@iislee/opencodex 2.11.0 → 2.35.0

package/src/server/management/oauth-account-routes.ts

@@ -19,6 +19,7 @@ import {
   getLoginStatus,
   isPublicOAuthProvider,
   listOAuthProviders,
+  publicOAuthAuthenticationErrorMessage,
   startLoginFlow,
   submitManualLoginCode,
 } from "../../oauth";
@@ -29,7 +30,7 @@ import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/ke
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
-import { clearProviderQuotaCache, fetchProviderAccountQuotas, fetchProviderQuotaReports, supportsPerAccountQuota } from "../../providers/quota";
+import { clearAccountQuotaCache, clearProviderQuotaCache, fetchProviderAccountQuotas, fetchProviderQuotaReports, supportsPerAccountQuota } from "../../providers/quota";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
 import {
@@ -69,6 +70,13 @@ import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, C
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, readManagementJsonBodyOr, rethrowManagementBodyTooLarge } from "./body";
 import { codexAccountNamespaceProviderCollisionError } from "../../codex/account-namespace-match";
+import { ACCOUNT_IMPORT_DEADLINE_MS, ACCOUNT_IMPORT_MAX_REQUEST_BYTES } from "../../oauth/account-import";
+import { readBoundedJsonRequestBody } from "../request-decompress";
+
+// ACCOUNT_IMPORT_DEADLINE_MS is the shared CLI/server import window. Individual
+// provider requests keep their own shorter timeouts; this is only the server-side
+// backstop for the admitted batch. A disconnected request aborts immediately
+// through req.signal below.
 
 /**
  * Parses a bounded JSON object body, or null. Malformed JSON is swallowed; an
@@ -112,7 +120,7 @@ function validateKeyName(
 }
 
 export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<Response | null> {
-  const { req, url, config, deps, refreshCodexCatalogBestEffort, syncClaudeAgentDefsBestEffort } = ctx;
+  const { req, url, config, deps, syncClaudeAgentDefsBestEffort } = ctx;
 
   // Which providers support real OAuth login (drives the GUI's "Log in with …" buttons).
   if (url.pathname === "/api/oauth/providers" && req.method === "GET") {
@@ -128,7 +136,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
   // the provider's loopback callback server (inside this process) captures the redirect in the
   // background, then the credential is persisted. The GUI opens the URL and polls /api/oauth/status.
   if (url.pathname === "/api/oauth/login" && req.method === "POST") {
-    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; addAccount?: boolean; accountId?: string; reauth?: boolean };
+    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; addAccount?: boolean; accountId?: string; reauth?: boolean; openBrowser?: unknown };
     const provider = (body.provider ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
     const namespaceCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, provider);
@@ -159,16 +167,28 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
           reconcileLiveStateStores();
         },
       });
-      if (authUrl && !deviceCode) {
-        // Open the browser server-side (the proxy runs on the user's machine) — the GUI's
-        // window.open is popup-blocked because it runs after an await, not a direct click.
+      // Open the browser server-side (the proxy runs on the user's machine) — the GUI's
+      // window.open is popup-blocked because it runs after an await, not a direct click.
+      //
+      // The operator can decline, which is the only way to finish a login in a
+      // browser profile other than the OS default, or on a different machine
+      // than the proxy. Declining changes nothing else: the URL is still
+      // returned below and every login surface renders it with a copy button.
+      const { shouldOpenBrowserForLogin } = await import("../../oauth/open-browser-choice");
+      if (authUrl && !deviceCode && shouldOpenBrowserForLogin(body.openBrowser, config)) {
         const { openUrl } = await import("../../lib/open-url");
         openUrl(authUrl);
       }
       return jsonResponse({ url: authUrl, instructions, deviceCode });
     } catch (err) {
       if (err instanceof OAuthMutationBusyError) throw err;
-      return jsonResponse({ error: err instanceof Error ? err.message : String(err) }, 409);
+      const message = err instanceof Error ? err.message : String(err);
+      const duplicateLoginMessage = `A login for ${provider} is already in progress`;
+      return jsonResponse({
+        error: message === duplicateLoginMessage
+          ? duplicateLoginMessage
+          : publicOAuthAuthenticationErrorMessage(err),
+      }, 409);
     }
   }
 
@@ -201,7 +221,8 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
   if (url.pathname === "/api/oauth/status" && req.method === "GET") {
     const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
-    return jsonResponse(getLoginStatus(provider));
+    const status = getLoginStatus(provider);
+    return jsonResponse(status);
   }
 
   if (url.pathname === "/api/oauth/logout" && req.method === "POST") {
@@ -210,6 +231,10 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     await removeCredential(provider);
     reconcileLiveStateStores();
     clearLoginState(provider);
+    const { clearModelCache } = await import("../../codex/model-cache");
+    const { clearGatherRoutedModelsInflight } = await import("../../codex/catalog");
+    clearModelCache(provider);
+    clearGatherRoutedModelsInflight();
     // Drop cached/last-good quota rows tied to the removed credential.
     const { clearProviderQuotaCache, clearAccountQuotaCache } = await import("../../providers/quota");
     clearProviderQuotaCache();
@@ -283,6 +308,10 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       const { resetAnthropicRoutingForManualSelection } = await import("../../oauth/anthropic-routing");
       resetAnthropicRoutingForManualSelection(body.accountId);
     }
+    const { clearModelCache } = await import("../../codex/model-cache");
+    const { clearGatherRoutedModelsInflight } = await import("../../codex/catalog");
+    clearModelCache(provider);
+    clearGatherRoutedModelsInflight();
     const { clearProviderQuotaCache } = await import("../../providers/quota");
     clearProviderQuotaCache();
     return jsonResponse({ ok: true, provider, activeAccountId: body.accountId });
@@ -378,6 +407,55 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     return jsonResponse({ ok: true, cleared });
   }
 
+  if (url.pathname === "/api/oauth/accounts/import" && req.method === "POST") {
+    const controller = new AbortController();
+    const abortRequest = () => controller.abort();
+    if (req.signal.aborted) abortRequest();
+    else req.signal.addEventListener("abort", abortRequest, { once: true });
+    const deadline = setTimeout(abortRequest, ACCOUNT_IMPORT_DEADLINE_MS);
+    try {
+      let rawBody: unknown;
+      try {
+        rawBody = await readBoundedJsonRequestBody(
+          req,
+          ACCOUNT_IMPORT_MAX_REQUEST_BYTES,
+          undefined,
+          { signal: controller.signal },
+        );
+      } catch {
+        if (controller.signal.aborted) return jsonResponse({ code: "import_cancelled" }, 408);
+        return jsonResponse({ code: "invalid_document" }, 400);
+      }
+      if (!isPlainRecord(rawBody)) return jsonResponse({ code: "invalid_document" }, 400);
+      const provider = typeof rawBody.provider === "string" ? rawBody.provider : "";
+      const format = typeof rawBody.format === "string" ? rawBody.format : "";
+      const { importAccounts } = await import("../../oauth/account-import");
+      const imported = await importAccounts({
+        provider,
+        format,
+        document: rawBody.document,
+        signal: controller.signal,
+      });
+      const changed = imported.ok
+        ? imported.result.importedCount > 0 || imported.result.updatedCount > 0
+        : imported.changed === true;
+      if (changed) {
+        reconcileLiveStateStores();
+        const { clearModelCache } = await import("../../codex/model-cache");
+        const { clearGatherRoutedModelsInflight } = await import("../../codex/catalog");
+        clearModelCache(provider);
+        clearGatherRoutedModelsInflight();
+        clearProviderQuotaCache();
+        clearAccountQuotaCache(provider);
+      }
+      if (!imported.ok) return jsonResponse({ code: imported.code }, imported.status);
+      return jsonResponse(imported.result);
+    } finally {
+      clearTimeout(deadline);
+      req.signal.removeEventListener("abort", abortRequest);
+    }
+  }
+
   if (url.pathname === "/api/oauth/accounts/alias" && req.method === "PUT") {
     const body = await readManagementJsonBodyOr(req, {}) as { provider?: unknown; accountId?: unknown; alias?: unknown };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
@@ -406,6 +484,10 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       clearAnthropicSessionAffinityForAccount(id);
     }
     if (!getAccountSet(provider)) clearLoginState(provider);
+    const { clearModelCache } = await import("../../codex/model-cache");
+    const { clearGatherRoutedModelsInflight } = await import("../../codex/catalog");
+    clearModelCache(provider);
+    clearGatherRoutedModelsInflight();
     const { clearProviderQuotaCache, clearAccountQuotaCache } = await import("../../providers/quota");
     clearProviderQuotaCache();
     clearAccountQuotaCache(provider);

package/src/server/management/provider-capability-config.ts

@@ -0,0 +1,48 @@
+import { booleanRecordConfigError } from "../../config/provider-validation";
+import type { OcxConfig } from "../../types";
+
+/**
+ * Provider-management validation that belongs to the provider editor, not the
+ * request-authentication/CORS boundary. Keeping this here lets the editor
+ * evolve its capability schema without widening the auth-cors security surface.
+ */
+export function providerServiceTierConfigError(name: unknown, provider: unknown): string | null {
+  if (typeof name !== "string" || !provider || typeof provider !== "object" || Array.isArray(provider)) {
+    return null;
+  }
+  const error = booleanRecordConfigError(
+    (provider as { modelSupportsServiceTier?: unknown }).modelSupportsServiceTier,
+    "modelSupportsServiceTier",
+  );
+  return error ? `provider ${name} ${error}` : null;
+}
+
+function publicServiceTierRecord(value: unknown): Record<string, boolean> | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const entries = Object.entries(value).filter(([model, supported]) =>
+    model.trim().length > 0 && typeof supported === "boolean",
+  );
+  return Object.fromEntries(entries) as Record<string, boolean>;
+}
+
+/**
+ * Add the provider editor's capability map to the already secret-free config
+ * DTO. `safeConfigDTO` remains the owner of auth/cors redaction; this helper
+ * only projects a boolean model capability used by the management UI.
+ */
+export function withProviderServiceTierDTO(dto: unknown, config: OcxConfig): unknown {
+  if (!dto || typeof dto !== "object" || Array.isArray(dto)) return dto;
+  const root = dto as { providers?: unknown };
+  if (!root.providers || typeof root.providers !== "object" || Array.isArray(root.providers)) return dto;
+
+  const providers = root.providers as Record<string, unknown>;
+  const projectedProviders: Record<string, unknown> = { ...providers };
+  for (const [name, provider] of Object.entries(config.providers)) {
+    const dtoProvider = providers[name];
+    if (!dtoProvider || typeof dtoProvider !== "object" || Array.isArray(dtoProvider)) continue;
+    const capabilities = publicServiceTierRecord(provider.modelSupportsServiceTier);
+    if (capabilities === undefined) continue;
+    projectedProviders[name] = { ...(dtoProvider as Record<string, unknown>), modelSupportsServiceTier: capabilities };
+  }
+  return { ...root, providers: projectedProviders };
+}