fix(tools): require usable media auth profiles

hxy91819 · hxy91819 · commit 26083be72952 · 2026-05-22T23:23:09.000+08:00
diff --git a/src/agents/tools/model-config.helpers.test.ts b/src/agents/tools/model-config.helpers.test.ts
@@ -62,6 +62,81 @@ describe("hasProviderAuthForTool", () => {
     ).toBe(true);
   });
 
+  it("keeps bearer token profiles as valid tool auth", () => {
+    expect(
+      hasProviderAuthForTool({
+        provider: "hatchery",
+        authStore: {
+          version: 1,
+          profiles: {
+            "hatchery:default": {
+              provider: "hatchery",
+              type: "token",
+              token: "tok-profile", // pragma: allowlist secret
+            },
+          },
+        },
+      }),
+    ).toBe(true);
+  });
+
+  it("rejects blank API-key auth-store profiles for tool preflight", () => {
+    expect(
+      hasProviderAuthForTool({
+        provider: "hatchery",
+        authStore: {
+          version: 1,
+          profiles: {
+            "hatchery:default": {
+              provider: "hatchery",
+              type: "api_key",
+              key: "   ",
+            },
+          },
+        },
+      }),
+    ).toBe(false);
+  });
+
+  it("rejects expired bearer token profiles for tool preflight", () => {
+    expect(
+      hasProviderAuthForTool({
+        provider: "hatchery",
+        authStore: {
+          version: 1,
+          profiles: {
+            "hatchery:default": {
+              provider: "hatchery",
+              type: "token",
+              token: "tok-profile", // pragma: allowlist secret
+              expires: Date.now() - 1_000,
+            },
+          },
+        },
+      }),
+    ).toBe(false);
+  });
+
+  it("keeps env-backed API-key profiles as valid tool auth", () => {
+    vi.stubEnv("HATCHERY_API_KEY", "sk-hatchery-env-profile"); // pragma: allowlist secret
+
+    expect(
+      hasProviderAuthForTool({
+        provider: "hatchery",
+        authStore: {
+          version: 1,
+          profiles: {
+            "hatchery:default": {
+              provider: "hatchery",
+              type: "api_key",
+              keyRef: { source: "env", provider: "default", id: "HATCHERY_API_KEY" },
+            },
+          },
+        },
+      }),
+    ).toBe(true);
+  });
+
   it("rejects aws-sdk auth because tool execution requires an API key string", () => {
     const cfg = {
       models: {
diff --git a/src/agents/tools/model-config.helpers.ts b/src/agents/tools/model-config.helpers.ts
@@ -5,13 +5,15 @@ import {
 } from "../../config/model-input.js";
 import type { AgentToolModelConfig } from "../../config/types.agents-shared.js";
 import type { OpenClawConfig } from "../../config/types.openclaw.js";
+import { coerceSecretRef } from "../../config/types.secrets.js";
+import { normalizeOptionalSecretInput } from "../../utils/normalize-secret-input.js";
 import {
   externalCliDiscoveryForProviderAuth,
   ensureAuthProfileStore,
   hasAnyAuthProfileStoreSource,
   listProfilesForProvider,
 } from "../auth-profiles.js";
-import type { AuthProfileStore } from "../auth-profiles/types.js";
+import type { AuthProfileCredential, AuthProfileStore } from "../auth-profiles/types.js";
 import { DEFAULT_MODEL, DEFAULT_PROVIDER } from "../defaults.js";
 import {
   hasRuntimeAvailableProviderAuth,
@@ -43,14 +45,19 @@ export function resolveDefaultModelRef(cfg?: OpenClawConfig): { provider: string
 
 export function hasAuthForProvider(params: {
   provider: string;
+  cfg?: OpenClawConfig;
   agentDir?: string;
   authStore?: AuthProfileStore;
 }): boolean {
   if (resolveEnvApiKey(params.provider)?.apiKey) {
     return true;
   }
   if (params.authStore) {
-    return listProfilesForProvider(params.authStore, params.provider).length > 0;
+    return hasUsableProfileForProvider({
+      store: params.authStore,
+      provider: params.provider,
+      cfg: params.cfg,
+    });
   }
   const agentDir = params.agentDir?.trim();
   if (!agentDir) {
@@ -62,7 +69,71 @@ export function hasAuthForProvider(params: {
   const store = ensureAuthProfileStore(agentDir, {
     externalCli: externalCliDiscoveryForProviderAuth({ provider: params.provider }),
   });
-  return listProfilesForProvider(store, params.provider).length > 0;
+  return hasUsableProfileForProvider({
+    store,
+    provider: params.provider,
+    cfg: params.cfg,
+  });
+}
+
+function hasUsableProfileForProvider(params: {
+  store: AuthProfileStore;
+  provider: string;
+  cfg?: OpenClawConfig;
+}): boolean {
+  return listProfilesForProvider(params.store, params.provider).some((profileId) => {
+    const credential = params.store.profiles[profileId];
+    return Boolean(credential && hasUsableProfileCredential({ credential, cfg: params.cfg }));
+  });
+}
+
+function hasUsableProfileCredential(params: {
+  credential: AuthProfileCredential;
+  cfg?: OpenClawConfig;
+}): boolean {
+  if (params.credential.type === "api_key") {
+    return (
+      hasAvailableProfileSecretInput({
+        value: params.credential.key,
+        cfg: params.cfg,
+      }) ||
+      hasAvailableProfileSecretInput({
+        value: params.credential.keyRef,
+        cfg: params.cfg,
+      })
+    );
+  }
+  if (params.credential.type === "token") {
+    if (typeof params.credential.expires === "number" && params.credential.expires <= Date.now()) {
+      return false;
+    }
+    return (
+      hasAvailableProfileSecretInput({
+        value: params.credential.token,
+        cfg: params.cfg,
+      }) ||
+      hasAvailableProfileSecretInput({
+        value: params.credential.tokenRef,
+        cfg: params.cfg,
+      })
+    );
+  }
+  return Boolean(
+    normalizeOptionalSecretInput(params.credential.access) ||
+    normalizeOptionalSecretInput(params.credential.refresh) ||
+    normalizeOptionalSecretInput(params.credential.idToken),
+  );
+}
+
+function hasAvailableProfileSecretInput(params: { value: unknown; cfg?: OpenClawConfig }): boolean {
+  const ref = coerceSecretRef(params.value, params.cfg?.secrets?.defaults);
+  if (ref) {
+    if (ref.source === "env") {
+      return Boolean(normalizeOptionalSecretInput(process.env[ref.id]));
+    }
+    return true;
+  }
+  return Boolean(normalizeOptionalSecretInput(params.value));
 }
 
 export function hasProviderAuthForTool(params: {
@@ -75,6 +146,7 @@ export function hasProviderAuthForTool(params: {
   if (
     hasAuthForProvider({
       provider: params.provider,
+      cfg: params.cfg,
       agentDir: params.agentDir,
       authStore: params.authStore,
     })
diff --git a/src/agents/tools/video-generate-tool.ts b/src/agents/tools/video-generate-tool.ts
@@ -263,6 +263,7 @@ function isVideoGenerationProviderConfigured(params: {
     }) ||
     hasAuthForProvider({
       provider: params.providerId,
+      cfg: params.cfg,
       agentDir: params.agentDir,
       authStore: params.authStore,
     })
