@goodandready/dsh-subscriptions 0.6.0 → 0.6.2

package/lib/routes/accounts.js

@@ -0,0 +1,343 @@
+import { normalizeSlots } from '../accounts.js'
+import { Config, publicConfig } from '../config-schema.js'
+import { decryptWithPassphrase, encryptWithPassphrase } from '../crypto.js'
+import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson } from '../http.js'
+import { discoverLocalCliSessions, loadLocalCliBlob } from '../import-auth.js'
+import { isProvider, oauthRef } from '../refs.js'
+
+export function registerAccountsRoutes(ctx, state) {
+  const {
+    live,
+    accountsView,
+    getSettingsApi,
+    syncCustomVendors,
+    syncAdapter,
+    stripLegacySlots,
+    store,
+    refreshModels,
+    refForSlot,
+    resetCredits,
+    subscriptions,
+  } = state
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/reset-credits',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      const q = queryOf(req)
+      const provider = q.get('provider') || ''
+      const index = Number(q.get('index') || '1')
+      const ref = refForSlot(provider, index)
+      if (!ref) { writeJson(res, 404, { ok: false, error: { code: 'slot', message: 'slot not found' } }); return }
+      try {
+        writeJson(res, 200, { ok: true, ...(await resetCredits.inspect(ref)) })
+      } catch (e) {
+        writeJson(res, 200, { ok: false, error: { code: 'reset', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /reset-credits')
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/reset-credits/prepare',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 4096)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const ref = refForSlot(String(payload.provider || ''), Number(payload.index) || 1)
+      if (!ref) { writeJson(res, 404, { ok: false, error: { code: 'slot', message: 'slot not found' } }); return }
+      try {
+        writeJson(res, 200, { ok: true, ...(await resetCredits.prepare(ref)) })
+      } catch (e) {
+        writeJson(res, 200, { ok: false, error: { code: 'reset', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /reset-credits/prepare')
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/reset-credits/consume',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 4096)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      try {
+        const result = await resetCredits.consume({ challengeId: payload.challengeId, acknowledged: payload.acknowledged })
+        writeJson(res, 200, { ok: true, result })
+        refreshModels().catch(() => {})
+      } catch (e) {
+        writeJson(res, 200, { ok: false, error: { code: 'reset', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /reset-credits/consume')
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/discover-local',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      try {
+        const detected = await discoverLocalCliSessions()
+        writeJson(res, 200, { ok: true, detected })
+      } catch (e) {
+        writeJson(res, 500, { ok: false, error: { message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /discover-local')
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/import-local',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let body
+      try {
+        body = JSON.parse((await readBody(req, 16 * 1024)).toString('utf8') || '{}')
+      } catch {
+        body = null
+      }
+      if (!body || !body.provider) {
+        writeJson(res, 400, { ok: false, error: { code: 'bad_request', message: 'missing provider' } })
+        return
+      }
+      try {
+        const blob = await loadLocalCliBlob(body.provider)
+        const prov = body.provider
+        const idx = Number(body.index) || 1
+        const curSlots = Array.isArray(live().slots) ? live().slots.slice() : []
+        const exists = curSlots.some((s) => s && s.provider === prov && Number(s.index) === idx)
+        if (!exists && getSettingsApi()) {
+          const nextSlots = curSlots.concat([{
+            provider: prov,
+            index: idx,
+            label: blob.email || '',
+          }])
+          const parsed = Config({ ...live(), slots: stripLegacySlots(nextSlots) })
+          await getSettingsApi().replace(parsed)
+          syncCustomVendors()
+        }
+        const slot = normalizeSlots(live().slots).find((s) => s.provider === prov && s.index === idx)
+        const ref = slot ? slot.ref : `${prov.toUpperCase()}_OAUTH_${idx}`
+        await store.saveBlob(ref, blob)
+        await syncAdapter()
+        refreshModels().catch(() => {})
+        writeJson(res, 200, {
+          ok: true,
+          ref,
+          provider: prov,
+          email: blob.email || '',
+          accounts: await accountsView(),
+          config: publicConfig(live()),
+        })
+      } catch (e) {
+        writeJson(res, 400, { ok: false, error: { message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /import-local')
+
+
+  // Export of the encrypted token bundle. Tokens are never logged.
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/export',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 8 * 1024)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const passphrase = payload.passphrase
+      if (!passphrase || typeof passphrase !== 'string') {
+        writeJson(res, 400, { ok: false, error: { code: 'passphrase', message: 'passphrase is required' } })
+        return
+      }
+      try {
+        const accounts = []
+        for (const slot of normalizeSlots(live().slots)) {
+          try {
+            const blob = await store.loadBlob(slot.ref)
+            accounts.push({ ref: slot.ref, provider: slot.provider, index: slot.index, label: slot.label || blob.label || '', blob })
+          } catch { /* skip missing */ }
+        }
+        if (!accounts.length) {
+          writeJson(res, 200, { ok: false, error: { code: 'empty', message: 'no connected accounts' } })
+          return
+        }
+        const bundle = JSON.stringify({ v: 1, exportedAt: Date.now(), accounts })
+        const encrypted = encryptWithPassphrase(bundle, passphrase)
+        writeJson(res, 200, { ok: true, payload: encrypted, count: accounts.length })
+      } catch (e) {
+        writeJson(res, 500, { ok: false, error: { code: 'export', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /export')
+
+
+  // Import of the encrypted bundle.
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/import',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 1024 * 1024)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const { passphrase, payload: encrypted } = payload
+      if (!passphrase || !encrypted) {
+        writeJson(res, 400, { ok: false, error: { code: 'params', message: 'passphrase and payload are required' } })
+        return
+      }
+      let bundle
+      try {
+        bundle = JSON.parse(decryptWithPassphrase(encrypted, passphrase))
+      } catch (e) {
+        writeJson(res, 400, { ok: false, error: { code: 'decrypt', message: 'wrong passphrase or corrupted bundle' } })
+        return
+      }
+      if (!bundle || !Array.isArray(bundle.accounts)) {
+        writeJson(res, 400, { ok: false, error: { code: 'format', message: 'invalid bundle format' } })
+        return
+      }
+      let imported = 0
+      for (const row of bundle.accounts) {
+        try {
+          await store.saveBlob(row.ref, row.blob)
+          imported++
+        } catch { /* skip broken */ }
+      }
+      await syncAdapter()
+      writeJson(res, 200, { ok: true, imported, total: bundle.accounts.length, accounts: await accountsView() })
+    }),
+  }), 'dsh-subscriptions: /import')
+
+
+  // #45: import an existing refresh token / API key without an OAuth flow.
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/import-token',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const provider = payload.provider
+      const index = Number(payload.index || '1')
+      const refreshToken = payload.refreshToken
+      const apiKey = payload.apiKey
+      if (!isProvider(provider)) {
+        writeJson(res, 400, { ok: false, error: { code: 'provider', message: 'unknown provider' } })
+        return
+      }
+      if (!refreshToken && !apiKey) {
+        writeJson(res, 400, { ok: false, error: { code: 'token', message: 'refreshToken or apiKey is required' } })
+        return
+      }
+      try {
+        const ref = oauthRef(provider, index)
+        const blob = { accessToken: apiKey || refreshToken, refreshToken: refreshToken || apiKey }
+        if (apiKey) { blob.apiKey = apiKey; blob.apiKeyOnly = true }
+        await store.saveBlob(ref, blob)
+        await syncAdapter()
+        refreshModels().catch(() => {})
+        writeJson(res, 200, { ok: true, ref, accounts: await accountsView() })
+      } catch (e) {
+        writeJson(res, 400, { ok: false, error: { code: 'import', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /import-token')
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/logout',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 8 * 1024)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      try {
+        const ref = oauthRef(payload.provider, payload.index)
+        await store.clearRef(ref)
+        await syncAdapter()
+        refreshModels().catch(() => {})
+        writeJson(res, 200, { ok: true, ref, accounts: await accountsView() })
+      } catch (e) {
+        writeJson(res, 400, { ok: false, error: { code: 'logout', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /logout')
+}

package/lib/routes/oauth.js

@@ -0,0 +1,248 @@
+import { normalizeSlots, vendorConfig } from '../accounts.js'
+import { escapeHtml, isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeHtml, writeJson } from '../http.js'
+import { startLoopback } from '../loopback.js'
+import { parseCallbackInput, requestOrigin } from '../oauth.js'
+import { createPkce } from '../pkce.js'
+import { displayName, isProvider, oauthRef } from '../refs.js'
+import { getVendor } from '../vendors/index.js'
+
+export function registerOauthRoutes(ctx, state) {
+  const {
+    live,
+    accountsView,
+    syncAdapter,
+    store,
+    redirectFor,
+    OK_HTML,
+    refreshModels,
+    pending,
+    completeOAuth,
+    fetchForRef,
+    sweepPending,
+    subscriptions,
+    pmL,
+  } = state
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/oauth/start',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      const q = queryOf(req)
+      const provider = q.get('provider') || ''
+      const index = Number(q.get('index') || '1')
+      if (!isProvider(provider)) {
+        writeJson(res, 400, { ok: false, error: { code: 'provider', message: 'unknown provider' } })
+        return
+      }
+      const origin = requestOrigin(req)
+      const redirectUri = redirectFor(provider, live(), origin)
+      const pkce = await createPkce()
+      pending.set(pkce.state, {
+        provider,
+        index,
+        verifier: pkce.verifier,
+        challenge: pkce.challenge,
+        state: pkce.state,
+        redirectUri,
+        createdAt: Date.now(),
+      })
+      const cfg = { ...vendorConfig(provider, live()), redirectUri }
+      const url = getVendor(provider).authorizeUrl(cfg, pkce)
+      // #89: if redirect_uri is loopback - start a temporary catch server.
+      let autoCatch = false
+      if (live().autoLoopback) {
+        try {
+          const cb = new URL(redirectUri)
+          if (cb.hostname === 'localhost' || cb.hostname === '127.0.0.1') {
+            autoCatch = true
+            startLoopback({
+              redirectUri,
+              onCode: async (params) => {
+                const code = params.get('code') || ''
+                const state = params.get('state') || ''
+                if (!code) throw new Error('no code')
+                await completeOAuth({ provider, index, code, state })
+                return OK_HTML
+              },
+            }).catch(() => {})
+          }
+        } catch { autoCatch = false }
+      }
+      writeJson(res, 200, { ok: true, url, state: pkce.state, redirectUri, autoCatch })
+    }),
+  }), 'dsh-subscriptions: /oauth/start')
+
+
+  // #90: Device-code login (headless/VPS). Codex-only: auth.openai.com mints an
+  // authorization_code + code_verifier server-side; we finish with the normal
+  // PKCE exchange using the device redirect URI. Device code stays server-side
+  // in the pending map (same lifetime as PKCE pending rows).
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/oauth/device/start',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let body
+      try {
+        body = JSON.parse((await readBody(req, 16 * 1024)).toString('utf8'))
+      } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const provider = String(body.provider || '')
+      const index = Number(body.index || 1)
+      if (!isProvider(provider)) {
+        writeJson(res, 400, { ok: false, error: { code: 'provider', message: 'unknown provider' } })
+        return
+      }
+      const vendor = getVendor(provider)
+      if (typeof vendor.deviceStart !== 'function') {
+        writeJson(res, 400, { ok: false, error: { code: 'device', message: 'device login not supported for ' + provider } })
+        return
+      }
+      try {
+        const cfg = vendorConfig(provider, live())
+        const start = await vendor.deviceStart(cfg, (fetchForRef(oauthRef(provider, index)) || fetch))
+        const state = 'dev-' + Date.now() + '-' + Math.random().toString(36).slice(2, 10)
+        sweepPending(Date.now())
+        pending.set(state, {
+          kind: 'device',
+          provider,
+          index,
+          ref: oauthRef(provider, index),
+          deviceAuthId: start.deviceAuthId,
+          userCode: start.userCode,
+          intervalMs: start.intervalMs,
+          createdAt: Date.now(),
+        })
+        writeJson(res, 200, { ok: true, state, userCode: start.userCode, authUrl: start.authUrl, intervalMs: start.intervalMs })
+      } catch (e) {
+        writeJson(res, 502, { ok: false, error: { code: e && e.code || 'DEVICE', message: String(e && e.message || e).slice(0, 300) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /oauth/device/start')
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/oauth/device/poll',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let body
+      try {
+        body = JSON.parse((await readBody(req, 16 * 1024)).toString('utf8'))
+      } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const state = String(body.state || '')
+      sweepPending(Date.now())
+      const row = pending.get(state)
+      if (!row || row.kind !== 'device') {
+        writeJson(res, 404, { ok: false, error: { code: 'expired', message: 'device login session expired; start again' } })
+        return
+      }
+      const vendor = getVendor(row.provider)
+      try {
+        const cfg = vendorConfig(row.provider, live())
+        const out = await vendor.devicePoll(cfg, { deviceAuthId: row.deviceAuthId, userCode: row.userCode }, (fetchForRef(row.ref) || fetch))
+        if (out.status !== 'authorized') {
+          writeJson(res, 200, { ok: true, status: out.status })
+          return
+        }
+        const slots = normalizeSlots(live().slots)
+        const slot = slots.find((s) => s.ref === row.ref)
+        const blob = out.blob
+        if (slot && slot.label) blob.label = slot.label
+        await store.saveBlob(row.ref, blob)
+        pending.delete(state)
+        await syncAdapter()
+        refreshModels().catch(() => {})
+        writeJson(res, 200, { ok: true, status: 'authorized', ref: row.ref, label: pmL(blob.label || blob.email) || displayName(row.provider) })
+      } catch (e) {
+        writeJson(res, 502, { ok: false, error: { code: e && e.code || 'DEVICE', message: String(e && e.message || e).slice(0, 300) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /oauth/device/poll')
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/oauth/callback',
+    handler: async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      const q = queryOf(req)
+      const code = q.get('code') || ''
+      const state = q.get('state') || ''
+      const row = pending.get(state)
+      if (!code || !row) {
+        writeHtml(res, 400, '<!doctype html><meta charset="utf-8"><title>Subscriptions</title><p>Login session missing. Return to Settings and paste the redirected URL.</p>')
+        return
+      }
+      try {
+        await completeOAuth({ provider: row.provider, index: row.index, code, state })
+        writeHtml(res, 200, '<!doctype html><meta charset="utf-8"><title>Subscriptions</title><p>Signed in. You can close this tab and return to Settings.</p>')
+      } catch (e) {
+        writeHtml(res, 400, `<!doctype html><meta charset="utf-8"><title>Subscriptions</title><p>${escapeHtml(String(e && e.message || e))}</p>`)
+      }
+    },
+  }), 'dsh-subscriptions: /oauth/callback')
+
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/oauth/complete',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 16 * 1024)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const parsed = parseCallbackInput(payload.url || payload.code || '')
+      const provider = payload.provider
+      const index = payload.index
+      const code = parsed.code
+      const state = parsed.state || payload.state || ''
+      if (!code) {
+        writeJson(res, 400, { ok: false, error: { code: 'code', message: 'paste the redirected URL or the code' } })
+        return
+      }
+      try {
+        const result = await completeOAuth({ provider, index, code, state })
+        writeJson(res, 200, { ok: true, ...result, accounts: await accountsView() })
+      } catch (e) {
+        writeJson(res, 400, { ok: false, error: { code: 'oauth', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /oauth/complete')
+}