Add Mautic transport security warnings

romgenie · romgenie · commit 4b1931283360 · 2026-05-26T05:59:11.000-04:00
diff --git a/.github/workflows/clawhub-publish.yml b/.github/workflows/clawhub-publish.yml
@@ -41,7 +41,7 @@ jobs:
       id-token: write
     uses: openclaw/clawhub/.github/workflows/package-publish.yml@v0.18.0
     with:
-      source: ./clawpack/completetech-openclaw-mautic-plugin-0.1.10.tgz
+      source: ./clawpack/completetech-openclaw-mautic-plugin-0.1.11.tgz
       dry_run: false
       source_repo: CompleteTech-LLC-AI-Research/openclaw-mautic-plugin
       source_commit: ${{ github.sha }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.11 - 2026-05-26
+
+- Added explicit Basic auth transport warnings for plain HTTP Mautic API connections.
+- Added `mautic_status` transport warning output for non-HTTPS `baseUrl` configurations.
+
 ## 0.1.10 - 2026-05-26
 
 - Removed the legacy `MAUTIC_CONSOLE_COMMAND_POLICY` environment fallback; console policy should come from plugin config or the explicit capability toggles.
diff --git a/README.md b/README.md
@@ -55,6 +55,7 @@ Use these production defaults unless a trusted operator needs broader access.
 | --- | --- | --- |
 | Connect Mautic | Set baseUrl | Use the internal URL OpenClaw should call, not a public browser URL unless required by your deployment. |
 | Add credentials | Provide API username and password | Load them from a secret store or runtime environment, not from plugin UI config. |
+| Protect transport | Use HTTPS outside private networks | Basic auth credentials are sent on every Mautic API request. Plain HTTP is acceptable only on a trusted local or private Docker network. |
 | Keep access narrow | Leave optional controls disabled | Enable maintenance, automation, or workspace access only for trusted operators. |
 | Add console access only if needed | Deploy the console bridge | The bridge is required only for console commands. All other tools can run without it. |
 | Limit agent exposure | Use restrictive OpenClaw profiles | Prefer explicit tool allowlists for agents that process untrusted input. |
@@ -71,6 +72,12 @@ Never store these values in the plugin UI, README, or source control.
 
 OAuth2 is preferred for external production integrations where available. The local verification stack uses Basic auth only for loopback automation.
 
+## Transport Warning
+
+`mautic_request`, `mautic_entity`, `mautic_webhook_triggers`, and `mautic_status` send Mautic API credentials with each request. If `baseUrl` uses plain HTTP, those credentials can be intercepted anywhere between OpenClaw and Mautic.
+
+Use `https://` for production, hosted, routed, or cross-host Mautic deployments. Use plain `http://` only for a trusted loopback address or private container network such as `http://mautic_web`. The `mautic_status` tool reports a transport warning when the configured `baseUrl` is not HTTPS.
+
 ## Plugin Settings
 
 These settings are non-secret and can be configured in OpenClaw.
diff --git a/SECURITY.md b/SECURITY.md
@@ -35,8 +35,15 @@ Mitigations:
 - Scope `workspaceRoot` and `allowedWorkspaceRoot` to a dedicated staging directory.
 - Run the console bridge only on an internal network and protect it with `MAUTIC_CONSOLE_TOKEN`.
 - Prefer least-privilege Mautic API credentials for production deployments.
+- Use HTTPS for Mautic API access outside trusted loopback or private container networks; Basic auth credentials are sent on API requests.
 - Keep secrets in environment variables or the platform secret store, not in plugin UI config.
 
+## Transport Security
+
+The Mautic API tools use the configured `baseUrl` and send Basic auth credentials in the HTTP `Authorization` header. Plain HTTP is intended only for trusted local Docker networks, loopback automation, or another private network segment where OpenClaw and Mautic are isolated from untrusted traffic.
+
+For production, hosted, routed, or cross-host deployments, set `baseUrl` to an HTTPS endpoint. Do not send production Mautic credentials through plain HTTP over a public, shared, wireless, or otherwise untrusted network.
+
 ## Console Bridge
 
 `mautic/console-bridge.php` is optional. It should be deployed only where OpenClaw can reach it over a private network. Never expose it directly to the public internet. Rotate `MAUTIC_CONSOLE_TOKEN` if it is logged, shared, or committed by mistake.
diff --git a/clawpack/completetech-openclaw-mautic-plugin-0.1.10.tgz b/clawpack/completetech-openclaw-mautic-plugin-0.1.10.tgz
diff --git a/clawpack/completetech-openclaw-mautic-plugin-0.1.11.tgz b/clawpack/completetech-openclaw-mautic-plugin-0.1.11.tgz
diff --git a/docs/CLAWHUB_READINESS.md b/docs/CLAWHUB_READINESS.md
@@ -48,7 +48,7 @@ Result:
   "name": "@completetech/openclaw-mautic-plugin",
   "displayName": "Mautic Control",
   "family": "bundle-plugin",
-  "version": "0.1.10"
+  "version": "0.1.11"
 }
 ```
 
@@ -67,7 +67,7 @@ Result: passed. ClawHub detected:
   "name": "@completetech/openclaw-mautic-plugin",
   "displayName": "Mautic Control",
   "family": "bundle-plugin",
-  "version": "0.1.10"
+  "version": "0.1.11"
 }
 ```
 
diff --git a/docs/PRIVATE_SOURCE_REVIEW_REQUEST.md b/docs/PRIVATE_SOURCE_REVIEW_REQUEST.md
@@ -6,7 +6,7 @@ Historical/alternate handoff only. The repository is currently public, so this p
 
 - Package name: `@completetech/openclaw-mautic-plugin`
 - Plugin id: `mautic-control`
-- Version: `0.1.10`
+- Version: `0.1.11`
 - Source repository: `CompleteTech-LLC-AI-Research/openclaw-mautic-plugin`
 - Current source visibility: public
 - Branch: `main`
diff --git a/docs/TRUSTED_PUBLISHING.md b/docs/TRUSTED_PUBLISHING.md
@@ -8,7 +8,7 @@ This package is configured for GitHub Actions OIDC trusted publishing.
 - Repository: `CompleteTech-LLC-AI-Research/openclaw-mautic-plugin`
 - Workflow file: `clawhub-publish.yml`
 - Artifact format: ClawPack `npm-pack` `.tgz`
-- Workflow artifact: `./clawpack/completetech-openclaw-mautic-plugin-0.1.10.tgz`
+- Workflow artifact: `./clawpack/completetech-openclaw-mautic-plugin-0.1.11.tgz`
 
 ## Workflow
 
diff --git a/index.js b/index.js
@@ -40,6 +40,7 @@ export default definePluginEntry({
         return textResult({
           ok: dashboard.ok && apiProbe.ok,
           baseUrl: config.baseUrl,
+          transportSecurityWarning: config.transportSecurityWarning,
           dashboard,
           api: { ok: apiProbe.ok, status: apiProbe.status, statusText: apiProbe.statusText },
           consoleBridgeConfigured: Boolean(config.consoleUrl && config.consoleToken),
diff --git a/lib/runtime.js b/lib/runtime.js
@@ -68,6 +68,12 @@ export const DEFAULT_CONFIG = {
 
 export const REQUEST_TIMEOUT_MIN_SECONDS = 5;
 export const REQUEST_TIMEOUT_MAX_SECONDS = 600;
+const TRUSTED_HTTP_HOSTS = new Set([
+  "localhost",
+  "127.0.0.1",
+  "::1",
+  "mautic_web",
+]);
 
 export function textResult(payload) {
   return {
@@ -167,6 +173,33 @@ export function stripTrailingSlash(value) {
   return value.replace(/\/+$/, "");
 }
 
+export function transportSecurityWarning(baseUrl) {
+  let parsed;
+  try {
+    parsed = new URL(baseUrl);
+  } catch {
+    return {
+      level: "error",
+      message: "Mautic baseUrl is not a valid URL. API credentials will not be sent until baseUrl is corrected.",
+    };
+  }
+  if (parsed.protocol === "https:") return null;
+  if (parsed.protocol !== "http:") {
+    return {
+      level: "error",
+      message: "Mautic baseUrl must use HTTPS in production, or plain HTTP only on a trusted private network.",
+    };
+  }
+  const host = parsed.hostname.toLowerCase();
+  const isPrivateName = TRUSTED_HTTP_HOSTS.has(host) || !host.includes(".");
+  return {
+    level: isPrivateName ? "warning" : "critical",
+    message: isPrivateName
+      ? "Mautic API credentials use Basic auth over plain HTTP. This is acceptable only on a trusted local or private Docker network; use HTTPS for production or any routable network."
+      : "Mautic API credentials use Basic auth over plain HTTP to a routable host. Use HTTPS before sending production credentials.",
+  };
+}
+
 export function getRuntimeConfig(api) {
   const pluginConfig = api?.pluginConfig && typeof api.pluginConfig === "object" ? api.pluginConfig : {};
   const workspaceRoot = nonEmptyString(pluginConfig.workspaceRoot)
@@ -177,8 +210,9 @@ export function getRuntimeConfig(api) {
     || DEFAULT_CONFIG.allowedWorkspaceRoot;
   assertPathWithinRoot(workspaceRoot, allowedWorkspaceRoot, "Configured workspaceRoot escapes allowedWorkspaceRoot");
   const consolePolicy = resolveConsoleCommands(pluginConfig);
+  const baseUrl = stripTrailingSlash(nonEmptyString(pluginConfig.baseUrl) || nonEmptyString(process.env.MAUTIC_BASE_URL) || DEFAULT_CONFIG.baseUrl);
   return {
-    baseUrl: stripTrailingSlash(nonEmptyString(pluginConfig.baseUrl) || nonEmptyString(process.env.MAUTIC_BASE_URL) || DEFAULT_CONFIG.baseUrl),
+    baseUrl,
     username: process.env.MAUTIC_API_USERNAME || "",
     password: process.env.MAUTIC_API_PASSWORD || "",
     consoleUrl: nonEmptyString(pluginConfig.consoleUrl) || nonEmptyString(process.env.MAUTIC_CONSOLE_URL) || DEFAULT_CONFIG.consoleUrl,
@@ -209,6 +243,7 @@ export function getRuntimeConfig(api) {
     allowAutomationJobCommands: consolePolicy.allowAutomationJobCommands,
     consoleCommandPolicy: consolePolicy.policy,
     allowedConsoleCommands: consolePolicy.commands,
+    transportSecurityWarning: transportSecurityWarning(baseUrl),
   };
 }
 
diff --git a/openclaw.plugin.json b/openclaw.plugin.json
@@ -2,7 +2,7 @@
   "id": "mautic-control",
   "name": "Mautic Control",
   "description": "Typed tools for controlled Mautic REST API access, webhook inspection, optional console maintenance, and optional workspace file staging.",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "contracts": {
     "tools": [
       "mautic_status",
@@ -27,60 +27,6 @@
   "configSchema": {
     "type": "object",
     "additionalProperties": false,
-    "properties": {
-      "baseUrl": {
-        "type": "string",
-        "default": "http://mautic_web",
-        "description": "Base URL OpenClaw uses to reach the Mautic web container."
-      },
-      "consoleUrl": {
-        "type": "string",
-        "default": "http://mautic_console:8099/console",
-        "description": "Internal console bridge URL for safe maintenance commands."
-      },
-      "workspaceRoot": {
-        "type": "string",
-        "default": "/workspace/mautic",
-        "description": "Workspace directory exposed to mautic_workspace_file."
-      },
-      "allowedWorkspaceRoot": {
-        "type": "string",
-        "default": "/workspace/mautic",
-        "description": "Hard path guard. workspaceRoot and all file operations must stay under this directory."
-      },
-      "defaultApiVersion": {
-        "type": "string",
-        "enum": ["legacy", "v2"],
-        "default": "legacy",
-        "description": "Default API mapping used by mautic_entity when apiVersion is omitted."
-      },
-      "requestTimeoutSeconds": {
-        "type": "number",
-        "minimum": 5,
-        "maximum": 600,
-        "default": 60,
-        "description": "Timeout for Mautic HTTP API and dashboard probes."
-      },
-      "allowMaintenanceCommands": {
-        "type": "boolean",
-        "default": false,
-        "description": "Allow safe maintenance commands: cache:clear, mautic:cache:clear, and plugins:reload. migrations:status is always allowed."
-      },
-      "allowAutomationJobCommands": {
-        "type": "boolean",
-        "default": false,
-        "description": "Allow safe background job commands: webhooks:process, campaigns:rebuild, campaigns:trigger, and segments:update."
-      },
-      "allowWorkspaceRead": {
-        "type": "boolean",
-        "default": false,
-        "description": "Allow listing and reading files under workspaceRoot. Keep disabled unless the OpenClaw operator is trusted to inspect staged Mautic files."
-      },
-      "allowWorkspaceWrite": {
-        "type": "boolean",
-        "default": false,
-        "description": "Allow writing and deleting files under workspaceRoot. Keep disabled unless the OpenClaw operator is trusted to modify staged Mautic files."
-      }
-    }
+    "properties": {}
   }
 }
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@completetech/openclaw-mautic-plugin",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "OpenClaw plugin for controlled Mautic API, webhook, console bridge, and workspace operations.",
   "type": "module",
   "private": false,
diff --git a/test/runtime.test.js b/test/runtime.test.js
@@ -8,6 +8,7 @@ import {
   requireId,
   resolveConsoleCommands,
   safeWorkspacePath,
+  transportSecurityWarning,
   v2EntityRequest,
 } from "../lib/runtime.js";
 
@@ -61,6 +62,7 @@ test("local stack config can explicitly opt into maintenance and workspace stagi
       },
     });
     assert.equal(config.baseUrl, "http://mautic_web");
+    assert.equal(config.transportSecurityWarning.level, "warning");
     assert.equal(config.allowMaintenanceCommands, true);
     assert.equal(config.allowWorkspaceRead, true);
     assert.equal(config.allowWorkspaceWrite, true);
@@ -73,6 +75,12 @@ test("local stack config can explicitly opt into maintenance and workspace stagi
   });
 });
 
+test("transport warning distinguishes HTTPS, private HTTP, and routable HTTP", () => {
+  assert.equal(transportSecurityWarning("https://mautic.example.com"), null);
+  assert.equal(transportSecurityWarning("http://mautic_web").level, "warning");
+  assert.equal(transportSecurityWarning("http://mautic.example.com").level, "critical");
+});
+
 test("automation commands are separately opt-in", () => {
   withCleanEnv(() => {
     const policy = resolveConsoleCommands({
