
|
||||
resolveOnboardingAccountId,
|
||||
@@ -67,13 +68,14 @@ async function promptTelegramAllowFrom(params: {
|
||||
cfg: OpenClawConfig;
|
||||
prompter: WizardPrompter;
|
||||
accountId: string;
|
||||
tokenOverride?: string;
|
||||
}): Promise<OpenClawConfig> {
|
||||
const { cfg, prompter, accountId } = params;
|
||||
const resolved = resolveTelegramAccount({ cfg, accountId });
|
||||
const existingAllowFrom = resolved.config.allowFrom ?? [];
|
||||
await noteTelegramUserIdHelp(prompter);
|
||||
|
||||
const token = resolved.token;
|
||||
const token = params.tokenOverride?.trim() || resolved.token;
|
||||
if (!token) {
|
||||
await prompter.note("Telegram token missing; username lookup is unavailable.", "Telegram");
|
||||
}
|
||||
@@ -150,9 +152,14 @@ const dmPolicy: ChannelOnboardingDmPolicy = {
|
||||
export const telegramOnboardingAdapter: ChannelOnboardingAdapter = {
|
||||
channel,
|
||||
getStatus: async ({ cfg }) => {
|
||||
const configured = listTelegramAccountIds(cfg).some((accountId) =>
|
||||
Boolean(resolveTelegramAccount({ cfg, accountId }).token),
|
||||
);
|
||||
const configured = listTelegramAccountIds(cfg).some((accountId) => {
|
||||
const account = resolveTelegramAccount({ cfg, accountId });
|
||||
return (
|
||||
Boolean(account.token) ||
|
||||
Boolean(account.config.tokenFile?.trim()) ||
|
||||
hasConfiguredSecretInput(account.config.botToken)
|
||||
);
|
||||
});
|
||||
return {
|
||||
channel,
|
||||
configured,
|
||||
@@ -164,6 +171,7 @@ export const telegramOnboardingAdapter: ChannelOnboardingAdapter = {
|
||||
configure: async ({
|
||||
cfg,
|
||||
prompter,
|
||||
options,
|
||||
accountOverrides,
|
||||
shouldPromptAccountIds,
|
||||
forceAllowFrom,
|
||||
@@ -184,43 +192,60 @@ export const telegramOnboardingAdapter: ChannelOnboardingAdapter = {
|
||||
cfg: next,
|
||||
accountId: telegramAccountId,
|
||||
});
|
||||
const accountConfigured = Boolean(resolvedAccount.token);
|
||||
const hasConfiguredBotToken = hasConfiguredSecretInput(resolvedAccount.config.botToken);
|
||||
const hasConfigToken =
|
||||
hasConfiguredBotToken || Boolean(resolvedAccount.config.tokenFile?.trim());
|
||||
const accountConfigured = Boolean(resolvedAccount.token) || hasConfigToken;
|
||||
const allowEnv = telegramAccountId === DEFAULT_ACCOUNT_ID;
|
||||
const canUseEnv =
|
||||
allowEnv &&
|
||||
!resolvedAccount.config.botToken &&
|
||||
Boolean(process.env.TELEGRAM_BOT_TOKEN?.trim());
|
||||
const hasConfigToken = Boolean(
|
||||
resolvedAccount.config.botToken || resolvedAccount.config.tokenFile,
|
||||
);
|
||||
allowEnv && !hasConfigToken && Boolean(process.env.TELEGRAM_BOT_TOKEN?.trim());
|
||||
|
||||
if (!accountConfigured) {
|
||||
await noteTelegramTokenHelp(prompter);
|
||||
}
|
||||
|
||||
const tokenResult = await promptSingleChannelToken({
|
||||
const tokenResult = await promptSingleChannelSecretInput({
|
||||
cfg: next,
|
||||
prompter,
|
||||
providerHint: "telegram",
|
||||
credentialLabel: "Telegram bot token",
|
||||
secretInputMode: options?.secretInputMode,
|
||||
accountConfigured,
|
||||
canUseEnv,
|
||||
hasConfigToken,
|
||||
envPrompt: "TELEGRAM_BOT_TOKEN detected. Use env var?",
|
||||
keepPrompt: "Telegram token already configured. Keep it?",
|
||||
inputPrompt: "Enter Telegram bot token",
|
||||
preferredEnvVar: allowEnv ? "TELEGRAM_BOT_TOKEN" : undefined,
|
||||
});
|
||||
|
||||
next = applySingleTokenPromptResult({
|
||||
cfg: next,
|
||||
channel: "telegram",
|
||||
accountId: telegramAccountId,
|
||||
tokenPatchKey: "botToken",
|
||||
tokenResult,
|
||||
});
|
||||
let resolvedTokenForAllowFrom: string | undefined;
|
||||
if (tokenResult.action === "use-env") {
|
||||
next = applySingleTokenPromptResult({
|
||||
cfg: next,
|
||||
channel: "telegram",
|
||||
accountId: telegramAccountId,
|
||||
tokenPatchKey: "botToken",
|
||||
tokenResult: { useEnv: true, token: null },
|
||||
});
|
||||
resolvedTokenForAllowFrom = process.env.TELEGRAM_BOT_TOKEN?.trim() || undefined;
|
||||
} else if (tokenResult.action === "set") {
|
||||
next = applySingleTokenPromptResult({
|
||||
cfg: next,
|
||||
channel: "telegram",
|
||||
accountId: telegramAccountId,
|
||||
tokenPatchKey: "botToken",
|
||||
tokenResult: { useEnv: false, token: tokenResult.value },
|
||||
});
|
||||
resolvedTokenForAllowFrom = tokenResult.resolvedValue;
|
||||
}
|
||||
|
||||
if (forceAllowFrom) {
|
||||
next = await promptTelegramAllowFrom({
|
||||
cfg: next,
|
||||
prompter,
|
||||
accountId: telegramAccountId,
|
||||
tokenOverride: resolvedTokenForAllowFrom,
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user