|
| 1 | +import crypto from "node:crypto"; |
| 2 | +import fs from "node:fs"; |
| 3 | +import os from "node:os"; |
| 4 | +import path from "node:path"; |
| 5 | + |
| 6 | +const GATEWAY_TOKEN_FILENAME = "gateway.token"; |
| 7 | +const SIG_EXTENSION = ".sig"; |
| 8 | + |
| 9 | +let cachedGatewayToken: string | null | undefined; |
| 10 | + |
| 11 | +/** |
| 12 | + * Resolves the gateway token path at ~/.openclaw/gateway.token. |
| 13 | + */ |
| 14 | +function resolveGatewayTokenPath(): string { |
| 15 | + return path.join(os.homedir(), ".openclaw", GATEWAY_TOKEN_FILENAME); |
| 16 | +} |
| 17 | + |
| 18 | +/** |
| 19 | + * Reads and caches the gateway token from ~/.openclaw/gateway.token. |
| 20 | + * Returns null if the file does not exist or cannot be read. |
| 21 | + */ |
| 22 | +export function readGatewayToken(): string | null { |
| 23 | + if (cachedGatewayToken !== undefined) { |
| 24 | + return cachedGatewayToken; |
| 25 | + } |
| 26 | + try { |
| 27 | + const tokenPath = resolveGatewayTokenPath(); |
| 28 | + const raw = fs.readFileSync(tokenPath, "utf-8").trim(); |
| 29 | + cachedGatewayToken = raw.length > 0 ? raw : null; |
| 30 | + } catch { |
| 31 | + cachedGatewayToken = null; |
| 32 | + } |
| 33 | + return cachedGatewayToken; |
| 34 | +} |
| 35 | + |
| 36 | +/** |
| 37 | + * Computes HMAC-SHA256 of config content using the gateway token. |
| 38 | + */ |
| 39 | +export function computeConfigHmac(content: string, token: string): string { |
| 40 | + return crypto.createHmac("sha256", token).update(content).digest("hex"); |
| 41 | +} |
| 42 | + |
| 43 | +/** |
| 44 | + * Resolves the sidecar HMAC signature file path for a config path. |
| 45 | + */ |
| 46 | +export function resolveConfigSigPath(configPath: string): string { |
| 47 | + return `${configPath}${SIG_EXTENSION}`; |
| 48 | +} |
| 49 | + |
| 50 | +/** |
| 51 | + * Writes the HMAC signature sidecar file after a config write. |
| 52 | + * Best-effort; failures are silently ignored. |
| 53 | + */ |
| 54 | +export async function writeConfigHmacSig(configPath: string, configContent: string): Promise<void> { |
| 55 | + const token = readGatewayToken(); |
| 56 | + if (!token) { |
| 57 | + return; |
| 58 | + } |
| 59 | + try { |
| 60 | + const hmac = computeConfigHmac(configContent, token); |
| 61 | + const sigPath = resolveConfigSigPath(configPath); |
| 62 | + await fs.promises.writeFile(sigPath, hmac, { encoding: "utf-8", mode: 0o600 }); |
| 63 | + } catch { |
| 64 | + // best-effort |
| 65 | + } |
| 66 | +} |
| 67 | + |
| 68 | +export type ConfigHmacVerifyResult = |
| 69 | + | { status: "ok" } |
| 70 | + | { status: "no-token" } |
| 71 | + | { status: "no-sig" } |
| 72 | + | { status: "mismatch" } |
| 73 | + | { status: "error"; detail: string }; |
| 74 | + |
| 75 | +/** |
| 76 | + * Verifies the HMAC signature sidecar file against config content. |
| 77 | + * Returns a discriminated result indicating the verification outcome. |
| 78 | + */ |
| 79 | +export function verifyConfigHmac( |
| 80 | + configPath: string, |
| 81 | + configContent: string, |
| 82 | +): ConfigHmacVerifyResult { |
| 83 | + const token = readGatewayToken(); |
| 84 | + if (!token) { |
| 85 | + return { status: "no-token" }; |
| 86 | + } |
| 87 | + const sigPath = resolveConfigSigPath(configPath); |
| 88 | + let storedHmac: string; |
| 89 | + try { |
| 90 | + storedHmac = fs.readFileSync(sigPath, "utf-8").trim(); |
| 91 | + } catch { |
| 92 | + return { status: "no-sig" }; |
| 93 | + } |
| 94 | + if (storedHmac.length === 0) { |
| 95 | + return { status: "no-sig" }; |
| 96 | + } |
| 97 | + try { |
| 98 | + const expectedHmac = computeConfigHmac(configContent, token); |
| 99 | + if (storedHmac === expectedHmac) { |
| 100 | + return { status: "ok" }; |
| 101 | + } |
| 102 | + return { status: "mismatch" }; |
| 103 | + } catch (err: unknown) { |
| 104 | + const detail = err instanceof Error ? err.message : "unknown error during HMAC verification"; |
| 105 | + return { status: "error", detail }; |
| 106 | + } |
| 107 | +} |
| 108 | + |
| 109 | +/** |
| 110 | + * Clears the cached gateway token. Useful for testing. |
| 111 | + */ |
| 112 | +export function clearGatewayTokenCache(): void { |
| 113 | + cachedGatewayToken = undefined; |
| 114 | +} |
0 commit comments