LLM/moltbot
1
0
Fork 0
mirror of https://github.com/moltbot/moltbot.git synced 2026-05-13 15:47:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(test): isolate auth profile secrets in test state (#81393)

Browse Source 
Merged via squash.

Prepared head SHA: fde8787cb7
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com>
Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com>
Reviewed-by: @altaywtf
This commit is contained in:
Altay
2026-05-13 17:34:45 +03:00
committed by GitHub
parent 210c7c1b85
commit a40499b21a
3 changed files with 85 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

63
test/scripts/openclaw-test-state.test.ts
View File

@@ -19,6 +19,8 @@ function escapeRegex(value: string): string {
return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
}
const secretKeyPattern = /^[a-f0-9]{64}$/u;
describe("scripts/lib/openclaw-test-state", () => {
it("creates a sourceable env file and JSON description", async () => {
const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-test-state-script-"));
@@ -47,12 +49,14 @@ describe("scripts/lib/openclaw-test-state", () => {
expect(payload.stateDir).toBe(path.join(payload.home, ".openclaw"));
expect(payload.configPath).toBe(path.join(payload.stateDir, "openclaw.json"));
expect(payload.workspaceDir).toBe(path.join(payload.home, "workspace"));
expect(payload.env.OPENCLAW_AUTH_PROFILE_SECRET_KEY).toMatch(secretKeyPattern);
expect(payload.env).toEqual({
HOME: payload.home,
USERPROFILE: payload.home,
OPENCLAW_HOME: payload.home,
OPENCLAW_STATE_DIR: payload.stateDir,
OPENCLAW_CONFIG_PATH: payload.configPath,
OPENCLAW_AUTH_PROFILE_SECRET_KEY: payload.env.OPENCLAW_AUTH_PROFILE_SECRET_KEY,
});
expect(payload.config).toEqual({
update: {
@@ -66,14 +70,16 @@ describe("scripts/lib/openclaw-test-state", () => {
expect(envFileText).toContain("export OPENCLAW_HOME=");
expect(envFileText).toContain("export OPENCLAW_STATE_DIR=");
expect(envFileText).toContain("export OPENCLAW_CONFIG_PATH=");
expect(envFileText).toContain("export OPENCLAW_AUTH_PROFILE_SECRET_KEY=");
const probe = await execFileAsync("bash", [
"-lc",
`source ${shellQuote(envFile)}; node -e 'const fs=require("node:fs"); const config=JSON.parse(fs.readFileSync(process.env.OPENCLAW_CONFIG_PATH,"utf8")); process.stdout.write(JSON.stringify({home:process.env.HOME,stateDir:process.env.OPENCLAW_STATE_DIR,channel:config.update.channel}));'`,
`source ${shellQuote(envFile)}; node -e 'const fs=require("node:fs"); const config=JSON.parse(fs.readFileSync(process.env.OPENCLAW_CONFIG_PATH,"utf8")); process.stdout.write(JSON.stringify({home:process.env.HOME,stateDir:process.env.OPENCLAW_STATE_DIR,secretKey:process.env.OPENCLAW_AUTH_PROFILE_SECRET_KEY,channel:config.update.channel}));'`,
]);
expect(JSON.parse(probe.stdout)).toEqual({
home: payload.home,
stateDir: payload.stateDir,
secretKey: payload.env.OPENCLAW_AUTH_PROFILE_SECRET_KEY,
channel: "stable",
});
await fs.rm(payload.root, { recursive: true, force: true });
@@ -106,7 +112,7 @@ describe("scripts/lib/openclaw-test-state", () => {
const probe = await execFileAsync("bash", [
"-lc",
`source ${shellQuote(snippetFile)}; node -e 'const fs=require("node:fs"); const config=JSON.parse(fs.readFileSync(process.env.OPENCLAW_CONFIG_PATH,"utf8")); process.stdout.write(JSON.stringify({home:process.env.HOME,openclawHome:process.env.OPENCLAW_HOME,workspace:process.env.OPENCLAW_TEST_WORKSPACE_DIR,channel:config.update.channel}));'; rm -rf "$HOME"`,
`source ${shellQuote(snippetFile)}; node -e 'const fs=require("node:fs"); const config=JSON.parse(fs.readFileSync(process.env.OPENCLAW_CONFIG_PATH,"utf8")); process.stdout.write(JSON.stringify({home:process.env.HOME,openclawHome:process.env.OPENCLAW_HOME,workspace:process.env.OPENCLAW_TEST_WORKSPACE_DIR,secretKey:process.env.OPENCLAW_AUTH_PROFILE_SECRET_KEY,channel:config.update.channel}));'; rm -rf "$HOME"`,
]);
const payload = JSON.parse(probe.stdout);
@@ -116,6 +122,7 @@ describe("scripts/lib/openclaw-test-state", () => {
);
expect(payload.openclawHome).toBe(payload.home);
expect(payload.workspace).toBe(`${payload.home}/workspace`);
expect(payload.secretKey).toMatch(secretKeyPattern);
expect(payload.channel).toBe("stable");
const customTemp = path.join(tempRoot, "state-tmp");
@@ -135,6 +142,52 @@ describe("scripts/lib/openclaw-test-state", () => {
}
});
it("keeps shell key generation independent of node", async () => {
const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-test-state-path-node-"));
const fakeBin = path.join(tempRoot, "bin");
const snippetFile = path.join(tempRoot, "state.sh");
const functionFile = path.join(tempRoot, "state-function.sh");
try {
await fs.mkdir(fakeBin, { recursive: true });
await fs.writeFile(
path.join(fakeBin, "node"),
"#!/bin/sh\necho 'fake node should not be used for key generation' >&2\nexit 42\n",
"utf8",
);
await fs.chmod(path.join(fakeBin, "node"), 0o755);
const shell = await execFileAsync(process.execPath, [
scriptPath,
"shell",
"--label",
"path-node",
"--scenario",
"empty",
]);
await fs.writeFile(snippetFile, shell.stdout, "utf8");
const shellProbe = await execFileAsync("bash", [
"-lc",
`export PATH=${shellQuote(fakeBin)}:$PATH; source ${shellQuote(snippetFile)}; printf '%s' "$OPENCLAW_AUTH_PROFILE_SECRET_KEY"; rm -rf "$HOME"`,
]);
expect(shellProbe.stdout).toMatch(secretKeyPattern);
const renderedFunction = await execFileAsync(process.execPath, [
scriptPath,
"shell-function",
]);
await fs.writeFile(functionFile, renderedFunction.stdout, "utf8");
const functionProbe = await execFileAsync("bash", [
"-lc",
`export PATH=${shellQuote(fakeBin)}:$PATH; export OPENCLAW_TEST_STATE_TMPDIR=${shellQuote(path.join(tempRoot, "function-tmp"))}; source ${shellQuote(functionFile)}; openclaw_test_state_create "path node" minimal; printf '%s' "$OPENCLAW_AUTH_PROFILE_SECRET_KEY"; rm -rf "$HOME"`,
]);
expect(functionProbe.stdout).toMatch(secretKeyPattern);
} finally {
await fs.rm(tempRoot, { recursive: true, force: true });
}
});
it("creates the upgrade survivor scenario", async () => {
const { stdout } = await execFileAsync(process.execPath, [
scriptPath,
@@ -182,7 +235,7 @@ describe("scripts/lib/openclaw-test-state", () => {
const probe = await execFileAsync("bash", [
"-lc",
`export OPENCLAW_TEST_STATE_TMPDIR=${shellQuote(path.join(tempRoot, "function-tmp"))}; source ${shellQuote(snippetFile)}; export OPENCLAW_AGENT_DIR=/tmp/outside-agent; openclaw_test_state_create "onboard case" minimal; node -e 'const fs=require("node:fs"); const config=JSON.parse(fs.readFileSync(process.env.OPENCLAW_CONFIG_PATH,"utf8")); process.stdout.write(JSON.stringify({home:process.env.HOME,tmpDir:process.env.OPENCLAW_TEST_STATE_TMPDIR,agentDir:process.env.OPENCLAW_AGENT_DIR || null,workspace:process.env.OPENCLAW_TEST_WORKSPACE_DIR,config}));'; rm -rf "$HOME"`,
`export OPENCLAW_TEST_STATE_TMPDIR=${shellQuote(path.join(tempRoot, "function-tmp"))}; source ${shellQuote(snippetFile)}; export OPENCLAW_AGENT_DIR=/tmp/outside-agent; openclaw_test_state_create "onboard case" minimal; node -e 'const fs=require("node:fs"); const config=JSON.parse(fs.readFileSync(process.env.OPENCLAW_CONFIG_PATH,"utf8")); process.stdout.write(JSON.stringify({home:process.env.HOME,tmpDir:process.env.OPENCLAW_TEST_STATE_TMPDIR,agentDir:process.env.OPENCLAW_AGENT_DIR || null,workspace:process.env.OPENCLAW_TEST_WORKSPACE_DIR,secretKey:process.env.OPENCLAW_AUTH_PROFILE_SECRET_KEY,config}));'; rm -rf "$HOME"`,
]);
const payload = JSON.parse(probe.stdout);
@@ -190,16 +243,18 @@ describe("scripts/lib/openclaw-test-state", () => {
expect(payload.home).toContain("/openclaw-onboard-case-minimal-home.");
expect(payload.agentDir).toBeNull();
expect(payload.workspace).toBe(`${payload.home}/workspace`);
expect(payload.secretKey).toMatch(secretKeyPattern);
expect(payload.config).toStrictEqual({});
const existingHome = path.join(tempRoot, "existing-home");
const existingProbe = await execFileAsync("bash", [
"-lc",
`source ${shellQuote(snippetFile)}; openclaw_test_state_create ${shellQuote(existingHome)} minimal; printf '{"kept":true}\\n' > "$OPENCLAW_CONFIG_PATH"; openclaw_test_state_create ${shellQuote(existingHome)} empty; node -e 'const fs=require("node:fs"); const config=JSON.parse(fs.readFileSync(process.env.OPENCLAW_CONFIG_PATH,"utf8")); process.stdout.write(JSON.stringify({home:process.env.HOME,config}));'`,
`source ${shellQuote(snippetFile)}; openclaw_test_state_create ${shellQuote(existingHome)} minimal; firstKey="$OPENCLAW_AUTH_PROFILE_SECRET_KEY"; export firstKey; printf '{"kept":true}\\n' > "$OPENCLAW_CONFIG_PATH"; openclaw_test_state_create ${shellQuote(existingHome)} empty; node -e 'const fs=require("node:fs"); const config=JSON.parse(fs.readFileSync(process.env.OPENCLAW_CONFIG_PATH,"utf8")); process.stdout.write(JSON.stringify({home:process.env.HOME,secretKey:process.env.OPENCLAW_AUTH_PROFILE_SECRET_KEY,firstKey:process.env.firstKey,config}));'`,
]);
const existingPayload = JSON.parse(existingProbe.stdout);
expect(existingPayload.home).toBe(existingHome);
expect(existingPayload.secretKey).toBe(existingPayload.firstKey);
expect(existingPayload.config).toEqual({ kept: true });
} finally {
await fs.rm(tempRoot, { recursive: true, force: true });