Copilot/refactor serverless azure function by ASISaga · Pull Request #17970 · openclaw/openclaw

ASISaga · 2026-02-16T10:33:18Z

Summary

Describe the problem and fix in 2–5 bullets:

Problem:
Why it matters:
What changed:
What did NOT change (scope boundary):

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes #
Related #

User-visible / Behavior Changes

List user-visible changes (including defaults/config).
If none, write None.

Security Impact (required)

New permissions/capabilities? (Yes/No)
Secrets/tokens handling changed? (Yes/No)
New/changed network calls? (Yes/No)
Command/tool execution surface changed? (Yes/No)
Data access scope changed? (Yes/No)
If any Yes, explain risk + mitigation:

Repro + Verification

Environment

OS:
Runtime/container:
Model/provider:
Integration/channel (if any):
Relevant config (redacted):

Steps

Expected

Actual

Evidence

Attach at least one:

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

Verified scenarios:
Edge cases checked:
What you did not verify:

Compatibility / Migration

Backward compatible? (Yes/No)
Config/env changes? (Yes/No)
Migration needed? (Yes/No)
If yes, exact upgrade steps:

Failure Recovery (if this breaks)

How to disable/revert this change quickly:
Files/config to restore:
Known bad symptoms reviewers should watch for:

Risks and Mitigations

List only real risks for this PR. Add/remove entries as needed. If none, write None.

Risk:
- Mitigation:

Greptile Summary

This PR adds a complete Azure Functions serverless deployment option for OpenClaw, including a Telegram webhook handler (azure-function/), an Azure Table Storage memory provider (src/memory/memory-provider-azure.ts), an Azure Blob Storage session store, Bicep infrastructure-as-code, comprehensive docs, and tests.

Webhook handler (azure-function/src/functions/webhook.ts): Implements a POST-triggered Azure Function that validates Telegram webhook headers and processes updates via grammy. Contains two issues: (1) authentication validation runs after body parsing (should be before to reject unauthenticated requests early), and (2) dead health-check code inside the POST handler that's unreachable because /healthz has its own route registration.
Memory provider (src/memory/memory-provider-azure.ts): Implements MemorySearchManager using Azure Table Storage with keyword-based search, chunk/file/meta CRUD, and embedding cache. Previously flagged OData filter injection concerns remain. The provider is not yet wired into the search-manager factory.
Session store (azure-function/src/storage/session-store-azure.ts): Clean Blob Storage session persistence implementation with proper 404 handling and idempotent container creation.
Infrastructure (infra/main.bicep): Well-structured Bicep template provisioning Storage, Key Vault (with RBAC), Function App, and App Insights with appropriate security defaults.
Tests: Comprehensive unit tests for the memory provider with proper Azure SDK mocking.
Docs and README updates: Adds Azure deployment guide and cross-references from existing docs.

Confidence Score: 3/5

PR is mostly additive with no changes to existing logic, but the webhook has an auth ordering bug that should be fixed before merging.
Score of 3 reflects that this is a large, additive PR with well-structured code and good test coverage, but the webhook authentication ordering issue (body parsed before validation) is a real logic bug that should be corrected. The dead health-check code is minor but indicates incomplete cleanup. The previously-flagged OData injection concerns in the memory provider also remain unaddressed.
Pay close attention to azure-function/src/functions/webhook.ts (auth ordering bug and dead code) and src/memory/memory-provider-azure.ts (previously flagged OData filter injection concerns).

_{Last reviewed commit: a35d2a5}

…rovider and Bicep IaC Co-authored-by: ASISaga <[email protected]>

Co-authored-by: ASISaga <[email protected]>

- Created docs/install/azure.md with full Azure Functions deployment guide - Updated docs/vps.md to include Azure as a serverless deployment option - Updated docs/platforms/index.md to reference Azure deployment - Updated docs/docs.json navigation to include Azure in hosting section - Updated README.md with Cloud & VPS Deployment section highlighting Azure Co-authored-by: ASISaga <[email protected]>

Co-authored-by: ASISaga <[email protected]>

…-deployment docs: Add Azure Functions deployment documentation

greptile-apps

_{19 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-16T10:36:08Z

src/memory/memory-provider-azure.ts

+    const results: MemorySearchResult[] = [];
+
+    const iter = this.chunksClient.listEntities<ChunkEntity>({
+      queryOptions: { filter: `PartitionKey eq '${this.agentId}'` },


SQL injection vulnerability via string interpolation in filter query.

agentId should be sanitized or parameterized.

Suggested change

queryOptions: { filter: `PartitionKey eq '${this.agentId}'` },

queryOptions: { filter: `PartitionKey eq '${this.agentId.replace(/'/g, "''")}'` },

Prompt To Fix With AI

This is a comment left during a code review. Path: src/memory/memory-provider-azure.ts Line: 156:156 Comment: SQL injection vulnerability via string interpolation in filter query. `agentId` should be sanitized or parameterized. ```suggestion queryOptions: { filter: `PartitionKey eq '${this.agentId.replace(/'/g, "''")}'` }, ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-16T10:36:09Z

src/memory/memory-provider-azure.ts

+
+    const iter = this.chunksClient.listEntities<ChunkEntity>({
+      queryOptions: {
+        filter: `PartitionKey eq '${this.agentId}' and path eq '${params.relPath}'`,


SQL injection vulnerability via string interpolation in filter query.

Both agentId and params.relPath should be sanitized.

Suggested change

filter: `PartitionKey eq '${this.agentId}' and path eq '${params.relPath}'`,

filter: `PartitionKey eq '${this.agentId.replace(/'/g, "''")}' and path eq '${params.relPath.replace(/'/g, "''")}'`,

Prompt To Fix With AI

This is a comment left during a code review. Path: src/memory/memory-provider-azure.ts Line: 189:189 Comment: SQL injection vulnerability via string interpolation in filter query. Both `agentId` and `params.relPath` should be sanitized. ```suggestion filter: `PartitionKey eq '${this.agentId.replace(/'/g, "''")}' and path eq '${params.relPath.replace(/'/g, "''")}'`, ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-16T10:36:10Z

src/memory/memory-provider-azure.ts

+  async deleteChunksByPath(path: string, source: MemorySource): Promise<void> {
+    const iter = this.chunksClient.listEntities<ChunkEntity>({
+      queryOptions: {
+        filter: `PartitionKey eq '${this.agentId}' and path eq '${path}' and source eq '${source}'`,


SQL injection vulnerability via string interpolation in filter query.

All three variables (agentId, path, source) should be sanitized.

Suggested change

filter: `PartitionKey eq '${this.agentId}' and path eq '${path}' and source eq '${source}'`,

filter: `PartitionKey eq '${this.agentId.replace(/'/g, "''")}' and path eq '${path.replace(/'/g, "''")}' and source eq '${source.replace(/'/g, "''")}'`,

Prompt To Fix With AI

This is a comment left during a code review. Path: src/memory/memory-provider-azure.ts Line: 360:360 Comment: SQL injection vulnerability via string interpolation in filter query. All three variables (`agentId`, `path`, `source`) should be sanitized. ```suggestion filter: `PartitionKey eq '${this.agentId.replace(/'/g, "''")}' and path eq '${path.replace(/'/g, "''")}' and source eq '${source.replace(/'/g, "''")}'`, ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps

_{19 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-17T01:51:38Z

azure-function/src/functions/webhook.ts

+  // Health-check endpoint
+  if (request.url.endsWith("/healthz")) {
+    return { status: 200, body: "ok" };
+  }


Dead code — unreachable health check

This health-check branch is unreachable. The telegramWebhook handler is registered on route telegram-webhook (POST only), so a request to /healthz is never routed here — it goes to the dedicated healthz handler registered at line 143. This block should be removed to avoid confusion.

Suggested change

// Health-check endpoint

if (request.url.endsWith("/healthz")) {

return { status: 200, body: "ok" };

}

Prompt To Fix With AI

This is a comment left during a code review. Path: azure-function/src/functions/webhook.ts Line: 98:101 Comment: **Dead code — unreachable health check** This health-check branch is unreachable. The `telegramWebhook` handler is registered on route `telegram-webhook` (POST only), so a request to `/healthz` is never routed here — it goes to the dedicated `healthz` handler registered at line 143. This block should be removed to avoid confusion. ```suggestion ``` How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-17T01:51:39Z

azure-function/src/functions/webhook.ts

+  try {
+    // grammy's webhookCallback returns a handler for the Node http module.
+    // In Azure Functions v4 we need to adapt the request/response ourselves.
+    const body = await request.text();
+    const update = JSON.parse(body);
+
+    // Validate secret token header when configured.
+    if (secret) {
+      const headerSecret = request.headers.get("x-telegram-bot-api-secret-token") ?? "";
+      if (headerSecret !== secret) {
+        context.warn("Telegram webhook secret mismatch");
+        return { status: 401, body: "Unauthorized" };
+      }
+    }


Webhook auth runs after body parsing

The request body is read and JSON-parsed (lines 109-110) before the webhook validation header is checked (lines 113-118). This means unauthenticated requests still trigger body reading and JSON parsing, wasting compute and exposing the parsing surface to untrusted input.

The existing webhook handler in src/telegram/webhook.ts validates authentication (via grammy's webhookCallback) before processing the body.

Move the header validation block (lines 113-118) to run before request.text() and JSON.parse(body) so unauthenticated requests are rejected early without reading the body.

Prompt To Fix With AI

This is a comment left during a code review. Path: azure-function/src/functions/webhook.ts Line: 106:119 Comment: **Webhook auth runs after body parsing** The request body is read and JSON-parsed (lines 109-110) *before* the webhook validation header is checked (lines 113-118). This means unauthenticated requests still trigger body reading and JSON parsing, wasting compute and exposing the parsing surface to untrusted input. The existing webhook handler in `src/telegram/webhook.ts` validates authentication (via grammy's `webhookCallback`) before processing the body. Move the header validation block (lines 113-118) to run before `request.text()` and `JSON.parse(body)` so unauthenticated requests are rejected early without reading the body. How can I resolve this? If you propose a fix, please make it concise.

openclaw-barnacle · 2026-02-22T04:04:31Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

openclaw-barnacle · 2026-03-15T04:23:59Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

openclaw-barnacle · 2026-03-19T04:11:49Z

Closing due to inactivity.
If you believe this PR should be revived, post in #pr-thunderdome-dangerzone on Discord to talk to a maintainer.
That channel is the escape hatch for high-quality PRs that get auto-closed.

Resolved: - openclaw#25790 (Teams issue, CLOSED) - openclaw#47860 (Teams PR, CLOSED) - openclaw#48116 (Azure issue, CLOSED) - openclaw#48899 (Azure issue, CLOSED) - openclaw#47898 (Azure PR, MERGED) - openclaw#17970 (Azure PR, CLOSED) - openclaw#21678 (Windows issue, CLOSED)

Copilot AI and others added 8 commits February 16, 2026 07:06

Initial plan

e933258

Add Azure Functions serverless deployment with Table Storage memory p…

e36d32c

…rovider and Bicep IaC Co-authored-by: ASISaga <[email protected]>

Fix lint errors and add tests for Azure Table Storage memory provider

de2a092

Co-authored-by: ASISaga <[email protected]>

Initial plan

c3d8ff9

docs: Add link to Azure docs in azure-function README

2b74f0f

Co-authored-by: ASISaga <[email protected]>

docs: Add Azure to remote gateway examples

f9c28ea

Co-authored-by: ASISaga <[email protected]>

Merge pull request #2 from ASISaga/copilot/update-documentation-azure…

a35d2a5

…-deployment docs: Add Azure Functions deployment documentation

openclaw-barnacle bot added docs Improvements or additions to documentation gateway Gateway runtime size: XL labels Feb 16, 2026

greptile-apps bot reviewed Feb 16, 2026

View reviewed changes

steipete closed this Feb 16, 2026

steipete reopened this Feb 17, 2026

greptile-apps bot reviewed Feb 17, 2026

View reviewed changes

openclaw-barnacle bot added stale Marked as stale due to inactivity and removed stale Marked as stale due to inactivity labels Feb 22, 2026

openclaw-barnacle bot added the stale Marked as stale due to inactivity label Mar 15, 2026

BradGroux mentioned this pull request Mar 17, 2026

WORKING: All Microsoft Issues and PRs #49126

Draft

openclaw-barnacle bot closed this Mar 19, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Copilot/refactor serverless azure function#17970

Copilot/refactor serverless azure function#17970
ASISaga wants to merge 8 commits intoopenclaw:mainfrom
ASISaga:copilot/refactor-serverless-azure-function

ASISaga commented Feb 16, 2026 •

edited by greptile-apps bot

Loading

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot Feb 16, 2026

Uh oh!

greptile-apps bot Feb 16, 2026

Uh oh!

greptile-apps bot Feb 16, 2026

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot Feb 17, 2026

Uh oh!

greptile-apps bot Feb 17, 2026

Uh oh!

openclaw-barnacle bot commented Feb 22, 2026

Uh oh!

openclaw-barnacle bot commented Mar 15, 2026

Uh oh!

openclaw-barnacle bot commented Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	queryOptions: { filter: `PartitionKey eq '${this.agentId}'` },
	queryOptions: { filter: `PartitionKey eq '${this.agentId.replace(/'/g, "''")}'` },

	filter: `PartitionKey eq '${this.agentId}' and path eq '${params.relPath}'`,
	filter: `PartitionKey eq '${this.agentId.replace(/'/g, "''")}' and path eq '${params.relPath.replace(/'/g, "''")}'`,

Uh oh!

Conversation

ASISaga commented Feb 16, 2026 • edited by greptile-apps bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

User-visible / Behavior Changes

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Compatibility / Migration

Failure Recovery (if this breaks)

Risks and Mitigations

Greptile Summary

Confidence Score: 3/5

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

openclaw-barnacle bot commented Feb 22, 2026

Uh oh!

openclaw-barnacle bot commented Mar 15, 2026

Uh oh!

openclaw-barnacle bot commented Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ASISaga commented Feb 16, 2026 •

edited by greptile-apps bot

Loading