openclaw/dist/models-auth-order-DXjqYf0q.js

Multi-channel AI gateway with extensible messaging integrations

import { t as createSubsystemLogger } from "./subsystem-Dy2tqXOS.js";
import { n as resolveProviderIdForAuth } from "./provider-auth-aliases-DhA9c2am.js";
import { t as ErrorCodes } from "./gateway-error-details-w0nAGBBp.js";
import { sn as validateModelsAuthOrderSetParams } from "./src-BiL5aQto.js";
import { d as errorShape } from "./error-codes-Bo8q2D1o.js";
import { s as setAuthProfileOrder } from "./profiles-DOTqXcYA.js";
import { s as resolveExplicitAuthOrderSelection } from "./order-CC2RBzI5.js";
import { d as refreshPreparedModelRuntimeSnapshots } from "./prepared-model-runtime-DgNj94yb.js";
import "./auth-profiles-BdUEhE7u.js";
import { r as clearCurrentProviderAuthState } from "./model-provider-auth-state-Bn1pG368.js";
import { i as warmCurrentProviderAuthStateOffMainThread } from "./model-provider-auth-jVhbzrw7.js";
import { n as readPreparedCatalog } from "./server-model-catalog-auth-d5Ty5VGR.js";
import { t as formatForLog } from "./ws-log-Dkg9wKNU.js";
import { t as assertValidParams } from "./validation-pzrlzFvo.js";
import { t as clearModelAuthStatusUsageCache } from "./models-auth-status-usage-cache-DTKjRTY8.js";
import { d as refreshActiveProviderAuthRuntimeSnapshot } from "./runtime-C3AQ3lWb.js";
import { n as resolveModelAuthAgentScope, t as modelAuthAgentScopeError } from "./model-auth-agent-scope-Bkn59-AH.js";
import { t as resolveConfigBoundProfileIds } from "./models-auth-status-config-BOZ7BO6r.js";
//#region src/gateway/server-methods/models-auth-order.ts
const log = createSubsystemLogger("models-auth-order");
const modelsAuthOrderHandlers = { "models.authOrderSet": async ({ params, respond, context }) => {
	if (!assertValidParams(params, validateModelsAuthOrderSetParams, "models.authOrderSet", respond)) return;
	const provider = params.provider;
	const profileIds = params.profileIds ?? null;
	const rejectInvalidOrder = (message) => respond(false, void 0, errorShape(ErrorCodes.INVALID_REQUEST, message));
	try {
		const cfg = context.getRuntimeConfig();
		const scope = resolveModelAuthAgentScope(cfg, params.agentId);
		if (!scope.ok) {
			respond(false, void 0, modelAuthAgentScopeError(scope));
			return;
		}
		const preparedSnapshot = await readPreparedCatalog(context, scope.agentId);
		if (!preparedSnapshot) throw new Error(`prepared model auth owner is unavailable (${scope.agentId})`);
		const authAliasLookupParams = {
			config: preparedSnapshot.config,
			workspaceDir: preparedSnapshot.workspaceDir,
			metadataSnapshot: preparedSnapshot.metadataSnapshot,
			includeUntrustedWorkspacePlugins: false
		};
		const authProvider = resolveProviderIdForAuth(provider, authAliasLookupParams);
		const configuredOrder = resolveExplicitAuthOrderSelection({
			storeOrder: preparedSnapshot.authStore.order,
			configuredOrder: preparedSnapshot.config.auth?.order,
			providerKey: provider,
			providerAuthKey: authProvider
		});
		if (profileIds && configuredOrder.order !== void 0 && !configuredOrder.fromStore) {
			rejectInvalidOrder(`profile priority for provider ${provider} is controlled by auth configuration`);
			return;
		}
		const availableProfileIds = Object.entries(preparedSnapshot.authStore.profiles).filter(([, credential]) => resolveProviderIdForAuth(credential.provider, authAliasLookupParams) === authProvider).map(([profileId]) => profileId);
		const configBoundProfileIds = resolveConfigBoundProfileIds(preparedSnapshot.config, preparedSnapshot.authStore, authAliasLookupParams);
		if (profileIds && availableProfileIds.some((profileId) => configBoundProfileIds.has(profileId))) {
			rejectInvalidOrder(`profile priority for provider ${provider} is controlled by provider configuration`);
			return;
		}
		const invalidProfile = profileIds?.find((profileId) => {
			const credential = preparedSnapshot.authStore.profiles[profileId];
			return !credential || resolveProviderIdForAuth(credential.provider, authAliasLookupParams) !== authProvider;
		});
		if (invalidProfile) {
			rejectInvalidOrder(`profileId ${invalidProfile} is unavailable for provider ${provider}`);
			return;
		}
		if (profileIds && profileIds.length !== availableProfileIds.length) {
			rejectInvalidOrder(`profileIds must include every available profile for provider ${provider}`);
			return;
		}
		if (!await setAuthProfileOrder({
			agentDir: preparedSnapshot.agentDir,
			provider: authProvider,
			order: profileIds,
			sharedStoreWrite: true
		})) {
			respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, "auth profile order is temporarily unavailable"));
			return;
		}
		clearModelAuthStatusUsageCache();
		clearCurrentProviderAuthState();
		respond(true, {
			provider,
			profileIds
		}, void 0);
		Promise.all([
			refreshActiveProviderAuthRuntimeSnapshot(),
			refreshPreparedModelRuntimeSnapshots(cfg, {
				catalogMode: "static",
				allowGatewaySubagentBinding: true,
				agentIds: /* @__PURE__ */ new Set([scope.agentId]),
				pluginMetadataSnapshot: preparedSnapshot.metadataSnapshot
			}),
			warmCurrentProviderAuthStateOffMainThread(cfg)
		]).catch((err) => {
			log.warn(`provider auth state refresh after reorder failed: ${formatForLog(err)}`);
		});
	} catch (err) {
		respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, formatForLog(err)));
	}
} };
//#endregion
export { modelsAuthOrderHandlers };