@amir83nasr/10router 0.1.0

package/src/lib/oauth/services/claude.js

@@ -0,0 +1,135 @@
+import { OAuthService } from "./oauth.js";
+import { CLAUDE_CONFIG } from "../constants/oauth.js";
+import { getServerCredentials } from "../config/index.js";
+import { spinner as createSpinner } from "../utils/ui.js";
+
+/**
+ * Claude OAuth Service
+ */
+export class ClaudeService extends OAuthService {
+  constructor() {
+    super(CLAUDE_CONFIG);
+  }
+
+  /**
+   * Build Claude authorization URL
+   */
+  buildClaudeAuthUrl(redirectUri, state, codeChallenge) {
+    const scopeStr = CLAUDE_CONFIG.scopes.join(" ");
+    const params = new URLSearchParams({
+      code: "true",
+      client_id: CLAUDE_CONFIG.clientId,
+      response_type: "code",
+      redirect_uri: redirectUri,
+      scope: scopeStr,
+      code_challenge: codeChallenge,
+      code_challenge_method: CLAUDE_CONFIG.codeChallengeMethod,
+      state: state,
+    });
+
+    return `${CLAUDE_CONFIG.authorizeUrl}?${params.toString()}`;
+  }
+
+  /**
+   * Exchange Claude authorization code (with special handling)
+   */
+  async exchangeClaudeCode(code, redirectUri, codeVerifier, state) {
+    // Parse code - may contain state after #
+    let authCode = code;
+    let codeState = "";
+    if (authCode.includes("#")) {
+      const parts = authCode.split("#");
+      authCode = parts[0];
+      codeState = parts[1] || "";
+    }
+
+    // Claude uses JSON format (not form-urlencoded)
+    const tokenPayload = {
+      code: authCode,
+      state: codeState || state,
+      grant_type: "authorization_code",
+      client_id: CLAUDE_CONFIG.clientId,
+      redirect_uri: redirectUri,
+      code_verifier: codeVerifier,
+    };
+
+    const response = await fetch(CLAUDE_CONFIG.tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json",
+      },
+      body: JSON.stringify(tokenPayload),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Token exchange failed: ${error}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Save Claude tokens to server
+   */
+  async saveTokens(tokens) {
+    const { server, token, userId } = getServerCredentials();
+
+    // Server will auto-generate displayName based on existing account count
+    const response = await fetch(`${server}/api/cli/providers/claude`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`,
+        "X-User-Id": userId,
+      },
+      body: JSON.stringify({
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        expiresIn: tokens.expires_in,
+        scope: tokens.scope,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.json();
+      throw new Error(error.error || "Failed to save tokens");
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Complete Claude OAuth flow
+   */
+  async connect() {
+    const spinner = createSpinner("Starting Claude OAuth...").start();
+
+    try {
+      spinner.text = "Starting local server...";
+
+      // Authenticate and get authorization code
+      const { code, state, codeVerifier, redirectUri } = await this.authenticate(
+        "Claude",
+        this.buildClaudeAuthUrl.bind(this),
+      );
+
+      spinner.start("Exchanging code for tokens...");
+
+      // Exchange code for tokens
+      const tokens = await this.exchangeClaudeCode(code, redirectUri, codeVerifier, state);
+
+      spinner.text = "Saving tokens to server...";
+
+      // Save tokens to server
+      await this.saveTokens(tokens);
+
+      spinner.succeed("Claude connected successfully!");
+      return true;
+    } catch (error) {
+      spinner.fail(`Failed: ${error.message}`);
+      throw error;
+    }
+  }
+}

package/src/lib/oauth/services/codex.js

@@ -0,0 +1,149 @@
+import open from "open";
+import { OAuthService } from "./oauth.js";
+import { CODEX_CONFIG } from "../constants/oauth.js";
+import { getServerCredentials } from "../config/index.js";
+import { startLocalServer } from "../utils/server.js";
+import { generatePKCE } from "../utils/pkce.js";
+import { spinner as createSpinner } from "../utils/ui.js";
+
+/**
+ * Codex (OpenAI) OAuth Service
+ */
+export class CodexService extends OAuthService {
+  constructor() {
+    super(CODEX_CONFIG);
+  }
+
+  /**
+   * Build Codex authorization URL
+   */
+  buildCodexAuthUrl(redirectUri, state, codeChallenge) {
+    // Build URL manually to ensure space encoding as %20 instead of +
+    const params = {
+      response_type: "code",
+      client_id: CODEX_CONFIG.clientId,
+      redirect_uri: redirectUri,
+      scope: CODEX_CONFIG.scope,
+      code_challenge: codeChallenge,
+      code_challenge_method: CODEX_CONFIG.codeChallengeMethod,
+      ...CODEX_CONFIG.extraParams,
+      state: state,
+    };
+
+    const queryString = Object.entries(params)
+      .map(([key, value]) => `${key}=${encodeURIComponent(value)}`)
+      .join("&");
+
+    return `${CODEX_CONFIG.authorizeUrl}?${queryString}`;
+  }
+
+  /**
+   * Save Codex tokens to server
+   */
+  async saveTokens(tokens) {
+    const { server, token, userId } = getServerCredentials();
+
+    const response = await fetch(`${server}/api/cli/providers/codex`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`,
+        "X-User-Id": userId,
+      },
+      body: JSON.stringify({
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        expiresIn: tokens.expires_in,
+        lastRefreshAt: new Date().toISOString(),
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.json();
+      throw new Error(error.error || "Failed to save tokens");
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Complete Codex OAuth flow
+   */
+  async connect() {
+    const spinner = createSpinner("Starting Codex OAuth...").start();
+
+    try {
+      spinner.text = "Starting local server...";
+
+      // Start local server for callback (use fixed port 1455 like real Codex CLI)
+      const fixedPort = CODEX_CONFIG.fixedPort;
+      let callbackParams = null;
+      const { port, close } = await startLocalServer((params) => {
+        callbackParams = params;
+      }, fixedPort);
+
+      const redirectUri = `http://localhost:${port}/auth/callback`;
+      spinner.succeed(`Local server started on port ${port}`);
+
+      // Generate PKCE
+      const { codeVerifier, codeChallenge, state } = generatePKCE();
+
+      // Build authorization URL
+      const authUrl = this.buildCodexAuthUrl(redirectUri, state, codeChallenge);
+
+      console.log("\nOpening browser for OpenAI authentication...");
+      console.log(`If browser doesn't open, visit:\n${authUrl}\n`);
+
+      // Open browser
+      await open(authUrl);
+
+      // Wait for callback
+      spinner.start("Waiting for OpenAI authorization...");
+
+      await new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+          reject(new Error("Authentication timeout (5 minutes)"));
+        }, 300000);
+
+        const checkInterval = setInterval(() => {
+          if (callbackParams) {
+            clearInterval(checkInterval);
+            clearTimeout(timeout);
+            resolve();
+          }
+        }, 100);
+      });
+
+      close();
+
+      if (callbackParams.error) {
+        throw new Error(callbackParams.error_description || callbackParams.error);
+      }
+
+      if (!callbackParams.code) {
+        throw new Error("No authorization code received");
+      }
+
+      spinner.start("Exchanging code for tokens...");
+
+      // Exchange code for tokens (Codex uses form-urlencoded)
+      const tokens = await this.exchangeCode(
+        callbackParams.code,
+        redirectUri,
+        codeVerifier,
+        "application/x-www-form-urlencoded",
+      );
+
+      spinner.text = "Saving tokens to server...";
+
+      // Save tokens to server
+      await this.saveTokens(tokens);
+
+      spinner.succeed("Codex connected successfully!");
+      return true;
+    } catch (error) {
+      spinner.fail(`Failed: ${error.message}`);
+      throw error;
+    }
+  }
+}

package/src/lib/oauth/services/cursor.js

@@ -0,0 +1,179 @@
+import { CURSOR_CONFIG } from "../constants/oauth.js";
+
+/**
+ * Cursor IDE OAuth Service
+ * Supports Import Token method from Cursor IDE's local SQLite database
+ *
+ * Token Location:
+ * - Linux: ~/.config/Cursor/User/globalStorage/state.vscdb
+ * - macOS: /Users/<user>/Library/Application Support/Cursor/User/globalStorage/state.vscdb
+ * - Windows: %APPDATA%\Cursor\User\globalStorage\state.vscdb
+ *
+ * Database Keys:
+ * - cursorAuth/accessToken: The access token
+ * - storage.serviceMachineId: Machine ID for checksum
+ */
+
+export class CursorService {
+  constructor() {
+    this.config = CURSOR_CONFIG;
+  }
+
+  /**
+   * Generate Cursor checksum (jyh cipher)
+   * Algorithm: XOR timestamp bytes with rolling key (initial 165), then base64 encode
+   * Format: {encoded_timestamp},{machineId}
+   */
+  generateChecksum(machineId) {
+    const timestamp = Math.floor(Date.now() / 1000).toString();
+    let key = 165;
+    const encoded = [];
+
+    for (let i = 0; i < timestamp.length; i++) {
+      const charCode = timestamp.charCodeAt(i);
+      encoded.push(charCode ^ key);
+      key = (key + charCode) & 0xff; // Rolling key update
+    }
+
+    const base64Encoded = Buffer.from(encoded).toString("base64");
+    return `${base64Encoded},${machineId}`;
+  }
+
+  /**
+   * Build request headers for Cursor API
+   */
+  buildHeaders(accessToken, machineId, ghostMode = false) {
+    const checksum = this.generateChecksum(machineId);
+
+    return {
+      Authorization: `Bearer ${accessToken}`,
+      "Content-Type": "application/connect+proto",
+      "Connect-Protocol-Version": "1",
+      "x-cursor-client-version": this.config.clientVersion,
+      "x-cursor-client-type": this.config.clientType,
+      "x-cursor-client-os": this.detectOS(),
+      "x-cursor-client-arch": this.detectArch(),
+      "x-cursor-client-device-type": "desktop",
+      "x-cursor-checksum": checksum,
+      "x-ghost-mode": ghostMode ? "true" : "false",
+    };
+  }
+
+  /**
+   * Detect OS for headers
+   */
+  detectOS() {
+    if (typeof process !== "undefined") {
+      const platform = process.platform;
+      if (platform === "win32") return "windows";
+      if (platform === "darwin") return "macos";
+      return "linux";
+    }
+    return "linux";
+  }
+
+  /**
+   * Detect architecture for headers
+   */
+  detectArch() {
+    if (typeof process !== "undefined") {
+      const arch = process.arch;
+      if (arch === "x64") return "x86_64";
+      if (arch === "arm64") return "aarch64";
+      return arch;
+    }
+    return "x86_64";
+  }
+
+  /**
+   * Validate and import token from Cursor IDE
+   * Note: We skip API validation because Cursor API uses complex protobuf format.
+   * Token will be validated when actually used for requests.
+   * @param {string} accessToken - Access token from state.vscdb
+   * @param {string} machineId - Machine ID from state.vscdb
+   */
+  async validateImportToken(accessToken, machineId) {
+    // Basic validation
+    if (!accessToken || typeof accessToken !== "string") {
+      throw new Error("Access token is required");
+    }
+
+    if (!machineId || typeof machineId !== "string") {
+      throw new Error("Machine ID is required");
+    }
+
+    // Token format validation (Cursor tokens are typically long strings)
+    if (accessToken.length < 50) {
+      throw new Error("Invalid token format. Token appears too short.");
+    }
+
+    // Machine ID format validation (should be UUID-like)
+    const uuidRegex = /^[a-f0-9-]{32,}$/i;
+    if (!uuidRegex.test(machineId.replace(/-/g, ""))) {
+      throw new Error("Invalid machine ID format. Expected UUID format.");
+    }
+
+    // Note: We don't validate against API because Cursor uses complex protobuf.
+    // Token will be validated when used for actual requests.
+
+    return {
+      accessToken,
+      machineId,
+      expiresIn: 86400, // Cursor tokens typically last 24 hours
+      authMethod: "imported",
+    };
+  }
+
+  /**
+   * Extract user info from token if possible
+   * Cursor tokens may contain encoded user info
+   */
+  extractUserInfo(accessToken) {
+    try {
+      // Try to decode as JWT
+      const parts = accessToken.split(".");
+      if (parts.length === 3) {
+        let payload = parts[1];
+        while (payload.length % 4) {
+          payload += "=";
+        }
+        const decoded = JSON.parse(
+          Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString(),
+        );
+        return {
+          email: decoded.email || decoded.sub,
+          userId: decoded.sub || decoded.user_id,
+        };
+      }
+    } catch {
+      // Token is not a JWT, that's okay
+    }
+
+    return null;
+  }
+
+  /**
+   * Get token storage path instructions for user
+   */
+  getTokenStorageInstructions() {
+    return {
+      title: "How to get your Cursor token",
+      steps: [
+        "1. Open Cursor IDE and make sure you're logged in",
+        "2. Find the state.vscdb file:",
+        `   - Linux: ${this.config.tokenStoragePaths.linux}`,
+        `   - macOS: ${this.config.tokenStoragePaths.macos}`,
+        `   - Windows: ${this.config.tokenStoragePaths.windows}`,
+        "3. Open the database with SQLite browser or CLI:",
+        "   sqlite3 state.vscdb \"SELECT value FROM itemTable WHERE key='cursorAuth/accessToken'\"",
+        "4. Also get the machine ID:",
+        "   sqlite3 state.vscdb \"SELECT value FROM itemTable WHERE key='storage.serviceMachineId'\"",
+        "5. Paste both values in the form below",
+      ],
+      alternativeMethod: [
+        "Or use this one-liner to get both values:",
+        "sqlite3 state.vscdb \"SELECT key, value FROM itemTable WHERE key IN ('cursorAuth/accessToken', 'storage.serviceMachineId')\"",
+      ],
+    };
+  }
+}

package/src/lib/oauth/services/github.js

@@ -0,0 +1,227 @@
+import { OAuthService } from "./oauth.js";
+import { GITHUB_CONFIG } from "../constants/oauth.js";
+import { spinner as createSpinner } from "../utils/ui.js";
+
+/**
+ * GitHub Copilot OAuth Service
+ * Uses Device Code Flow for authentication
+ */
+export class GitHubService extends OAuthService {
+  constructor() {
+    super(GITHUB_CONFIG);
+  }
+
+  /**
+   * Get device code for GitHub authentication
+   */
+  async getDeviceCode() {
+    const response = await fetch(`${GITHUB_CONFIG.deviceCodeUrl}`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        client_id: GITHUB_CONFIG.clientId,
+        scope: GITHUB_CONFIG.scopes,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to get device code: ${error}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Poll for access token using device code
+   */
+  async pollAccessToken(deviceCode, verificationUri, userCode, interval = 5000) {
+    const spinner = createSpinner("Waiting for GitHub authentication...").start();
+
+    // Show user code and verification URL
+    console.log(`\nPlease visit: ${verificationUri}`);
+    console.log(`Enter code: ${userCode}\n`);
+
+    // Open browser automatically
+    try {
+      const open = (await import("open")).default;
+      await open(verificationUri);
+    } catch (error) {
+      console.log("Could not open browser automatically. Please visit the URL above manually.");
+    }
+
+    // Poll for access token
+    while (true) {
+      await new Promise((resolve) => setTimeout(resolve, interval));
+
+      const response = await fetch(`${GITHUB_CONFIG.tokenUrl}`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json",
+        },
+        body: new URLSearchParams({
+          client_id: GITHUB_CONFIG.clientId,
+          device_code: deviceCode,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        }),
+      });
+
+      const data = await response.json();
+
+      if (data.access_token) {
+        spinner.succeed("GitHub authentication successful!");
+        return {
+          access_token: data.access_token,
+          token_type: data.token_type,
+          scope: data.scope,
+        };
+      } else if (data.error === "authorization_pending") {
+        // Continue polling
+        continue;
+      } else if (data.error === "slow_down") {
+        // Increase polling interval
+        interval += 5000;
+        continue;
+      } else if (data.error === "expired_token") {
+        spinner.fail("Device code expired. Please try again.");
+        throw new Error("Device code expired");
+      } else if (data.error === "access_denied") {
+        spinner.fail("Access denied by user.");
+        throw new Error("Access denied");
+      } else {
+        spinner.fail("Failed to get access token.");
+        throw new Error(data.error_description || data.error);
+      }
+    }
+  }
+
+  /**
+   * Get Copilot token using GitHub access token
+   */
+  async getCopilotToken(accessToken) {
+    const response = await fetch(`${GITHUB_CONFIG.copilotTokenUrl}`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`, // GitHub API typically uses Bearer
+        Accept: "application/json",
+        "X-GitHub-Api-Version": GITHUB_CONFIG.apiVersion,
+        "User-Agent": GITHUB_CONFIG.userAgent,
+      },
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to get Copilot token: ${error}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Get user info using GitHub access token
+   */
+  async getUserInfo(accessToken) {
+    const response = await fetch(`${GITHUB_CONFIG.userInfoUrl}`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`, // GitHub API typically uses Bearer
+        Accept: "application/json",
+        "X-GitHub-Api-Version": GITHUB_CONFIG.apiVersion,
+        "User-Agent": GITHUB_CONFIG.userAgent,
+      },
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to get user info: ${error}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Complete GitHub Copilot authentication flow
+   */
+  async authenticate() {
+    try {
+      // Get device code
+      const deviceResponse = await this.getDeviceCode();
+
+      // Poll for access token
+      const tokenResponse = await this.pollAccessToken(
+        deviceResponse.device_code,
+        deviceResponse.verification_uri,
+        deviceResponse.user_code,
+      );
+
+      // Get Copilot token
+      const copilotToken = await this.getCopilotToken(tokenResponse.access_token);
+
+      // Get user info
+      const userInfo = await this.getUserInfo(tokenResponse.access_token);
+
+      console.log(`\nSuccessfully authenticated as ${userInfo.login}`);
+
+      return {
+        accessToken: tokenResponse.access_token,
+        copilotToken: copilotToken.token,
+        refreshToken: null, // GitHub device flow doesn't return refresh token
+        expiresIn: copilotToken.expires_at,
+        userInfo: {
+          id: userInfo.id,
+          login: userInfo.login,
+          name: userInfo.name,
+          email: userInfo.email,
+        },
+        copilotTokenInfo: copilotToken,
+      };
+    } catch (error) {
+      throw new Error(`GitHub authentication failed: ${error.message}`);
+    }
+  }
+
+  /**
+   * Connect to server with GitHub credentials
+   */
+  async connect() {
+    try {
+      // Authenticate with GitHub
+      const authResult = await this.authenticate();
+
+      // Send credentials to server
+      const { server, token, userId } = await import("../config/index.js").then((m) =>
+        m.getServerCredentials(),
+      );
+      const spinner = (await import("../utils/ui.js")).spinner("Connecting to server...").start();
+
+      const response = await fetch(`${server}/api/cli/providers/github`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${token}`,
+          "X-User-Id": userId,
+        },
+        body: JSON.stringify({
+          accessToken: authResult.accessToken,
+          copilotToken: authResult.copilotToken,
+          userInfo: authResult.userInfo,
+          copilotTokenInfo: authResult.copilotTokenInfo,
+        }),
+      });
+
+      if (!response.ok) {
+        const errorData = await response.json();
+        throw new Error(errorData.error || "Failed to connect to server");
+      }
+
+      spinner.succeed("GitHub Copilot connected successfully!");
+      console.log(`\nConnected as: ${authResult.userInfo.login}`);
+    } catch (error) {
+      const { error: showError } = await import("../utils/ui.js");
+      showError(`GitHub connection failed: ${error.message}`);
+      throw error;
+    }
+  }
+}