Documentation
¶
Index ¶
- Constants
- Variables
- func AssertSecurePath(params AuditParams) (string, error)
- func ReadJSONPointer(data interface{}, pointer string) (interface{}, error)
- func ResolveDefaultProvider(ref *SecretRef, cfg *SecretsConfig) string
- func ResolveSecretInput(input SecretInput, cfg *SecretsConfig, getenv func(string) string) (string, error)
- type AuditParams
- type CandidateApp
- type ChannelsRoot
- type FeishuAccount
- type FeishuChannel
- type OpenClawRoot
- type ProviderConfig
- type ProviderDefaults
- type SecretInput
- type SecretRef
- type SecretsConfig
Constants ¶
const ( DefaultFileTimeoutMs = 5000 DefaultFileMaxBytes = 1024 * 1024 // 1 MiB DefaultExecTimeoutMs = 5000 DefaultExecMaxOutputBytes = 1024 * 1024 // 1 MiB )
Default values for provider config fields (aligned with OpenClaw resolve.ts).
const DefaultProviderAlias = "default"
DefaultProviderAlias is the fallback provider name when none is specified.
const SingleValueFileRefID = "$SINGLE_VALUE"
SingleValueFileRefID is the required ref.ID for singleValue file mode (aligned with OpenClaw ref-contract.ts SINGLE_VALUE_FILE_REF_ID).
Variables ¶
var EnvTemplateRe = regexp.MustCompile(`^\$\{([A-Z][A-Z0-9_]{0,127})\}$`)
EnvTemplateRe matches OpenClaw env template strings like "${FEISHU_APP_SECRET}". Only uppercase letters, digits, and underscores; 1-128 chars; must start with uppercase.
Functions ¶
func AssertSecurePath ¶
func AssertSecurePath(params AuditParams) (string, error)
AssertSecurePath verifies that a file/command path is safe for use with OpenClaw SecretRef resolution. On success it returns the effective path (the symlink target, if the input was a symlink and allowed).
The check is a short, ordered pipeline — each step below is both a read of the contract and a pointer to the helper that enforces it.
func ReadJSONPointer ¶
ReadJSONPointer navigates a parsed JSON value (typically the result of json.Unmarshal into interface{}) using an RFC 6901 JSON Pointer string.
Supported pointer format: "/key/subkey/subsubkey". An empty pointer ("") returns data as-is. RFC 6901 escape sequences: ~1 → /, ~0 → ~.
Limitation: only object (map) traversal is supported. Array index segments (e.g., "/channels/0/appId") are not implemented because OpenClaw's SecretRef file provider uses object-only paths in practice.
func ResolveDefaultProvider ¶
func ResolveDefaultProvider(ref *SecretRef, cfg *SecretsConfig) string
ResolveDefaultProvider returns the effective provider alias for a SecretRef. If ref.Provider is set, returns it; otherwise falls back to config defaults or "default".
func ResolveSecretInput ¶
func ResolveSecretInput(input SecretInput, cfg *SecretsConfig, getenv func(string) string) (string, error)
ResolveSecretInput resolves a SecretInput to a plain-text secret string. This is the main dispatcher that handles all SecretInput forms:
- Plain string passthrough
- "${VAR_NAME}" env template expansion
- SecretRef object routing to env/file/exec sub-resolvers
The getenv parameter allows injection for testing (typically os.Getenv). This function is only called during config bind (cold path).
Types ¶
type AuditParams ¶
type AuditParams struct {
TargetPath string
Label string // e.g. "secrets.providers.vault.command"
TrustedDirs []string
AllowInsecurePath bool
AllowReadableByOthers bool
AllowSymlinkPath bool
}
AuditParams holds parameters for AssertSecurePath.
type CandidateApp ¶
type CandidateApp struct {
Label string
AppID string
AppSecret SecretInput
Brand string
}
CandidateApp represents a bindable app from OpenClaw's feishu channel config.
func ListCandidateApps ¶
func ListCandidateApps(ch *FeishuChannel) []CandidateApp
ListCandidateApps enumerates all bindable (enabled) apps from a FeishuChannel. Disabled accounts (enabled: false) are filtered out.
type ChannelsRoot ¶
type ChannelsRoot struct {
Feishu *FeishuChannel `json:"feishu,omitempty"`
}
ChannelsRoot holds channel configurations.
type FeishuAccount ¶
type FeishuAccount struct {
Enabled *bool `json:"enabled,omitempty"` // nil = default enabled
AppID string `json:"appId,omitempty"`
AppSecret SecretInput `json:"appSecret,omitempty"`
Brand string `json:"domain,omitempty"`
}
FeishuAccount is a single account entry within Accounts. Like FeishuChannel, `Brand` maps to OpenClaw's `domain` key.
type FeishuChannel ¶
type FeishuChannel struct {
Enabled *bool `json:"enabled,omitempty"` // nil = default enabled
AppID string `json:"appId,omitempty"`
AppSecret SecretInput `json:"appSecret,omitempty"`
Brand string `json:"domain,omitempty"`
Accounts map[string]*FeishuAccount `json:"accounts,omitempty"`
}
FeishuChannel represents the channels.feishu subtree. Single-account: AppID + AppSecret + Brand at top level. Multi-account: Accounts map (keyed by label like "work", "personal").
Note: OpenClaw's canonical schema stores the brand under the key `domain` (values "feishu" | "lark"), not `brand`. The Go field name `Brand` stays aligned with our internal terminology, but the JSON tag matches OpenClaw's on-disk format.
type OpenClawRoot ¶
type OpenClawRoot struct {
Channels ChannelsRoot `json:"channels"`
Secrets *SecretsConfig `json:"secrets,omitempty"`
}
OpenClawRoot captures the minimal subset of openclaw.json needed by config bind. Unknown fields are silently ignored (forward-compatible with future OpenClaw versions).
func ReadOpenClawConfig ¶
func ReadOpenClawConfig(path string) (*OpenClawRoot, error)
ReadOpenClawConfig reads and parses an openclaw.json file at the given path.
type ProviderConfig ¶
type ProviderConfig struct {
Source string `json:"source"` // "env" | "file" | "exec"
// env source fields
Allowlist []string `json:"allowlist,omitempty"`
// file source fields
Path string `json:"path,omitempty"`
Mode string `json:"mode,omitempty"` // "singleValue" | "json"; default "json"
TimeoutMs int `json:"timeoutMs,omitempty"`
MaxBytes int `json:"maxBytes,omitempty"`
// exec source fields
Command string `json:"command,omitempty"`
Args []string `json:"args,omitempty"`
NoOutputTimeoutMs int `json:"noOutputTimeoutMs,omitempty"`
MaxOutputBytes int `json:"maxOutputBytes,omitempty"`
JSONOnly *bool `json:"jsonOnly,omitempty"` // nil = default true
Env map[string]string `json:"env,omitempty"`
PassEnv []string `json:"passEnv,omitempty"`
TrustedDirs []string `json:"trustedDirs,omitempty"`
AllowInsecurePath bool `json:"allowInsecurePath,omitempty"`
AllowSymlinkCommand bool `json:"allowSymlinkCommand,omitempty"`
}
ProviderConfig holds configuration for a secret provider. Fields are source-specific; unused fields for other sources are ignored.
func LookupProvider ¶
func LookupProvider(ref *SecretRef, cfg *SecretsConfig) (*ProviderConfig, error)
LookupProvider resolves a provider config from the registry. Returns the provider config or an error if not found. Special case: env source with "default" provider returns a synthetic empty env provider.
type ProviderDefaults ¶
type ProviderDefaults struct {
Env string `json:"env,omitempty"`
File string `json:"file,omitempty"`
Exec string `json:"exec,omitempty"`
}
ProviderDefaults holds default provider aliases for each source type.
type SecretInput ¶
type SecretInput struct {
Plain string // non-empty when value is a plain string (including "${VAR}" templates)
Ref *SecretRef // non-nil when value is a SecretRef object
}
SecretInput is a union type: either a plain string or a SecretRef object. Implements custom JSON unmarshaling to handle both forms.
func (SecretInput) IsPlain ¶
func (s SecretInput) IsPlain() bool
IsPlain returns true if this is a plain string (not a SecretRef object).
func (SecretInput) IsZero ¶
func (s SecretInput) IsZero() bool
IsZero returns true if no value was provided.
func (SecretInput) MarshalJSON ¶
func (s SecretInput) MarshalJSON() ([]byte, error)
MarshalJSON serializes SecretInput back to JSON.
func (*SecretInput) UnmarshalJSON ¶
func (s *SecretInput) UnmarshalJSON(data []byte) error
UnmarshalJSON handles both string and object forms of SecretInput.
type SecretRef ¶
type SecretRef struct {
Source string `json:"source"` // "env" | "file" | "exec"
Provider string `json:"provider,omitempty"` // provider alias; defaults to config.secrets.defaults.<source> or "default"
ID string `json:"id"` // lookup key (env var name / JSON pointer / exec ref id)
}
SecretRef references a secret stored externally via OpenClaw's provider system.
type SecretsConfig ¶
type SecretsConfig struct {
Providers map[string]*ProviderConfig `json:"providers,omitempty"`
Defaults *ProviderDefaults `json:"defaults,omitempty"`
}
SecretsConfig captures the secrets.providers registry from openclaw.json.
Source Files