refactor(gateway): update gateway parameters to use None as default #169

backend/tests/test_gateway_resolver.py

@@ -5,6 +5,7 @@ from uuid import uuid4
 
 import pytest
 
+import app.services.openclaw.session_service as session_service
 from app.models.gateways import Gateway
 from app.schemas.gateway_api import GatewayResolveQuery
 from app.services.openclaw.gateway_resolver import (
@@ -100,3 +101,82 @@ async def test_resolve_gateway_keeps_gateway_allow_insecure_tls_for_direct_url()
     )
 
     assert config.allow_insecure_tls is True
+
+
+class _FakeGatewayQuery:
+    def __init__(self, gateway: Gateway | None) -> None:
+        self._gateway = gateway
+        self.filters: list[dict[str, object]] = []
+
+    def filter_by(self, **kwargs: object) -> _FakeGatewayQuery:
+        self.filters.append(kwargs)
+        return self
+
+    async def first(self, _session: object) -> Gateway | None:
+        return self._gateway
+
+
+class _FakeAsyncSession:
+    async def exec(
+        self, *_args: object, **_kwargs: object
+    ) -> None:  # pragma: no cover - guard only
+        return None
+
+
+@pytest.mark.asyncio
+async def test_resolve_gateway_uses_saved_gateway_settings_when_direct_flags_missing(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    gateway = _gateway(
+        disable_device_pairing=True,
+        allow_insecure_tls=True,
+        url="wss://gateway.example:18789/ws",
+        token=" db-token ",
+    )
+    fake_query = _FakeGatewayQuery(gateway)
+    monkeypatch.setattr(session_service.Gateway, "objects", fake_query)
+
+    service = GatewaySessionService(session=_FakeAsyncSession())  # type: ignore[arg-type]
+    _, config, _ = await service.resolve_gateway(
+        GatewayResolveQuery(gateway_url=gateway.url),
+        user=None,
+        organization_id=gateway.organization_id,
+    )
+
+    assert config.token is None
+    assert config.allow_insecure_tls is True
+    assert config.disable_device_pairing is True
+    assert fake_query.filters == [
+        {"url": gateway.url},
+        {"organization_id": gateway.organization_id},
+    ]
+
+
+@pytest.mark.asyncio
+async def test_resolve_gateway_prefers_explicit_direct_flags_over_saved_settings(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    gateway = _gateway(
+        disable_device_pairing=True,
+        allow_insecure_tls=True,
+        url="wss://gateway.example:18789/ws",
+        token="db-token",
+    )
+    fake_query = _FakeGatewayQuery(gateway)
+    monkeypatch.setattr(session_service.Gateway, "objects", fake_query)
+
+    service = GatewaySessionService(session=object())  # type: ignore[arg-type]
+    _, config, _ = await service.resolve_gateway(
+        GatewayResolveQuery(
+            gateway_url=gateway.url,
+            gateway_token="explicit-token",
+            gateway_allow_insecure_tls=False,
+            gateway_disable_device_pairing=False,
+        ),
+        user=None,
+        organization_id=gateway.organization_id,
+    )
+
+    assert config.token == "explicit-token"
+    assert config.allow_insecure_tls is False
+    assert config.disable_device_pairing is False

backend/tests/test_gateway_rpc_connect_scopes.py

@@ -192,3 +192,93 @@ async def test_openclaw_call_surfaces_scope_error_without_device_fallback(
             "status",
             config=GatewayConfig(url="ws://gateway.example/ws", token="secret-token"),
         )
+
+
+class _FakeConnectContext:
+    async def __aenter__(self) -> object:
+        return object()
+
+    async def __aexit__(self, _exc_type: object, _exc: object, _tb: object) -> bool:
+        return False
+
+
+@pytest.mark.asyncio
+async def test_openclaw_call_once_does_not_pass_ssl_none_for_wss(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    captured: dict[str, object] = {}
+
+    def _fake_connect(url: str, **kwargs: object) -> _FakeConnectContext:
+        captured["url"] = url
+        captured["kwargs"] = kwargs
+        return _FakeConnectContext()
+
+    async def _fake_recv_first(_ws: object) -> None:
+        return None
+
+    async def _fake_ensure_connected(
+        _ws: object, _first_message: object, _config: GatewayConfig
+    ) -> None:
+        return None
+
+    async def _fake_send_request(_ws: object, _method: str, _params: object) -> object:
+        return {"ok": True}
+
+    monkeypatch.setattr(gateway_rpc.websockets, "connect", _fake_connect)
+    monkeypatch.setattr(gateway_rpc, "_recv_first_message_or_none", _fake_recv_first)
+    monkeypatch.setattr(gateway_rpc, "_ensure_connected", _fake_ensure_connected)
+    monkeypatch.setattr(gateway_rpc, "_send_request", _fake_send_request)
+
+    payload = await gateway_rpc._openclaw_call_once(
+        "status",
+        None,
+        config=GatewayConfig(url="wss://gateway.example/ws", allow_insecure_tls=False),
+        gateway_url="wss://gateway.example/ws",
+    )
+
+    assert payload == {"ok": True}
+    assert captured["url"] == "wss://gateway.example/ws"
+    kwargs = captured["kwargs"]
+    assert isinstance(kwargs, dict)
+    assert "ssl" not in kwargs
+
+
+@pytest.mark.asyncio
+async def test_openclaw_call_once_passes_ssl_context_for_insecure_wss(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    captured: dict[str, object] = {}
+
+    def _fake_connect(url: str, **kwargs: object) -> _FakeConnectContext:
+        captured["url"] = url
+        captured["kwargs"] = kwargs
+        return _FakeConnectContext()
+
+    async def _fake_recv_first(_ws: object) -> None:
+        return None
+
+    async def _fake_ensure_connected(
+        _ws: object, _first_message: object, _config: GatewayConfig
+    ) -> None:
+        return None
+
+    async def _fake_send_request(_ws: object, _method: str, _params: object) -> object:
+        return {"ok": True}
+
+    monkeypatch.setattr(gateway_rpc.websockets, "connect", _fake_connect)
+    monkeypatch.setattr(gateway_rpc, "_recv_first_message_or_none", _fake_recv_first)
+    monkeypatch.setattr(gateway_rpc, "_ensure_connected", _fake_ensure_connected)
+    monkeypatch.setattr(gateway_rpc, "_send_request", _fake_send_request)
+
+    payload = await gateway_rpc._openclaw_call_once(
+        "status",
+        None,
+        config=GatewayConfig(url="wss://gateway.example/ws", allow_insecure_tls=True),
+        gateway_url="wss://gateway.example/ws",
+    )
+
+    assert payload == {"ok": True}
+    assert captured["url"] == "wss://gateway.example/ws"
+    kwargs = captured["kwargs"]
+    assert isinstance(kwargs, dict)
+    assert kwargs.get("ssl") is not None