@godspeedai/cognate-provider-openai-oauth 0.8.0 → 0.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +4 -4
- package/src/EGM.md +41 -0
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@godspeedai/cognate-provider-openai-oauth",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.9.0",
|
|
4
4
|
"description": "Sign in with ChatGPT (SIWC) OAuth/OIDC credential adapter: dynamic client registration, PKCE sign-in, validated tokens, rotating refresh, and governed subscription inference.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -22,8 +22,8 @@
|
|
|
22
22
|
".": "./src/index.ts"
|
|
23
23
|
},
|
|
24
24
|
"dependencies": {
|
|
25
|
-
"@godspeedai/cognate-capabilities": "^0.
|
|
26
|
-
"@godspeedai/cognate-provider-auth": "^0.
|
|
27
|
-
"@godspeedai/cognate-provider-openai-responses": "^0.
|
|
25
|
+
"@godspeedai/cognate-capabilities": "^0.9.0",
|
|
26
|
+
"@godspeedai/cognate-provider-auth": "^0.9.0",
|
|
27
|
+
"@godspeedai/cognate-provider-openai-responses": "^0.9.0"
|
|
28
28
|
}
|
|
29
29
|
}
|
package/src/EGM.md
ADDED
|
@@ -0,0 +1,41 @@
|
|
|
1
|
+
# provider-openai-oauth / src — subscription-backed ChatGPT provider
|
|
2
|
+
|
|
3
|
+
## Overview
|
|
4
|
+
|
|
5
|
+
Signs in to a ChatGPT plan over SIWC, stores per-account credentials on disk, and exposes a `ModelProvider` that wraps the shared Responses adapter so every plan-backed request honors the preview constraints `[provider.ts:subscriptionResponsesProvider]`. The module re-exports everything from `protocol.ts`, `jwt.ts`, `store.ts`, `session.ts`, and `provider.ts` `[index.ts:1]`. Session lifecycle covers loopback callback sign-in, ID-token validation, single-flight refresh, revocation, and a per-request `CredentialSource` lease `[session.ts:1]`.
|
|
6
|
+
|
|
7
|
+
## Interface
|
|
8
|
+
|
|
9
|
+
- `subscriptionResponsesProvider` — provider with `generate` served through the stream `[provider.ts:subscriptionResponsesProvider]`
|
|
10
|
+
- `subscriptionRequest` — strips system-role items into `instructions` and drops temperature/maxTokens `[provider.ts:subscriptionRequest]`
|
|
11
|
+
- `signIn` / `refreshAccount` / `signOut` — session lifecycle over the loopback flow `[session.ts:signIn]`
|
|
12
|
+
- `subscriptionCredentialSource` / `subscriptionGrant` / `ensureAutomationGrant` — credential and consent plumbing `[session.ts:subscriptionCredentialSource]`
|
|
13
|
+
- `SiwcOptions` — accounts dir, app name, discovery URL, fetcher, browser opener, loopback port, clock `[session.ts:SiwcOptions]`
|
|
14
|
+
- `validateIdToken` / `JwksClient` / `IdTokenError` — RS256/ES256-only ID-token validation `[jwt.ts:validateIdToken]`
|
|
15
|
+
- `writeAccountRecord` / `readAccountRecord` / `accountsDirectory` — atomic owner-only credential persistence `[store.ts:writeAccountRecord]`
|
|
16
|
+
- `AccountRecord` / `AutomationConsent` — credential record and secret-free consent record `[store.ts:AccountRecord]`
|
|
17
|
+
- `buildAuthorizationUrl` / `parseCallback` / `exchangeAuthorizationCode` / `refreshTokens` / `revokeToken` — protocol calls `[protocol.ts:buildAuthorizationUrl]`
|
|
18
|
+
|
|
19
|
+
## Invariants
|
|
20
|
+
|
|
21
|
+
- Every plan-backed request is transformed by `subscriptionRequest`; `generate` is served through `stream` so `stream:true` always holds `[provider.ts:subscriptionResponsesProvider]`
|
|
22
|
+
- A subscription stream that ends without a final `done` delta throws `ModelProviderError("malformed_response")` `[provider.ts:subscriptionResponsesProvider]`
|
|
23
|
+
- `assertSubscriptionUse` runs before credential acquisition, so automation requires recorded consent independent of token validity `[provider.ts:subscriptionResponsesProvider]`
|
|
24
|
+
- Usage mode defaults to `interactive` `[provider.ts:subscriptionResponsesProvider]`
|
|
25
|
+
- Only RS256 and ES256 are accepted, so `alg` confusion and `none` tokens cannot pass `[jwt.ts:1]`
|
|
26
|
+
- An unfamiliar `kid` forces exactly one JWKS refresh, never a loop; keys are cached for 300 000 ms `[jwt.ts:JwksClient]`
|
|
27
|
+
- Account records are written temp-then-rename with mode `0o600`, so readers never see a torn record `[store.ts:writeAccountRecord]`
|
|
28
|
+
- A client id must match `^[A-Za-z0-9_-]{8,128}$` before it is used in a path, preventing traversal `[store.ts:accountPath]`
|
|
29
|
+
- Automation consent is stored separately in a secret-free record `[store.ts:AutomationConsent]`
|
|
30
|
+
- The account directory layout is `<home>/.config/<appName>/openai` `[store.ts:accountsDirectory]`
|
|
31
|
+
|
|
32
|
+
## Side Effects
|
|
33
|
+
|
|
34
|
+
- Filesystem writes of credential JSON with `0o600` permissions and a temp+`rename` sequence `[store.ts:writeAccountRecord]`
|
|
35
|
+
- Outbound HTTP to the issuer's discovery, authorization, token, JWKS, and revocation endpoints `[protocol.ts:OPENAI_ISSUER]`
|
|
36
|
+
- A loopback HTTP listener for the OAuth callback and optional system-browser launch `[session.ts:SiwcOptions]`
|
|
37
|
+
- Child process spawning for the browser opener path `[session.ts:1]`
|
|
38
|
+
|
|
39
|
+
## Verification
|
|
40
|
+
|
|
41
|
+
- Run: `cd packages/provider-openai-oauth && bun test`
|