openclaw/dist/credentials-secret-inputs-BwO3mIKP.mjs

Multi-channel AI gateway with extensible messaging integrations

import { f as resolveConfigSecretRef, t as cloneConfigWithResolutionFacts } from "./resolution-facts-HH1cnmIY.mjs";
import { o as isSecretResolutionError } from "./resolve-errors-DYenvPyo.mjs";
import { r as trimToUndefined } from "./credential-planner-qXtujUeq.mjs";
import { i as resolveGatewayCredentialsFromConfig, r as resolveExplicitGatewayAuth, t as GatewaySecretRefUnavailableError } from "./credentials-lHQ7_oVm.mjs";
import { a as readGatewaySecretInputValue, i as isTokenGatewaySecretInputPath, n as assignResolvedGatewaySecretInput, r as isSupportedGatewaySecretInputPath, t as ALL_GATEWAY_SECRET_INPUT_PATHS } from "./secret-input-paths-C2PsvPdU.mjs";
import { t as materializeSecretInput } from "./resolve-secret-input-string-CozIWIOP.mjs";
//#region src/gateway/credentials-secret-inputs.ts
async function resolveConfiguredGatewaySecretInput(params) {
	const configuredValue = readGatewaySecretInputValue(params.config, params.path);
	const ref = resolveConfigSecretRef({
		config: params.config,
		path: params.path,
		value: configuredValue,
		defaults: params.config.secrets?.defaults
	});
	const value = await materializeSecretInput({
		config: params.config,
		value: ref ?? configuredValue,
		env: params.env,
		normalize: trimToUndefined,
		onResolveRefError: (error) => {
			if (isSecretResolutionError(error) && error.code === "SECRET_REF_REDACTED_VALUE") throw error;
			throw new GatewaySecretRefUnavailableError(params.path);
		}
	});
	if (!value) throw new Error(`${params.path} resolved to an empty or non-string value.`);
	return value;
}
function hasConfiguredGatewaySecretRef(config, path) {
	return Boolean(resolveConfigSecretRef({
		config,
		path,
		value: readGatewaySecretInputValue(config, path),
		defaults: config.secrets?.defaults
	}));
}
function localAuthModeAllowsGatewaySecretInputPath(params) {
	const { authMode, path } = params;
	if (authMode === "none") return false;
	if (authMode === "trusted-proxy") return !isTokenGatewaySecretInputPath(path);
	if (authMode === "token") return isTokenGatewaySecretInputPath(path);
	if (authMode === "password") return !isTokenGatewaySecretInputPath(path);
	return true;
}
function canGatewaySecretInputPathWin(params) {
	if (!hasConfiguredGatewaySecretRef(params.config, params.path)) return false;
	const mode = params.options.modeOverride ?? (params.config.gateway?.mode === "remote" ? "remote" : "local");
	if (mode === "local" && !localAuthModeAllowsGatewaySecretInputPath({
		authMode: params.config.gateway?.auth?.mode,
		path: params.path
	})) return false;
	const sentinel = `__OPENCLAW_GATEWAY_SECRET_REF_PROBE_${params.path.replaceAll(".", "_")}__`;
	const probeConfig = cloneConfigWithResolutionFacts(params.config);
	for (const candidatePath of ALL_GATEWAY_SECRET_INPUT_PATHS) {
		if (!hasConfiguredGatewaySecretRef(probeConfig, candidatePath)) continue;
		assignResolvedGatewaySecretInput({
			config: probeConfig,
			path: candidatePath,
			value: void 0
		});
	}
	assignResolvedGatewaySecretInput({
		config: probeConfig,
		path: params.path,
		value: sentinel
	});
	try {
		const resolved = resolveGatewayCredentialsFromConfig({
			...params.options,
			cfg: probeConfig,
			env: params.env
		});
		const authMode = params.config.gateway?.auth?.mode;
		const tokenCanWin = resolved.token === sentinel && (mode === "local" && authMode === "token" || !resolved.password);
		const passwordCanWin = resolved.password === sentinel && (mode === "local" && (authMode === "password" || authMode === "trusted-proxy") || !resolved.token);
		return tokenCanWin || passwordCanWin;
	} catch {
		return false;
	}
}
/** Test whether resolving a configured secret-ref path could affect selected credentials. */
function gatewaySecretInputPathCanWin(params) {
	const { path, env = process.env, ...options } = params;
	return canGatewaySecretInputPathWin({
		options: {
			...options,
			explicitAuth: resolveExplicitGatewayAuth(options.explicitAuth)
		},
		env,
		config: params.config,
		path
	});
}
/** Resolve only secret refs that can win, then select Gateway credentials. */
async function resolveGatewayCredentialsWithSecretInputs(params) {
	const explicitAuth = resolveExplicitGatewayAuth(params.explicitAuth);
	if (explicitAuth.token || explicitAuth.password) return explicitAuth;
	const options = {
		...params,
		explicitAuth
	};
	const env = options.env ?? process.env;
	const config = options.config;
	let resolvedConfig = config;
	for (const path of ALL_GATEWAY_SECRET_INPUT_PATHS) {
		if (!canGatewaySecretInputPathWin({
			options,
			env,
			config: resolvedConfig,
			path
		})) continue;
		if (resolvedConfig === config) resolvedConfig = cloneConfigWithResolutionFacts(config);
		try {
			const value = await resolveConfiguredGatewaySecretInput({
				config: resolvedConfig,
				path,
				env
			});
			assignResolvedGatewaySecretInput({
				config: resolvedConfig,
				path,
				value
			});
		} catch (error) {
			if (isSecretResolutionError(error) && error.code === "SECRET_REF_REDACTED_VALUE") throw error;
		}
	}
	const resolvedPaths = /* @__PURE__ */ new Set();
	for (;;) try {
		return resolveGatewayCredentialsFromConfig({
			...options,
			cfg: resolvedConfig,
			env
		});
	} catch (error) {
		if (!(error instanceof GatewaySecretRefUnavailableError)) throw error;
		const path = error.path;
		if (!isSupportedGatewaySecretInputPath(path) || resolvedPaths.has(path)) throw error;
		if (resolvedConfig === config) resolvedConfig = cloneConfigWithResolutionFacts(config);
		const value = await resolveConfiguredGatewaySecretInput({
			config: resolvedConfig,
			path,
			env
		});
		assignResolvedGatewaySecretInput({
			config: resolvedConfig,
			path,
			value
		});
		resolvedPaths.add(path);
	}
}
//#endregion
export { resolveGatewayCredentialsWithSecretInputs as n, gatewaySecretInputPathCanWin as t };