Upload 189 files

src/gateway/auth.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, it } from "vitest";
+import crypto from "node:crypto";
 import { authorizeGatewayConnect } from "./auth.js";
 
 describe("gateway auth", () => {
@@ -98,4 +99,48 @@ describe("gateway auth", () => {
     expect(res.method).toBe("tailscale");
     expect(res.user).toBe("peter");
   });
+
+  it("allows Control UI oauth session cookie to satisfy token mode auth", async () => {
+    const prevEnv = {
+      OPENCLAW_CONTROL_UI_GOOGLE_CLIENT_ID: process.env.OPENCLAW_CONTROL_UI_GOOGLE_CLIENT_ID,
+      OPENCLAW_CONTROL_UI_GOOGLE_CLIENT_SECRET: process.env.OPENCLAW_CONTROL_UI_GOOGLE_CLIENT_SECRET,
+      OPENCLAW_CONTROL_UI_SESSION_SECRET: process.env.OPENCLAW_CONTROL_UI_SESSION_SECRET,
+      OPENCLAW_CONTROL_UI_ALLOWED_GOOGLE_EMAILS: process.env.OPENCLAW_CONTROL_UI_ALLOWED_GOOGLE_EMAILS,
+    };
+    try {
+      process.env.OPENCLAW_CONTROL_UI_GOOGLE_CLIENT_ID = "cid";
+      process.env.OPENCLAW_CONTROL_UI_GOOGLE_CLIENT_SECRET = "csecret";
+      process.env.OPENCLAW_CONTROL_UI_SESSION_SECRET = "session-secret";
+      process.env.OPENCLAW_CONTROL_UI_ALLOWED_GOOGLE_EMAILS = "admin@example.com";
+
+      const payload = {
+        v: 1,
+        exp: Math.floor(Date.now() / 1000) + 60,
+        provider: "google",
+        sub: "sub-1",
+        email: "admin@example.com",
+      };
+      const body = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+      const sig = crypto.createHmac("sha256", "session-secret").update(body).digest("base64url");
+      const cookieToken = `${body}.${sig}`;
+
+      const res = await authorizeGatewayConnect({
+        auth: { mode: "token", token: "gateway-token", allowTailscale: false },
+        connectAuth: null,
+        client: { id: "openclaw-control-ui", version: "test", platform: "web", mode: "webchat" },
+        req: {
+          socket: { remoteAddress: "203.0.113.1" },
+          headers: { host: "example.com", cookie: `openclaw_ui_session=${encodeURIComponent(cookieToken)}` },
+        } as never,
+      });
+      expect(res.ok).toBe(true);
+      expect(res.method).toBe("control-ui-oauth");
+      expect(res.user).toBe("admin@example.com");
+    } finally {
+      process.env.OPENCLAW_CONTROL_UI_GOOGLE_CLIENT_ID = prevEnv.OPENCLAW_CONTROL_UI_GOOGLE_CLIENT_ID;
+      process.env.OPENCLAW_CONTROL_UI_GOOGLE_CLIENT_SECRET = prevEnv.OPENCLAW_CONTROL_UI_GOOGLE_CLIENT_SECRET;
+      process.env.OPENCLAW_CONTROL_UI_SESSION_SECRET = prevEnv.OPENCLAW_CONTROL_UI_SESSION_SECRET;
+      process.env.OPENCLAW_CONTROL_UI_ALLOWED_GOOGLE_EMAILS = prevEnv.OPENCLAW_CONTROL_UI_ALLOWED_GOOGLE_EMAILS;
+    }
+  });
 });

src/gateway/auth.ts

@@ -2,6 +2,8 @@ import type { IncomingMessage } from "node:http";
 import { timingSafeEqual } from "node:crypto";
 import type { GatewayAuthConfig, GatewayTailscaleMode } from "../config/config.js";
 import { readTailscaleWhoisIdentity, type TailscaleWhoisIdentity } from "../infra/tailscale.js";
+import { GATEWAY_CLIENT_IDS, type GatewayClientInfo } from "./protocol/client-info.js";
+import { readControlUiOauthSessionIdentityFromRequest } from "./control-ui.js";
 import { isTrustedProxyAddress, parseForwardedForClientIp, resolveGatewayClientIp } from "./net.js";
 export type ResolvedGatewayAuthMode = "token" | "password";
 
@@ -14,7 +16,7 @@ export type ResolvedGatewayAuth = {
 
 export type GatewayAuthResult = {
   ok: boolean;
-  method?: "token" | "password" | "tailscale" | "device-token";
+  method?: "token" | "password" | "tailscale" | "device-token" | "control-ui-oauth";
   user?: string;
   reason?: string;
 };
@@ -241,11 +243,19 @@ export async function authorizeGatewayConnect(params: {
   req?: IncomingMessage;
   trustedProxies?: string[];
   tailscaleWhois?: TailscaleWhoisLookup;
+  client?: GatewayClientInfo | null;
 }): Promise<GatewayAuthResult> {
   const { auth, connectAuth, req, trustedProxies } = params;
   const tailscaleWhois = params.tailscaleWhois ?? readTailscaleWhoisIdentity;
   const localDirect = isLocalDirectRequest(req, trustedProxies);
 
+  if (auth.mode === "token" && params.client?.id === GATEWAY_CLIENT_IDS.CONTROL_UI && req) {
+    const session = readControlUiOauthSessionIdentityFromRequest(req);
+    if (session) {
+      return { ok: true, method: "control-ui-oauth", user: session.email ?? session.login ?? session.sub };
+    }
+  }
+
   if (auth.allowTailscale && !localDirect) {
     const tailscaleCheck = await resolveVerifiedTailscaleUser({
       req,

src/gateway/control-ui.ts

@@ -327,7 +327,7 @@ function getRequestOrigin(req: IncomingMessage) {
 }
 
 function controlUiCookiePath(basePath: string) {
-  return basePath || "/";
+  return "/";
 }
 
 function buildBaseUrlPath(basePath: string, suffix: string) {
@@ -409,6 +409,30 @@ function readSessionFromRequest(req: IncomingMessage, cfg: ControlUiOauthConfig)
   return value;
 }
 
+export type ControlUiOauthSessionIdentity = {
+  provider: "google" | "github";
+  sub: string;
+  email?: string;
+  login?: string;
+  name?: string;
+};
+
+export function readControlUiOauthSessionIdentityFromRequest(
+  req: IncomingMessage,
+): ControlUiOauthSessionIdentity | null {
+  const cfg = resolveControlUiOauthConfig();
+  if (!isControlUiOauthEnabled(cfg)) return null;
+  const session = readSessionFromRequest(req, cfg);
+  if (!session) return null;
+  return {
+    provider: session.provider,
+    sub: session.sub,
+    email: session.email,
+    login: session.login,
+    name: session.name,
+  };
+}
+
 type OAuthStatePayload = { v: 1; exp: number; nonce: string; provider: ControlUiOauthProvider };
 
 function issueOAuthState(res: ServerResponse, cfg: ControlUiOauthConfig, basePath: string, secure: boolean, provider: ControlUiOauthProvider) {

src/gateway/server/ws-connection/message-handler.ts

@@ -572,6 +572,7 @@ export function attachGatewayWsMessageHandler(params: {
           connectAuth: connectParams.auth,
           req: upgradeReq,
           trustedProxies,
+          client: connectParams.client,
         });
         let authOk = authResult.ok;
         let authMethod =