Telegram: resolve env SecretRef tokens at runtime

joshavant · joshavant · commit bc8df503fb0b · 2026-04-14T16:20:28.000-05:00
diff --git a/extensions/telegram/src/token.test.ts b/extensions/telegram/src/token.test.ts
@@ -229,7 +229,8 @@ describe("resolveTelegramToken", () => {
     expectNoTokenForUnknownAccount(createUnknownAccountConfig());
   });
 
-  it("throws when botToken is an unresolved SecretRef object", () => {
+  it("resolves env-backed SecretRefs from process.env", () => {
+    vi.stubEnv("TELEGRAM_BOT_TOKEN", "secretref-env-token");
     const cfg = {
       channels: {
         telegram: {
@@ -238,6 +239,21 @@ describe("resolveTelegramToken", () => {
       },
     } as unknown as OpenClawConfig;
 
+    expect(resolveTelegramToken(cfg)).toEqual({
+      token: "secretref-env-token",
+      source: "config",
+    });
+  });
+
+  it("keeps strict runtime behavior for unresolved non-env SecretRefs", () => {
+    const cfg = {
+      channels: {
+        telegram: {
+          botToken: { source: "file", provider: "vault", id: "/telegram/bot-token" },
+        },
+      },
+    } as unknown as OpenClawConfig;
+
     expect(() => resolveTelegramToken(cfg)).toThrow(
       /channels\.telegram\.botToken: unresolved SecretRef/i,
     );
diff --git a/extensions/telegram/src/token.ts b/extensions/telegram/src/token.ts
@@ -4,14 +4,41 @@ import { tryReadSecretFileSync } from "openclaw/plugin-sdk/channel-core";
 import type { OpenClawConfig } from "openclaw/plugin-sdk/config-runtime";
 import type { TelegramAccountConfig } from "openclaw/plugin-sdk/config-runtime";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/routing";
-import { normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
+import {
+  normalizeSecretInputString,
+  resolveSecretInputString,
+} from "openclaw/plugin-sdk/secret-input";
 
 export type TelegramTokenSource = "env" | "tokenFile" | "config" | "none";
 
 export type TelegramTokenResolution = BaseTokenResolution & {
   source: TelegramTokenSource;
 };
 
+function resolveRuntimeTokenValue(params: { value: unknown; path: string }): string | undefined {
+  const resolved = resolveSecretInputString({
+    value: params.value,
+    path: params.path,
+    mode: "inspect",
+  });
+  if (resolved.status === "available") {
+    return resolved.value;
+  }
+  if (resolved.status !== "configured_unavailable") {
+    return undefined;
+  }
+  if (resolved.ref.source === "env") {
+    return normalizeSecretInputString(process.env[resolved.ref.id]);
+  }
+  // Runtime resolution stays strict for non-env SecretRefs.
+  resolveSecretInputString({
+    value: params.value,
+    path: params.path,
+    mode: "strict",
+  });
+  return undefined;
+}
+
 type ResolveTelegramTokenOpts = {
   envToken?: string | null;
   accountId?: string | null;
@@ -79,7 +106,7 @@ export function resolveTelegramToken(
     return { token: "", source: "none" };
   }
 
-  const accountToken = normalizeResolvedSecretInputString({
+  const accountToken = resolveRuntimeTokenValue({
     value: accountCfg?.botToken,
     path: `channels.telegram.accounts.${accountId}.botToken`,
   });
@@ -100,7 +127,7 @@ export function resolveTelegramToken(
     return { token: "", source: "none" };
   }
 
-  const configToken = normalizeResolvedSecretInputString({
+  const configToken = resolveRuntimeTokenValue({
     value: telegramCfg?.botToken,
     path: "channels.telegram.botToken",
   });
