@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.7

package/packages/identity/src/providers/chatgpt/mapper.js

@@ -0,0 +1,43 @@
+import { normalizeExternalIdentity } from '../../contracts/external-identity.js';
+
+/**
+ * Normalize ChatGPT / OpenAI Apps SDK identity into portable external identity.
+ * Provider id is always `chatgpt` — never leak `oai-authenticated-*` header names into contracts.
+ *
+ * @param {Record<string, unknown> | null | undefined} profile
+ */
+export function normalizeChatGptIdentity(profile) {
+  const raw = profile && typeof profile === 'object' ? profile : {};
+  const email =
+    typeof raw.email === 'string' && raw.email.trim()
+      ? raw.email.trim().toLowerCase()
+      : null;
+  const subject = String(raw.sub || raw.id || raw.subject || email || '').trim();
+  if (!subject) {
+    throw new Error('chatgpt_identity_requires_subject');
+  }
+
+  const name =
+    typeof raw.name === 'string' && raw.name.trim()
+      ? raw.name.trim()
+      : typeof raw.displayName === 'string' && raw.displayName.trim()
+        ? raw.displayName.trim()
+        : typeof raw.fullName === 'string' && raw.fullName.trim()
+          ? raw.fullName.trim()
+          : null;
+
+  return normalizeExternalIdentity({
+    provider: 'chatgpt',
+    subject,
+    email,
+    emailVerified: Boolean(email),
+    name,
+    avatar: null,
+    username: null,
+    raw: {
+      source: 'chatgpt_hosted',
+      email,
+      name,
+    },
+  });
+}

package/packages/identity/src/providers/chatgpt/paths.js

@@ -0,0 +1,45 @@
+import {
+  CHATGPT_CALLBACK_PATH,
+  CHATGPT_SIGN_IN_PATH,
+  CHATGPT_SIGN_OUT_PATH,
+} from './headers.js';
+
+function isReservedAuthPath(pathname) {
+  return (
+    pathname === CHATGPT_SIGN_IN_PATH ||
+    pathname === CHATGPT_SIGN_OUT_PATH ||
+    pathname === CHATGPT_CALLBACK_PATH
+  );
+}
+
+/** Safe relative return path for ChatGPT hosted sign-in/out redirects. */
+export function safeRelativeReturnPath(value) {
+  const raw = String(value || '/');
+  if (!raw.startsWith('/') || raw.startsWith('//')) return '/';
+
+  let url;
+  try {
+    url = new URL(raw, 'https://app.local');
+  } catch {
+    return '/';
+  }
+  if (url.origin !== 'https://app.local') return '/';
+  if (isReservedAuthPath(url.pathname)) return '/';
+  return `${url.pathname}${url.search}${url.hash}`;
+}
+
+export function chatGPTSignInPath(returnTo = '/') {
+  const safeReturnTo = safeRelativeReturnPath(returnTo);
+  return `${CHATGPT_SIGN_IN_PATH}?return_to=${encodeURIComponent(safeReturnTo)}`;
+}
+
+export function chatGPTSignOutPath(returnTo = '/') {
+  const safeReturnTo = safeRelativeReturnPath(returnTo);
+  return `${CHATGPT_SIGN_OUT_PATH}?return_to=${encodeURIComponent(safeReturnTo)}`;
+}
+
+export {
+  CHATGPT_SIGN_IN_PATH,
+  CHATGPT_SIGN_OUT_PATH,
+  CHATGPT_CALLBACK_PATH,
+};

package/packages/identity/src/providers/cloudflare/oauth.js

@@ -1,10 +1,9 @@
 const CLOUDFLARE_AUTH_URL = 'https://dash.cloudflare.com/oauth2/auth';
 const CLOUDFLARE_TOKEN_URL = 'https://dash.cloudflare.com/oauth2/token';
 
-// Identity-only login should not request the full resource-access scope set
-// used elsewhere for the Local Studio Cloudflare *connection* (deploy/d1/r2/etc).
-// account-settings.read is enough to resolve the account for userinfo.
-const CLOUDFLARE_LOGIN_SCOPE = 'account-settings.read offline_access';
+// Identity-only login: account identity + user details (email/name via /v4/user).
+// Do NOT request the resource-access scope set used by the Cloudflare *connection* flow.
+const CLOUDFLARE_LOGIN_SCOPE = 'account-settings.read user-details.read offline_access';
 
 /** @param {import('../../provider-contract.js').OAuthAuthorizeInput} input */
 export function getCloudflareAuthUrl({ clientId, redirectUri, state, codeChallenge, scope } = {}) {

package/packages/identity/src/providers/cloudflare/profile.js

@@ -1,26 +1,61 @@
 const CLOUDFLARE_USERINFO_URL = 'https://dash.cloudflare.com/oauth2/userinfo';
+const CLOUDFLARE_API_USER_URL = 'https://api.cloudflare.com/client/v4/user';
 
 /**
  * Fetch the authenticated Cloudflare user's identity.
- * Response shape not fully verified against a live token yet — this reads
- * defensively (sub/id/user_id, email, name) rather than assuming Cloudflare's
- * exact OIDC field names. Confirm the real shape on first live login and
- * tighten this if fields differ.
+ *
+ * OIDC userinfo (`/oauth2/userinfo`) structurally returns `sub` only.
+ * Email/name require `user-details.read` and a second call to `/client/v4/user`
+ * (`data.result.*`, not top-level fields).
+ *
  * @param {string} accessToken
+ * @param {{ fetchImpl?: typeof fetch }} [opts]
  */
-export async function fetchCloudflareProfile(accessToken) {
+export async function fetchCloudflareProfile(accessToken, opts = {}) {
+  const token = String(accessToken || '').trim();
+  if (!token) return null;
+  const fetchImpl = opts.fetchImpl || fetch;
   try {
-    const res = await fetch(CLOUDFLARE_USERINFO_URL, {
-      headers: { Authorization: `Bearer ${accessToken}` },
+    const userinfoRes = await fetchImpl(CLOUDFLARE_USERINFO_URL, {
+      headers: { Authorization: `Bearer ${token}` },
     });
-    if (!res.ok) return null;
-    const data = await res.json();
-    if (!data) return null;
+    if (!userinfoRes.ok) return null;
+    const userinfo = await userinfoRes.json().catch(() => null);
+    if (!userinfo) return null;
+
+    const sub = userinfo.sub || userinfo.id || userinfo.user_id || null;
+    let email = typeof userinfo.email === 'string' ? userinfo.email : null;
+    let name = typeof userinfo.name === 'string'
+      ? userinfo.name
+      : (typeof userinfo.display_name === 'string' ? userinfo.display_name : null);
+
+    // Cloudflare userinfo does not return email/name — enrich from /v4/user.
+    if (!email || !name) {
+      try {
+        const apiRes = await fetchImpl(CLOUDFLARE_API_USER_URL, {
+          headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+        });
+        if (apiRes.ok) {
+          const body = await apiRes.json().catch(() => null);
+          const result = body?.result && typeof body.result === 'object' ? body.result : null;
+          if (result) {
+            if (!email && typeof result.email === 'string') email = result.email;
+            if (!name && typeof result.first_name === 'string' && typeof result.last_name === 'string') {
+              name = `${result.first_name} ${result.last_name}`.trim() || null;
+            }
+            if (!name && typeof result.name === 'string') name = result.name;
+          }
+        }
+      } catch {
+        // Non-fatal: identity can proceed with sub alone.
+      }
+    }
+
     return {
-      sub: data.sub || data.id || data.user_id || data.account_id || null,
-      email: data.email || null,
-      name: data.name || data.display_name || null,
-      raw: data,
+      sub: sub || null,
+      email,
+      name,
+      raw: userinfo,
     };
   } catch {
     return null;

package/packages/identity/src/providers/github/oauth.js

@@ -2,12 +2,11 @@ const GITHUB_AUTH_URL = 'https://github.com/login/oauth/authorize';
 const GITHUB_TOKEN_URL = 'https://github.com/login/oauth/access_token';
 
 /** @param {import('../../provider-contract.js').OAuthAuthorizeInput} input */
-export function getGithubAuthUrl({ clientId, redirectUri, state, codeChallenge, scope } = {}) {
+export function getGithubAuthUrl({ clientId, redirectUri, state, codeChallenge } = {}) {
   const url = new URL(GITHUB_AUTH_URL);
   url.searchParams.set('client_id', clientId || '');
   url.searchParams.set('redirect_uri', redirectUri || '');
   url.searchParams.set('response_type', 'code');
-  url.searchParams.set('scope', scope || 'read:user user:email');
   url.searchParams.set('state', state || '');
   if (codeChallenge) {
     url.searchParams.set('code_challenge', codeChallenge);

package/packages/identity/src/providers/github/profile.js

@@ -3,7 +3,8 @@ const GITHUB_EMAILS_URL = 'https://api.github.com/user/emails';
 
 const GITHUB_HEADERS = {
   Accept: 'application/vnd.github+json',
-  'X-GitHub-Api-Version': '2022-11-28',
+  'X-GitHub-Api-Version': '2026-03-10',
+  'User-Agent': 'AgentSam-Local-Studio',
 };
 
 /** @param {string} accessToken */
@@ -17,7 +18,15 @@ export async function fetchGithubProfile(accessToken) {
         headers: { Authorization: `Bearer ${accessToken}`, ...GITHUB_HEADERS },
       }),
     ]);
-    if (!userRes.ok) return null;
+    if (!userRes.ok) {
+      const detail = (await userRes.text()).slice(0, 500);
+      console.error('github_userinfo_failed', {
+        status: userRes.status,
+        requestId: userRes.headers.get('x-github-request-id'),
+        detail,
+      });
+      return null;
+    }
     const user = await userRes.json();
     let email = null;
     let emailVerified = false;
@@ -26,6 +35,11 @@ export async function fetchGithubProfile(accessToken) {
       const primary = Array.isArray(emails) ? emails.find((e) => e?.primary) : null;
       email = primary?.email || null;
       emailVerified = !!primary?.verified;
+    } else {
+      console.warn('github_user_emails_failed', {
+        status: emailRes.status,
+        requestId: emailRes.headers.get('x-github-request-id'),
+      });
     }
     return { ...user, email, email_verified: emailVerified };
   } catch {

package/packages/identity/src/providers/iam/index.js

@@ -9,13 +9,16 @@ import {
 } from './oauth.js';
 import { fetchIamProfile } from './profile.js';
 import { normalizeIamIdentity } from './mapper.js';
-import { DEFAULT_IAM_ORIGIN } from '../../contracts/auth-config.js';
+import { resolveIamIssuer } from '../../contracts/auth-config.js';
 
 /**
- * @param {string} [origin]
+ * @param {string} origin Absolute IAM issuer origin (required — no DEFAULT_*).
  */
-export function createIamIdentityProvider(origin = DEFAULT_IAM_ORIGIN) {
-  const resolvedOrigin = String(origin || DEFAULT_IAM_ORIGIN).replace(/\/+$/, '');
+export function createIamIdentityProvider(origin) {
+  const resolvedOrigin = String(origin || '').replace(/\/+$/, '');
+  if (!resolvedOrigin) {
+    throw new Error('IAM_OAUTH_ISSUER is required to create the IAM identity provider');
+  }
   return createIdentityProvider({
     id: 'iam',
     authorizeUrl: (input) => getIamAuthUrl({ ...input, origin: resolvedOrigin }),
@@ -25,7 +28,26 @@ export function createIamIdentityProvider(origin = DEFAULT_IAM_ORIGIN) {
   });
 }
 
-export const IamProvider = createIamIdentityProvider();
+/**
+ * Registry singleton — resolves IAM_OAUTH_ISSUER from env/input at call time.
+ * No baked-in product host.
+ */
+export const IamProvider = createIdentityProvider({
+  id: 'iam',
+  authorizeUrl: (input) => {
+    const origin = resolveIamIssuer(input?.env || process.env, input?.origin || input?.issuer || '');
+    return getIamAuthUrl({ ...input, origin });
+  },
+  exchangeCode: (input) => {
+    const origin = resolveIamIssuer(input?.env || process.env, input?.origin || input?.issuer || '');
+    return exchangeIamCode({ ...input, origin });
+  },
+  getProfile: (accessToken, input = {}) => {
+    const origin = resolveIamIssuer(input?.env || process.env, input?.origin || input?.issuer || '');
+    return fetchIamProfile({ origin, accessToken });
+  },
+  normalizeIdentity: normalizeIamIdentity,
+});
 
 export {
   getIamAuthUrl,

package/packages/identity/src/providers/index.js

@@ -5,11 +5,12 @@ import { GcpProvider } from './gcp/index.js';
 import { EmailProvider } from './email/index.js';
 import { IamProvider } from './iam/index.js';
 import { CloudflareProvider } from './cloudflare/index.js';
+import { ChatGptProvider } from './chatgpt/index.js';
 
 /**
  * Active identity provider registry.
- * `inneranimalmedia` is the canonical platform template id; `iam` remains a
- * legacy lookup alias (OAuth/DB provider key on platform identities).
+ * `inneranimalmedia` is the canonical platform template id; `iam` and `inneranimal` remain
+ * legacy lookup aliases (OAuth/DB provider keys on platform identities).
  * @type {Record<string, import('../provider-contract.js').IdentityProvider>}
  */
 export const identityProviders = Object.freeze({
@@ -20,12 +21,18 @@ export const identityProviders = Object.freeze({
   inneranimalmedia: IamProvider,
   iam: IamProvider,
   cloudflare: CloudflareProvider,
+  chatgpt: ChatGptProvider,
 });
 
 /** @param {string} id */
 export function getIdentityProvider(id) {
   const key = String(id || '').trim().toLowerCase();
-  if (key === 'iam') return identityProviders.inneranimalmedia || identityProviders.iam || null;
+  if (key === 'iam' || key === 'inneranimal') {
+    return identityProviders.inneranimalmedia || identityProviders.iam || null;
+  }
+  if (key === 'openai' || key === 'chatgpt-hosted' || key === 'chatgpt_hosted') {
+    return identityProviders.chatgpt || null;
+  }
   return identityProviders[key] || null;
 }
 
@@ -40,4 +47,5 @@ export {
   EmailProvider,
   IamProvider,
   CloudflareProvider,
+  ChatGptProvider,
 };

package/packages/identity/src/server/identity-service.js

@@ -61,6 +61,11 @@ export function createIdentityService(config) {
     return match ? decodeURIComponent(match[1]) : null;
   }
 
+  function parseBearerSessionId(authorization) {
+    const match = String(authorization || '').match(/^Bearer\s+([^\s]+)$/i);
+    return match ? match[1] : null;
+  }
+
   return Object.freeze({
     cookieName,
     app,
@@ -108,7 +113,8 @@ export function createIdentityService(config) {
     },
 
     async sessionFromRequest(request) {
-      const sessionId = parseSessionId(request.headers.get('Cookie'));
+      const sessionId = parseBearerSessionId(request.headers.get('Authorization'))
+        || parseSessionId(request.headers.get('Cookie'));
       if (!sessionId) return null;
       const session = await adapter.getSession(sessionId);
       if (!session) return null;
@@ -118,12 +124,13 @@ export function createIdentityService(config) {
     },
 
     async logout(request) {
-      const sessionId = parseSessionId(request.headers.get('Cookie'));
+      const sessionId = parseBearerSessionId(request.headers.get('Authorization'))
+        || parseSessionId(request.headers.get('Cookie'));
       if (sessionId) await adapter.revokeSession(sessionId);
       return { ok: true };
     },
 
-    async provisionOAuthUser({ provider, providerSubject, email, displayName }) {
+    async provisionOAuthUser({ provider, providerSubject, email, displayName, sessionType }) {
       let user = await adapter.findUserByProvider(provider, providerSubject);
       if (!user && email) {
         user = await adapter.findUserByEmail(email);
@@ -148,10 +155,33 @@ export function createIdentityService(config) {
         displayName: displayName || user.display_name,
         provider,
         providerSubject,
+        type: sessionType,
       });
       return { ok: true, authUserId: user.id, sessionId: session.id, session };
     },
 
+    isNativeSessionRequest(request) {
+      const marker = String(request?.headers?.get?.('X-AgentSam-Native-Client') || '').toLowerCase();
+      return marker === '1' || marker === 'true' || marker === 'native';
+    },
+
+    buildNativeLoginSuccessResponse(result, nextPath) {
+      const redirect = resolvePostLoginPath(nextPath);
+      return jsonResponse({
+        ok: true,
+        redirect,
+        session_id: result.sessionId,
+        expires_at: result.session?.expires_at ?? null,
+        user: result.user
+          ? {
+              id: result.user.id,
+              email: result.user.email,
+              displayName: result.user.display_name ?? null,
+            }
+          : null,
+      });
+    },
+
     buildLoginSuccessResponse(request, sessionId, nextPath) {
       const redirect = resolvePostLoginPath(nextPath);
       return jsonResponse(