feat: add OpenClaw runtime reauthentication

src/app/api/runtimes/[id]/route.test.ts

@@ -8,13 +8,27 @@ type RuntimeRow = {
   ownerUserId: string | null;
   ownerCompanyId: string | null;
   isPrimary: boolean;
+  runtimeType: string;
+  gatewayUrl: string;
+  metadata: Record<string, unknown>;
 };
 
 const mocks = vi.hoisted(() => ({
   access: vi.fn(),
   cleanup: vi.fn(),
   deleteManagedResources: vi.fn(),
   listManagedResources: vi.fn(),
+  probeGateway: vi.fn(),
+  sealDeviceKey: vi.fn((_value: string) => "sealed-device-key"),
+  storeDeviceAuth: vi.fn((
+    metadata: Record<string, unknown>,
+    _deviceId: string,
+    _deviceAuth: unknown,
+  ) => ({
+    ...metadata,
+    openclawDeviceAuth: { stored: true },
+  })),
+  sealAuthToken: vi.fn((value: string) => `sealed-token:${value}`),
   deletedTables: [] as string[],
   updatedTables: [] as string[],
   updatedValues: [] as Record<string, unknown>[],
@@ -25,6 +39,12 @@ const mocks = vi.hoisted(() => ({
     ownerUserId: "user-1",
     ownerCompanyId: null,
     isPrimary: false,
+    runtimeType: "openclaw",
+    gatewayUrl: "ws://localhost:18789",
+    metadata: {
+      devicePrivateKeyPem: "sealed-existing-key",
+      retained: true,
+    },
   } as RuntimeRow,
 }));
 
@@ -38,6 +58,11 @@ vi.mock("@/db/schema", () => ({
     ownerUserId: "companyRuntimes.ownerUserId",
     ownerCompanyId: "companyRuntimes.ownerCompanyId",
     isPrimary: "companyRuntimes.isPrimary",
+    authToken: "companyRuntimes.authToken",
+    metadata: "companyRuntimes.metadata",
+    status: "companyRuntimes.status",
+    lastPing: "companyRuntimes.lastPing",
+    updatedAt: "companyRuntimes.updatedAt",
   },
   cronJobs: { table: "cronJobs", id: "cronJobs.id" },
 }));
@@ -94,14 +119,41 @@ vi.mock("@/lib/runtime-api-dto", () => ({
   toBrowserSafeRuntime: (runtime: unknown) => runtime,
 }));
 
-import { DELETE } from "./route";
+vi.mock("@/lib/gateway-client", () => ({
+  probeGateway: (...args: unknown[]) => mocks.probeGateway(...args),
+  resolveDeviceIdentity: () => ({ deviceId: "device-1" }),
+}));
+
+vi.mock("@/lib/runtime-device-auth", () => ({
+  sealRuntimeDevicePrivateKey: (value: string) => mocks.sealDeviceKey(value),
+  storeRuntimeDeviceAuth: (
+    metadata: Record<string, unknown>,
+    deviceId: string,
+    deviceAuth: unknown,
+  ) => mocks.storeDeviceAuth(metadata, deviceId, deviceAuth),
+}));
+
+vi.mock("@/lib/runtime-token-crypto", () => ({
+  isEncryptedRuntimeAuthToken: (value: string) => value.startsWith("sealed-"),
+  sealRuntimeAuthToken: (value: string) => mocks.sealAuthToken(value),
+}));
+
+import { DELETE, PATCH } from "./route";
 
 function makeRequest(cleanup?: string) {
   const url = new URL("http://localhost/api/runtimes/runtime-1");
   if (cleanup) url.searchParams.set("cleanup", cleanup);
   return new NextRequest(url, { method: "DELETE" });
 }
 
+function makeReauthenticateRequest(body: Record<string, unknown>) {
+  return new NextRequest("http://localhost/api/runtimes/runtime-1", {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
 function context() {
   return { params: Promise.resolve({ id: "runtime-1" }) };
 }
@@ -160,3 +212,161 @@ describe("DELETE /api/runtimes/[id]", () => {
     expect(mocks.deleteManagedResources).not.toHaveBeenCalled();
   });
 });
+
+describe("PATCH /api/runtimes/[id] reauthenticate", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.updatedTables.length = 0;
+    mocks.updatedValues.length = 0;
+    mocks.access.mockResolvedValue({ userId: "user-1" });
+    mocks.runtime.ownerType = "user";
+    mocks.runtime.ownerUserId = "user-1";
+    mocks.runtime.runtimeType = "openclaw";
+    mocks.runtime.gatewayUrl = "ws://localhost:18789";
+    mocks.runtime.metadata = {
+      devicePrivateKeyPem: "sealed-existing-key",
+      retained: true,
+    };
+  });
+
+  it("verifies the replacement before atomically storing it", async () => {
+    mocks.probeGateway.mockResolvedValue({
+      ok: true,
+      agents: [],
+      models: [],
+      devicePrivateKeyPem: "raw-private-key",
+    });
+
+    const response = await PATCH(makeReauthenticateRequest({
+      action: "reauthenticate",
+      authToken: "new-token",
+    }), context());
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({
+      ok: true,
+      authenticationMode: "local-shared-token",
+    });
+    expect(mocks.probeGateway).toHaveBeenCalledWith(
+      "ws://localhost:18789",
+      "new-token",
+      "sealed-existing-key",
+    );
+    expect(mocks.updatedTables).toEqual(["companyRuntimes"]);
+    expect(mocks.updatedValues).toHaveLength(1);
+    expect(mocks.updatedValues[0]).toMatchObject({
+      authToken: "sealed-token:new-token",
+      metadata: {
+        devicePrivateKeyPem: "sealed-device-key",
+        retained: true,
+      },
+      status: "connected",
+    });
+  });
+
+  it("retains the approved device token returned by a paired gateway", async () => {
+    const deviceAuth = {
+      token: "device-token",
+      role: "operator",
+      scopes: ["operator.admin"],
+    };
+    mocks.probeGateway.mockResolvedValue({
+      ok: true,
+      agents: [],
+      models: [],
+      devicePrivateKeyPem: "raw-private-key",
+      deviceAuth,
+    });
+
+    const response = await PATCH(makeReauthenticateRequest({
+      action: "reauthenticate",
+      authToken: "new-token",
+    }), context());
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toMatchObject({
+      authenticationMode: "paired-device",
+    });
+    expect(mocks.storeDeviceAuth).toHaveBeenCalledWith(
+      expect.objectContaining({ devicePrivateKeyPem: "sealed-device-key" }),
+      "device-1",
+      deviceAuth,
+    );
+    expect(mocks.updatedValues[0]).toMatchObject({
+      metadata: { openclawDeviceAuth: { stored: true } },
+    });
+  });
+
+  it("keeps the stored credential unchanged when verification fails", async () => {
+    mocks.probeGateway.mockResolvedValue({
+      ok: false,
+      error: "unauthorized: gateway token mismatch",
+      agents: [],
+      models: [],
+    });
+
+    const response = await PATCH(makeReauthenticateRequest({
+      action: "reauthenticate",
+      authToken: "wrong-token",
+    }), context());
+
+    expect(response.status).toBe(401);
+    await expect(response.json()).resolves.toMatchObject({
+      code: "RUNTIME_REAUTHENTICATION_FAILED",
+    });
+    expect(mocks.updatedTables).toEqual([]);
+    expect(mocks.sealAuthToken).not.toHaveBeenCalled();
+  });
+
+  it("returns only a sealed identity for a pairing retry", async () => {
+    mocks.runtime.metadata = { retained: true };
+    mocks.probeGateway.mockResolvedValue({
+      ok: false,
+      error: "pairing_required",
+      pairingInstructions: "Approve the pending request",
+      agents: [],
+      models: [],
+      devicePrivateKeyPem: "raw-pending-private-key",
+    });
+
+    const response = await PATCH(makeReauthenticateRequest({
+      action: "reauthenticate",
+      authToken: "new-token",
+    }), context());
+    const body = await response.json();
+
+    expect(response.status).toBe(409);
+    expect(body).toMatchObject({
+      code: "PAIRING_REQUIRED",
+      pairingRequired: true,
+      deviceKeyPem: "sealed-device-key",
+    });
+    expect(JSON.stringify(body)).not.toContain("raw-pending-private-key");
+    expect(mocks.updatedTables).toEqual([]);
+  });
+
+  it("rejects a browser-supplied plaintext device key", async () => {
+    const response = await PATCH(makeReauthenticateRequest({
+      action: "reauthenticate",
+      authToken: "new-token",
+      deviceKeyPem: "-----BEGIN PRIVATE KEY-----",
+    }), context());
+
+    expect(response.status).toBe(400);
+    expect(mocks.probeGateway).not.toHaveBeenCalled();
+    expect(mocks.updatedTables).toEqual([]);
+  });
+
+  it("does not probe a runtime owned by another user", async () => {
+    mocks.runtime.ownerUserId = "user-2";
+
+    const response = await PATCH(makeReauthenticateRequest({
+      action: "reauthenticate",
+      authToken: "new-token",
+    }), context());
+
+    expect(response.status).toBe(403);
+    expect(mocks.probeGateway).not.toHaveBeenCalled();
+    expect(mocks.updatedTables).toEqual([]);
+  });
+});