@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.7

package/packages/identity/src/oauth/google-desktop-exchange.js

@@ -0,0 +1,341 @@
+import { fetchGoogleProfile } from '../providers/google/profile.js';
+import { SESSION_TYPES } from '../core/session-policy.js';
+
+/**
+ * Server-side Google token exchange for CLI / desktop PKCE.
+ *
+ * Desktop/"installed" OAuth clients are public PKCE clients. Some Google
+ * installed-app credentials still include a provider-issued client_secret.
+ * That value is not a confidentiality boundary, but if Google requires it for
+ * token exchange the service may keep it in GOOGLE_DESKTOP_CLIENT_SECRET.
+ * Hosted web OAuth remains confidential and uses GOOGLE_CLIENT_SECRET.
+ */
+
+const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
+
+function clean(value) {
+  return value == null ? '' : String(value).trim();
+}
+
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: {
+      'content-type': 'application/json; charset=utf-8',
+      'cache-control': 'no-store',
+    },
+  });
+}
+
+function isLoopbackRedirect(uri) {
+  try {
+    const u = new URL(String(uri || ''));
+    if (u.protocol !== 'http:') return false;
+    return u.hostname === '127.0.0.1' || u.hostname === 'localhost' || u.hostname === '[::1]';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Resolve which secret (if any) the Worker may attach for this client_id.
+ */
+export function resolveGoogleExchangeSecret(env, clientId) {
+  const id = clean(clientId);
+  const desktopId = clean(env?.GOOGLE_DESKTOP_CLIENT_ID);
+  const webId = clean(env?.GOOGLE_CLIENT_ID);
+  const webSecret = clean(env?.GOOGLE_CLIENT_SECRET);
+  const desktopSecret = clean(env?.GOOGLE_DESKTOP_CLIENT_SECRET);
+
+  if (id && webId && id === webId && webSecret) {
+    return { clientId: id, clientSecret: webSecret, mode: 'web_confidential' };
+  }
+  if (id && desktopId && id === desktopId) {
+    return {
+      clientId: id,
+      clientSecret: desktopSecret || null,
+      mode: 'desktop_public_pkce',
+    };
+  }
+  return { clientId: id || null, clientSecret: null, mode: 'unknown_client' };
+}
+
+export async function exchangeGoogleAuthorizationCode({
+  code,
+  codeVerifier,
+  clientId,
+  redirectUri,
+  clientSecret = null,
+  fetchImpl = fetch,
+} = {}) {
+  const body = new URLSearchParams({
+    grant_type: 'authorization_code',
+    code: clean(code),
+    code_verifier: clean(codeVerifier),
+    client_id: clean(clientId),
+    redirect_uri: clean(redirectUri),
+  });
+  if (clean(clientSecret)) body.set('client_secret', clean(clientSecret));
+
+  const res = await fetchImpl(GOOGLE_TOKEN_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body,
+  });
+  const data = await res.json().catch(() => ({}));
+  return { ok: res.ok && Boolean(data.access_token), status: res.status, data };
+}
+
+/**
+ * POST /api/oauth/google/desktop-exchange
+ * Body JSON: { code, code_verifier, redirect_uri, client_id }
+ */
+export async function handleGoogleDesktopExchangeRequest(request, env, opts = {}) {
+  if (request.method !== 'POST') {
+    return json({ ok: false, error: 'method_not_allowed' }, 405);
+  }
+
+  let payload = {};
+  try {
+    payload = await request.json();
+  } catch {
+    return json({ ok: false, error: 'invalid_json' }, 400);
+  }
+
+  const code = clean(payload.code);
+  const codeVerifier = clean(payload.code_verifier || payload.codeVerifier);
+  const redirectUri = clean(payload.redirect_uri || payload.redirectUri);
+  const clientId = clean(payload.client_id || payload.clientId);
+
+  if (!code || !codeVerifier || !redirectUri || !clientId) {
+    return json({
+      ok: false,
+      error: 'code_code_verifier_redirect_uri_client_id_required',
+    }, 400);
+  }
+  if (!isLoopbackRedirect(redirectUri)) {
+    return json({ ok: false, error: 'redirect_uri_must_be_loopback' }, 400);
+  }
+
+  const allowed = new Set(
+    [clean(env?.GOOGLE_DESKTOP_CLIENT_ID), clean(env?.GOOGLE_CLIENT_ID)].filter(Boolean),
+  );
+  if (!allowed.has(clientId)) {
+    return json({ ok: false, error: 'client_id_not_configured_on_host' }, 403);
+  }
+
+  const resolved = resolveGoogleExchangeSecret(env, clientId);
+  if (resolved.mode === 'unknown_client') {
+    return json({ ok: false, error: 'client_id_not_configured_on_host' }, 403);
+  }
+
+  const fetchImpl = opts.fetchImpl || fetch;
+  const result = await exchangeGoogleAuthorizationCode({
+    code,
+    codeVerifier,
+    clientId,
+    redirectUri,
+    clientSecret: resolved.clientSecret,
+    fetchImpl,
+  });
+
+  const detail = String(result.data?.error_description || result.data?.error || '');
+  if (!result.ok) {
+    return json({
+      ok: false,
+      error: 'google_token_exchange_failed',
+      detail: detail || `http_${result.status}`,
+    }, 502);
+  }
+
+  return json({
+    ok: true,
+    access_token: result.data.access_token,
+    refresh_token: result.data.refresh_token || null,
+    token_type: result.data.token_type || 'Bearer',
+    expires_in: result.data.expires_in || null,
+    scope: result.data.scope || null,
+    exchange_mode: resolved.mode,
+  });
+}
+
+
+export const GOOGLE_DESKTOP_LOGIN_EXCHANGE_PATH = '/api/oauth/google/desktop-login-exchange';
+const GOOGLE_ID_TOKEN_INFO_URL = 'https://oauth2.googleapis.com/tokeninfo';
+
+async function verifyGoogleDesktopIdToken(idToken, clientId, fetchImpl = fetch) {
+  const url = new URL(GOOGLE_ID_TOKEN_INFO_URL);
+  url.searchParams.set('id_token', clean(idToken));
+  const response = await fetchImpl(url, {
+    headers: { Accept: 'application/json' },
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    return {
+      ok: false,
+      error: 'google_id_token_invalid',
+      detail: clean(data.error_description || data.error),
+    };
+  }
+
+  const audience = clean(data.aud);
+  const issuer = clean(data.iss);
+  const expiresAt = Number(data.exp || 0);
+  const emailVerified = data.email_verified === true || String(data.email_verified) === 'true';
+
+  if (audience !== clean(clientId)) {
+    return { ok: false, error: 'google_id_token_audience_mismatch' };
+  }
+  if (!['accounts.google.com', 'https://accounts.google.com'].includes(issuer)) {
+    return { ok: false, error: 'google_id_token_issuer_invalid' };
+  }
+  if (!Number.isFinite(expiresAt) || expiresAt <= Math.floor(Date.now() / 1000)) {
+    return { ok: false, error: 'google_id_token_expired' };
+  }
+  if (!emailVerified) {
+    return { ok: false, error: 'google_email_not_verified' };
+  }
+
+  return { ok: true, data };
+}
+
+/**
+ * Google Desktop account identity handoff.
+ *
+ * The installed app is the public OAuth client. It performs Google
+ * Authorization Code + PKCE + loopback; this endpoint receives the one-time
+ * code + verifier, performs the provider token exchange, validates the Google
+ * ID token against GOOGLE_DESKTOP_CLIENT_ID, resolves the profile, and mints
+ * the normal AgentSam desktop session. No Google access token is persisted in
+ * the desktop app for identity-only sign-in.
+ */
+export async function handleGoogleDesktopLoginExchangeRequest(request, env, opts = {}) {
+  if (request.method !== 'POST') {
+    return json({ ok: false, error: 'method_not_allowed' }, 405);
+  }
+  const identity = opts.identity;
+  const adapter = opts.adapter;
+  if (!identity || !adapter) {
+    return json({ ok: false, error: 'identity_service_unavailable' }, 503);
+  }
+
+  let payload = {};
+  try {
+    payload = await request.json();
+  } catch {
+    return json({ ok: false, error: 'invalid_json' }, 400);
+  }
+
+  let accessToken = clean(payload.access_token || payload.accessToken);
+  let idToken = clean(payload.id_token || payload.idToken);
+  const clientId = clean(payload.client_id || payload.clientId);
+
+  const desktopId = clean(env?.GOOGLE_DESKTOP_CLIENT_ID);
+  if (!desktopId || !clientId || clientId !== desktopId) {
+    return json({ ok: false, error: 'google_desktop_client_id_required' }, 403);
+  }
+
+  if (!accessToken || !idToken) {
+    const code = clean(payload.code);
+    const codeVerifier = clean(payload.code_verifier || payload.codeVerifier);
+    const redirectUri = clean(payload.redirect_uri || payload.redirectUri);
+    if (!code || !codeVerifier || !redirectUri) {
+      return json({
+        ok: false,
+        error: 'code_code_verifier_redirect_uri_required',
+      }, 400);
+    }
+    if (!isLoopbackRedirect(redirectUri)) {
+      return json({ ok: false, error: 'redirect_uri_must_be_loopback' }, 400);
+    }
+
+    const resolved = resolveGoogleExchangeSecret(env, clientId);
+    const exchanged = await exchangeGoogleAuthorizationCode({
+      code,
+      codeVerifier,
+      clientId,
+      redirectUri,
+      clientSecret: resolved.clientSecret,
+      fetchImpl: opts.fetchImpl || fetch,
+    });
+    if (!exchanged.ok) {
+      return json({
+        ok: false,
+        error: 'google_token_exchange_failed',
+        detail: clean(
+          exchanged.data?.error_description
+          || exchanged.data?.error
+          || ('http_' + exchanged.status),
+        ),
+      }, 502);
+    }
+    accessToken = clean(exchanged.data?.access_token);
+    idToken = clean(exchanged.data?.id_token);
+    if (!accessToken || !idToken) {
+      return json({ ok: false, error: 'google_token_payload_incomplete' }, 502);
+    }
+  }
+
+  const verified = await verifyGoogleDesktopIdToken(
+    idToken,
+    clientId,
+    opts.fetchImpl || fetch,
+  );
+  if (!verified.ok) {
+    return json({
+      ok: false,
+      error: verified.error,
+      detail: verified.detail || null,
+    }, 401);
+  }
+
+  const profile = opts.fetchProfile
+    ? await opts.fetchProfile(accessToken)
+    : await fetchGoogleProfile(accessToken);
+  if (!profile?.sub) {
+    return json({ ok: false, error: 'google_userinfo_failed' }, 502);
+  }
+  if (clean(verified.data.sub) && clean(verified.data.sub) !== clean(profile.sub)) {
+    return json({ ok: false, error: 'google_subject_mismatch' }, 401);
+  }
+  if (
+    clean(verified.data.email) &&
+    clean(profile.email) &&
+    clean(verified.data.email).toLowerCase() !== clean(profile.email).toLowerCase()
+  ) {
+    return json({ ok: false, error: 'google_email_mismatch' }, 401);
+  }
+
+  const provisioned = await identity.provisionOAuthUser({
+    provider: 'google',
+    providerSubject: String(profile.sub),
+    email: profile.email || verified.data.email || null,
+    displayName: profile.name || profile.email || verified.data.email || null,
+    sessionType: SESSION_TYPES.DESKTOP,
+  });
+  const user = await adapter.findUserById(provisioned.authUserId);
+  await adapter.logAuthEvent?.({
+    userId: provisioned.authUserId,
+    eventType: 'login',
+    status: 'ok',
+    provider: 'google',
+    request,
+    metadata: {
+      session_type: SESSION_TYPES.DESKTOP,
+      oauth_client_type: 'desktop_public_pkce',
+    },
+  });
+
+  return json({
+    ok: true,
+    authenticated: true,
+    session_id: provisioned.sessionId,
+    expires_at: provisioned.session?.expires_at ?? null,
+    user: user ? {
+      id: user.id,
+      email: user.email ?? null,
+      displayName: user.display_name ?? profile.name ?? null,
+    } : null,
+    exchange_mode: 'desktop_public_pkce_native_exchange',
+  });
+}

package/packages/identity/src/oauth/iam-platform.js

@@ -5,6 +5,7 @@ import {
   resolveIamPlatformCredentials,
 } from './credentials.js';
 import { pkceChallenge, pkceVerifier, randomOAuthState } from './pkce.js';
+import { finishOAuthLogin, parseNativeStart, sessionTypeForTransaction } from './native-handoff.js';
 import {
   exchangeIamCode,
   getIamAuthUrl,
@@ -33,12 +34,23 @@ export async function iamPlatformOAuthStart(request, env, adapter, identity) {
     url.searchParams.get('next') || url.searchParams.get('return_to'),
   ) || '/';
 
+  const nativeStart = parseNativeStart(url, env);
+  if (nativeStart.error) {
+    return Response.json({ ok: false, error: nativeStart.error }, { status: 400 });
+  }
   await adapter.saveOAuthState({
     state,
     provider: IAM_PLATFORM_STATE_PROVIDER,
     codeVerifier,
     redirectTo,
     appId: identity?.app?.id || null,
+    ...(nativeStart.native
+      ? {
+          clientType: nativeStart.clientType,
+          nativeChallenge: nativeStart.nativeChallenge,
+          nativeRedirect: nativeStart.nativeRedirect,
+        }
+      : {}),
   });
 
   const redirectUri = `${url.origin}${IAM_PLATFORM_CALLBACK_PATH}`;
@@ -106,17 +118,17 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
     providerSubject: normalized.subject,
     email: normalized.email,
     displayName: normalized.name || normalized.email.split('@')[0] || 'User',
+    sessionType: sessionTypeForTransaction(saved),
   });
 
-  const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
-  const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
-  const globeUrl = `${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
-  return new Response(null, {
-    status: 302,
-    headers: {
-      Location: globeUrl,
-      'Set-Cookie': res.headers.get('Set-Cookie') || '',
-    },
+  return finishOAuthLogin({
+    request,
+    env,
+    identity,
+    adapter,
+    saved,
+    result,
+    loginPath: identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN),
   });
 }
 

package/packages/identity/src/oauth/native-handoff.js

@@ -0,0 +1,136 @@
+/**
+ * Native (desktop) OAuth handoff.
+ *
+ * A desktop app signs in through the system browser, so the provider redirect
+ * lands in a browser that cannot hand a Set-Cookie to the app. Instead:
+ *
+ *   start    GET  /api/oauth/{provider}/start?client=native
+ *                   &native_challenge=<S256(verifier)>&native_redirect=<deep link>
+ *   callback creates an auth_sessions row (type=desktop), stores a single-use
+ *            handoff bound to the PKCE challenge, and 302s to the deep link
+ *            with ?handoff=<one-time code> — the session id never rides a URL.
+ *   exchange POST /api/oauth/native/exchange { handoff, code_verifier }
+ *            → same JSON as native password login (session_id, expires_at, user)
+ *
+ * Identity only. This never writes provider resource grants (user_oauth_tokens).
+ */
+
+import { jsonResponse } from '../core/http-json.js';
+import { NATIVE_HANDOFF_TTL_SECONDS, SESSION_TYPES } from '../core/session-policy.js';
+import { pkceChallenge, randomOAuthState } from './pkce.js';
+
+const DEFAULT_NATIVE_SCHEMES = ['agentsamstudio'];
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '[::1]']);
+const S256_CHALLENGE = /^[A-Za-z0-9_-]{43}$/;
+
+export const NATIVE_EXCHANGE_PATH = '/api/oauth/native/exchange';
+
+async function sha256Hex(value) {
+  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(String(value)));
+  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+
+function allowedSchemes(env) {
+  const configured = String(env?.IDENTITY_NATIVE_REDIRECT_SCHEMES || '')
+    .split(',')
+    .map((s) => s.trim().toLowerCase())
+    .filter(Boolean);
+  return configured.length ? configured : DEFAULT_NATIVE_SCHEMES;
+}
+
+/** Deep-link scheme allowlist, or an http loopback redirect. Never a web origin. */
+export function isAllowedNativeRedirect(uri, env) {
+  let parsed;
+  try {
+    parsed = new URL(String(uri || ''));
+  } catch {
+    return false;
+  }
+  if (parsed.protocol === 'http:') return LOOPBACK_HOSTS.has(parsed.hostname);
+  return allowedSchemes(env).includes(parsed.protocol.replace(/:$/, '').toLowerCase());
+}
+
+/**
+ * Read native params off an OAuth start URL.
+ * @returns {{ native: false } | { native: true, error: string } |
+ *           { native: true, clientType: 'desktop', nativeChallenge: string, nativeRedirect: string }}
+ */
+export function parseNativeStart(url, env) {
+  const client = String(url.searchParams.get('client') || '').toLowerCase();
+  if (client !== 'native' && client !== 'desktop') return { native: false };
+  const nativeChallenge = url.searchParams.get('native_challenge') || '';
+  const nativeRedirect = url.searchParams.get('native_redirect') || '';
+  if (!S256_CHALLENGE.test(nativeChallenge)) return { native: true, error: 'native_challenge_invalid' };
+  if (!isAllowedNativeRedirect(nativeRedirect, env)) return { native: true, error: 'native_redirect_not_allowed' };
+  return { native: true, clientType: SESSION_TYPES.DESKTOP, nativeChallenge, nativeRedirect };
+}
+
+/** Session type an OAuth transaction should mint. */
+export function sessionTypeForTransaction(saved) {
+  return saved?.client_type === SESSION_TYPES.DESKTOP ? SESSION_TYPES.DESKTOP : SESSION_TYPES.BROWSER;
+}
+
+/**
+ * Shared callback tail for every OAuth lane. Browser transactions keep the
+ * existing cookie + globe redirect; native transactions get the handoff redirect.
+ */
+export async function finishOAuthLogin({ request, env, identity, adapter, saved, result, loginPath }) {
+  const url = new URL(request.url);
+  const redirectTo = identity.resolvePostLoginPath(saved?.redirect_to);
+
+  if (sessionTypeForTransaction(saved) === SESSION_TYPES.DESKTOP) {
+    if (!saved.native_challenge || !isAllowedNativeRedirect(saved.native_redirect, env)) {
+      await adapter.revokeSession?.(result.sessionId);
+      return Response.redirect(`${url.origin}${loginPath}?error=native_handoff_invalid`, 302);
+    }
+    const handoff = randomOAuthState();
+    await adapter.createNativeHandoff({
+      handoffHash: await sha256Hex(handoff),
+      sessionId: result.sessionId,
+      challenge: saved.native_challenge,
+      ttlSeconds: NATIVE_HANDOFF_TTL_SECONDS,
+    });
+    const target = new URL(saved.native_redirect);
+    target.searchParams.set('handoff', handoff);
+    return new Response(null, {
+      status: 302,
+      headers: { Location: target.toString(), 'Cache-Control': 'no-store' },
+    });
+  }
+
+  const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
+  const globeUrl = `${url.origin}${loginPath}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
+  return new Response(null, {
+    status: 302,
+    headers: { Location: globeUrl, 'Set-Cookie': res.headers.get('Set-Cookie') || '' },
+  });
+}
+
+/** POST /api/oauth/native/exchange — single-use, PKCE-bound. */
+export async function handleNativeExchangeRequest(request, { adapter, identity }) {
+  if (request.method !== 'POST') return jsonResponse({ ok: false, error: 'method_not_allowed' }, 405);
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return jsonResponse({ ok: false, error: 'invalid_json' }, 400);
+  }
+  const handoff = String(body?.handoff || '').trim();
+  const verifier = String(body?.code_verifier || body?.codeVerifier || '').trim();
+  if (!handoff || !verifier) {
+    return jsonResponse({ ok: false, error: 'handoff_and_code_verifier_required' }, 400);
+  }
+
+  // Consumed before the verifier check, so a wrong verifier burns the code.
+  const row = await adapter.consumeNativeHandoff(await sha256Hex(handoff));
+  if (!row) return jsonResponse({ ok: false, error: 'handoff_invalid_or_expired' }, 400);
+  if ((await pkceChallenge(verifier)) !== row.challenge) {
+    await adapter.revokeSession?.(row.session_id);
+    return jsonResponse({ ok: false, error: 'pkce_verification_failed' }, 400);
+  }
+
+  const session = await adapter.getSession(row.session_id);
+  const user = session ? await adapter.findUserById(session.user_id) : null;
+  if (!session || !user) return jsonResponse({ ok: false, error: 'session_unavailable' }, 401);
+  return identity.buildNativeLoginSuccessResponse({ sessionId: session.id, session, user }, body?.next);
+}

package/packages/identity/src/providers/chatgpt/headers.js

@@ -0,0 +1,65 @@
+/** ChatGPT Apps SDK / OpenAI hosted identity header constants. */
+
+export const CHATGPT_USER_EMAIL_HEADER = 'oai-authenticated-user-email';
+export const CHATGPT_USER_FULL_NAME_HEADER = 'oai-authenticated-user-full-name';
+export const CHATGPT_USER_FULL_NAME_ENCODING_HEADER =
+  'oai-authenticated-user-full-name-encoding';
+export const CHATGPT_PERCENT_ENCODED_UTF8 = 'percent-encoded-utf-8';
+
+export const CHATGPT_SIGN_IN_PATH = '/signin-with-chatgpt';
+export const CHATGPT_SIGN_OUT_PATH = '/signout-with-chatgpt';
+export const CHATGPT_CALLBACK_PATH = '/callback';
+
+/**
+ * @param {Headers | Record<string, string | string[] | undefined> | null | undefined} headers
+ * @param {string} name
+ */
+export function readHeader(headers, name) {
+  if (!headers) return null;
+  const key = String(name).toLowerCase();
+  if (typeof headers.get === 'function') {
+    const value = headers.get(name) ?? headers.get(key);
+    return value == null ? null : String(value);
+  }
+  const raw =
+    headers[name] ??
+    headers[key] ??
+    Object.entries(headers).find(([k]) => k.toLowerCase() === key)?.[1];
+  if (Array.isArray(raw)) return raw[0] == null ? null : String(raw[0]);
+  return raw == null ? null : String(raw);
+}
+
+function safeDecodeURIComponent(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Extract ChatGPT hosted user profile from request headers (Apps SDK).
+ * Does not leak transport headers into NormalizedExternalIdentity.raw beyond a redacted snapshot.
+ *
+ * @param {Headers | Record<string, string | string[] | undefined> | null | undefined} headers
+ * @returns {{ email: string, fullName: string | null, displayName: string } | null}
+ */
+export function readChatGptUserFromHeaders(headers) {
+  const email = readHeader(headers, CHATGPT_USER_EMAIL_HEADER);
+  if (!email) return null;
+
+  const encodedFullName = readHeader(headers, CHATGPT_USER_FULL_NAME_HEADER);
+  const encoding = readHeader(headers, CHATGPT_USER_FULL_NAME_ENCODING_HEADER);
+  const fullName =
+    encodedFullName && encoding === CHATGPT_PERCENT_ENCODED_UTF8
+      ? safeDecodeURIComponent(encodedFullName)
+      : encodedFullName && encoding !== CHATGPT_PERCENT_ENCODED_UTF8
+        ? encodedFullName
+        : null;
+
+  return {
+    email: email.trim().toLowerCase(),
+    fullName,
+    displayName: (fullName || email).trim(),
+  };
+}

package/packages/identity/src/providers/chatgpt/index.js

@@ -0,0 +1,86 @@
+import { createIdentityProvider } from '../../provider-contract.js';
+import { normalizeChatGptIdentity } from './mapper.js';
+import { readChatGptUserFromHeaders } from './headers.js';
+import { chatGPTSignInPath, chatGPTSignOutPath, safeRelativeReturnPath } from './paths.js';
+
+/**
+ * ChatGPT hosted identity provider (OpenAI Apps SDK).
+ *
+ * Auth is header-based in the ChatGPT host — not classic OAuth client credentials.
+ * `authorizeUrl` points at the hosted sign-in path; `exchangeCode` is unsupported.
+ */
+export const ChatGptProvider = createIdentityProvider({
+  id: 'chatgpt',
+  authorizeUrl: ({ redirectUri, state } = {}) => {
+    const returnTo =
+      typeof redirectUri === 'string' && redirectUri.startsWith('/')
+        ? redirectUri
+        : '/';
+    const path = chatGPTSignInPath(returnTo);
+    return state ? `${path}&state=${encodeURIComponent(state)}` : path;
+  },
+  exchangeCode: async () => null,
+  getProfile: async () => null,
+  normalizeIdentity: normalizeChatGptIdentity,
+});
+
+/**
+ * Build a portable CmsAuthHost for ChatGPT-hosted apps.
+ * Reads `oai-authenticated-*` headers; challenges to hosted sign-in when missing.
+ *
+ * @param {{ cmsBase?: string }} [options]
+ */
+export function createChatGptCmsAuthHost(options = {}) {
+  const cmsBase = options.cmsBase || '/cms';
+  return {
+    async authorizeCmsAccess({ path, headers }) {
+      const user = readChatGptUserFromHeaders(headers);
+      if (!user) {
+        return {
+          allowed: false,
+          principal: null,
+          reason: 'chatgpt_identity_required',
+          challengeUrl: chatGPTSignInPath(path || cmsBase),
+        };
+      }
+      const identity = normalizeChatGptIdentity({
+        email: user.email,
+        name: user.fullName || user.displayName,
+        sub: user.email,
+      });
+      return {
+        allowed: true,
+        principal: {
+          id: `chatgpt:${identity.subject}`,
+          displayName: identity.name || identity.email || identity.subject,
+          email: identity.email || undefined,
+          roles: ['cms_admin'],
+          localDevelopment: false,
+          provider: 'chatgpt',
+        },
+        reason: 'chatgpt_hosted_identity',
+      };
+    },
+    buildLoginUrl({ returnTo }) {
+      return chatGPTSignInPath(returnTo || cmsBase);
+    },
+  };
+}
+
+export {
+  normalizeChatGptIdentity,
+  readChatGptUserFromHeaders,
+  chatGPTSignInPath,
+  chatGPTSignOutPath,
+  safeRelativeReturnPath,
+};
+
+export {
+  CHATGPT_USER_EMAIL_HEADER,
+  CHATGPT_USER_FULL_NAME_HEADER,
+  CHATGPT_USER_FULL_NAME_ENCODING_HEADER,
+  CHATGPT_PERCENT_ENCODED_UTF8,
+  CHATGPT_SIGN_IN_PATH,
+  CHATGPT_SIGN_OUT_PATH,
+  CHATGPT_CALLBACK_PATH,
+} from './headers.js';