admin/Claw3D
1
0
Fork 0
mirror of https://github.com/iamlukethedev/Claw3D.git synced 2026-08-14 09:02:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(gateway): strip device auth when injecting managed token.

Browse Source 
Remove the browser device signature from forwarded connect frames when the proxy injects the shared host token, preventing OpenClaw from rejecting the mismatched signature.

Made-with: Cursor
This commit is contained in:
iamlukethedev
2026-04-08 18:14:11 -05:00
committed by iamlukethedev
parent badaf526bb
commit 6fc7c2216e
2 changed files with 7 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/gateway-proxy.js
+1
View File
@@ -96,6 +96,7 @@ const injectAuthToken = (params, token) => {
const auth = isObject(next.auth) ? { ...next.auth } : {};
auth.token = token;
next.auth = auth;
delete next.device;
return next;
};
tests/unit/gatewayProxy.test.ts
+6 -18
View File
@@ -432,7 +432,7 @@ describe("createGatewayProxy", () => {
}
});
it("injects host token while preserving device auth when browser token is missing", async () => {
it("strips device auth when injecting host token so upstream sees only shared token", async () => {
const upstream = new WebSocketServer({ port: 0 });
const address = upstream.address();
if (!address || typeof address === "string") {
@@ -441,21 +441,13 @@ describe("createGatewayProxy", () => {
const upstreamUrl = `ws://127.0.0.1:${address.port}`;
let seenToken: string | null = null;
let seenDeviceSignature: string | null = null;
let seenDeviceId: string | null = null;
let seenDevicePublicKey: string | null = null;
let seenDeviceNonce: string | null = null;
let seenDeviceSignedAt: number | null = null;
let seenDevice: unknown = "NOT_SET";
upstream.on("connection", (ws) => {
ws.on("message", (raw) => {
const parsed = JSON.parse(String(raw));
if (parsed?.method === "connect") {
seenToken = parsed?.params?.auth?.token ?? null;
seenDeviceSignature = parsed?.params?.device?.signature ?? null;
seenDeviceId = parsed?.params?.device?.id ?? null;
seenDevicePublicKey = parsed?.params?.device?.publicKey ?? null;
seenDeviceNonce = parsed?.params?.device?.nonce ?? null;
seenDeviceSignedAt = parsed?.params?.device?.signedAt ?? null;
seenDevice = parsed?.params?.device ?? null;
ws.send(
JSON.stringify({
type: "res",
@@ -490,7 +482,7 @@ describe("createGatewayProxy", () => {
browser.send(
JSON.stringify({
type: "req",
id: "connect-host-token-with-device",
id: "connect-host-token-strips-device",
method: "connect",
params: {
device: {
@@ -508,15 +500,11 @@ describe("createGatewayProxy", () => {
const response = JSON.parse(String(rawMessage ?? ""));
expect(response).toMatchObject({
type: "res",
id: "connect-host-token-with-device",
id: "connect-host-token-strips-device",
ok: true,
});
expect(seenToken).toBe("host-token-456");
expect(seenDeviceSignature).toBe("device-signature-123");
expect(seenDeviceId).toBe("device-id-123");
expect(seenDevicePublicKey).toBe("device-public-key-123");
expect(seenDeviceNonce).toBe("device-nonce-123");
expect(typeof seenDeviceSignedAt).toBe("number");
expect(seenDevice).toBeNull();
} finally {
for (const client of upstream.clients) {
client.close();