@cartanova/qgrid-cli 2.7.1 → 2.7.3

package/bundle/src/utils/providers/openai/openai-oauth.test.ts

@@ -0,0 +1,95 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import {
+  buildOpenAIAuthUrl,
+  exchangeOpenAICode,
+  generateOpenAIPKCE,
+  parseOpenAITokenClaims,
+} from "./openai-oauth";
+
+function jwt(payload: object): string {
+  return `e30.${Buffer.from(JSON.stringify(payload)).toString("base64url")}.sig`;
+}
+
+afterEach(() => vi.unstubAllGlobals());
+
+describe("OpenAI PKCE OAuth", () => {
+  it("builds Codex-compatible PKCE and authorization parameters", () => {
+    const pkce = generateOpenAIPKCE();
+    const url = new URL(buildOpenAIAuthUrl(pkce.codeChallenge, pkce.state, "https://q/callback"));
+
+    expect(pkce.codeVerifier.length).toBeGreaterThanOrEqual(43);
+    expect(url.origin + url.pathname).toBe("https://auth.openai.com/oauth/authorize");
+    expect(Object.fromEntries(url.searchParams)).toMatchObject({
+      response_type: "code",
+      redirect_uri: "https://q/callback",
+      code_challenge_method: "S256",
+      id_token_add_organizations: "true",
+      codex_cli_simplified_flow: "true",
+      originator: "codex_cli_rs",
+      state: pkce.state,
+    });
+  });
+
+  it("reads account, plan, and expiration from nested OpenAI JWT claims", () => {
+    expect(
+      parseOpenAITokenClaims(
+        jwt({
+          exp: 123,
+          "https://api.openai.com/auth": {
+            chatgpt_account_id: "account-1",
+            chatgpt_plan_type: "pro",
+          },
+        }),
+      ),
+    ).toEqual({ expiresAt: 123_000, accountId: "account-1", planType: "pro" });
+  });
+
+  it("exchanges the code directly and returns the existing credential shape", async () => {
+    const access = jwt({ exp: 200, "https://api.openai.com/auth": {} });
+    const id = jwt({
+      exp: 300,
+      "https://api.openai.com/auth": {
+        chatgpt_account_id: "account-1",
+        chatgpt_plan_type: "plus",
+      },
+    });
+    const fetchMock = vi.fn().mockResolvedValue(
+      new Response(
+        JSON.stringify({ access_token: access, refresh_token: "refresh", id_token: id }),
+        { status: 200 },
+      ),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    await expect(exchangeOpenAICode("code", "verifier", "https://q/callback")).resolves.toEqual({
+      accessToken: access,
+      refreshToken: "refresh",
+      idToken: id,
+      accessTokenExpiresAt: 200_000,
+      idTokenExpiresAt: 300_000,
+      accountId: "account-1",
+      planType: "plus",
+    });
+    const request = fetchMock.mock.calls[0]?.[1] as RequestInit;
+    expect(Object.fromEntries(request.body as URLSearchParams)).toEqual({
+      grant_type: "authorization_code",
+      code: "code",
+      redirect_uri: "https://q/callback",
+      client_id: "app_EMoamEEZ73f0CkXaXp7hrann",
+      code_verifier: "verifier",
+    });
+  });
+
+  it("redacts token endpoint response bodies", async () => {
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(
+      new Response('{"access_token":"secret-access","refresh_token":"secret-refresh"}', { status: 400 }),
+    ));
+    await expect(exchangeOpenAICode("code", "verifier", "https://q/callback")).rejects.toThrow(
+      "OPENAI_TOKEN_EXCHANGE_HTTP_400",
+    );
+    await expect(exchangeOpenAICode("code", "verifier", "https://q/callback")).rejects.not.toThrow(
+      /secret/,
+    );
+  });
+});

package/bundle/src/utils/providers/openai/openai-oauth.ts

@@ -0,0 +1,141 @@
+import crypto from "node:crypto";
+
+import {
+  OPENAI_AUTHORIZE_URL,
+  OPENAI_CLIENT_ID,
+  OPENAI_ORIGINATOR,
+  OPENAI_SCOPES,
+  OPENAI_TOKEN_URL,
+} from "./openai-constants";
+
+const OPENAI_AUTH_CLAIM = "https://api.openai.com/auth";
+
+export interface OpenAIPKCE {
+  codeVerifier: string;
+  codeChallenge: string;
+  state: string;
+}
+
+export interface OpenAITokenClaims {
+  expiresAt?: number;
+  accountId?: string;
+  planType?: string;
+}
+
+export interface OpenAIExchangedCredentials {
+  accessToken: string;
+  refreshToken: string;
+  idToken: string;
+  accessTokenExpiresAt: number;
+  idTokenExpiresAt?: number;
+  accountId: string;
+  planType?: string;
+}
+
+export function generateOpenAIPKCE(): OpenAIPKCE {
+  const codeVerifier = crypto.randomBytes(64).toString("base64url");
+  return {
+    codeVerifier,
+    codeChallenge: crypto.createHash("sha256").update(codeVerifier).digest("base64url"),
+    state: crypto.randomBytes(32).toString("base64url"),
+  };
+}
+
+export function buildOpenAIAuthUrl(
+  codeChallenge: string,
+  state: string,
+  redirectUri: string,
+): string {
+  const url = new URL(OPENAI_AUTHORIZE_URL);
+  url.search = new URLSearchParams({
+    response_type: "code",
+    client_id: OPENAI_CLIENT_ID,
+    redirect_uri: redirectUri,
+    scope: OPENAI_SCOPES,
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    id_token_add_organizations: "true",
+    codex_cli_simplified_flow: "true",
+    state,
+    originator: OPENAI_ORIGINATOR,
+  }).toString();
+  return url.toString();
+}
+
+export function parseOpenAITokenClaims(jwt: string): OpenAITokenClaims {
+  const parts = jwt.split(".");
+  const payloadPart = parts[1];
+  if (parts.length !== 3 || parts.some((part) => !part) || !payloadPart) {
+    throw new Error("invalid OpenAI JWT format");
+  }
+
+  let payload: unknown;
+  try {
+    payload = JSON.parse(Buffer.from(payloadPart, "base64url").toString("utf8"));
+  } catch {
+    throw new Error("invalid OpenAI JWT payload");
+  }
+  if (!payload || typeof payload !== "object") throw new Error("invalid OpenAI JWT payload");
+
+  const claims = payload as Record<string, unknown>;
+  const auth = claims[OPENAI_AUTH_CLAIM];
+  const nested = auth && typeof auth === "object" ? (auth as Record<string, unknown>) : {};
+  return {
+    expiresAt: typeof claims.exp === "number" ? claims.exp * 1000 : undefined,
+    accountId:
+      typeof nested.chatgpt_account_id === "string" ? nested.chatgpt_account_id : undefined,
+    planType: typeof nested.chatgpt_plan_type === "string" ? nested.chatgpt_plan_type : undefined,
+  };
+}
+
+export async function exchangeOpenAICode(
+  code: string,
+  codeVerifier: string,
+  redirectUri: string,
+): Promise<OpenAIExchangedCredentials> {
+  const response = await fetch(OPENAI_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirectUri,
+      client_id: OPENAI_CLIENT_ID,
+      code_verifier: codeVerifier,
+    }),
+  });
+  if (!response.ok) {
+    // Token endpoint bodies can echo credentials or provider diagnostics; never expose them.
+    await response.body?.cancel().catch(() => undefined);
+    throw new Error(`OPENAI_TOKEN_EXCHANGE_HTTP_${response.status}`);
+  }
+
+  const tokens = (await response.json()) as {
+    id_token?: string;
+    access_token?: string;
+    refresh_token?: string;
+    expires_in?: number;
+  };
+  if (!tokens.id_token || !tokens.access_token || !tokens.refresh_token) {
+    throw new Error("OpenAI token exchange returned incomplete credentials");
+  }
+
+  const idClaims = parseOpenAITokenClaims(tokens.id_token);
+  const accessClaims = parseOpenAITokenClaims(tokens.access_token);
+  const accountId = idClaims.accountId ?? accessClaims.accountId;
+  if (!accountId) throw new Error("OpenAI token did not include a ChatGPT account id");
+
+  return {
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token,
+    idToken: tokens.id_token,
+    accessTokenExpiresAt:
+      accessClaims.expiresAt ??
+      (tokens.expires_in ? Date.now() + tokens.expires_in * 1000 : Date.now()),
+    ...(idClaims.expiresAt ? { idTokenExpiresAt: idClaims.expiresAt } : {}),
+    accountId,
+    ...((idClaims.planType ?? accessClaims.planType)
+      ? { planType: idClaims.planType ?? accessClaims.planType }
+      : {}),
+  };
+}

package/bundle/src/utils/providers/openai/openai-quota.test.ts

@@ -1,9 +1,13 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
-import { type RateLimitSnapshot } from "../../../codex-protocol/v2/RateLimitSnapshot";
-import { readOpenAIQuotaUsage, type OpenAIRateLimitsWithMeta } from "./openai-quota";
+import { type QuotaRateLimitSnapshot } from "../common/provider-types";
+import {
+  CHATGPT_WHAM_USAGE_URL,
+  readOpenAIQuotaUsage,
+  type OpenAIRateLimitsWithMeta,
+} from "./openai-quota";
 
-function snapshot(overrides: Partial<RateLimitSnapshot> = {}): RateLimitSnapshot {
+function snapshot(overrides: Partial<QuotaRateLimitSnapshot> = {}): QuotaRateLimitSnapshot {
   return {
     limitId: "codex-primary",
     limitName: "Codex Primary",
@@ -16,7 +20,7 @@ function snapshot(overrides: Partial<RateLimitSnapshot> = {}): RateLimitSnapshot
   };
 }
 
-function payload(rateLimits: RateLimitSnapshot): OpenAIRateLimitsWithMeta {
+function payload(rateLimits: QuotaRateLimitSnapshot): OpenAIRateLimitsWithMeta {
   return { data: { rateLimits, rateLimitsByLimitId: null }, cachedAt: Date.now() - 1_250 };
 }
 
@@ -65,7 +69,7 @@ describe("readOpenAIQuotaUsage", () => {
     });
   });
 
-  it("converts missing primary data and rejected RPCs into lookup_failed", async () => {
+  it("converts missing primary data and rejected lookups into lookup_failed", async () => {
     await expect(
       readOpenAIQuotaUsage(async () => payload(snapshot({ primary: null }))),
     ).resolves.toMatchObject({
@@ -75,11 +79,80 @@ describe("readOpenAIQuotaUsage", () => {
 
     await expect(
       readOpenAIQuotaUsage(async () => {
-        throw new Error("rpc timeout");
+        throw new Error("lookup timeout");
       }),
     ).resolves.toMatchObject({
       kind: "lookup_failed",
-      reason: "rpc timeout",
+      reason: "lookup timeout",
     });
   });
+
+  it("reads wham usage directly with Codex identity headers", async () => {
+    const fetchMock = vi.fn<typeof fetch>(async () =>
+      new Response(JSON.stringify(payload(snapshot()).data), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      }),
+    );
+    await expect(
+      readOpenAIQuotaUsage({
+        credentials: { accessToken: "access", accountId: "acct" },
+        fetch: fetchMock,
+      }),
+    ).resolves.toMatchObject({ kind: "ok", utilizationPct: 17 });
+    expect(fetchMock).toHaveBeenCalledWith(
+      CHATGPT_WHAM_USAGE_URL,
+      expect.objectContaining({
+        method: "GET",
+        headers: expect.objectContaining({
+          Authorization: "Bearer access",
+          "ChatGPT-Account-ID": "acct",
+          originator: "codex_cli_rs",
+        }),
+      }),
+    );
+  });
+
+  it("normalizes the pinned wham rate_limit and additional_rate_limits shape", async () => {
+    const fetchMock = vi.fn<typeof fetch>(async () =>
+      new Response(JSON.stringify({
+        plan_type: "pro",
+        credits: { balance: 12 },
+        rate_limit_reached: "primary",
+        rate_limits: {
+          rate_limit: {
+            limit_id: "primary",
+            primary_window: { used_percent: 21, window_minutes: 300, reset_at: 123 },
+          },
+          additional_rate_limits: [{
+            rate_limit: {
+              limit_id: "secondary",
+              primary_window: { used_percent: 4, window_minutes: 10080, reset_at: 456 },
+            },
+          }],
+        },
+      }), { status: 200 }),
+    );
+    const result = await readOpenAIQuotaUsage({
+      credentials: { accessToken: "access", accountId: "acct" },
+      fetch: fetchMock,
+    });
+    expect(result).toMatchObject({
+      kind: "ok",
+      utilizationPct: 21,
+      raw: {
+        rateLimits: { limitId: "primary", planType: "pro", credits: { balance: 12 }, rateLimitReachedType: "primary" },
+        rateLimitsByLimitId: { secondary: { limitId: "secondary", primary: { usedPercent: 4 } } },
+      },
+    });
+  });
+
+  it("fails open for direct HTTP failures", async () => {
+    await expect(
+      readOpenAIQuotaUsage({
+        credentials: { accessToken: "access", accountId: "acct" },
+        fetch: async () => new Response("unavailable", { status: 503 }),
+      }),
+    ).resolves.toEqual({ kind: "lookup_failed", reason: "OpenAI quota lookup failed: HTTP 503" });
+  });
 });

package/bundle/src/utils/providers/openai/openai-quota.ts

@@ -1,7 +1,11 @@
-import { type GetAccountRateLimitsResponse } from "../../../codex-protocol/v2/GetAccountRateLimitsResponse";
+import { type OpenAICredentials } from "../../../application/token/token.types";
+import { type QuotaRateLimits, type QuotaRateLimitSnapshot } from "../common/provider-types";
+import { buildCodexIdentityHeaders } from "./openai-backend-protocol";
+
+export const CHATGPT_WHAM_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage" as const;
 
 export type OpenAIRateLimitsWithMeta = {
-  data: GetAccountRateLimitsResponse;
+  data: QuotaRateLimits;
   cachedAt: number;
 };
 
@@ -13,14 +17,110 @@ export type OpenAIQuotaUsageResult =
       windowDurationMins: number | null;
       resetsAt: number | null;
       limitId: string | null;
+      raw?: QuotaRateLimits;
     }
   | { kind: "lookup_failed"; reason: string };
 
+export interface OpenAIQuotaHttpOptions {
+  credentials: Pick<OpenAICredentials, "accessToken" | "accountId">;
+  fetch?: typeof fetch;
+  signal?: AbortSignal;
+}
+
+async function readDirect(options: OpenAIQuotaHttpOptions): Promise<OpenAIRateLimitsWithMeta> {
+  const response = await (options.fetch ?? fetch)(CHATGPT_WHAM_USAGE_URL, {
+    method: "GET",
+    headers: buildCodexIdentityHeaders(
+      options.credentials.accessToken,
+      options.credentials.accountId,
+    ),
+    ...(options.signal ? { signal: options.signal } : {}),
+  });
+  if (!response.ok) throw new Error(`OpenAI quota lookup failed: HTTP ${response.status}`);
+  const body = (await response.json()) as Record<string, unknown>;
+  const data = normalizeWhamUsage(body);
+  return { data, cachedAt: Date.now() };
+}
+
+function windowFrom(value: unknown) {
+  if (!value || typeof value !== "object") return null;
+  const source = value as Record<string, unknown>;
+  const usedPercent = Number(source.usedPercent ?? source.used_percent);
+  if (!Number.isFinite(usedPercent)) return null;
+  const duration = source.windowDurationMins ?? source.window_minutes;
+  const resets = source.resetsAt ?? source.reset_at;
+  return {
+    usedPercent,
+    windowDurationMins: duration === null || duration === undefined ? null : Number(duration),
+    resetsAt: resets === null || resets === undefined ? null : Number(resets),
+  };
+}
+
+function snapshotFrom(value: unknown): QuotaRateLimitSnapshot {
+  const source = (value && typeof value === "object" ? value : {}) as Record<string, unknown>;
+  const limitId = source.limitId ?? source.limit_id;
+  const limitName = source.limitName ?? source.limit_name;
+  return {
+    limitId: typeof limitId === "string" ? limitId : null,
+    limitName: typeof limitName === "string" ? limitName : null,
+    primary: windowFrom(source.primary ?? source.primary_window),
+    secondary: windowFrom(source.secondary ?? source.secondary_window),
+    credits: (source.credits ?? null) as QuotaRateLimitSnapshot["credits"],
+    planType:
+      typeof (source.planType ?? source.plan_type) === "string"
+        ? String(source.planType ?? source.plan_type)
+        : null,
+    rateLimitReachedType:
+      typeof (source.rateLimitReachedType ?? source.rate_limit_reached) === "string"
+        ? String(source.rateLimitReachedType ?? source.rate_limit_reached)
+        : null,
+  };
+}
+
+function normalizeWhamUsage(body: Record<string, unknown>): QuotaRateLimits {
+  if (body.rateLimits && typeof body.rateLimits === "object") {
+    return body as QuotaRateLimits;
+  }
+  const container =
+    body.rate_limits && typeof body.rate_limits === "object"
+      ? (body.rate_limits as Record<string, unknown>)
+      : body;
+  const shared = {
+    plan_type: body.plan_type ?? container.plan_type,
+    credits: body.credits ?? container.credits,
+    rate_limit_reached: body.rate_limit_reached ?? container.rate_limit_reached,
+  };
+  const primary = snapshotFrom({
+    ...shared,
+    ...((container.rate_limit ?? container) as Record<string, unknown>),
+  });
+  const additional = Array.isArray(container.additional_rate_limits)
+    ? container.additional_rate_limits
+    : Array.isArray(body.additional_rate_limits)
+      ? body.additional_rate_limits
+      : [];
+  const byId: Record<string, QuotaRateLimitSnapshot> = {};
+  for (const entry of additional) {
+    if (!entry || typeof entry !== "object") continue;
+    const wrapper = entry as Record<string, unknown>;
+    const snapshot = snapshotFrom({
+      ...shared,
+      ...((wrapper.rate_limit ?? wrapper) as Record<string, unknown>),
+    });
+    if (snapshot.limitId) byId[snapshot.limitId] = snapshot;
+  }
+  return {
+    rateLimits: primary,
+    rateLimitsByLimitId: Object.keys(byId).length ? byId : null,
+  };
+}
+
 export async function readOpenAIQuotaUsage(
-  readRateLimits: () => Promise<OpenAIRateLimitsWithMeta>,
+  source: (() => Promise<OpenAIRateLimitsWithMeta>) | OpenAIQuotaHttpOptions,
 ): Promise<OpenAIQuotaUsageResult> {
   try {
-    const { data, cachedAt } = await readRateLimits();
+    const direct = typeof source !== "function";
+    const { data, cachedAt } = await (typeof source === "function" ? source() : readDirect(source));
     const rateLimits = data.rateLimits;
     const primary = rateLimits?.primary;
 
@@ -39,6 +139,7 @@ export async function readOpenAIQuotaUsage(
       windowDurationMins: primary.windowDurationMins,
       resetsAt: primary.resetsAt,
       limitId: rateLimits.limitId,
+      ...(direct ? { raw: data } : {}),
     };
   } catch (e) {
     return { kind: "lookup_failed", reason: (e as Error).message };

package/bundle/src/utils/providers/openai/openai-refresh.test.ts

@@ -0,0 +1,120 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const { findOneMock, saveMock, deactivateMock } = vi.hoisted(() => ({
+  findOneMock: vi.fn(),
+  saveMock: vi.fn(),
+  deactivateMock: vi.fn(),
+}));
+
+vi.mock("../../../application/token/token.model", () => ({
+  TokenModel: { findOne: findOneMock, save: saveMock },
+}));
+vi.mock("../../../application/qgrid/token-death", () => ({
+  deactivateAuthDeadToken: deactivateMock,
+}));
+
+import { handleChatgptAuthTokensRefresh } from "./openai-refresh";
+
+function token(id: number) {
+  return {
+    id,
+    provider: "openai",
+    name: `token-${id}`,
+    credentials: {
+      accessToken: "old-access",
+      refreshToken: "old-refresh",
+      idToken: "old-id",
+      accessTokenExpiresAt: 1,
+      accountId: "account-1",
+      planType: "pro",
+    },
+  };
+}
+
+describe("OpenAI refresh", () => {
+  beforeEach(() => {
+    findOneMock.mockReset();
+    saveMock.mockReset().mockResolvedValue([1]);
+    deactivateMock.mockReset();
+  });
+  afterEach(() => vi.unstubAllGlobals());
+
+  it("deduplicates concurrent refreshes and persists refresh-token rotation", async () => {
+    findOneMock.mockResolvedValue(token(10));
+    let resolveFetch!: (response: Response) => void;
+    const fetchMock = vi.fn(
+      (_input: string | URL | Request, _init?: RequestInit) =>
+        new Promise<Response>((resolve) => (resolveFetch = resolve)),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    const first = handleChatgptAuthTokensRefresh(10);
+    const second = handleChatgptAuthTokensRefresh(10);
+    await vi.waitFor(() => expect(fetchMock).toHaveBeenCalledOnce());
+    resolveFetch(
+      new Response(
+        JSON.stringify({
+          access_token: "new-access",
+          refresh_token: "new-refresh",
+          id_token: "new-id",
+          expires_in: 60,
+        }),
+        { status: 200 },
+      ),
+    );
+
+    await expect(Promise.all([first, second])).resolves.toEqual([
+      { accessToken: "new-access", chatgptAccountId: "account-1", chatgptPlanType: "pro" },
+      { accessToken: "new-access", chatgptAccountId: "account-1", chatgptPlanType: "pro" },
+    ]);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const request = fetchMock.mock.calls[0]?.[1] as RequestInit;
+    expect((request.headers as Record<string, string>)["Content-Type"]).toBe(
+      "application/x-www-form-urlencoded",
+    );
+    expect(Object.fromEntries(request.body as URLSearchParams)).toEqual({
+      grant_type: "refresh_token",
+      client_id: "app_EMoamEEZ73f0CkXaXp7hrann",
+      refresh_token: "old-refresh",
+    });
+    expect(saveMock).toHaveBeenCalledWith([
+      expect.objectContaining({
+        id: 10,
+        credentials: expect.objectContaining({
+          accessToken: "new-access",
+          refreshToken: "new-refresh",
+          idToken: "new-id",
+        }),
+      }),
+    ]);
+  });
+
+  it("uses current stored credentials during the five-second refresh interval", async () => {
+    findOneMock.mockResolvedValue(token(10));
+    vi.stubGlobal("fetch", vi.fn());
+
+    await expect(handleChatgptAuthTokensRefresh(10)).resolves.toEqual({
+      accessToken: "old-access",
+      chatgptAccountId: "account-1",
+      chatgptPlanType: "pro",
+    });
+    expect(fetch).not.toHaveBeenCalled();
+  });
+
+  it("deactivates credentials on an explicit permanent failure code", async () => {
+    findOneMock.mockResolvedValue(token(11));
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(
+        new Response(JSON.stringify({ error: "refresh_token_reused" }), { status: 401 }),
+      ),
+    );
+
+    await expect(handleChatgptAuthTokensRefresh(11)).rejects.toThrow("OpenAI refresh failed: 401");
+    expect(deactivateMock).toHaveBeenCalledWith(
+      { id: 11, name: "token-11", provider: "openai" },
+      "old-refresh",
+      "openai:refresh_token_reused",
+    );
+  });
+});

package/bundle/src/utils/providers/openai/openai-refresh.ts

@@ -1,7 +1,7 @@
 /**
  * OpenAI chatgptAuthTokens refresh handler.
  *
- * - codex app-server 가 401 받으면 `account/chatgptAuthTokens/refresh` server-request 를 보냄
+ * - direct HTTPS/WS transport가 401 refresh를 소유하고 저장된 refresh token으로 갱신함
  * - qgrid 가 DB 의 refresh_token 으로 새 access_token 을 발급받아 응답
  * - per-token inflight promise 로 concurrent refresh dedup
  * - rotation 감지: 새 refresh_token 있으면 DB 즉시 업데이트
@@ -85,6 +85,8 @@ async function doRefresh(tokenId: number): Promise<RefreshResult> {
 
   const resp = await fetch(OPENAI_TOKEN_URL, {
     method: "POST",
+    // 토큰 엔드포인트는 OAuth 표준 form 인코딩 계약을 강제한다. JSON 으로 보내면
+    // access token 만료 후의 모든 refresh 가 거부되어 토큰이 통째로 죽는다.
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       grant_type: "refresh_token",

package/bundle/src/utils/providers/openai/openai-sse.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+
+import { normalizeOpenAISSE, parseOpenAISSE } from "./openai-sse";
+
+function chunks(...values: string[]): ReadableStream<Uint8Array> {
+  const encoder = new TextEncoder();
+  return new ReadableStream({
+    start(controller) {
+      for (const value of values) controller.enqueue(encoder.encode(value));
+      controller.close();
+    },
+  });
+}
+
+async function collect<T>(iterable: AsyncIterable<T>): Promise<T[]> {
+  const result: T[] = [];
+  for await (const value of iterable) result.push(value);
+  return result;
+}
+
+describe("OpenAI SSE parser", () => {
+  it("handles split UTF-8, CRLF, comments, and multiline data", async () => {
+    const source = ': ping\r\ndata: {"type":"response.output_text.delta"\r\ndata: ,"delta":"hé"}\r\n\r\n';
+    const bytes = new TextEncoder().encode(source);
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        for (const byte of bytes) controller.enqueue(Uint8Array.of(byte));
+        controller.close();
+      },
+    });
+    expect(await collect(parseOpenAISSE(stream))).toEqual([
+      { type: "response.output_text.delta", delta: "hé" },
+    ]);
+  });
+
+  it("normalizes deltas and requires response.completed before DONE", async () => {
+    const body = chunks(
+      'data: {"type":"response.output_text.delta","delta":"hello"}\n\n',
+      'data: {"type":"response.completed","response":{"id":"r1"}}\n\ndata: [DONE]\n\n',
+    );
+    expect(await collect(normalizeOpenAISSE(body))).toEqual([
+      { type: "text-delta", text: "hello" },
+      { type: "completed", responseId: "r1" },
+    ]);
+  });
+
+  it("rejects truncated streams", async () => {
+    await expect(
+      collect(normalizeOpenAISSE(chunks('data: {"type":"response.created"}\n\n'))),
+    ).rejects.toThrow("closed before a terminal event");
+  });
+});