@cartanova/qgrid-cli 2.6.0 → 2.6.1

package/bundle/src/application/qgrid/oauth.ts

@@ -20,6 +20,9 @@ const logger = getLogger(["qgrid", "oauth"]);
 const CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
 const AUTHORIZE_URL = "https://claude.com/cai/oauth/authorize";
 const TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+// client 허용 목록에 있는 콘솔 콜백. 인증 후 콘솔 페이지가 `code#state`를 표시하고
+// 사용자가 붙여넣는 코드 플로우(Claude Code CLI와 동일)에 사용한다.
+export const CONSOLE_CALLBACK_URL = "https://console.anthropic.com/oauth/code/callback";
 
 // login 시 사용 (authorize URL)
 const ALL_SCOPES = [

package/bundle/src/application/qgrid/qgrid-oauth-redirect.test.ts

@@ -1,22 +1,54 @@
 import { Sonamu } from "sonamu";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
+import { CONSOLE_CALLBACK_URL } from "./oauth";
 import { QgridFrame } from "./qgrid.frame";
 
-// oauthStart 는 PKCE 상태를 cache 에 저장한다 — redirect 파생 검증에는 실제 cache 가 필요 없다.
-vi.mock("sonamu/cache", () => ({
-  getCacheManagerRef: () => ({
-    set: vi.fn(async () => {}),
-    get: vi.fn(async () => undefined),
-    delete: vi.fn(async () => {}),
-  }),
+const { exchangeMock, tokenSaveMock, tokenDelMock, findByAccountMock } = vi.hoisted(() => ({
+  exchangeMock: vi.fn(),
+  tokenSaveMock: vi.fn(async () => [1]),
+  tokenDelMock: vi.fn(async () => 1),
+  findByAccountMock: vi.fn(async () => []),
 }));
 
-function redirectUriOf(authUrl: string): string | null {
-  return new URL(authUrl).searchParams.get("redirect_uri");
+// oauthStart 는 PKCE 상태를 cache 에 저장한다 — Map 스텁으로 왕복만 지원한다.
+vi.mock("sonamu/cache", () => {
+  const store = new Map<string, string>();
+  return {
+    getCacheManagerRef: () => ({
+      set: vi.fn(async ({ key, value }: { key: string; value: string }) => {
+        store.set(key, value);
+      }),
+      get: vi.fn(async ({ key }: { key: string }) => store.get(key)),
+      delete: vi.fn(async ({ key }: { key: string }) => {
+        store.delete(key);
+      }),
+    }),
+  };
+});
+
+vi.mock("./oauth", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("./oauth")>()),
+  exchangeCodeForTokens: exchangeMock,
+}));
+
+vi.mock("../token/token.model", () => ({
+  TokenModel: {
+    save: tokenSaveMock,
+    del: tokenDelMock,
+    findByAccountIdentifier: findByAccountMock,
+  },
+}));
+
+function authUrlParam(authUrl: string, key: string): string | null {
+  return new URL(authUrl).searchParams.get(key);
+}
+
+function mockHttpContext(headers: Record<string, string>, protocol = "http"): void {
+  vi.spyOn(Sonamu, "getContext").mockReturnValue({ headers, request: { protocol } } as never);
 }
 
-describe("QgridFrame.oauthStart redirect derivation", () => {
+describe("QgridFrame.oauthStart redirect resolution", () => {
   let savedPort: string | undefined;
 
   beforeEach(() => {
@@ -29,32 +61,91 @@ describe("QgridFrame.oauthStart redirect derivation", () => {
     vi.restoreAllMocks();
   });
 
-  it("derives the callback from the browser-sent Origin header", async () => {
-    vi.spyOn(Sonamu, "getContext").mockReturnValue({
-      headers: { origin: "https://qgrid.example.com" },
-      request: { protocol: "https" },
-    } as never);
+  it("uses the redirect flow with the request-derived callback on loopback origins", async () => {
+    mockHttpContext({ origin: "http://localhost:44900" });
+
+    const { authUrl, mode } = await QgridFrame.oauthStart("tok");
+    expect(mode).toBe("redirect");
+    expect(authUrlParam(authUrl, "redirect_uri")).toBe("http://localhost:44900/callback");
+  });
+
+  it("switches to the code flow with the console callback on remote origins", async () => {
+    mockHttpContext({ origin: "https://qgrid.example.com" });
 
-    const { authUrl } = await QgridFrame.oauthStart("tok");
-    expect(redirectUriOf(authUrl)).toBe("https://qgrid.example.com/callback");
+    const { authUrl, mode } = await QgridFrame.oauthStart("tok");
+    expect(mode).toBe("code");
+    expect(authUrlParam(authUrl, "redirect_uri")).toBe(CONSOLE_CALLBACK_URL);
   });
 
-  it("falls back to forwarded proto and host headers when Origin is absent", async () => {
-    vi.spyOn(Sonamu, "getContext").mockReturnValue({
-      headers: { host: "dev0.cartanova.ai:44900", "x-forwarded-proto": "https" },
-      request: { protocol: "http" },
-    } as never);
+  it("treats forwarded remote hosts as the code flow when Origin is absent", async () => {
+    mockHttpContext({ host: "qgrid.example.com", "x-forwarded-proto": "https" });
 
-    const { authUrl } = await QgridFrame.oauthStart("tok");
-    expect(redirectUriOf(authUrl)).toBe("https://dev0.cartanova.ai:44900/callback");
+    const { authUrl, mode } = await QgridFrame.oauthStart("tok");
+    expect(mode).toBe("code");
+    expect(authUrlParam(authUrl, "redirect_uri")).toBe(CONSOLE_CALLBACK_URL);
   });
 
-  it("falls back to localhost without an HTTP context", async () => {
+  it("falls back to the localhost redirect flow without an HTTP context", async () => {
     vi.spyOn(Sonamu, "getContext").mockImplementation(() => {
       throw new Error("no context");
     });
 
-    const { authUrl } = await QgridFrame.oauthStart("tok");
-    expect(redirectUriOf(authUrl)).toBe("http://localhost:44900/callback");
+    const { authUrl, mode } = await QgridFrame.oauthStart("tok");
+    expect(mode).toBe("redirect");
+    expect(authUrlParam(authUrl, "redirect_uri")).toBe("http://localhost:44900/callback");
+  });
+});
+
+describe("QgridFrame.oauthComplete code flow", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+    exchangeMock.mockReset();
+    tokenSaveMock.mockClear();
+    findByAccountMock.mockClear().mockResolvedValue([]);
+  });
+
+  it("exchanges a pasted code#state against the stored pending state and saves the token", async () => {
+    mockHttpContext({ origin: "https://qgrid.example.com" });
+    const { authUrl } = await QgridFrame.oauthStart("haze-2");
+    const state = authUrlParam(authUrl, "state")!;
+
+    exchangeMock.mockResolvedValueOnce({
+      accessToken: "at",
+      refreshToken: "rt",
+      expiresAt: 123,
+      scope: "user:inference",
+      accountUuid: "acc-1",
+    });
+
+    await expect(QgridFrame.oauthComplete(`  the-code#${state} `)).resolves.toEqual({
+      added: true,
+      name: "haze-2",
+    });
+
+    expect(exchangeMock).toHaveBeenCalledWith(
+      "the-code",
+      expect.any(String),
+      state,
+      CONSOLE_CALLBACK_URL,
+    );
+    expect(tokenSaveMock).toHaveBeenCalledWith([
+      expect.objectContaining({
+        provider: "anthropic",
+        name: "haze-2",
+        credentials: expect.objectContaining({ accessToken: "at", accountUuid: "acc-1" }),
+      }),
+    ]);
+  });
+
+  it("rejects input without a #state part", async () => {
+    await expect(QgridFrame.oauthComplete("just-a-code")).rejects.toThrow(/code#state/);
+    expect(exchangeMock).not.toHaveBeenCalled();
+  });
+
+  it("rejects an unknown or expired state", async () => {
+    await expect(QgridFrame.oauthComplete("code#no-such-state")).rejects.toThrow(
+      /not found or expired/,
+    );
+    expect(exchangeMock).not.toHaveBeenCalled();
   });
 });

package/bundle/src/application/qgrid/qgrid.frame.ts

@@ -19,6 +19,7 @@ import { TokenCredentials } from "../token/token.types";
 import {
   type AnthropicUsageRaw,
   buildAuthUrl,
+  CONSOLE_CALLBACK_URL,
   exchangeCodeForTokens,
   fetchUsage,
   generatePKCE,
@@ -80,15 +81,14 @@ async function deleteOAuthState(state: string): Promise<void> {
   await cache.delete({ key: `${OAUTH_STATE_PREFIX}${state}` });
 }
 
-// OAuth callback 은 대시보드가 접속한 qgrid 주소로 돌아온다. 브라우저가 보낸
-// Origin(우선) 또는 Host 헤더에서 base URL 을 파생하므로 별도 env 설정이 필요 없다.
-// HTTP context 가 없는 직접 호출(테스트 등)만 localhost 로 폴백한다.
-function getOAuthRedirectUri(): string {
+// OAuth 접속 주소는 브라우저가 보낸 Origin(우선) 또는 Host 헤더에서 파생한다.
+// HTTP context 가 없는 직접 호출(테스트 등)은 null 을 반환한다.
+function deriveRequestBaseUrl(): string | null {
   try {
     const { headers, request } = Sonamu.getContext();
     const origin = headers.origin;
     if (typeof origin === "string" && /^https?:\/\//.test(origin)) {
-      return `${origin.replace(/\/+$/, "")}/callback`;
+      return origin.replace(/\/+$/, "");
     }
     const forwardedHost = headers["x-forwarded-host"];
     const host = (Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost) ?? headers.host;
@@ -97,12 +97,34 @@ function getOAuthRedirectUri(): string {
       const proto =
         (Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto)?.split(",")[0] ??
         request.protocol;
-      return `${proto}://${host}/callback`;
+      return `${proto}://${host}`;
     }
   } catch {
     // direct frame call — HTTP context 없음
   }
-  return `http://localhost:${process.env.PORT ?? "44900"}/callback`;
+  return null;
+}
+
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+
+function isLoopbackBase(base: string): boolean {
+  try {
+    return LOOPBACK_HOSTNAMES.has(new URL(base).hostname);
+  } catch {
+    return false;
+  }
+}
+
+// Anthropic OAuth client 는 redirect_uri 허용 목록을 강제한다: 루프백(localhost)과
+// 콘솔 콜백만 허용된다. 따라서 루프백 접속은 자동 리다이렉트 플로우를,
+// 원격 접속은 콘솔 콜백 + 코드 붙여넣기 플로우(Claude Code CLI 와 동일)를 쓴다.
+function resolveOAuthRedirect(): { redirectUri: string; mode: "redirect" | "code" } {
+  const base = deriveRequestBaseUrl();
+  if (base && !isLoopbackBase(base)) {
+    return { redirectUri: CONSOLE_CALLBACK_URL, mode: "code" };
+  }
+  const loopbackBase = base ?? `http://localhost:${process.env.PORT ?? "44900"}`;
+  return { redirectUri: `${loopbackBase}/callback`, mode: "redirect" };
 }
 
 function rejectImageGenerationStream(args: QueryInput): void {
@@ -533,54 +555,87 @@ class QgridFrameClass extends BaseFrameClass {
   async oauthStart(name: string): Promise<OAuthStartResult> {
     const { codeVerifier, codeChallenge, state } = generatePKCE();
 
-    const redirectUri = getOAuthRedirectUri();
+    const { redirectUri, mode } = resolveOAuthRedirect();
     const authUrl = buildAuthUrl(codeChallenge, state, redirectUri);
 
     await setOAuthState(state, { codeVerifier, name, redirectUri });
 
-    return { authUrl };
+    return { authUrl, mode };
   }
 
-  async handleOAuthCallback(code: string, state: string, reply: FastifyReply): Promise<void> {
+  // 코드 붙여넣기 플로우(원격 접속): 콘솔 콜백이 표시한 `code#state` 를 받아 교환한다.
+  @api({ httpMethod: "POST", clients: ["axios", "tanstack-mutation"] })
+  async oauthComplete(pastedCode: string): Promise<{ added: boolean; name: string }> {
+    const trimmed = pastedCode.trim();
+    const separatorAt = trimmed.indexOf("#");
+    const code = separatorAt > 0 ? trimmed.slice(0, separatorAt) : "";
+    const state = separatorAt > 0 ? trimmed.slice(separatorAt + 1) : "";
+    if (!code || !state) {
+      throw new BadRequestException(
+        "expected the code shown after login, in code#state form" as LocalizedString,
+      );
+    }
+
     const pending = await getOAuthState(state);
     if (!pending) {
-      logger.warn("oauth callback: invalid_state");
-      return reply.redirect("/?oauth=error&reason=invalid_state");
+      throw new BadRequestException(
+        "login session not found or expired — start the login again" as LocalizedString,
+      );
     }
     await deleteOAuthState(state);
 
-    try {
-      const tokens = await exchangeCodeForTokens(
-        code,
-        pending.codeVerifier,
-        state,
-        pending.redirectUri,
-      );
+    await this.completeAnthropicLogin(code, state, pending);
+    return { added: true, name: pending.name };
+  }
 
-      if (tokens.accountUuid) {
-        const oldEntries = await TokenModel.findByAccountIdentifier(
-          "A",
-          "anthropic",
-          tokens.accountUuid,
-        );
-        if (oldEntries.length > 0) {
-          await TokenModel.del(oldEntries.map((o) => o.id));
-        }
+  // 교환 + 계정 중복 제거 + 저장 — redirect 콜백과 코드 붙여넣기 플로우가 공유한다.
+  private async completeAnthropicLogin(
+    code: string,
+    state: string,
+    pending: PendingOAuth,
+  ): Promise<void> {
+    const tokens = await exchangeCodeForTokens(
+      code,
+      pending.codeVerifier,
+      state,
+      pending.redirectUri,
+    );
+
+    if (tokens.accountUuid) {
+      const oldEntries = await TokenModel.findByAccountIdentifier(
+        "A",
+        "anthropic",
+        tokens.accountUuid,
+      );
+      if (oldEntries.length > 0) {
+        await TokenModel.del(oldEntries.map((o) => o.id));
       }
+    }
 
-      await TokenModel.save([
-        {
-          provider: "anthropic",
-          credentials: {
-            accessToken: tokens.accessToken,
-            refreshToken: tokens.refreshToken,
-            expiresAt: tokens.expiresAt ?? 0,
-            accountUuid: tokens.accountUuid ?? "",
-          },
-          name: pending.name,
+    await TokenModel.save([
+      {
+        provider: "anthropic",
+        credentials: {
+          accessToken: tokens.accessToken,
+          refreshToken: tokens.refreshToken,
+          expiresAt: tokens.expiresAt ?? 0,
+          accountUuid: tokens.accountUuid ?? "",
         },
-      ]);
+        name: pending.name,
+      },
+    ]);
+  }
+
+  async handleOAuthCallback(code: string, state: string, reply: FastifyReply): Promise<void> {
+    const pending = await getOAuthState(state);
+    if (!pending) {
+      logger.warn("oauth callback: invalid_state");
+      return reply.redirect("/?oauth=error&reason=invalid_state");
+    }
+    await deleteOAuthState(state);
 
+    try {
+      await this.completeAnthropicLogin(code, state, pending);
       return reply.redirect(`/?oauth=success&name=${encodeURIComponent(pending.name)}`);
     } catch (e) {
       return reply.redirect(`/?oauth=error&reason=${encodeURIComponent((e as Error).message)}`);
@@ -625,7 +680,7 @@ class QgridFrameClass extends BaseFrameClass {
         logger.warn(`OpenAI browser login failed: ${(e as Error).message}`);
       });
 
-    return { authUrl };
+    return { authUrl, mode: "redirect" };
   }
 
   @api({ httpMethod: "GET", clients: ["axios", "tanstack-query"] })

package/bundle/src/application/qgrid/qgrid.types.ts

@@ -274,6 +274,9 @@ export type TokenStats = z.infer<typeof TokenStats>;
 
 export const OAuthStartResult = z.object({
   authUrl: z.string(),
+  // redirect: 브라우저 자동 복귀(루프백 접속). code: 콘솔 콜백 + 코드 붙여넣기(원격 접속).
+  // OpenAI 경로는 codex 가 콜백을 처리하므로 항상 redirect 를 반환한다.
+  mode: z.enum(["redirect", "code"]),
 });
 export type OAuthStartResult = z.infer<typeof OAuthStartResult>;
 

package/bundle/src/application/sonamu.generated.http

@@ -500,6 +500,15 @@ Content-Type: application/json
 
 ###
 
+POST {{baseUrl}}/api/qgrid/oauthComplete
+Content-Type: application/json
+
+{
+  "pastedCode": "PASTEDCODE"
+}
+
+###
+
 POST {{baseUrl}}/api/qgrid/oauthStartOpenAI
 Content-Type: application/json