From aaa73a5ba20cd943183429ae62001b058729182c Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Wed, 17 Jun 2026 15:46:44 +0200
Subject: [PATCH] fix(testing): use UUIDs for Telegram credential leases

---
 scripts/e2e/telegram-user-credential.ts       |  8 ++++++--
 test/scripts/telegram-user-credential.test.ts | 15 +++++++++++++++
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/scripts/e2e/telegram-user-credential.ts b/scripts/e2e/telegram-user-credential.ts
index 9057c4734593..e17299b3b3fc 100644
--- a/scripts/e2e/telegram-user-credential.ts
+++ b/scripts/e2e/telegram-user-credential.ts
@@ -1,7 +1,7 @@
 #!/usr/bin/env -S node --import tsx
 // Telegram User Credential script supports OpenClaw repository automation.
 
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { copyFile, mkdir, mkdtemp, readFile, rm, unlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
@@ -224,6 +224,10 @@ async function postBroker(params: {
   return payload;
 }
 
+export function buildTelegramUserCredentialOwnerId() {
+  return `telegram-user-${randomUUID()}`;
+}
+
 async function resolveConvexLeaseConfig(opts: Map<string, string>) {
   const envFile = opts.get("env-file") || DEFAULT_CONVEX_ENV_FILE;
   const fileEnv = await readEnvFile(envFile);
@@ -259,7 +263,7 @@ async function resolveConvexLeaseConfig(opts: Map<string, string>) {
     ownerId:
       opts.get("owner-id") ||
       process.env.OPENCLAW_QA_CREDENTIAL_OWNER_ID?.trim() ||
-      `telegram-user-${Date.now()}-${Math.random().toString(16).slice(2, 10)}`,
+      buildTelegramUserCredentialOwnerId(),
   };
 }
 
diff --git a/test/scripts/telegram-user-credential.test.ts b/test/scripts/telegram-user-credential.test.ts
index cc38ed2932c5..e5804965e636 100644
--- a/test/scripts/telegram-user-credential.test.ts
+++ b/test/scripts/telegram-user-credential.test.ts
@@ -118,6 +118,21 @@ describe("telegram user credential path handling", () => {
 });
 
 describe("telegram user credential IO", () => {
+  it("uses collision-resistant generated credential lease owner IDs", async () => {
+    const credentialModule = (await import(
+      `${new URL("../../scripts/e2e/telegram-user-credential.ts", import.meta.url).href}?case=owner-id-${Date.now()}`
+    )) as {
+      buildTelegramUserCredentialOwnerId(): string;
+    };
+
+    expect(credentialModule.buildTelegramUserCredentialOwnerId()).toMatch(
+      /^telegram-user-[0-9a-f-]{36}$/u,
+    );
+    expect(readFileSync("scripts/e2e/telegram-user-credential.ts", "utf8")).not.toContain(
+      "telegram-user-${Date.now()}-${Math.random()",
+    );
+  });
+
   it("rejects oversized chunked lease payload markers before hydration", async () => {
     const credentialModule = (await import(
       `${new URL("../../scripts/e2e/telegram-user-credential.ts", import.meta.url).href}?case=chunk-marker-${Date.now()}`