@deepseek-ai/dsh-deepseek-account-platform 0.1.7-alpha.1

package/lib/types/protocol.js

@@ -0,0 +1,210 @@
+/** Validated platform HTTP messages and restricted browser destinations. */
+import { z } from 'zod';
+/** Protocol errors expose a stable code, never a response body or authorization URL. */
+export class PlatformAuthError extends Error {
+    code;
+    /** @param code - safe error classification. */
+    constructor(code) {
+        super(`account: ${code}`);
+        this.code = code;
+    }
+}
+/**
+ * Accept HTTPS platform endpoints, or explicitly configured loopback development HTTP.
+ * @param value - configured origin.
+ * @param allowLoopbackHttp - development-only opt-in.
+ * @returns normalized origin.
+ */
+export function platformOrigin(value, allowLoopbackHttp) {
+    const url = new URL(value);
+    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if (url.username || url.password || url.pathname !== '/' || url.search || url.hash
+        || !(url.protocol === 'https:' || (allowLoopbackHttp && loopback && url.protocol === 'http:'))) {
+        throw new Error('account: platformOrigin must be an HTTPS origin or explicitly enabled loopback HTTP origin');
+    }
+    return url.origin;
+}
+/**
+ * Validate platform-owned browser destinations without forwarding arbitrary URLs.
+ * @param value - returned browser URL.
+ * @param origin - configured platform origin.
+ * @param path - fixed authorize or completion path.
+ * @param rewriteOrigin - map validated browser pages to the configured development origin.
+ * @returns normalized URL on the configured origin.
+ */
+export function browserUrl(value, origin, path, rewriteOrigin = false) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        console.info('[deepseek-account] browser URL rejected', { path, reason: 'invalid-url' });
+        throw new PlatformAuthError('protocol');
+    }
+    const allowedOrigin = url.origin === origin || (rewriteOrigin && url.protocol === 'https:');
+    if (!allowedOrigin || url.pathname !== path || url.username || url.password || url.hash) {
+        console.info('[deepseek-account] browser URL rejected', {
+            path, originMismatch: !allowedOrigin, pathMismatch: url.pathname !== path,
+            hasCredentials: Boolean(url.username || url.password), hasFragment: Boolean(url.hash),
+        });
+        throw new PlatformAuthError('protocol');
+    }
+    return rewriteOrigin ? `${origin}${url.pathname}${url.search}` : url.href;
+}
+/**
+ * Validate Host-only deployment headers without exposing their values in diagnostics.
+ * @param values - configured headers for the Platform origin.
+ * @returns normalized headers; authorization, routing and framing remain provider-owned.
+ */
+export function platformHeaders(values) {
+    const headers = new Headers();
+    const names = new Set();
+    for (const [name, value] of Object.entries(values)) {
+        const key = name.toLowerCase();
+        if (['authorization', 'x-dsh-auth-token', 'host', 'content-length', 'transfer-encoding', 'connection', 'content-type'].includes(key)
+            || names.has(key))
+            throw new Error('account: requestHeaders contains a reserved or duplicate header');
+        names.add(key);
+        try {
+            headers.set(name, value);
+        }
+        catch {
+            throw new Error('account: requestHeaders contains an invalid header');
+        }
+    }
+    return Object.fromEntries(headers);
+}
+const envelope = z.object({ code: z.literal(0), data: z.object({ biz_code: z.number().int(), biz_data: z.unknown() }) });
+/** Successful initialization response. */
+export const initialization = z.object({
+    authorize_url: z.url(), authorize_id: z.string().min(1), expires_in: z.number().positive(),
+});
+/** Successful code exchange response. */
+export const exchange = z.object({ token: z.string().regex(/^[\x21-\x7e]+$/), authorized_url: z.url(), user: z.unknown().optional() });
+/**
+ * Read one bounded platform response with stable, non-secret diagnostics.
+ * @param origin - validated platform origin.
+ * @param method - platform endpoint suffix.
+ * @param body - protocol request, never logged.
+ * @param signal - attempt cancellation and timeout.
+ * @param headers - validated deployment headers for this origin.
+ * @returns successful business payload, validated by its caller.
+ */
+export async function requestPlatform(origin, method, body, signal, headers) {
+    return platformRequest(`${origin}/auth-api/v0/dsh/${method}`, {
+        method: 'POST', headers: { ...headers, 'content-type': 'application/json' }, body: JSON.stringify(body),
+    }, signal);
+}
+/**
+ * Fetch a fixed Platform account endpoint with the grant kept in Host request headers.
+ * @param origin - configured and grant-matched origin.
+ * @param path - account endpoint.
+ * @param token - account grant.
+ * @param signal - credential lifetime and request timeout.
+ * @param headers - validated deployment headers for this origin.
+ * @returns successful business payload.
+ */
+export function requestAccount(origin, path, token, signal, headers) {
+    return platformRequest(`${origin}${path}`, { method: 'GET', headers: { ...headers, 'x-dsh-auth-token': token } }, signal);
+}
+/**
+ * End the Platform session using its existing logout endpoint.
+ * @param origin - configured origin matching the grant issuer.
+ * @param token - stored account token.
+ * @param signal - logout request deadline.
+ * @param headers - validated deployment headers for this origin.
+ * @returns after Platform confirms logout.
+ */
+export async function logoutAccount(origin, token, signal, headers) {
+    await platformRequest(`${origin}/auth-api/v0/users/logout`, {
+        method: 'POST', headers: { ...headers, 'x-dsh-auth-token': token },
+    }, signal);
+}
+async function platformRequest(url, init, signal) {
+    const path = new URL(url).pathname;
+    console.info('[deepseek-account] request', { path, method: init.method });
+    let response;
+    try {
+        response = await fetch(url, { ...init, redirect: 'error', signal });
+    }
+    catch {
+        console.info('[deepseek-account] request failed', { path, errorCode: 'network', aborted: signal.aborted });
+        throw new PlatformAuthError('network');
+    }
+    console.info('[deepseek-account] response', { path, status: response.status });
+    if (!response.ok || response.body === null) {
+        await response.body?.cancel();
+        throw new PlatformAuthError('network');
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    let stage = 'read-body';
+    try {
+        while (true) {
+            const next = await reader.read();
+            if (next.done)
+                break;
+            size += next.value.byteLength;
+            if (size > 65_536) {
+                stage = 'body-limit';
+                throw new PlatformAuthError('protocol');
+            }
+            chunks.push(next.value);
+        }
+        stage = 'parse-json';
+        const payload = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+        const codes = z.object({ code: z.number().int(), data: z.object({ biz_code: z.number().int() }).optional() }).safeParse(payload);
+        if (codes.success)
+            console.info('[deepseek-account] response codes', {
+                path, code: codes.data.code, bizCode: codes.data.data?.biz_code,
+            });
+        stage = 'envelope';
+        const parsed = envelope.safeParse(payload);
+        if (!parsed.success) {
+            console.info('[deepseek-account] envelope rejected', {
+                path, issues: parsed.error.issues.map(issue => ({ path: issue.path, code: issue.code })),
+            });
+            throw new PlatformAuthError('protocol');
+        }
+        stage = 'business-code';
+        if (parsed.data.data.biz_code !== 0) {
+            // TODO(product-error-ui): Apply product-defined copy and UI behavior for the supplied biz_code values.
+            // Business failures use the existing generic failure UI until then; backend messages stay Host-only.
+            throw new PlatformAuthError('protocol');
+        }
+        return parsed.data.data.biz_data;
+    }
+    catch (error) {
+        console.info('[deepseek-account] response rejected', { path, stage, errorCode: 'protocol' });
+        if (error instanceof PlatformAuthError)
+            throw error;
+        throw new PlatformAuthError('protocol');
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+        reader.releaseLock();
+    }
+}
+/**
+ * Accept a browser-accessible loopback HTTP origin for local or SSH-forwarded login.
+ * @param value - loopback HTTP origin with an explicit port supplied by the authenticated initiating client.
+ * @returns normalized origin; remote domains and path-based proxies are unsupported.
+ */
+export function loginOrigin(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new PlatformAuthError('protocol');
+    }
+    const explicitPort = /^http:\/\/(?:localhost|127\.0\.0\.1|\[::1\]):([0-9]+)\/?$/i.exec(value)?.[1];
+    if (explicitPort === undefined || Number(explicitPort) === 0
+        || url.protocol !== 'http:' || !['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)
+        || url.username || url.password || url.pathname !== '/' || url.search || url.hash) {
+        throw new PlatformAuthError('protocol');
+    }
+    return `${url.protocol}//${url.hostname}:${Number(explicitPort)}`;
+}
+//# sourceMappingURL=protocol.js.map

package/lib/types/types.d.ts

@@ -0,0 +1,3 @@
+/** Platform provider reuses the account service's client-safe state. */
+export type { AccountView, SignInAttemptView } from '@deepseek-ai/dsh-deepseek-account/types';
+//# sourceMappingURL=types.d.ts.map

package/lib/types/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@deepseek-ai/dsh-deepseek-account-platform",
+  "description": "Authorize DeepSeek accounts through browser PKCE",
+  "version": "0.1.7-alpha.1",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/credentials/deepseek-account-platform"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./types": {
+      "types": "./lib/types/types.d.ts",
+      "default": "./lib/types/types.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/types/**/*.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.3",
+    "@deepseek-ai/dsh-deepseek-account": "^0.1.7-alpha.1",
+    "@deepseek-ai/dsh-authorization": "^0.1.7-alpha.1",
+    "@deepseek-ai/dsh-credentials": "^0.1.7-alpha.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-alpha.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.3",
+    "@deepseek-ai/dsh-deepseek-account": "^0.1.7-alpha.1",
+    "@deepseek-ai/dsh-authorization": "^0.1.7-alpha.1",
+    "@deepseek-ai/dsh-credentials": "^0.1.7-alpha.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-alpha.1"
+  },
+  "dependencies": {
+    "zod": "^4.4.3",
+    "@deepseek-ai/schemastery": "^3.18.3"
+  }
+}