@openclaw/googlechat 2026.5.2-beta.1 → 2026.5.3-beta.1

package/src/secret-contract.test.ts

@@ -1,60 +0,0 @@
-import type { OpenClawConfig } from "openclaw/plugin-sdk/config-types";
-import {
-  applyResolvedAssignments,
-  createResolverContext,
-  resolveSecretRefValues,
-} from "openclaw/plugin-sdk/runtime-secret-resolution";
-import { describe, expect, it } from "vitest";
-import { collectRuntimeConfigAssignments } from "./secret-contract.js";
-
-describe("googlechat secret contract", () => {
-  it("resolves account serviceAccount SecretRefs for enabled accounts", async () => {
-    const sourceConfig = {
-      channels: {
-        googlechat: {
-          enabled: true,
-          accounts: {
-            work: {
-              enabled: true,
-              serviceAccountRef: {
-                source: "env",
-                provider: "default",
-                id: "GOOGLECHAT_SERVICE_ACCOUNT",
-              },
-            },
-          },
-        },
-      },
-    } satisfies OpenClawConfig;
-    const resolvedConfig: OpenClawConfig = structuredClone(sourceConfig);
-    const context = createResolverContext({
-      sourceConfig,
-      env: {
-        GOOGLECHAT_SERVICE_ACCOUNT: '{"client_email":"bot@example.com"}',
-      },
-    });
-
-    collectRuntimeConfigAssignments({
-      config: resolvedConfig,
-      defaults: undefined,
-      context,
-    });
-
-    const resolved = await resolveSecretRefValues(
-      context.assignments.map((assignment) => assignment.ref),
-      {
-        config: sourceConfig,
-        env: context.env,
-        cache: context.cache,
-      },
-    );
-    applyResolvedAssignments({
-      assignments: context.assignments,
-      resolved,
-    });
-
-    const workAccount = resolvedConfig.channels?.googlechat?.accounts?.work;
-    expect(workAccount?.serviceAccount).toBe('{"client_email":"bot@example.com"}');
-    expect(context.warnings).toEqual([]);
-  });
-});

package/src/secret-contract.ts

@@ -1,161 +0,0 @@
-import {
-  getChannelSurface,
-  hasOwnProperty,
-  pushAssignment,
-  pushInactiveSurfaceWarning,
-  pushWarning,
-  resolveChannelAccountSurface,
-  type ResolverContext,
-  type SecretDefaults,
-} from "openclaw/plugin-sdk/channel-secret-basic-runtime";
-import { coerceSecretRef } from "openclaw/plugin-sdk/secret-ref-runtime";
-
-type GoogleChatAccountLike = {
-  serviceAccount?: unknown;
-  serviceAccountRef?: unknown;
-  accounts?: Record<string, unknown>;
-};
-
-export const secretTargetRegistryEntries: import("openclaw/plugin-sdk/channel-secret-basic-runtime").SecretTargetRegistryEntry[] =
-  [
-    {
-      id: "channels.googlechat.accounts.*.serviceAccount",
-      targetType: "channels.googlechat.serviceAccount",
-      targetTypeAliases: ["channels.googlechat.accounts.*.serviceAccount"],
-      configFile: "openclaw.json",
-      pathPattern: "channels.googlechat.accounts.*.serviceAccount",
-      refPathPattern: "channels.googlechat.accounts.*.serviceAccountRef",
-      secretShape: "sibling_ref",
-      expectedResolvedValue: "string-or-object",
-      includeInPlan: true,
-      includeInConfigure: true,
-      includeInAudit: true,
-      accountIdPathSegmentIndex: 3,
-    },
-    {
-      id: "channels.googlechat.serviceAccount",
-      targetType: "channels.googlechat.serviceAccount",
-      configFile: "openclaw.json",
-      pathPattern: "channels.googlechat.serviceAccount",
-      refPathPattern: "channels.googlechat.serviceAccountRef",
-      secretShape: "sibling_ref",
-      expectedResolvedValue: "string-or-object",
-      includeInPlan: true,
-      includeInConfigure: true,
-      includeInAudit: true,
-    },
-  ];
-
-function resolveSecretInputRef(params: {
-  value: unknown;
-  refValue?: unknown;
-  defaults?: SecretDefaults;
-}) {
-  const explicitRef = coerceSecretRef(params.refValue, params.defaults);
-  const inlineRef = explicitRef ? null : coerceSecretRef(params.value, params.defaults);
-  return {
-    explicitRef,
-    inlineRef,
-    ref: explicitRef ?? inlineRef,
-  };
-}
-
-function collectGoogleChatAccountAssignment(params: {
-  target: GoogleChatAccountLike;
-  path: string;
-  defaults?: SecretDefaults;
-  context: ResolverContext;
-  active?: boolean;
-  inactiveReason?: string;
-}): void {
-  const { explicitRef, ref } = resolveSecretInputRef({
-    value: params.target.serviceAccount,
-    refValue: params.target.serviceAccountRef,
-    defaults: params.defaults,
-  });
-  if (!ref) {
-    return;
-  }
-  if (params.active === false) {
-    pushInactiveSurfaceWarning({
-      context: params.context,
-      path: `${params.path}.serviceAccount`,
-      details: params.inactiveReason,
-    });
-    return;
-  }
-  if (
-    explicitRef &&
-    params.target.serviceAccount !== undefined &&
-    !coerceSecretRef(params.target.serviceAccount, params.defaults)
-  ) {
-    pushWarning(params.context, {
-      code: "SECRETS_REF_OVERRIDES_PLAINTEXT",
-      path: params.path,
-      message: `${params.path}: serviceAccountRef is set; runtime will ignore plaintext serviceAccount.`,
-    });
-  }
-  pushAssignment(params.context, {
-    ref,
-    path: `${params.path}.serviceAccount`,
-    expected: "string-or-object",
-    apply: (value) => {
-      params.target.serviceAccount = value;
-    },
-  });
-}
-
-export function collectRuntimeConfigAssignments(params: {
-  config: { channels?: Record<string, unknown> };
-  defaults?: SecretDefaults;
-  context: ResolverContext;
-}): void {
-  const resolved = getChannelSurface(params.config, "googlechat");
-  if (!resolved) {
-    return;
-  }
-  const googleChat = resolved.channel as GoogleChatAccountLike;
-  const surface = resolveChannelAccountSurface(googleChat as Record<string, unknown>);
-  const topLevelServiceAccountActive = !surface.channelEnabled
-    ? false
-    : !surface.hasExplicitAccounts
-      ? true
-      : surface.accounts.some(
-          ({ account, enabled }) =>
-            enabled &&
-            !hasOwnProperty(account, "serviceAccount") &&
-            !hasOwnProperty(account, "serviceAccountRef"),
-        );
-  collectGoogleChatAccountAssignment({
-    target: googleChat,
-    path: "channels.googlechat",
-    defaults: params.defaults,
-    context: params.context,
-    active: topLevelServiceAccountActive,
-    inactiveReason: "no enabled account inherits this top-level Google Chat serviceAccount.",
-  });
-  if (!surface.hasExplicitAccounts) {
-    return;
-  }
-  for (const { accountId, account, enabled } of surface.accounts) {
-    if (
-      !hasOwnProperty(account, "serviceAccount") &&
-      !hasOwnProperty(account, "serviceAccountRef")
-    ) {
-      continue;
-    }
-    collectGoogleChatAccountAssignment({
-      target: account as GoogleChatAccountLike,
-      path: `channels.googlechat.accounts.${accountId}`,
-      defaults: params.defaults,
-      context: params.context,
-      active: enabled,
-      inactiveReason: "Google Chat account is disabled.",
-    });
-  }
-}
-
-export const channelSecrets = {
-  secretTargetRegistryEntries,
-  collectRuntimeConfigAssignments,
-};

package/src/sender-allow.ts

@@ -1,46 +0,0 @@
-import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
-
-function normalizeUserId(raw?: string | null): string {
-  const trimmed = typeof raw === "string" ? raw.trim() : "";
-  if (!trimmed) {
-    return "";
-  }
-  return normalizeLowercaseStringOrEmpty(trimmed.replace(/^users\//i, ""));
-}
-
-function isEmailLike(value: string): boolean {
-  // Keep this intentionally loose; allowlists are user-provided config.
-  return value.includes("@");
-}
-
-export function isSenderAllowed(
-  senderId: string,
-  senderEmail: string | undefined,
-  allowFrom: string[],
-  allowNameMatching = false,
-) {
-  if (allowFrom.includes("*")) {
-    return true;
-  }
-  const normalizedSenderId = normalizeUserId(senderId);
-  const normalizedEmail = normalizeLowercaseStringOrEmpty(senderEmail ?? "");
-  return allowFrom.some((entry) => {
-    const normalized = normalizeLowercaseStringOrEmpty(entry);
-    if (!normalized) {
-      return false;
-    }
-
-    // Accept `googlechat:<id>` but treat `users/...` as an *ID* only (deprecated `users/<email>`).
-    const withoutPrefix = normalized.replace(/^(googlechat|google-chat|gchat):/i, "");
-    if (withoutPrefix.startsWith("users/")) {
-      return normalizeUserId(withoutPrefix) === normalizedSenderId;
-    }
-
-    // Raw email allowlist entries are a break-glass override.
-    if (allowNameMatching && normalizedEmail && isEmailLike(withoutPrefix)) {
-      return withoutPrefix === normalizedEmail;
-    }
-
-    return withoutPrefix.replace(/^users\//i, "") === normalizedSenderId;
-  });
-}

package/src/setup-core.ts

@@ -1,40 +0,0 @@
-import {
-  createPatchedAccountSetupAdapter,
-  createSetupInputPresenceValidator,
-} from "openclaw/plugin-sdk/setup-runtime";
-
-const channel = "googlechat" as const;
-
-export const googlechatSetupAdapter = createPatchedAccountSetupAdapter({
-  channelKey: channel,
-  validateInput: createSetupInputPresenceValidator({
-    defaultAccountOnlyEnvError:
-      "GOOGLE_CHAT_SERVICE_ACCOUNT env vars can only be used for the default account.",
-    whenNotUseEnv: [
-      {
-        someOf: ["token", "tokenFile"],
-        message: "Google Chat requires --token (service account JSON) or --token-file.",
-      },
-    ],
-  }),
-  buildPatch: (input) => {
-    const patch = input.useEnv
-      ? {}
-      : input.tokenFile
-        ? { serviceAccountFile: input.tokenFile }
-        : input.token
-          ? { serviceAccount: input.token }
-          : {};
-    const audienceType = input.audienceType?.trim();
-    const audience = input.audience?.trim();
-    const webhookPath = input.webhookPath?.trim();
-    const webhookUrl = input.webhookUrl?.trim();
-    return {
-      ...patch,
-      ...(audienceType ? { audienceType } : {}),
-      ...(audience ? { audience } : {}),
-      ...(webhookPath ? { webhookPath } : {}),
-      ...(webhookUrl ? { webhookUrl } : {}),
-    };
-  },
-});

package/src/setup-surface.ts

@@ -1,236 +0,0 @@
-import {
-  addWildcardAllowFrom,
-  applySetupAccountConfigPatch,
-  createPromptParsedAllowFromForAccount,
-  createStandardChannelSetupStatus,
-  DEFAULT_ACCOUNT_ID,
-  formatDocsLink,
-  mergeAllowFromEntries,
-  migrateBaseNameToDefaultAccount,
-  splitSetupEntries,
-  type ChannelSetupDmPolicy,
-  type ChannelSetupWizard,
-} from "openclaw/plugin-sdk/setup";
-import {
-  normalizeOptionalString,
-  normalizeStringifiedOptionalString,
-} from "openclaw/plugin-sdk/text-runtime";
-import { resolveDefaultGoogleChatAccountId, resolveGoogleChatAccount } from "./accounts.js";
-
-const channel = "googlechat" as const;
-const ENV_SERVICE_ACCOUNT = "GOOGLE_CHAT_SERVICE_ACCOUNT";
-const ENV_SERVICE_ACCOUNT_FILE = "GOOGLE_CHAT_SERVICE_ACCOUNT_FILE";
-const USE_ENV_FLAG = "__googlechatUseEnv";
-const AUTH_METHOD_FLAG = "__googlechatAuthMethod";
-
-type GoogleChatTextInput = NonNullable<ChannelSetupWizard["textInputs"]>[number];
-type GoogleChatTextInputKey = GoogleChatTextInput["inputKey"];
-
-const promptAllowFrom = createPromptParsedAllowFromForAccount({
-  defaultAccountId: resolveDefaultGoogleChatAccountId,
-  message: "Google Chat allowFrom (users/<id> or raw email; avoid users/<email>)",
-  placeholder: "users/123456789, name@example.com",
-  parseEntries: (raw) => ({
-    entries: mergeAllowFromEntries(undefined, splitSetupEntries(raw)),
-  }),
-  getExistingAllowFrom: ({ cfg, accountId }) =>
-    resolveGoogleChatAccount({ cfg, accountId }).config.dm?.allowFrom ?? [],
-  applyAllowFrom: ({ cfg, accountId, allowFrom }) =>
-    applySetupAccountConfigPatch({
-      cfg,
-      channelKey: channel,
-      accountId,
-      patch: {
-        dm: {
-          ...resolveGoogleChatAccount({ cfg, accountId }).config.dm,
-          allowFrom,
-        },
-      },
-    }),
-});
-
-const googlechatDmPolicy: ChannelSetupDmPolicy = {
-  label: "Google Chat",
-  channel,
-  policyKey: "channels.googlechat.dm.policy",
-  allowFromKey: "channels.googlechat.dm.allowFrom",
-  resolveConfigKeys: (cfg, accountId) =>
-    (accountId ?? resolveDefaultGoogleChatAccountId(cfg)) !== DEFAULT_ACCOUNT_ID
-      ? {
-          policyKey: `channels.googlechat.accounts.${accountId ?? resolveDefaultGoogleChatAccountId(cfg)}.dm.policy`,
-          allowFromKey: `channels.googlechat.accounts.${accountId ?? resolveDefaultGoogleChatAccountId(cfg)}.dm.allowFrom`,
-        }
-      : {
-          policyKey: "channels.googlechat.dm.policy",
-          allowFromKey: "channels.googlechat.dm.allowFrom",
-        },
-  getCurrent: (cfg, accountId) =>
-    resolveGoogleChatAccount({
-      cfg,
-      accountId: accountId ?? resolveDefaultGoogleChatAccountId(cfg),
-    }).config.dm?.policy ?? "pairing",
-  setPolicy: (cfg, policy, accountId) => {
-    const resolvedAccountId = accountId ?? resolveDefaultGoogleChatAccountId(cfg);
-    const currentDm = resolveGoogleChatAccount({
-      cfg,
-      accountId: resolvedAccountId,
-    }).config.dm;
-    return applySetupAccountConfigPatch({
-      cfg,
-      channelKey: channel,
-      accountId: resolvedAccountId,
-      patch: {
-        dm: {
-          ...currentDm,
-          policy,
-          ...(policy === "open" ? { allowFrom: addWildcardAllowFrom(currentDm?.allowFrom) } : {}),
-        },
-      },
-    });
-  },
-  promptAllowFrom,
-};
-
-function createServiceAccountTextInput(params: {
-  inputKey: GoogleChatTextInputKey;
-  message: string;
-  placeholder: string;
-  authMethod: "file" | "inline";
-  patchKey: "serviceAccountFile" | "serviceAccount";
-}): GoogleChatTextInput {
-  return {
-    inputKey: params.inputKey,
-    message: params.message,
-    placeholder: params.placeholder,
-    shouldPrompt: ({ credentialValues }) =>
-      credentialValues[USE_ENV_FLAG] !== "1" &&
-      credentialValues[AUTH_METHOD_FLAG] === params.authMethod,
-    validate: ({ value }) => (normalizeStringifiedOptionalString(value) ? undefined : "Required"),
-    normalizeValue: ({ value }) => normalizeStringifiedOptionalString(value) ?? "",
-    applySet: async ({ cfg, accountId, value }) =>
-      applySetupAccountConfigPatch({
-        cfg,
-        channelKey: channel,
-        accountId,
-        patch: { [params.patchKey]: value },
-      }),
-  };
-}
-
-export const googlechatSetupWizard: ChannelSetupWizard = {
-  channel,
-  status: createStandardChannelSetupStatus({
-    channelLabel: "Google Chat",
-    configuredLabel: "configured",
-    unconfiguredLabel: "needs service account",
-    configuredHint: "configured",
-    unconfiguredHint: "needs auth",
-    includeStatusLine: true,
-    resolveConfigured: ({ cfg, accountId }) =>
-      resolveGoogleChatAccount({ cfg, accountId }).credentialSource !== "none",
-  }),
-  introNote: {
-    title: "Google Chat setup",
-    lines: [
-      "Google Chat apps use service-account auth and an HTTPS webhook.",
-      "Set the Chat API scopes in your service account and configure the Chat app URL.",
-      "Webhook verification requires audience type + audience value.",
-      `Docs: ${formatDocsLink("/channels/googlechat", "googlechat")}`,
-    ],
-  },
-  prepare: async ({ cfg, accountId, credentialValues, prompter }) => {
-    const envReady =
-      accountId === DEFAULT_ACCOUNT_ID &&
-      (Boolean(process.env[ENV_SERVICE_ACCOUNT]) || Boolean(process.env[ENV_SERVICE_ACCOUNT_FILE]));
-    if (envReady) {
-      const useEnv = await prompter.confirm({
-        message: "Use GOOGLE_CHAT_SERVICE_ACCOUNT env vars?",
-        initialValue: true,
-      });
-      if (useEnv) {
-        return {
-          cfg: applySetupAccountConfigPatch({
-            cfg,
-            channelKey: channel,
-            accountId,
-            patch: {},
-          }),
-          credentialValues: {
-            ...credentialValues,
-            [USE_ENV_FLAG]: "1",
-          },
-        };
-      }
-    }
-
-    const method = await prompter.select({
-      message: "Google Chat auth method",
-      options: [
-        { value: "file", label: "Service account JSON file" },
-        { value: "inline", label: "Paste service account JSON" },
-      ],
-      initialValue: "file",
-    });
-
-    return {
-      credentialValues: {
-        ...credentialValues,
-        [USE_ENV_FLAG]: "0",
-        [AUTH_METHOD_FLAG]: method,
-      },
-    };
-  },
-  credentials: [],
-  textInputs: [
-    createServiceAccountTextInput({
-      inputKey: "tokenFile",
-      message: "Service account JSON path",
-      placeholder: "/path/to/service-account.json",
-      authMethod: "file",
-      patchKey: "serviceAccountFile",
-    }),
-    createServiceAccountTextInput({
-      inputKey: "token",
-      message: "Service account JSON (single line)",
-      placeholder: '{"type":"service_account", ... }',
-      authMethod: "inline",
-      patchKey: "serviceAccount",
-    }),
-  ],
-  finalize: async ({ cfg, accountId, prompter }) => {
-    const account = resolveGoogleChatAccount({
-      cfg,
-      accountId,
-    });
-    const audienceType = await prompter.select({
-      message: "Webhook audience type",
-      options: [
-        { value: "app-url", label: "App URL (recommended)" },
-        { value: "project-number", label: "Project number" },
-      ],
-      initialValue: account.config.audienceType === "project-number" ? "project-number" : "app-url",
-    });
-    const audience = await prompter.text({
-      message: audienceType === "project-number" ? "Project number" : "App URL",
-      placeholder:
-        audienceType === "project-number" ? "1234567890" : "https://your.host/googlechat",
-      initialValue: account.config.audience || undefined,
-      validate: (value) => (normalizeStringifiedOptionalString(value) ? undefined : "Required"),
-    });
-    return {
-      cfg: migrateBaseNameToDefaultAccount({
-        cfg: applySetupAccountConfigPatch({
-          cfg,
-          channelKey: channel,
-          accountId,
-          patch: {
-            audienceType,
-            audience: normalizeOptionalString(audience) ?? "",
-          },
-        }),
-        channelKey: channel,
-      }),
-    };
-  },
-  dmPolicy: googlechatDmPolicy,
-};