@eduwork/dsh-oidc 0.2.4 → 0.3.0-dev.2

package/lib/gateway-backend.js

@@ -0,0 +1,443 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto'
+import { WebOidcBackend, account, sessionRef } from './oidc.js'
+import { DesktopOidcBackend } from './desktop-oidc.js'
+import { emptyResources, normalizeResourceModels } from './resources.js'
+import { gatewayJSON, liteLLMToken, protocolError, readGatewayJSON, registerLiteLLM, revokeLiteLLM, tokenRequest } from './litellm-protocol.js'
+import { detectGatewayProtocol } from './gateway-protocol.js'
+import { oidcLlmIdentity, oidcLlmToken } from './oidc-llm-protocol.js'
+import { bufferResourceResponse, validateResourceRead } from './model-resource-transport.js'
+
+const seconds = backend => Math.floor(backend.now() / 1000)
+const fingerprint = (profile, descriptor) => createHash('sha256').update(JSON.stringify({ auth: profile.auth, descriptor })).digest('hex')
+const query = (url, key, required = false) => {
+  const values = url.searchParams.getAll(key)
+  if (values.length > 1 || (required && !values[0])) throw protocolError('oidc_callback_invalid', 'Invalid gateway callback parameters')
+  return values[0]
+}
+
+function scopedResponse(response, lease) {
+  if (!response.body) { lease.close(); return response }
+  const reader = response.body.getReader()
+  const body = new ReadableStream({
+    async pull(controller) {
+      try {
+        lease.assertCurrent()
+        const next = await reader.read()
+        lease.assertCurrent()
+        if (next.done) { lease.close(); controller.close() }
+        else controller.enqueue(next.value)
+      } catch (cause) {
+        lease.close()
+        await reader.cancel().catch(() => {})
+        controller.error(cause)
+      }
+    },
+    async cancel(reason) { lease.close(); await reader.cancel(reason).catch(() => {}) },
+  }, { highWaterMark: 0 })
+  return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers })
+}
+
+/** Token model protocols share the OIDC identity and callback implementation. */
+function withGatewayAuth(Base) {
+  return class extends Base {
+    constructor(...args) {
+      super(...args)
+      this.gatewayRevisions = new Map()
+      this.gatewayCalls = new Map()
+      this.ctx.effect(() => () => {
+        for (const profile of this.profiles.values()) if (profile.auth) this.invalidateGatewayCalls(profile)
+      }, 'dsh-oidc: gateway model requests')
+    }
+
+    invalidateGatewayCalls(profile) {
+      this.gatewayRevisions.set(profile.id, (this.gatewayRevisions.get(profile.id) ?? 0) + 1)
+      for (const controller of this.gatewayCalls.get(profile.id) ?? []) controller.abort()
+      this.gatewayCalls.delete(profile.id)
+    }
+
+    async createGatewayScope(profileID) {
+      const profile = this.profile(profileID), epoch = this.accountEpoch(profile)
+      const revision = this.gatewayRevisions.get(profileID) ?? 0
+      const session = await this.activeSession(profile)
+      if (!session) throw protocolError('oidc_login_required', 'Gateway sign-in is required')
+      await this.gatewayCurrent(profile, session, epoch)
+      const assertCurrent = () => {
+        if (epoch !== this.accountEpoch(profile) || revision !== (this.gatewayRevisions.get(profileID) ?? 0)) {
+          throw protocolError('oidc_login_cancelled', 'Gateway authorization changed; start a new model request')
+        }
+      }
+      assertCurrent()
+      return {
+        open: signal => {
+          assertCurrent()
+          const controller = new AbortController()
+          let calls = this.gatewayCalls.get(profileID)
+          if (!calls) this.gatewayCalls.set(profileID, calls = new Set())
+          calls.add(controller)
+          return {
+            signal: signal ? AbortSignal.any([signal, controller.signal]) : controller.signal,
+            assertCurrent,
+            resolveCredential: async providerID => {
+              assertCurrent()
+              if (providerID !== profile.provider.id) throw protocolError('oidc_authorized_origin_denied', 'Gateway credential does not belong to this provider')
+              const current = await this.activeSession(profile)
+              assertCurrent()
+              if (!current || current.contextID !== session.contextID) throw protocolError('oidc_login_cancelled', 'Gateway account changed during the request')
+              return { value: current.accessToken }
+            },
+            close: () => { controller.abort(); calls.delete(controller); if (!calls.size && this.gatewayCalls.get(profileID) === calls) this.gatewayCalls.delete(profileID) },
+          }
+        },
+      }
+    }
+
+    async discover(profile) {
+      if (!profile.auth) return super.discover(profile)
+      const cached = this.discovery.get(profile.id)
+      if (cached) return cached
+      const raw = await gatewayJSON(this.fetch, profile.auth.discoveryUrl, { headers: { accept: 'application/json' } })
+      const descriptor = detectGatewayProtocol(raw, profile)
+      this.discovery.set(profile.id, descriptor)
+      return descriptor
+    }
+
+    async createAuthorization(profile, descriptor, redirectURI) {
+      if (!profile.auth) return super.createAuthorization(profile, descriptor, redirectURI)
+      const epoch = this.accountEpoch(profile)
+      const clientId = descriptor.clientId ?? await registerLiteLLM(this.fetch, descriptor, redirectURI)
+      if (epoch !== this.accountEpoch(profile)) throw protocolError('oidc_login_cancelled', 'Sign-in was cancelled')
+      this.pruneFlows()
+      if (this.flows.size >= 32) throw protocolError('oidc_flow_limit', 'Too many pending sign-ins')
+      const state = randomBytes(32).toString('base64url'), verifier = randomBytes(48).toString('base64url')
+      const flow = { profileID: profile.id, verifier, clientId, redirectURI, createdAt: this.now(), epoch }
+      const target = new URL(descriptor.authorizationEndpoint)
+      for (const [key, value] of Object.entries({ response_type: 'code', client_id: clientId, redirect_uri: redirectURI, state, code_challenge: createHash('sha256').update(verifier).digest('base64url'), code_challenge_method: 'S256', resource: descriptor.resource })) target.searchParams.set(key, value)
+      if (descriptor.scopes) target.searchParams.set('scope', descriptor.scopes.join(' '))
+      if (descriptor.identityMode === 'oidc') {
+        flow.nonce = randomBytes(32).toString('base64url')
+        target.searchParams.set('nonce', flow.nonce)
+        target.searchParams.set('prompt', 'consent')
+      }
+      this.flows.set(state, flow)
+      return { state, flow, authorizationURL: target.toString() }
+    }
+
+    async exchangeAuthorization(requested, flow) {
+      const profile = this.profile(flow.profileID)
+      if (!profile.auth) return super.exchangeAuthorization(requested, flow)
+      const descriptor = await this.discover(profile)
+      const issuers = requested.searchParams.getAll('iss')
+      if (!issuers.length && descriptor.requireResponseIssuer) throw protocolError('gateway_callback_issuer_missing', 'Gateway authorization response omitted its required issuer')
+      if (issuers.length > 1 || issuers.length === 1 && issuers[0] !== descriptor.issuer) throw protocolError('gateway_callback_issuer_invalid', 'Gateway authorization response issuer is invalid')
+      if (query(requested, 'error')) throw protocolError('oidc_authorization_rejected', 'Gateway authorization was declined')
+      const code = query(requested, 'code', true)
+      const raw = await tokenRequest(this.fetch, descriptor, { grant_type: 'authorization_code', client_id: flow.clientId, code, redirect_uri: flow.redirectURI, code_verifier: flow.verifier })
+      const draft = descriptor.protocol === 'oidc-llm-draft-0.1'
+      let token
+      try { token = draft ? oidcLlmToken(raw, descriptor, this.now) : liteLLMToken(raw, this.now) }
+      catch (cause) {
+        if (draft && typeof raw.refresh_token === 'string' && raw.refresh_token.length > 0 && raw.refresh_token.length <= 65536) await this.revokeGateway(profile, descriptor, { clientId: flow.clientId, refreshToken: raw.refresh_token })
+        throw cause
+      }
+      const session = { ...token, issuer: descriptor.issuer, protocol: descriptor.protocol, clientId: flow.clientId, binding: fingerprint(profile, descriptor), contextID: randomUUID(), capabilities: [] }
+      if (draft) {
+        session.identityMode = descriptor.identityMode
+        session.oidcNonce = flow.nonce
+        try { await this.gatewayIdentity(profile, descriptor, raw, session) }
+        catch (cause) { await this.revokeGateway(profile, descriptor, session); throw cause }
+      } else {
+        // Only project a display name; budgets, keys and team records never enter RPC.
+        try {
+          const info = await gatewayJSON(this.fetch, descriptor.userInfoEndpoint, { headers: { authorization: `Bearer ${session.accessToken}`, accept: 'application/json' } })
+          if (info.user_id === session.identity.sub && typeof info.user_info?.user_alias === 'string' && info.user_info.user_alias.trim()) session.identity.name = info.user_info.user_alias.trim().slice(0, 256)
+        } catch { /* Identity is supplied by the token endpoint; display data is optional. */ }
+      }
+      if (flow.epoch !== this.accountEpoch(profile)
+        || this.attempts && ![...this.attempts.values()].some(attempt => attempt.flow === flow && attempt.state === 'pending')) {
+        await this.revokeGateway(profile, descriptor, session)
+        throw protocolError('oidc_login_cancelled', 'Account changed during sign-in')
+      }
+      return session
+    }
+
+    async gatewayIdentity(profile, descriptor, raw, session, previous) {
+      let claims
+      if (descriptor.identityMode === 'oidc' && (!previous || raw.id_token !== undefined)) {
+        claims = await this.verifyIDToken({ oidc: { issuer: descriptor.issuer, clientId: session.clientId } }, descriptor,
+          raw.id_token, session.oidcNonce, session.accessToken, { refresh: Boolean(previous) })
+        const audience = (Array.isArray(claims.aud) ? [...claims.aud] : [claims.aud]).sort()
+        if (previous && (claims.sub !== previous.identity.sub || JSON.stringify(audience) !== JSON.stringify(previous.oidcAudience)
+          || claims.auth_time !== undefined && claims.auth_time !== previous.authTime)) {
+          throw protocolError('gateway_identity_changed', 'OIDC refresh identity changed')
+        }
+        session.oidcAudience = audience
+        if (claims.auth_time !== undefined) session.authTime = claims.auth_time
+      }
+      const info = await gatewayJSON(this.fetch, descriptor.userInfoEndpoint, { headers: { authorization: `Bearer ${session.accessToken}`, accept: 'application/json' } })
+      session.identity = oidcLlmIdentity(info)
+      if (claims && claims.sub !== session.identity.sub || previous && previous.identity.sub !== session.identity.sub) throw protocolError('gateway_identity_changed', 'UserInfo subject does not match the authorization')
+    }
+
+    async loadSession(profile) {
+      if (!profile.auth) return super.loadSession(profile)
+      const epoch = this.accountEpoch(profile)
+      const record = await this.ctx.credentials.resolve(sessionRef(profile))
+      if (!record?.value) return undefined
+      let session
+      try { session = JSON.parse(record.value) } catch { return undefined }
+      const descriptor = await this.discover(profile)
+      if (epoch !== this.accountEpoch(profile)) return undefined
+      if (session?.protocol !== descriptor.protocol || session.binding !== fingerprint(profile, descriptor) || typeof session.contextID !== 'string' || !session.contextID || typeof session.accessToken !== 'string' || !session.accessToken || typeof session.refreshToken !== 'string' || !session.refreshToken || typeof session.clientId !== 'string' || !session.clientId || !Number.isFinite(session.expiresAt) || typeof session.identity?.sub !== 'string' || !session.identity.sub || !(session.teamID === null || typeof session.teamID === 'string')) return undefined
+      if (descriptor.protocol === 'oidc-llm-draft-0.1' && (session.clientId !== descriptor.clientId || session.identityMode !== descriptor.identityMode
+        || !Array.isArray(session.scopes) || descriptor.scopes.some(scope => !session.scopes.includes(scope))
+        || session.scopes.some(scope => !descriptor.scopes.includes(scope))
+        || descriptor.identityMode === 'oidc' && typeof session.oidcNonce !== 'string')) return undefined
+      return session
+    }
+
+    async saveSession(profile, session, epoch = this.accountEpoch(profile)) {
+      if (!profile.auth) return super.saveSession(profile, session, epoch)
+      return this.writeCredentials(profile, epoch, async () => {
+        await this.ctx.credentials.set(sessionRef(profile), JSON.stringify(session))
+        this.invalidateGatewayCalls(profile)
+        this.resourceFlights.delete(profile.id)
+        await this.clearGatewayModels(profile)
+      })
+    }
+
+    refresh(profile, session) {
+      if (!profile.auth) return super.refresh(profile, session)
+      const key = `${profile.id}:${session.contextID}`
+      if (!this.refreshFlights.has(key)) {
+        const flight = this.performRefresh(profile, session).finally(() => { if (this.refreshFlights.get(key) === flight) this.refreshFlights.delete(key) })
+        this.refreshFlights.set(key, flight)
+      }
+      return this.refreshFlights.get(key)
+    }
+
+    async gatewayCurrent(profile, session, epoch) {
+      const current = await this.loadSession(profile)
+      if (epoch !== this.accountEpoch(profile) || current?.contextID !== session.contextID) throw protocolError('oidc_login_cancelled', 'Gateway account changed during the request')
+      return current
+    }
+
+    async performRefresh(profile, session) {
+      if (!profile.auth) return super.performRefresh(profile, session)
+      const epoch = this.accountEpoch(profile), descriptor = await this.discover(profile)
+      const saved = await this.gatewayCurrent(profile, session, epoch)
+      // A request may have captured the old pair before the previous flight settled.
+      if (saved.accessToken !== session.accessToken) return saved
+      let next, received
+      try {
+        const raw = await tokenRequest(this.fetch, descriptor, { grant_type: 'refresh_token', client_id: saved.clientId, refresh_token: saved.refreshToken })
+        received = raw
+        if (descriptor.protocol === 'oidc-llm-draft-0.1') {
+          next = { ...saved, ...oidcLlmToken(raw, descriptor, this.now, saved) }
+          await this.gatewayIdentity(profile, descriptor, raw, next, saved)
+        } else next = { ...saved, ...liteLLMToken(raw, this.now) }
+        if (next.identity.sub !== saved.identity.sub || next.teamID !== saved.teamID) throw protocolError('gateway_identity_changed', 'Gateway authorization identity changed during refresh')
+        next.identity = saved.identity
+        await this.writeCredentials(profile, epoch, async () => {
+          // Serialize persistence of the entire rotated pair. Never overwrite a new login.
+          await this.gatewayCurrent(profile, saved, epoch)
+          await this.ctx.credentials.set(sessionRef(profile), JSON.stringify(next))
+        })
+        return next
+      } catch (cause) {
+        if (next) await this.revokeGateway(profile, descriptor, next)
+        else if (descriptor.protocol === 'oidc-llm-draft-0.1' && typeof received?.refresh_token === 'string') await this.revokeGateway(profile, descriptor, { ...saved, refreshToken: received.refresh_token })
+        if (cause.oauthError === 'invalid_grant' || cause.oauthError === 'invalid_client' || cause.code === 'gateway_identity_changed'
+          || descriptor.protocol === 'oidc-llm-draft-0.1' && received) {
+          await this.writeCredentials(profile, epoch, async () => {
+            await this.gatewayCurrent(profile, saved, epoch)
+            await this.ctx.credentials.unset(sessionRef(profile))
+            this.invalidateGatewayCalls(profile)
+          })
+          await this.clearGatewayModels(profile)
+          this.accountChanged(account(profile, undefined, false))
+          throw protocolError('oidc_login_required', 'Gateway authorization expired; please sign in again')
+        }
+        throw cause
+      }
+    }
+
+    async activeSession(profile) {
+      if (!profile.auth) return super.activeSession(profile)
+      const epoch = this.accountEpoch(profile)
+      const session = await this.loadSession(profile)
+      if (!session) return undefined
+      if (session.expiresAt > seconds(this) + 90) return session
+      try { return await this.refresh(profile, session) }
+      catch (cause) {
+        // Brief outages must not discard a still-valid access token; expired tokens stop.
+        if ((cause.code === 'gateway_unavailable' || cause.status === 429 || cause.status >= 500) && session.expiresAt > seconds(this)) return this.gatewayCurrent(profile, session, epoch)
+        throw cause
+      }
+    }
+
+    async modelAuthorization(profileID, expectedBaseURL) {
+      const profile = this.profile(profileID), epoch = this.accountEpoch(profile)
+      if (!profile.auth || typeof expectedBaseURL !== 'string') return false
+      const descriptor = await this.discover(profile)
+      if (expectedBaseURL !== descriptor.baseURL) return false
+      const session = await this.activeSession(profile)
+      if (!session) return false
+      await this.gatewayCurrent(profile, session, epoch)
+      return true
+    }
+
+    async resolveGatewayCredential(profileID) {
+      const profile = this.profile(profileID), epoch = this.accountEpoch(profile)
+      const session = await this.activeSession(profile)
+      if (!session) return undefined
+      await this.gatewayCurrent(profile, session, epoch)
+      return { value: session.accessToken }
+    }
+
+    async status(profileID) {
+      const profile = this.profile(profileID)
+      if (!profile.auth) return super.status(profileID)
+      const epoch = this.accountEpoch(profile), session = await this.loadSession(profile)
+      if (!session) return account(profile, undefined, false)
+      if (!this.resourceStates.has(profileID)) await this.resources(profileID)
+      await this.gatewayCurrent(profile, session, epoch)
+      return account(profile, session, session.expiresAt > seconds(this) || Boolean(session.refreshToken), 'access_token')
+    }
+
+    async reconcile(profileID, options = {}) {
+      const profile = this.profile(profileID)
+      if (!profile.auth) return super.reconcile(profileID, options)
+      const epoch = this.accountEpoch(profile), session = await this.activeSession(profile)
+      if (!session) return account(profile, undefined, false)
+      await this.resources(profileID)
+      await this.gatewayCurrent(profile, session, epoch)
+      return account(profile, session, true, 'access_token')
+    }
+
+    async authorizedFetch(profileID, endpoint, init = {}) {
+      const profile = this.profile(profileID)
+      if (!profile.auth) return super.authorizedFetch(profileID, endpoint, init)
+      const epoch = this.accountEpoch(profile), descriptor = await this.discover(profile)
+      const target = new URL(endpoint)
+      // Host-only model and own-account routes, never key administration or arbitrary origins.
+      const modelBase = new URL(`${descriptor.baseURL}/`)
+      if (target.username || target.password || target.hash || target.origin !== modelBase.origin || !(target.href === descriptor.userInfoEndpoint || target.pathname.startsWith(modelBase.pathname))) throw protocolError('oidc_authorized_origin_denied', 'Gateway token destination is not an authorized resource')
+      const scope = await this.createGatewayScope(profileID)
+      const lease = scope.open(init.signal ?? AbortSignal.timeout(20_000))
+      let response
+      try {
+        let session = await this.activeSession(profile)
+        lease.assertCurrent()
+        if (!session) throw protocolError('oidc_login_required', 'Gateway sign-in is required')
+        const request = current => this.fetch(target.href, { ...init, headers: { ...Object.fromEntries(new Headers(init.headers)), authorization: `Bearer ${current.accessToken}` }, redirect: 'error', signal: lease.signal })
+        response = await request(session)
+        // Retry only safe reads. A generation (including SSE) is never replayed here.
+        if (response.status === 401 && ['GET', 'HEAD'].includes((init.method ?? 'GET').toUpperCase())) {
+          await response.body?.cancel()
+          session = await this.refresh(profile, session)
+          lease.assertCurrent()
+          response = await request(session)
+        }
+        await this.gatewayCurrent(profile, session, epoch)
+        lease.assertCurrent()
+        return scopedResponse(response, lease)
+      } catch (cause) {
+        lease.close()
+        await response?.body?.cancel().catch(() => {})
+        throw cause
+      }
+    }
+
+    async modelResourceFetch(profileID, relativePath, options = {}) {
+      const profile = this.profile(profileID)
+      if (!profile.auth) return super.modelResourceFetch(profileID, relativePath, options)
+      validateResourceRead(relativePath, options)
+      const epoch = this.accountEpoch(profile), revision = this.gatewayRevisions.get(profileID) ?? 0
+      const descriptor = await this.discover(profile)
+      const response = await this.authorizedFetch(profileID, `${descriptor.baseURL}${relativePath}`, {
+        method: 'GET', headers: { accept: 'application/json' },
+        signal: AbortSignal.any([AbortSignal.timeout(20_000), ...(options.signal ? [options.signal] : [])]),
+      })
+      return bufferResourceResponse(response, () => {
+        if (epoch !== this.accountEpoch(profile) || revision !== (this.gatewayRevisions.get(profileID) ?? 0)) throw protocolError('oidc_login_cancelled', 'Gateway account changed during resource request')
+      })
+    }
+
+    async readResources(profileID) {
+      const profile = this.profile(profileID)
+      if (!profile.auth) return super.readResources(profileID)
+      const result = { ...emptyResources(profile), models: [] }, epoch = this.accountEpoch(profile)
+      const session = await this.activeSession(profile)
+      if (!session) return result
+      const descriptor = await this.discover(profile)
+      try {
+        const raw = await readGatewayJSON(await this.authorizedFetch(profileID, `${descriptor.baseURL}/models`))
+        const models = Array.isArray(raw.data) && raw.data.length === 0 ? [] : normalizeResourceModels(raw, this.reviewedProfiles.get(profileID))
+        await this.gatewayCurrent(profile, session, epoch)
+        const next = Object.freeze({ ...profile, provider: Object.freeze({ ...profile.provider, baseURL: descriptor.baseURL, models }) })
+        // updateProvider is synchronous in the Host; no asynchronous account switch gap.
+        this.updateProvider(next)
+        this.profiles.set(profileID, next)
+        result.models = models
+      } catch (cause) {
+        if (cause.code === 'oidc_login_cancelled' || cause.code === 'oidc_login_required') throw cause
+        result.issues.push('models_unavailable')
+      }
+      await this.gatewayCurrent(profile, session, epoch)
+      this.resourceStates.set(profileID, result)
+      return result
+    }
+
+    async clearGatewayModels(profile) {
+      const next = Object.freeze({ ...profile, provider: Object.freeze({ ...profile.provider, models: [] }) })
+      this.updateProvider(next)
+      this.profiles.set(profile.id, next)
+      this.resourceStates.delete(profile.id)
+    }
+
+    async revokeGateway(profile, descriptor, session) {
+      try {
+        if (descriptor.protocol !== 'oidc-llm-draft-0.1') await revokeLiteLLM(this.fetch, descriptor, session)
+        else {
+          const response = await this.fetch(descriptor.revocationEndpoint, {
+            method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({ token: session.refreshToken, token_type_hint: 'refresh_token', client_id: session.clientId }),
+            redirect: 'error', signal: AbortSignal.timeout(5_000),
+          })
+          await response.body?.cancel()
+          if (response.status !== 200) throw protocolError('gateway_revocation_failed', 'Remote revocation was not confirmed')
+        }
+      }
+      catch { this.ctx.logger.warn('Gateway refresh revocation was not confirmed; local logout still removes access') }
+    }
+
+    async logout(profileID) {
+      const profile = this.profile(profileID)
+      if (!profile.auth) return super.logout(profileID)
+      this.accountEpochs.set(profileID, this.accountEpoch(profile) + 1)
+      this.invalidateGatewayCalls(profile)
+      for (const attempt of this.attempts?.values() ?? []) if (attempt.profileID === profileID && attempt.state === 'pending') await this.cancelLogin(attempt.loginID)
+      const epoch = this.accountEpoch(profile)
+      // Clear locally even when discovery is offline on a fresh process.
+      const record = await this.ctx.credentials.resolve(sessionRef(profile))
+      let session
+      try { session = JSON.parse(record?.value) } catch { /* No valid revocation candidate. */ }
+      await this.clearCredentials(profile, epoch)
+      for (const key of this.refreshFlights.keys()) if (key.startsWith(`${profileID}:`)) this.refreshFlights.delete(key)
+      this.resourceFlights.delete(profileID)
+      for (const [state, flow] of this.flows) if (flow.profileID === profileID) this.flows.delete(state)
+      await this.clearGatewayModels(profile)
+      this.accountChanged(account(profile, undefined, false))
+      if (session) {
+        try {
+          const descriptor = await this.discover(profile)
+          if (session.binding === fingerprint(profile, descriptor)) await this.revokeGateway(profile, descriptor, session)
+        } catch { this.ctx.logger.warn('Gateway logout completed locally; remote revocation could not be confirmed') }
+      }
+      return account(profile, undefined, false)
+    }
+  }
+}
+
+export const GatewayWebBackend = withGatewayAuth(WebOidcBackend)
+export const GatewayDesktopBackend = withGatewayAuth(DesktopOidcBackend)

package/lib/gateway-protocol.js

@@ -0,0 +1,6 @@
+import { detectGatewayProtocol as detectLiteLLM, protocolError } from './litellm-protocol.js'
+import { detectOidcLlm } from './oidc-llm-protocol.js'
+export function detectGatewayProtocol(raw, profile) {
+  if (profile.auth.experimentalOidcLlm && !Object.hasOwn(raw, 'oidc_llm')) throw protocolError('gateway_protocol_unsupported', 'Configured oidc-llm authorization cannot fall back to another gateway protocol')
+  return Object.hasOwn(raw, 'oidc_llm') ? detectOidcLlm(raw, profile) : detectLiteLLM(raw, profile)
+}

package/lib/index.js

@@ -1,7 +1,6 @@
 import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol'
 import { apply as applyEnterpriseProvider } from './provider/index.js'
-import { NativeOidcBackend, WebOidcBackend } from './oidc.js'
-import { DesktopOidcBackend } from './desktop-oidc.js'
+import { GatewayDesktopBackend, GatewayWebBackend } from './gateway-backend.js'
 import { enterpriseProviderConfig, loadEnterpriseProfiles, publicProfile } from './profile.js'
 
 export const name = 'dsh-oidc'
@@ -14,6 +13,7 @@ export class OidcAccountService extends TypertRemoteService {
     super(ctx, 'oidcAccounts')
     for (const initialize of remoteInitializers) initialize.call(this)
     this.profiles = loadEnterpriseProfiles(config)
+    if (config.backend === 'native') throw new Error('The legacy native account bridge has been removed; use the desktop or web Host backend')
     if (this.profiles.size === 0 && config.allowEmptyProfiles !== true) throw new Error('dsh-oidc requires at least one Enterprise Profile')
     this.uiMode = ['external', 'models-only'].includes(config.uiMode) ? config.uiMode : 'standard'
     this.manageProductBrand = config.manageProductBrand !== false
@@ -33,13 +33,14 @@ export class OidcAccountService extends TypertRemoteService {
     this.accountStates = new Map()
     const provider = applyEnterpriseProvider(ctx, {
       ...enterpriseProviderConfig(this.profiles),
+      createAuthorizationScope: providerID => {
+        const profile = [...this.profiles.values()].find(value => value.provider?.id === providerID)
+        return profile?.auth ? this.backend.createGatewayScope(profile.id) : undefined
+      },
       resolveCredential: async providerID => {
         const profile = [...this.profiles.values()].find(value => value.provider?.id === providerID)
         if (!profile) return undefined
-        if (this.backend instanceof NativeOidcBackend) return ctx.credentials.resolve(profile.keyBinding.credentialRef)
-        if (this.backend instanceof WebOidcBackend) return this.backend.resolveBoundCredential(profile.id, {
-          credentialRef: profile.keyBinding.credentialRef, runtimeBaseURL: profile.provider.baseURL,
-        })
+        return this.backend?.resolveGatewayCredential(profile.id)
       },
     })
     const backendOptions = {
@@ -51,9 +52,8 @@ export class OidcAccountService extends TypertRemoteService {
             provider.replaceConfig(enterpriseProviderConfig(profiles))
           },
         }
-    if (config.backend === 'native') this.backend = new NativeOidcBackend(ctx, this.profiles)
-    else if (config.backend === 'desktop') {
-      this.backend = new DesktopOidcBackend(ctx, this.profiles, config.desktop ?? {}, backendOptions)
+    if (config.backend === 'desktop') {
+      this.backend = new GatewayDesktopBackend(ctx, this.profiles, config.desktop ?? {}, backendOptions)
       ctx.inject(['desktopServices'], inner => {
         this.backend.openExternal = url => inner.desktopServices.openExternal(url)
         inner.effect(() => () => {
@@ -64,7 +64,7 @@ export class OidcAccountService extends TypertRemoteService {
     } else {
       this.backendReady = new Promise(resolve => {
         ctx.inject(['webServer'], inner => {
-          const backend = new WebOidcBackend(inner, this.profiles, config.web ?? {}, backendOptions)
+          const backend = new GatewayWebBackend(inner, this.profiles, config.web ?? {}, backendOptions)
           this.backend = backend
           resolve()
           inner.effect(() => () => { if (this.backend === backend) this.backend = undefined }, 'dsh-oidc: web backend')
@@ -114,10 +114,9 @@ export class OidcAccountService extends TypertRemoteService {
   modelResourceFetch(profileID, relativePath, options) {
     return this.callBackend('modelResourceFetch', profileID, relativePath, options)
   }
-  // Host-only credential snapshot for optional adapters; never exposed via RPC.
-  async resolveBoundCredential(profileID, expected) {
-    await this.backendReady
-    return this.backend instanceof WebOidcBackend ? this.backend.resolveBoundCredential(profileID, expected) : undefined
+  // Host-only readiness check for explicitly configured model-service adapters.
+  modelAuthorization(profileID, expectedBaseURL) {
+    return this.callBackend('modelAuthorization', profileID, expectedBaseURL)
   }
   async begin(profileID) {
     const result = await this.callBackend('begin', profileID)
@@ -184,6 +183,6 @@ for (const method of [
 
 export default OidcAccountService
 export { enterpriseProviderConfig, loadEnterpriseProfiles, normalizeEnterpriseProfile, publicProfile } from './profile.js'
-export { NativeOidcBackend, WebOidcBackend } from './oidc.js'
+export { WebOidcBackend } from './oidc.js'
 export { DesktopOidcBackend } from './desktop-oidc.js'
 export { EnterpriseModelTransforms } from './provider/transforms.js'

package/lib/litellm-protocol.js

@@ -0,0 +1,117 @@
+import { serviceProtocolAllowed } from './transport.js'
+// LiteLLM v1.101.0, native CLI auth contract 1. This is OAuth, not OIDC.
+// Protocol-specific wire fields stay here; tokens never cross the renderer RPC.
+const MAX_BYTES = 1024 * 1024
+const MAX_TOKEN = 64 * 1024
+export const protocolError = (code, message) => Object.assign(new Error(message), { code })
+const nonempty = (value, max = MAX_TOKEN) => typeof value === 'string' && value.length > 0 && value.length <= max
+
+export async function readGatewayJSON(response) {
+  if (Number(response.headers.get('content-length')) > MAX_BYTES) {
+    await response.body?.cancel()
+    throw protocolError('gateway_response_invalid', 'Gateway response exceeds the size limit')
+  }
+  const reader = response.body?.getReader(), chunks = []
+  let size = 0
+  if (reader) {
+    try {
+      for (;;) {
+        const { done, value } = await reader.read()
+        if (done) break
+        size += value.byteLength
+        if (size > MAX_BYTES) throw new Error('limit')
+        chunks.push(value)
+      }
+    } catch {
+      await reader.cancel().catch(() => {})
+      throw protocolError('gateway_response_invalid', 'Gateway response could not be read')
+    }
+  }
+  let raw
+  try { raw = JSON.parse(Buffer.concat(chunks).toString('utf8')) }
+  catch { throw protocolError('gateway_response_invalid', 'Gateway did not return JSON') }
+  if (!response.ok) {
+    // Never include untrusted error descriptions or echoed credentials in logs/UI.
+    const oauthError = ['invalid_grant', 'invalid_client', 'invalid_target', 'invalid_request', 'unsupported_grant_type'].includes(raw?.error) ? raw.error : undefined
+    throw Object.assign(protocolError('gateway_request_failed', `Gateway request failed (HTTP ${response.status}${oauthError ? `, ${oauthError}` : ''})`), { status: response.status, oauthError })
+  }
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw protocolError('gateway_response_invalid', 'Gateway response must be an object')
+  return raw
+}
+
+export async function gatewayJSON(fetcher, url, init = {}) {
+  let response
+  try {
+    response = await fetcher(url, { ...init, redirect: 'error', signal: init.signal ?? AbortSignal.timeout(20_000) })
+  } catch {
+    throw protocolError('gateway_unavailable', 'Gateway request did not complete; check the connection and retry')
+  }
+  return readGatewayJSON(response)
+}
+
+function trustedURL(value, profile, origin) {
+  let url
+  try { url = new URL(value) } catch { throw protocolError('gateway_discovery_invalid', 'Gateway metadata contains an invalid URL') }
+  if (!nonempty(value, 2048) || !serviceProtocolAllowed(url, profile.allowInsecureDevelopment) || url.username || url.password || url.search || url.hash || (origin && url.origin !== origin)) {
+    throw protocolError('gateway_discovery_invalid', 'Gateway metadata URL is outside the configured trust boundary')
+  }
+  return url
+}
+
+export function detectGatewayProtocol(raw, profile) {
+  if (Object.hasOwn(raw, 'oidc_llm')) {
+    throw protocolError('gateway_protocol_unsupported', 'oidc-llm is not enabled yet; retain the existing oidc profile until the new server protocol is available')
+  }
+  if (raw.contract_version !== 1) throw protocolError('gateway_protocol_unsupported', 'Unsupported gateway discovery contract; ordinary OIDC must use the existing oidc profile')
+  const origin = new URL(profile.auth.discoveryUrl).origin
+  const issuer = trustedURL(raw.issuer, profile, origin)
+  if (profile.auth.expectedIssuer && raw.issuer !== profile.auth.expectedIssuer) throw protocolError('gateway_discovery_invalid', 'Gateway issuer does not match expectedIssuer')
+  // Native proxy resource and issuer describe the same gateway, including its prefix.
+  trustedURL(raw.resource, profile, origin)
+  if (raw.resource !== raw.issuer) throw protocolError('gateway_discovery_invalid', 'LiteLLM resource must exactly match its issuer')
+  for (const [key, required] of Object.entries({ response_types_supported: ['code'], grant_types_supported: ['authorization_code', 'refresh_token'], code_challenge_methods_supported: ['S256'], token_endpoint_auth_methods_supported: ['none'], revocation_endpoint_auth_methods_supported: ['none'] })) {
+    if (!Array.isArray(raw[key]) || required.some(value => !raw[key].includes(value))) throw protocolError('gateway_discovery_invalid', `LiteLLM discovery lacks required ${key}`)
+  }
+  const result = { protocol: 'litellm-native-v1', issuer: raw.issuer, resource: raw.resource }
+  for (const [property, wire] of Object.entries({ authorizationEndpoint: 'authorization_endpoint', tokenEndpoint: 'token_endpoint', registrationEndpoint: 'registration_endpoint', revocationEndpoint: 'revocation_endpoint' })) {
+    trustedURL(raw[wire], profile, origin)
+    result[property] = raw[wire]
+  }
+  const base = issuer.href.replace(/\/+$/, '')
+  return Object.freeze({ ...result, baseURL: `${base}/v1`, userInfoEndpoint: `${base}/user/info` })
+}
+
+export async function registerLiteLLM(fetcher, descriptor, redirectURI) {
+  const redirect = new URL(redirectURI)
+  if (redirect.protocol !== 'http:' || redirect.hostname !== '127.0.0.1' || redirect.username || redirect.password || redirect.search || redirect.hash) throw protocolError('gateway_callback_invalid', 'LiteLLM requires a loopback callback')
+  const raw = await gatewayJSON(fetcher, descriptor.registrationEndpoint, {
+    method: 'POST', headers: { 'content-type': 'application/json', accept: 'application/json' },
+    body: JSON.stringify({ client_name: 'EduWork', redirect_uris: [redirectURI], token_endpoint_auth_method: 'none', grant_types: ['authorization_code', 'refresh_token'], response_types: ['code'] }),
+  })
+  if (!nonempty(raw.client_id) || raw.token_endpoint_auth_method !== 'none' || !Array.isArray(raw.redirect_uris) || raw.redirect_uris.length !== 1 || raw.redirect_uris[0] !== redirectURI) {
+    throw protocolError('gateway_registration_invalid', 'LiteLLM did not register the requested public client callback')
+  }
+  return raw.client_id
+}
+
+export function liteLLMToken(raw, now, previous) {
+  if (!nonempty(raw.access_token) || !nonempty(raw.refresh_token) || typeof raw.token_type !== 'string' || raw.token_type.toLowerCase() !== 'bearer' || !Number.isSafeInteger(raw.expires_in) || raw.expires_in <= 0 || raw.expires_in > 365 * 86400 || !nonempty(raw.user_id, 1024) || !(raw.team_id === null || nonempty(raw.team_id, 1024))) {
+    throw protocolError('gateway_token_invalid', 'LiteLLM token response is incomplete or invalid')
+  }
+  if (previous && (raw.user_id !== previous.identity.sub || raw.team_id !== previous.teamID)) throw protocolError('gateway_identity_changed', 'Gateway authorization identity changed during refresh; sign in again')
+  return { accessToken: raw.access_token, refreshToken: raw.refresh_token, expiresAt: Math.floor(now() / 1000) + raw.expires_in, teamID: raw.team_id, identity: { sub: raw.user_id, name: previous?.identity?.name || raw.user_id } }
+}
+
+export function tokenRequest(fetcher, descriptor, values) {
+  return gatewayJSON(fetcher, descriptor.tokenEndpoint, {
+    method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+    body: new URLSearchParams({ ...values, resource: descriptor.resource }),
+  })
+}
+
+export async function revokeLiteLLM(fetcher, descriptor, session) {
+  await gatewayJSON(fetcher, descriptor.revocationEndpoint, {
+    method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({ token: session.refreshToken, client_id: session.clientId }), signal: AbortSignal.timeout(5_000),
+  })
+}