@hywkp/test-openclaw-sider 1.0.2

package/src/auth.ts

@@ -0,0 +1,292 @@
+import { type OpenClawConfig, type PluginRuntime } from "openclaw/plugin-sdk";
+import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
+import { type OpenClawPluginService } from "openclaw/plugin-sdk/plugin-entry";
+import {
+  SIDER_CHANNEL_ID,
+  SIDER_DEFAULT_BASE_URL,
+  readDefaultSiderSetupTokenEnv,
+  readSiderBaseUrlEnv,
+} from "./config.js";
+import { SIDER_USER_AGENT } from "./user-agent.js";
+
+export const SIDER_AUTH_EXCHANGE_API_PATH = "/v1/claws/register";
+export type SiderSetupConfigSnapshot = {
+  enabled?: boolean;
+  setupToken?: string;
+  token?: string;
+};
+
+type SiderRegisterResponse = {
+  claw_id: string;
+  token: string;
+};
+
+type SiderResolvedCredentials = {
+  token: string;
+};
+
+type SiderAuthSetupServiceParams = {
+  listAccountIds: (cfg: OpenClawConfig) => string[];
+  getAccountSetupConfig: (
+    cfg: OpenClawConfig,
+    accountId: string,
+  ) => SiderSetupConfigSnapshot;
+};
+
+let runtimeRef: PluginRuntime | null = null;
+const pendingAccountOperations = new Map<string, Promise<OpenClawConfig>>();
+
+function getSiderAuthRuntime(): PluginRuntime {
+  if (!runtimeRef) {
+    throw new Error("sider auth runtime not initialized");
+  }
+  return runtimeRef;
+}
+
+function trimMaybe(value: string | undefined): string | undefined {
+  const trimmed = value?.trim();
+  return trimmed || undefined;
+}
+
+function normalizeGatewayUrl(raw?: string): string | undefined {
+  const trimmed = trimMaybe(raw);
+  return trimmed ? trimmed.replace(/\/+$/, "") : undefined;
+}
+
+export function resolveSiderBaseUrl(): string {
+  return normalizeGatewayUrl(readSiderBaseUrlEnv()) ?? SIDER_DEFAULT_BASE_URL;
+}
+
+function getPendingOperation(accountId: string): Promise<OpenClawConfig> | undefined {
+  return pendingAccountOperations.get(accountId);
+}
+
+async function withPendingOperation(
+  accountId: string,
+  run: () => Promise<OpenClawConfig>,
+): Promise<OpenClawConfig> {
+  const existing = getPendingOperation(accountId);
+  if (existing) {
+    return await existing;
+  }
+  const pending = (async () => {
+    try {
+      return await run();
+    } finally {
+      pendingAccountOperations.delete(accountId);
+    }
+  })();
+  pendingAccountOperations.set(accountId, pending);
+  return await pending;
+}
+
+function buildSiderApiUrl(pathname: string): string {
+  const url = new URL(resolveSiderBaseUrl());
+  const basePath = url.pathname.replace(/\/+$/, "");
+  const suffix = pathname.startsWith("/") ? pathname : `/${pathname}`;
+  url.pathname = `${basePath}${suffix}`;
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+
+export function resolveSiderApiUrl(pathname: string): string {
+  return buildSiderApiUrl(pathname);
+}
+
+export function formatAuthorizationHeader(token: string): string {
+  const trimmed = token.trim();
+  if (!trimmed) {
+    return trimmed;
+  }
+  return /^Bearer\s+/i.test(trimmed) ? trimmed : `Bearer ${trimmed}`;
+}
+
+export function appendTokenQuery(url: string, token?: string): string {
+  const trimmed = token?.trim();
+  if (!trimmed) {
+    return url;
+  }
+  const next = new URL(url);
+  next.searchParams.set("token", trimmed);
+  return next.toString();
+}
+
+function parseRegisterResponse(payload: unknown): SiderRegisterResponse {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new Error("selfclaw register response is not a JSON object");
+  }
+  const clawId = trimMaybe(
+    typeof (payload as Record<string, unknown>).claw_id === "string"
+      ? ((payload as Record<string, unknown>).claw_id as string)
+      : undefined,
+  );
+  const token = trimMaybe(
+    typeof (payload as Record<string, unknown>).token === "string"
+      ? ((payload as Record<string, unknown>).token as string)
+      : undefined,
+  );
+  if (!clawId || !token) {
+    throw new Error("selfclaw register response missing claw_id/token");
+  }
+  return {
+    claw_id: clawId,
+    token,
+  };
+}
+
+async function exchangeSetupToken(params: {
+  pathname: string;
+  authorization: string;
+}): Promise<SiderResolvedCredentials> {
+  const url = buildSiderApiUrl(params.pathname);
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      Authorization: formatAuthorizationHeader(params.authorization),
+      "User-Agent": SIDER_USER_AGENT,
+    },
+  });
+  if (!response.ok) {
+    let detail = "";
+    try {
+      const text = (await response.text()).trim();
+      if (text) {
+        detail = `: ${text}`;
+      }
+    } catch {
+      // Ignore body read failures and keep the status-only error.
+    }
+    throw new Error(`selfclaw request failed (${response.status} ${response.statusText})${detail}`);
+  }
+  let payload: unknown = null;
+  try {
+    payload = await response.json();
+  } catch {
+    payload = null;
+  }
+  const parsed = parseRegisterResponse(payload);
+  return { token: parsed.token };
+}
+
+export function cloneOpenClawConfig(cfg: OpenClawConfig): OpenClawConfig {
+  return structuredClone(cfg);
+}
+
+function ensureChannelConfig(cfg: OpenClawConfig): Record<string, unknown> {
+  const next = cfg as OpenClawConfig & {
+    channels?: Record<string, Record<string, unknown>>;
+  };
+  next.channels ??= {};
+  next.channels[SIDER_CHANNEL_ID] ??= {};
+  return next.channels[SIDER_CHANNEL_ID]!;
+}
+
+export function resolveWritableSiderAccountConfig(
+  cfg: OpenClawConfig,
+  accountId: string,
+): Record<string, unknown> {
+  const channelCfg = ensureChannelConfig(cfg);
+  if (accountId === DEFAULT_ACCOUNT_ID) {
+    return channelCfg;
+  }
+  const accounts =
+    typeof channelCfg.accounts === "object" && channelCfg.accounts && !Array.isArray(channelCfg.accounts)
+      ? (channelCfg.accounts as Record<string, Record<string, unknown>>)
+      : ((channelCfg.accounts = {}) as Record<string, Record<string, unknown>>);
+  accounts[accountId] ??= {};
+  return accounts[accountId]!;
+}
+
+async function persistSiderCredentials(params: {
+  accountId: string;
+  credentials: SiderResolvedCredentials;
+}): Promise<OpenClawConfig> {
+  const runtime = getSiderAuthRuntime();
+  const latestCfg = cloneOpenClawConfig(runtime.config.loadConfig());
+  const accountCfg = resolveWritableSiderAccountConfig(latestCfg, params.accountId);
+  accountCfg.token = params.credentials.token;
+  delete accountCfg.setupToken;
+  if (accountCfg.enabled === undefined) {
+    accountCfg.enabled = true;
+  }
+  await runtime.config.writeConfigFile(latestCfg);
+  return latestCfg;
+}
+
+function resolveConfiguredSetupToken(snapshot: SiderSetupConfigSnapshot): string | undefined {
+  return trimMaybe(snapshot.setupToken);
+}
+
+export function setSiderAuthRuntime(runtime: PluginRuntime): void {
+  runtimeRef = runtime;
+}
+
+export function resolveSiderSetupToken(
+  accountId: string,
+  snapshot?: SiderSetupConfigSnapshot,
+): string | undefined {
+  const configuredToken = snapshot ? resolveConfiguredSetupToken(snapshot) : undefined;
+  if (configuredToken) {
+    return configuredToken;
+  }
+  if (accountId === DEFAULT_ACCOUNT_ID) {
+    return trimMaybe(readDefaultSiderSetupTokenEnv());
+  }
+  return undefined;
+}
+
+export function isSiderAccountSetupPending(accountId: string): boolean {
+  return pendingAccountOperations.has(accountId);
+}
+
+export async function ensureSiderAccountSetup(params: {
+  cfg: OpenClawConfig;
+  accountId: string;
+  getAccountSetupConfig: (
+    cfg: OpenClawConfig,
+    accountId: string,
+  ) => SiderSetupConfigSnapshot;
+}): Promise<OpenClawConfig> {
+  const snapshot = params.getAccountSetupConfig(params.cfg, params.accountId);
+  if (snapshot.enabled === false) {
+    return params.cfg;
+  }
+  const setupToken = resolveSiderSetupToken(params.accountId, snapshot);
+  if (!setupToken) {
+    return params.cfg;
+  }
+  return await withPendingOperation(params.accountId, async () => {
+    const credentials = await exchangeSetupToken({
+      pathname: SIDER_AUTH_EXCHANGE_API_PATH,
+      authorization: setupToken,
+    });
+    return await persistSiderCredentials({
+      accountId: params.accountId,
+      credentials,
+    });
+  });
+}
+
+export function createSiderAuthSetupService(
+  params: SiderAuthSetupServiceParams,
+): OpenClawPluginService {
+  return {
+    id: "sider-auth-setup",
+    start: async (ctx) => {
+      const accountIds = params.listAccountIds(ctx.config);
+      for (const accountId of accountIds) {
+        try {
+          await ensureSiderAccountSetup({
+            cfg: ctx.config,
+            accountId,
+            getAccountSetupConfig: params.getAccountSetupConfig,
+          });
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          ctx.logger.warn(`sider setup failed for "${accountId}": ${message}`);
+        }
+      }
+    },
+  };
+}