negodiy/openclaw
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(gateway): strip unbound scopes for shared-auth connects

Browse Source
This commit is contained in:
Peter Steinberger
2026-03-13 02:51:32 +00:00
parent b858d6c3a9
commit 7dc447f79f
2 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/gateway/server.auth.default-token.suite.ts
View File

@@ -157,10 +157,11 @@ export function registerDefaultAuthTokenSuite(): void {
expectStatusError?: string;
}> = [
{
name: "operator + valid shared token => connected with preserved scopes",
name: "operator + valid shared token => connected with cleared scopes",
opts: { role: "operator", token, device: null },
expectConnectOk: true,
expectStatusOk: true,
expectStatusOk: false,
expectStatusError: "missing scope",
},
{
name: "node + valid shared token => rejected without device",

5
src/gateway/server/ws-connection/message-handler.ts
View File

@@ -526,7 +526,10 @@ export function attachGatewayWsMessageHandler(params: {
hasSharedAuth,
isLocalClient,
});
if (!device && decision.kind !== "allow") {
// Shared token/password auth can bypass pairing for trusted operators, but
// device-less backend clients must not self-declare scopes. Control UI
// keeps its explicitly allowed device-less scopes on the allow path.
if (!device && (!isControlUi || decision.kind !== "allow")) {
clearUnboundScopes();
}
if (decision.kind === "allow") {