fix(gateway): honor profile auth for SecretRef model entries (#90686)

rohitjavvadi · web-flow · commit f3df863aff9c · 2026-06-13T02:39:06.000-07:00
Fixes #90685 by allowing models.list availability to use matching auth-profile credentials when provider config contains a non-env SecretRef, while preserving unavailable results for unresolved SecretRef-only providers. Adds isolated regression coverage for file SecretRefs and secretref-managed provider markers. Co-authored-by: Rohit <rohitjavvadi2@gmail.com>
diff --git a/src/gateway/server-methods/models-list-result.ts b/src/gateway/server-methods/models-list-result.ts
@@ -14,7 +14,6 @@ import {
   type AuthProfileStore,
 } from "../../agents/auth-profiles.js";
 import { DEFAULT_PROVIDER } from "../../agents/defaults.js";
-import { NON_ENV_SECRETREF_MARKER } from "../../agents/model-auth-markers.js";
 import { hasRuntimeAvailableProviderAuth } from "../../agents/model-auth.js";
 import {
   loadModelCatalogForBrowse,
@@ -57,18 +56,6 @@ function omitRuntimeModelParams(entry: ModelCatalogEntry): ModelCatalogEntry {
   return rest;
 }
 
-function modelCatalogEntryHasUnknownSecretRefAvailability(
-  cfg: OpenClawConfig,
-  entry: ModelCatalogEntry,
-): boolean {
-  const providerId = normalizeProviderId(entry.provider);
-  const provider = Object.entries(cfg.models?.providers ?? {}).find(
-    ([id]) => normalizeProviderId(id) === providerId,
-  )?.[1];
-  const apiKey = provider?.apiKey;
-  return apiKey === NON_ENV_SECRETREF_MARKER || (isSecretRef(apiKey) && apiKey.source !== "env");
-}
-
 function createInFlightProviderAuthChecker(
   providerAuthChecker: ModelsListProviderAuthChecker,
 ): ModelsListProviderAuthChecker {
@@ -219,16 +206,9 @@ async function resolveModelsListEntryAvailability(
 
 async function buildPublicModelsListEntry(params: {
   entry: ModelCatalogEntry;
-  cfg: OpenClawConfig;
   providerAuthChecker?: ModelsListProviderAuthChecker;
 }): Promise<ModelsListEntry> {
   const publicEntry = omitRuntimeModelParams(params.entry);
-  if (modelCatalogEntryHasUnknownSecretRefAvailability(params.cfg, params.entry)) {
-    return {
-      ...publicEntry,
-      available: false,
-    };
-  }
   if (!params.providerAuthChecker) {
     return publicEntry;
   }
@@ -253,7 +233,6 @@ async function buildPublicModelsListEntries(params: {
     params.catalog.map((entry) =>
       buildPublicModelsListEntry({
         entry,
-        cfg: params.cfg,
         providerAuthChecker,
       }),
     ),
diff --git a/src/gateway/server-methods/models.test.ts b/src/gateway/server-methods/models.test.ts
@@ -565,6 +565,90 @@ describe("models.list", () => {
     );
   });
 
+  it("marks auth profiles available even when provider config uses non-env SecretRef markers", async () => {
+    for (const fixture of [
+      {
+        name: "file",
+        apiKey: {
+          source: "file",
+          provider: "mounted-json",
+          id: "/providers/vllm/apiKey",
+        },
+      },
+      { name: "managed-marker", apiKey: "secretref-managed" },
+    ] as const) {
+      await withOpenClawTestState(
+        {
+          layout: "state-only",
+          prefix: `openclaw-models-list-provider-${fixture.name}-profile-`,
+          agentEnv: "main",
+          env: {
+            OPENCLAW_TEST_PROFILE_API_KEY: "test-token",
+            VLLM_API_KEY: undefined,
+          },
+        },
+        async (state) => {
+          await state.writeAuthProfiles({
+            version: 1,
+            profiles: {
+              "vllm:env": {
+                type: "api_key",
+                provider: "vllm",
+                keyRef: {
+                  source: "env",
+                  provider: "default",
+                  id: "OPENCLAW_TEST_PROFILE_API_KEY",
+                },
+              },
+            },
+          });
+
+          const cfg = {
+            agents: {
+              defaults: {
+                models: {
+                  "vllm/*": {},
+                },
+              },
+            },
+            models: {
+              providers: {
+                vllm: {
+                  apiKey: fixture.apiKey,
+                },
+              },
+            },
+          } as unknown as OpenClawConfig;
+
+          const { request, respond } = requestModelsList({
+            view: "all",
+            runtimeConfig: cfg,
+            loadGatewayModelCatalog: vi.fn(() =>
+              Promise.resolve([{ id: "llama-secure", name: "Llama Secure", provider: "vllm" }]),
+            ),
+            reqId: `req-models-list-provider-${fixture.name}-profile`,
+          });
+          await request;
+
+          expect(respond).toHaveBeenCalledWith(
+            true,
+            {
+              models: [
+                {
+                  id: "llama-secure",
+                  name: "Llama Secure",
+                  provider: "vllm",
+                  available: true,
+                },
+              ],
+            },
+            undefined,
+          );
+        },
+      );
+    }
+  });
+
   it("preserves catalog load errors before the timeout fallback wins", async () => {
     const { request, respond } = requestModelsList({
       view: "configured",
