openclaw/dist/auth-surface-resolution-Dr_JIxWO.js

Multi-channel AI gateway with extensible messaging integrations

import { s as hasConfiguredSecretInput } from "./types.secrets-_0JOMGE5.js";
import { a as trimToUndefined } from "./credential-planner-wESmL_7M.js";
import "./credentials-irvgw8Le.js";
import { t as resolveConfiguredSecretInputString } from "./resolve-configured-secret-input-string-9uwQlTwC.js";
//#region src/gateway/auth-surface-resolution.ts
async function resolveGatewayCredential(params) {
	const resolved = await resolveConfiguredSecretInputString({
		config: params.config,
		env: params.env,
		value: params.value,
		path: params.path,
		unresolvedReasonStyle: "detailed"
	});
	if (resolved.unresolvedRefReason) params.diagnostics.push(resolved.unresolvedRefReason);
	return resolved;
}
function withDiagnostics(params) {
	return params.diagnostics.length > 0 ? {
		...params.result,
		diagnostics: params.diagnostics
	} : params.result;
}
/** Resolves best-effort credentials for non-mutating local/remote gateway probes. */
async function resolveGatewayProbeSurfaceAuth(params) {
	const env = params.env ?? process.env;
	const diagnostics = [];
	const authMode = params.config.gateway?.auth?.mode;
	if (params.surface === "remote") {
		const remoteToken = await resolveGatewayCredential({
			config: params.config,
			env,
			diagnostics,
			path: "gateway.remote.token",
			value: params.config.gateway?.remote?.token
		});
		const remotePassword = remoteToken.value ? { value: void 0 } : await resolveGatewayCredential({
			config: params.config,
			env,
			diagnostics,
			path: "gateway.remote.password",
			value: params.config.gateway?.remote?.password
		});
		return withDiagnostics({
			diagnostics,
			result: {
				token: remoteToken.value,
				password: remotePassword.value
			}
		});
	}
	if (authMode === "none" || authMode === "trusted-proxy") return {};
	const envToken = trimToUndefined(env.OPENCLAW_GATEWAY_TOKEN);
	const envPassword = trimToUndefined(env.OPENCLAW_GATEWAY_PASSWORD);
	if (authMode === "token") {
		const token = await resolveGatewayCredential({
			config: params.config,
			env,
			diagnostics,
			path: "gateway.auth.token",
			value: params.config.gateway?.auth?.token
		});
		return token.value ? withDiagnostics({
			diagnostics,
			result: { token: token.value }
		}) : envToken ? { token: envToken } : withDiagnostics({
			diagnostics,
			result: {}
		});
	}
	if (authMode === "password") {
		const password = await resolveGatewayCredential({
			config: params.config,
			env,
			diagnostics,
			path: "gateway.auth.password",
			value: params.config.gateway?.auth?.password
		});
		return password.value ? withDiagnostics({
			diagnostics,
			result: { password: password.value }
		}) : envPassword ? { password: envPassword } : withDiagnostics({
			diagnostics,
			result: {}
		});
	}
	const token = await resolveGatewayCredential({
		config: params.config,
		env,
		diagnostics,
		path: "gateway.auth.token",
		value: params.config.gateway?.auth?.token
	});
	if (token.value) return withDiagnostics({
		diagnostics,
		result: { token: token.value }
	});
	if (envToken) return { token: envToken };
	if (envPassword) return withDiagnostics({
		diagnostics,
		result: { password: envPassword }
	});
	const password = await resolveGatewayCredential({
		config: params.config,
		env,
		diagnostics,
		path: "gateway.auth.password",
		value: params.config.gateway?.auth?.password
	});
	return withDiagnostics({
		diagnostics,
		result: {
			token: token.value,
			password: password.value
		}
	});
}
/** Resolves credentials for client paths that must either authenticate or explain the failure. */
async function resolveGatewayInteractiveSurfaceAuth(params) {
	const env = params.env ?? process.env;
	const diagnostics = [];
	const explicitToken = trimToUndefined(params.explicitAuth?.token);
	const explicitPassword = trimToUndefined(params.explicitAuth?.password);
	const envToken = params.suppressEnvAuthFallback ? void 0 : trimToUndefined(env.OPENCLAW_GATEWAY_TOKEN);
	const envPassword = params.suppressEnvAuthFallback ? void 0 : trimToUndefined(env.OPENCLAW_GATEWAY_PASSWORD);
	if (params.surface === "remote") {
		const remoteToken = explicitToken ? { value: explicitToken } : await resolveGatewayCredential({
			config: params.config,
			env,
			diagnostics,
			path: "gateway.remote.token",
			value: params.config.gateway?.remote?.token
		});
		const remotePassword = explicitPassword || envPassword ? { value: explicitPassword ?? envPassword } : await resolveGatewayCredential({
			config: params.config,
			env,
			diagnostics,
			path: "gateway.remote.password",
			value: params.config.gateway?.remote?.password
		});
		const token = explicitToken ?? remoteToken.value ?? envToken;
		const password = explicitPassword ?? envPassword ?? remotePassword.value;
		return token || password ? {
			token,
			password
		} : { failureReason: remoteToken.unresolvedRefReason ?? remotePassword.unresolvedRefReason ?? "Missing gateway auth credentials." };
	}
	const authMode = params.config.gateway?.auth?.mode;
	if (authMode === "none" || authMode === "trusted-proxy") return {
		token: explicitToken ?? envToken,
		password: explicitPassword ?? envPassword
	};
	const hasConfiguredToken = hasConfiguredSecretInput(params.config.gateway?.auth?.token, params.config.secrets?.defaults);
	const hasConfiguredPassword = hasConfiguredSecretInput(params.config.gateway?.auth?.password, params.config.secrets?.defaults);
	const resolveToken = async () => {
		const localToken = explicitToken ? { value: explicitToken } : await resolveGatewayCredential({
			config: params.config,
			env,
			diagnostics,
			path: "gateway.auth.token",
			value: params.config.gateway?.auth?.token
		});
		const token = explicitToken ?? localToken.value ?? envToken;
		return {
			token,
			failureReason: token ? void 0 : localToken.unresolvedRefReason ?? "Missing gateway auth token."
		};
	};
	const resolvePassword = async () => {
		const localPassword = explicitPassword || envPassword ? { value: explicitPassword ?? envPassword } : await resolveGatewayCredential({
			config: params.config,
			env,
			diagnostics,
			path: "gateway.auth.password",
			value: params.config.gateway?.auth?.password
		});
		const password = explicitPassword ?? envPassword ?? localPassword.value;
		return {
			password,
			failureReason: password ? void 0 : localPassword.unresolvedRefReason ?? "Missing gateway auth password."
		};
	};
	if (authMode === "password") {
		const password = await resolvePassword();
		return {
			token: explicitToken ?? envToken,
			password: password.password,
			failureReason: password.failureReason
		};
	}
	if (authMode === "token") {
		const token = await resolveToken();
		return {
			token: token.token,
			password: explicitPassword ?? envPassword,
			failureReason: token.failureReason
		};
	}
	if (Boolean(explicitPassword ?? envPassword) || hasConfiguredPassword && !hasConfiguredToken) {
		const password = await resolvePassword();
		return {
			token: explicitToken ?? envToken,
			password: password.password,
			failureReason: password.failureReason
		};
	}
	const token = await resolveToken();
	return {
		token: token.token,
		password: explicitPassword ?? envPassword,
		failureReason: token.failureReason
	};
}
//#endregion
export { resolveGatewayProbeSurfaceAuth as n, resolveGatewayInteractiveSurfaceAuth as t };