@fudrouter/fsrouter 0.6.64 → 0.6.65

package/open-sse/services/tokenRefresh.js

@@ -0,0 +1,254 @@
+import { PROVIDERS } from "../config/providers.js";
+import { OAUTH_ENDPOINTS, REFRESH_LEAD_MS } from "../config/appConstants.js";
+import {
+  refreshXaiToken,
+  refreshAccessToken,
+  refreshClaudeOAuthToken,
+  refreshGoogleToken,
+  refreshQwenToken,
+  refreshCodexToken,
+  refreshKiroToken,
+  refreshIflowToken,
+  refreshGitHubToken,
+  refreshCopilotToken,
+  refreshCodebuddyToken,
+  classifyOAuthRefreshError,
+} from "./tokenRefresh/providers.js";
+
+// Re-export all provider refresh functions (preserves public API for all consumers)
+export {
+  refreshAccessToken,
+  refreshClaudeOAuthToken,
+  refreshGoogleToken,
+  refreshQwenToken,
+  refreshCodexToken,
+  refreshKiroToken,
+  refreshIflowToken,
+  refreshGitHubToken,
+  refreshCopilotToken,
+  refreshCodebuddyToken,
+  classifyOAuthRefreshError,
+};
+
+export const TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1000;
+
+export function isUnrecoverableRefreshError(result) {
+  return (
+    result &&
+    typeof result === "object" &&
+    (result.error === "unrecoverable_refresh_error" ||
+      result.error === "refresh_token_reused" ||
+      result.error === "invalid_request" ||
+      result.error === "invalid_grant")
+  );
+}
+
+export function getRefreshLeadMs(provider) {
+  return REFRESH_LEAD_MS[provider] || TOKEN_EXPIRY_BUFFER_MS;
+}
+
+export function parseVertexSaJson(apiKey) {
+  if (typeof apiKey !== "string") return null;
+  try {
+    const parsed = JSON.parse(apiKey);
+    if (parsed.type === "service_account" && parsed.client_email && parsed.private_key && parsed.project_id) {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+// Cache Vertex tokens keyed by service account email { token, expiresAt }
+const vertexTokenCache = new Map();
+
+export async function refreshVertexToken(saJson, log) {
+  const cacheKey = saJson.client_email;
+  const cached = vertexTokenCache.get(cacheKey);
+
+  if (cached && cached.expiresAt - Date.now() > 5 * 60 * 1000) {
+    return { accessToken: cached.token, expiresAt: cached.expiresAt };
+  }
+
+  try {
+    const { SignJWT, importPKCS8 } = await import("jose");
+    log?.debug?.("TOKEN_REFRESH", `Vertex minting token for ${saJson.client_email}`);
+    const privateKey = await importPKCS8(saJson.private_key.replace(/\\n/g, "\n"), "RS256");
+    const now = Math.floor(Date.now() / 1000);
+
+    const jwt = await new SignJWT({ scope: "https://www.googleapis.com/auth/cloud-platform" })
+      .setProtectedHeader({ alg: "RS256" })
+      .setIssuer(saJson.client_email)
+      .setAudience(OAUTH_ENDPOINTS.google.token)
+      .setIssuedAt(now)
+      .setExpirationTime(now + 3600)
+      .sign(privateKey);
+
+    const res = await fetch(OAUTH_ENDPOINTS.google.token, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        assertion: jwt,
+      }),
+    });
+
+    if (!res.ok) {
+      const err = await res.text();
+      log?.error?.("TOKEN_REFRESH", `Vertex token mint failed: ${err}`);
+      return null;
+    }
+
+    const { access_token, expires_in } = await res.json();
+    const expiresAt = Date.now() + (expires_in ?? 3600) * 1000;
+
+    vertexTokenCache.set(cacheKey, { token: access_token, expiresAt });
+    log?.info?.("TOKEN_REFRESH", `Vertex token minted for ${saJson.client_email}`);
+
+    return { accessToken: access_token, expiresAt };
+  } catch (error) {
+    log?.error?.("TOKEN_REFRESH", `Vertex token error: ${error.message}`);
+    return null;
+  }
+}
+
+function vertexRefreshHandler(c, log) {
+  const saJson = parseVertexSaJson(c.apiKey);
+  if (!saJson) return null;
+  return refreshVertexToken(saJson, log);
+}
+
+const REFRESH_HANDLERS = {
+  "gemini-cli": (c, log) => refreshGoogleToken(c.refreshToken, PROVIDERS["gemini-cli"].clientId, PROVIDERS["gemini-cli"].clientSecret, log),
+  antigravity: (c, log) => refreshGoogleToken(c.refreshToken, PROVIDERS.antigravity.clientId, PROVIDERS.antigravity.clientSecret, log),
+  claude: (c, log) => refreshClaudeOAuthToken(c.refreshToken, log),
+  codex: (c, log) => refreshCodexToken(c.refreshToken, log),
+  qwen: (c, log) => refreshQwenToken(c.refreshToken, log),
+  iflow: (c, log) => refreshIflowToken(c.refreshToken, log),
+  github: (c, log) => refreshGitHubToken(c.refreshToken, log),
+  kiro: (c, log) => refreshKiroToken(c.refreshToken, c.providerSpecificData, log),
+  xai: (c, log) => refreshXaiToken(c.refreshToken, log),
+  // Grok CLI shares xAI OAuth client + token endpoint (device-code tokens refresh the same way)
+  "grok-cli": (c, log) => refreshXaiToken(c.refreshToken, log),
+  gcli: (c, log) => refreshXaiToken(c.refreshToken, log),
+  "codebuddy-cn": (c, log) => refreshCodebuddyToken(c.refreshToken, log),
+  vertex: vertexRefreshHandler,
+  "vertex-partner": vertexRefreshHandler
+};
+
+export async function getAccessToken(provider, credentials, log) {
+  if (!credentials || !credentials.refreshToken || typeof credentials.refreshToken !== "string") {
+    log?.warn?.("TOKEN_REFRESH", `No valid refresh token available for provider: ${provider}`);
+    return null;
+  }
+  return _getAccessTokenInternal(provider, credentials, log);
+}
+
+async function _getAccessTokenInternal(provider, credentials, log) {
+  if (provider === "gemini") {
+    return refreshGoogleToken(credentials.refreshToken, PROVIDERS.gemini.clientId, PROVIDERS.gemini.clientSecret, log);
+  }
+  const handler = REFRESH_HANDLERS[provider];
+  if (!handler) {
+    log?.warn?.("TOKEN_REFRESH", `Unsupported provider for token refresh: ${provider}`);
+    return null;
+  }
+  return handler(credentials, log);
+}
+
+export async function refreshTokenByProvider(provider, credentials, log) {
+  if (!credentials.refreshToken) return null;
+  const handler = REFRESH_HANDLERS[provider];
+  return handler ? handler(credentials, log) : refreshAccessToken(provider, credentials.refreshToken, credentials, log);
+}
+
+export function formatProviderCredentials(provider, credentials, log) {
+  const config = PROVIDERS[provider];
+  if (!config) {
+    log?.warn?.("TOKEN_REFRESH", `No configuration found for provider: ${provider}`);
+    return null;
+  }
+
+  switch (provider) {
+    case "gemini":
+      return {
+        apiKey: credentials.apiKey,
+        accessToken: credentials.accessToken,
+        projectId: credentials.projectId
+      };
+
+    case "claude":
+      return {
+        apiKey: credentials.apiKey,
+        accessToken: credentials.accessToken
+      };
+
+    case "codex":
+    case "qwen":
+    case "iflow":
+    case "openai":
+    case "openrouter":
+    case "xai":
+    case "grok-cli":
+      return {
+        apiKey: credentials.apiKey,
+        accessToken: credentials.accessToken
+      };
+
+    case "antigravity":
+    case "gemini-cli":
+      return {
+        accessToken: credentials.accessToken,
+        refreshToken: credentials.refreshToken,
+        projectId: credentials.projectId
+      };
+
+    default:
+      return {
+        apiKey: credentials.apiKey,
+        accessToken: credentials.accessToken,
+        refreshToken: credentials.refreshToken
+      };
+  }
+}
+
+export async function getAllAccessTokens(userInfo, log) {
+  const results = {};
+
+  if (userInfo.connections && Array.isArray(userInfo.connections)) {
+    for (const connection of userInfo.connections) {
+      if (connection.isActive && connection.provider) {
+        const token = await getAccessToken(connection.provider, {
+          refreshToken: connection.refreshToken
+        }, log);
+
+        if (token) {
+          results[connection.provider] = token;
+        }
+      }
+    }
+  }
+
+  return results;
+}
+
+export async function refreshWithRetry(refreshFn, maxRetries = 3, log = null) {
+  for (let attempt = 0; attempt < maxRetries; attempt++) {
+    if (attempt > 0) {
+      const delay = attempt * 1000;
+      log?.debug?.("TOKEN_REFRESH", `Retry ${attempt}/${maxRetries} after ${delay}ms`);
+      await new Promise(r => setTimeout(r, delay));
+    }
+
+    try {
+      const result = await refreshFn();
+      if (result) return result;
+    } catch (error) {
+      log?.warn?.("TOKEN_REFRESH", `Attempt ${attempt + 1}/${maxRetries} failed: ${error.message}`);
+    }
+  }
+
+  log?.error?.("TOKEN_REFRESH", `All ${maxRetries} retry attempts failed`);
+  return null;
+}

package/open-sse/services/usage/claude.js

@@ -0,0 +1,147 @@
+/**
+ * Claude usage handler
+ */
+
+import { proxyAwareFetch } from "../../utils/proxyFetch.js";
+import { ANTHROPIC_API_VERSION } from "../../providers/shared.js";
+import { U, parseResetTime } from "./shared.js";
+
+// Claude API config (urls from registry, apiVersion is header logic kept here)
+const CLAUDE_CONFIG = {
+  oauthUsageUrl: U("claude").oauthUrl,
+  usageUrl: U("claude").orgUrl,
+  settingsUrl: U("claude").settingsUrl,
+  apiVersion: ANTHROPIC_API_VERSION,
+};
+
+// OAuth usage endpoint rate-limits (429); cool down per-token to stop hammering it.
+// Only the quota endpoint is affected — chat with the same token still works.
+const OAUTH_429_COOLDOWN_MS = 180000;
+const oauthCooldown = new Map();
+
+export async function getClaudeUsage(accessToken, proxyOptions = null) {
+  try {
+    // Skip OAuth usage call while this token is cooling down from a recent 429
+    const cooldownUntil = oauthCooldown.get(accessToken);
+    if (cooldownUntil && Date.now() < cooldownUntil) {
+      return await getClaudeUsageLegacy(accessToken, proxyOptions);
+    }
+
+    // Primary: OAuth usage endpoint (Claude Code consumer OAuth tokens)
+    const oauthResponse = await proxyAwareFetch(CLAUDE_CONFIG.oauthUsageUrl, {
+      method: "GET",
+      headers: {
+        "Authorization": `Bearer ${accessToken}`,
+        "anthropic-beta": "oauth-2025-04-20",
+        "anthropic-version": CLAUDE_CONFIG.apiVersion,
+      },
+    }, proxyOptions);
+
+    if (oauthResponse.ok) {
+      const data = await oauthResponse.json();
+      const quotas = {};
+
+      // utilization = % USED (e.g. 87 means 87% used, 13% remaining)
+      const hasUtilization = (window) =>
+        window && typeof window === "object" && typeof window.utilization === "number";
+
+      const createQuotaObject = (window) => {
+        const used = window.utilization;
+        const remaining = Math.max(0, 100 - used);
+        return {
+          used,
+          total: 100,
+          remaining,
+          remainingPercentage: remaining,
+          resetAt: parseResetTime(window.resets_at),
+          unlimited: false,
+        };
+      };
+
+      if (hasUtilization(data.five_hour)) {
+        quotas["session (5h)"] = createQuotaObject(data.five_hour);
+      }
+
+      if (hasUtilization(data.seven_day)) {
+        quotas["weekly (7d)"] = createQuotaObject(data.seven_day);
+      }
+
+      // Parse model-specific weekly windows (e.g. seven_day_sonnet, seven_day_opus)
+      for (const [key, value] of Object.entries(data)) {
+        if (key.startsWith("seven_day_") && key !== "seven_day" && hasUtilization(value)) {
+          const modelName = key.replace("seven_day_", "");
+          quotas[`weekly ${modelName} (7d)`] = createQuotaObject(value);
+        }
+      }
+
+      return {
+        plan: "Claude Code",
+        extraUsage: data.extra_usage ?? null,
+        quotas,
+      };
+    }
+
+    // Cool down OAuth usage polling after a 429 (quota endpoint only)
+    if (oauthResponse.status === 429) {
+      oauthCooldown.set(accessToken, Date.now() + OAUTH_429_COOLDOWN_MS);
+    }
+
+    // Fallback: legacy settings + org usage endpoint
+    console.warn(`[Claude Usage] OAuth endpoint returned ${oauthResponse.status}, falling back to legacy`);
+    return await getClaudeUsageLegacy(accessToken, proxyOptions);
+  } catch (error) {
+    return { message: `Claude connected. Unable to fetch usage: ${error.message}` };
+  }
+}
+
+/**
+ * Legacy Claude usage for API key / org admin users
+ */
+async function getClaudeUsageLegacy(accessToken, proxyOptions = null) {
+  try {
+    const settingsResponse = await proxyAwareFetch(CLAUDE_CONFIG.settingsUrl, {
+      method: "GET",
+      headers: {
+        "Authorization": `Bearer ${accessToken}`,
+        "anthropic-version": CLAUDE_CONFIG.apiVersion,
+      },
+    }, proxyOptions);
+
+    if (settingsResponse.ok) {
+      const settings = await settingsResponse.json();
+
+      if (settings.organization_id) {
+        const usageResponse = await proxyAwareFetch(
+          CLAUDE_CONFIG.usageUrl.replace("{org_id}", settings.organization_id),
+          {
+            method: "GET",
+            headers: {
+              "Authorization": `Bearer ${accessToken}`,
+              "anthropic-version": CLAUDE_CONFIG.apiVersion,
+            },
+          },
+          proxyOptions
+        );
+
+        if (usageResponse.ok) {
+          const usage = await usageResponse.json();
+          return {
+            plan: settings.plan || "Unknown",
+            organization: settings.organization_name,
+            quotas: usage,
+          };
+        }
+      }
+
+      return {
+        plan: settings.plan || "Unknown",
+        organization: settings.organization_name,
+        message: "Claude connected. Usage details require admin access.",
+      };
+    }
+
+    return { message: "Claude connected. Usage API requires admin permissions." };
+  } catch (error) {
+    return { message: `Claude connected. Unable to fetch usage: ${error.message}` };
+  }
+}

package/open-sse/services/usage/codebuddy-cn.js

@@ -0,0 +1,138 @@
+/**
+ * CodeBuddy CN usage handler
+ *
+ * Scoped to the "codebuddy-cn" provider specifically — a future "codebuddy-intl"
+ * variant would get its own handler/endpoint, so keep this CN-only.
+ *
+ * Quota lives behind a Tencent billing endpoint (POST, payload wrapped twice
+ * under data.Response.Data). It mixes two credit types that must NOT be merged:
+ *
+ *  - Refill / base ("基础体验包"): a recurring allowance whose cycle resets long
+ *    before the resource itself expires (CycleEndTime << DeductionEndTime). The
+ *    live numbers live in the *Cycle* fields (e.g. CycleCapacityUsed 6.54 / 500)
+ *    and resetAt is the next monthly refresh.
+ *  - Bonus ("活动赠送包"): one-shot credits that run a single cycle and then
+ *    expire for good (CycleEndTime == DeductionEndTime). Numbers live in the
+ *    plain Capacity fields.
+ *
+ * We surface one quota row per package — a cadence label (Monthly/Weekly/Daily)
+ * for refill packs, "Bonus Pack N" for bonus packs (soonest-expiring first).
+ */
+
+import { proxyAwareFetch } from "../../utils/proxyFetch.js";
+import { PROVIDERS } from "../../providers/index.js";
+import { U, parseResetTime } from "./shared.js";
+
+const PROVIDER_ID = "codebuddy-cn";
+
+// Prefer the *Precise string fields (exact), fall back to the numeric ones.
+function num(precise, plain) {
+  const n = Number(precise ?? plain);
+  return Number.isFinite(n) ? n : 0;
+}
+
+// Label a refill pack by its cycle length (Monthly is the common CodeBuddy case).
+function refillCadence(acc) {
+  const start = parseResetTime(acc.CycleStartTime);
+  const end = parseResetTime(acc.CycleEndTime);
+  if (start && end) {
+    const days = (new Date(end).getTime() - new Date(start).getTime()) / 86400000;
+    if (days <= 1.5) return "Daily";
+    if (days <= 10) return "Weekly";
+  }
+  return "Monthly";
+}
+
+export async function getCodeBuddyCnUsage(accessToken, apiKey, providerSpecificData, proxyOptions = null) {
+  const token = accessToken || apiKey;
+  if (!token) {
+    return { message: "CodeBuddy CN credential not available." };
+  }
+
+  try {
+    const response = await proxyAwareFetch(U(PROVIDER_ID).url, {
+      method: "POST",
+      headers: {
+        ...(PROVIDERS[PROVIDER_ID]?.headers || {}),
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+        Accept: "application/json",
+      },
+      body: "{}",
+    }, proxyOptions);
+
+    if (response.status === 401 || response.status === 403) {
+      return { message: "CodeBuddy CN credential invalid or expired." };
+    }
+    if (!response.ok) {
+      return { message: `CodeBuddy CN quota API error (${response.status}).` };
+    }
+
+    const json = await response.json();
+    if (json?.code !== 0) {
+      return { message: `CodeBuddy CN quota error: ${json?.msg || "unknown"}` };
+    }
+
+    const data = json?.data?.Response?.Data || {};
+    const accounts = Array.isArray(data.Accounts) ? data.Accounts : [];
+    if (accounts.length === 0) {
+      return { message: "CodeBuddy CN connected. No credit package found." };
+    }
+
+    const cycleEndMs = (acc) => {
+      const r = parseResetTime(acc.CycleEndTime);
+      return r ? new Date(r).getTime() : Number.POSITIVE_INFINITY;
+    };
+    // Refill packs roll into a new cycle before the resource expires; bonus packs
+    // end exactly at expiry. >2d gap between cycle end and validity end = refill.
+    const REFILL_GAP_MS = 2 * 24 * 60 * 60 * 1000;
+    const isRefill = (acc) => {
+      const ce = cycleEndMs(acc);
+      const de = Number(acc.DeductionEndTime);
+      return Number.isFinite(ce) && Number.isFinite(de) && de - ce > REFILL_GAP_MS;
+    };
+    const byExpiry = (a, b) => cycleEndMs(a) - cycleEndMs(b);
+
+    const refills = accounts.filter(isRefill).sort(byExpiry);
+    const bonuses = accounts.filter((a) => !isRefill(a)).sort(byExpiry);
+
+    const quotas = {};
+    // Refill packs first: cadence-labelled, using the *Cycle* balance and
+    // resetting at the next refresh.
+    const seenRefill = {};
+    refills.forEach((acc) => {
+      const base = refillCadence(acc);
+      seenRefill[base] = (seenRefill[base] || 0) + 1;
+      const name = seenRefill[base] > 1 ? `${base} ${seenRefill[base]}` : base;
+      quotas[name] = {
+        used: num(acc.CycleCapacityUsedPrecise, acc.CycleCapacityUsed),
+        total: num(acc.CycleCapacitySizePrecise, acc.CycleCapacitySize),
+        resetAt: parseResetTime(acc.CycleEndTime),
+        unlimited: false,
+        // Recurring allowance: the CycleEndTime is the next refresh, not the
+        // final expiry. The UI must show "Resets in", not "Expires in".
+        recurring: true,
+      };
+    });
+    // Bonus packs: use the lifetime Capacity balance; resetAt is the expiry.
+    // These are one-shot credits (CycleEndTime == DeductionEndTime), so they
+    // never replenish — mark recurring:false so the UI shows "Expires in"
+    // instead of implying a monthly refill.
+    bonuses.forEach((acc, i) => {
+      quotas[`Bonus Pack ${i + 1}`] = {
+        used: num(acc.CapacityUsedPrecise, acc.CapacityUsed),
+        total: num(acc.CapacitySizePrecise, acc.CapacitySize),
+        resetAt: parseResetTime(acc.CycleEndTime),
+        unlimited: false,
+        recurring: false,
+      };
+    });
+
+    const basePkg = refills[0] || accounts[0] || {};
+    const plan = basePkg.PackageName || basePkg.SubProductName || "CodeBuddy CN";
+
+    return { plan, quotas };
+  } catch (error) {
+    return { message: `CodeBuddy CN error: ${error.message}` };
+  }
+}