@openclaw/zalo 2026.2.25 → 2026.3.2

package/src/secret-input.ts

@@ -0,0 +1,19 @@
+import {
+  hasConfiguredSecretInput,
+  normalizeResolvedSecretInputString,
+  normalizeSecretInputString,
+} from "openclaw/plugin-sdk";
+import { z } from "zod";
+
+export { hasConfiguredSecretInput, normalizeResolvedSecretInputString, normalizeSecretInputString };
+
+export function buildSecretInputSchema() {
+  return z.union([
+    z.string(),
+    z.object({
+      source: z.enum(["env", "file", "exec"]),
+      provider: z.string().min(1),
+      id: z.string().min(1),
+    }),
+  ]);
+}

package/src/token.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it } from "vitest";
+import { resolveZaloToken } from "./token.js";
+import type { ZaloConfig } from "./types.js";
+
+describe("resolveZaloToken", () => {
+  it("falls back to top-level token for non-default accounts without overrides", () => {
+    const cfg = {
+      botToken: "top-level-token",
+      accounts: {
+        work: {},
+      },
+    } as ZaloConfig;
+    const res = resolveZaloToken(cfg, "work");
+    expect(res.token).toBe("top-level-token");
+    expect(res.source).toBe("config");
+  });
+
+  it("uses accounts.default botToken for default account when configured", () => {
+    const cfg = {
+      botToken: "top-level-token",
+      accounts: {
+        default: {
+          botToken: "default-account-token",
+        },
+      },
+    } as ZaloConfig;
+    const res = resolveZaloToken(cfg, "default");
+    expect(res.token).toBe("default-account-token");
+    expect(res.source).toBe("config");
+  });
+
+  it("does not inherit top-level token when account token is explicitly blank", () => {
+    const cfg = {
+      botToken: "top-level-token",
+      accounts: {
+        work: {
+          botToken: "",
+        },
+      },
+    } as ZaloConfig;
+    const res = resolveZaloToken(cfg, "work");
+    expect(res.token).toBe("");
+    expect(res.source).toBe("none");
+  });
+
+  it("resolves account token when account key casing differs from normalized id", () => {
+    const cfg = {
+      accounts: {
+        Work: {
+          botToken: "work-token",
+        },
+      },
+    } as ZaloConfig;
+    const res = resolveZaloToken(cfg, "work");
+    expect(res.token).toBe("work-token");
+    expect(res.source).toBe("config");
+  });
+});

package/src/token.ts

@@ -1,5 +1,7 @@
 import { readFileSync } from "node:fs";
-import { type BaseTokenResolution, DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk";
+import type { BaseTokenResolution } from "openclaw/plugin-sdk";
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
+import { normalizeResolvedSecretInputString, normalizeSecretInputString } from "./secret-input.js";
 import type { ZaloConfig } from "./types.js";
 
 export type ZaloTokenResolution = BaseTokenResolution & {
@@ -9,17 +11,36 @@ export type ZaloTokenResolution = BaseTokenResolution & {
 export function resolveZaloToken(
   config: ZaloConfig | undefined,
   accountId?: string | null,
+  options?: { allowUnresolvedSecretRef?: boolean },
 ): ZaloTokenResolution {
   const resolvedAccountId = accountId ?? DEFAULT_ACCOUNT_ID;
   const isDefaultAccount = resolvedAccountId === DEFAULT_ACCOUNT_ID;
   const baseConfig = config;
-  const accountConfig =
-    resolvedAccountId !== DEFAULT_ACCOUNT_ID
-      ? (baseConfig?.accounts?.[resolvedAccountId] as ZaloConfig | undefined)
-      : undefined;
+  const resolveAccountConfig = (id: string): ZaloConfig | undefined => {
+    const accounts = baseConfig?.accounts;
+    if (!accounts || typeof accounts !== "object") {
+      return undefined;
+    }
+    const direct = accounts[id] as ZaloConfig | undefined;
+    if (direct) {
+      return direct;
+    }
+    const normalized = normalizeAccountId(id);
+    const matchKey = Object.keys(accounts).find((key) => normalizeAccountId(key) === normalized);
+    return matchKey ? ((accounts as Record<string, ZaloConfig>)[matchKey] ?? undefined) : undefined;
+  };
+  const accountConfig = resolveAccountConfig(resolvedAccountId);
+  const accountHasBotToken = Boolean(
+    accountConfig && Object.prototype.hasOwnProperty.call(accountConfig, "botToken"),
+  );
 
-  if (accountConfig) {
-    const token = accountConfig.botToken?.trim();
+  if (accountConfig && accountHasBotToken) {
+    const token = options?.allowUnresolvedSecretRef
+      ? normalizeSecretInputString(accountConfig.botToken)
+      : normalizeResolvedSecretInputString({
+          value: accountConfig.botToken,
+          path: `channels.zalo.accounts.${resolvedAccountId}.botToken`,
+        });
     if (token) {
       return { token, source: "config" };
     }
@@ -36,8 +57,25 @@ export function resolveZaloToken(
     }
   }
 
-  if (isDefaultAccount) {
-    const token = baseConfig?.botToken?.trim();
+  const accountTokenFile = accountConfig?.tokenFile?.trim();
+  if (!accountHasBotToken && accountTokenFile) {
+    try {
+      const fileToken = readFileSync(accountTokenFile, "utf8").trim();
+      if (fileToken) {
+        return { token: fileToken, source: "configFile" };
+      }
+    } catch {
+      // ignore read failures
+    }
+  }
+
+  if (!accountHasBotToken) {
+    const token = options?.allowUnresolvedSecretRef
+      ? normalizeSecretInputString(baseConfig?.botToken)
+      : normalizeResolvedSecretInputString({
+          value: baseConfig?.botToken,
+          path: "channels.zalo.botToken",
+        });
     if (token) {
       return { token, source: "config" };
     }
@@ -52,6 +90,9 @@ export function resolveZaloToken(
         // ignore read failures
       }
     }
+  }
+
+  if (isDefaultAccount) {
     const envToken = process.env.ZALO_BOT_TOKEN?.trim();
     if (envToken) {
       return { token: envToken, source: "env" };

package/src/types.ts

@@ -1,16 +1,18 @@
+import type { SecretInput } from "openclaw/plugin-sdk";
+
 export type ZaloAccountConfig = {
   /** Optional display name for this account (used in CLI/UI lists). */
   name?: string;
   /** If false, do not start this Zalo account. Default: true. */
   enabled?: boolean;
   /** Bot token from Zalo Bot Creator. */
-  botToken?: string;
+  botToken?: SecretInput;
   /** Path to file containing the bot token. */
   tokenFile?: string;
   /** Webhook URL for receiving updates (HTTPS required). */
   webhookUrl?: string;
   /** Webhook secret token (8-256 chars) for request verification. */
-  webhookSecret?: string;
+  webhookSecret?: SecretInput;
   /** Webhook path for the gateway HTTP server (defaults to webhook URL path). */
   webhookPath?: string;
   /** Direct message access policy (default: pairing). */