@inneranimalmedia/agentsam-sdk 2.6.5 → 2.6.8

package/packages/identity/src/frontend/auth-portal/pages/reset.html

@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Reset password | AgentSam</title>
+    <title>Reset password</title>
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&display=swap"
         rel="stylesheet">
     <script src="https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js"></script>
@@ -280,8 +280,8 @@
 <div class="login-card">
     <img
       class="auth-logo"
-      src="/shared/agentsam-mark.svg"
-      alt="AgentSam"
+      src="/shared/app-icon.png"
+      alt="Sign in"
       style="width:120px;height:120px;object-fit:contain;display:block;margin:0 auto 20px;"
     />
 
@@ -290,7 +290,7 @@
     <p class="subtitle">We'll send you a secure verification code.</p>
 
     <div class="email-note">
-        You'll receive an email from <strong data-company-support-email>support@agentsam.dev</strong>.<br>
+        You'll receive an email from <strong data-company-support-email>support@example.com</strong>.<br>
         Check your inbox and spam folder.
     </div>
 
@@ -365,7 +365,7 @@
 </div>
 
 <footer class="auth-min-footer" aria-label="Legal">
-    <span data-company-name>AgentSam</span>
+    <span data-company-name>App</span>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
     <a href="/privacy">Privacy</a>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>

package/packages/identity/src/frontend/auth-portal/pages/signup.html

@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Sign up | AgentSam</title>
+    <title>Sign up</title>
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&display=swap"
         rel="stylesheet">
     <script src="https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js"></script>
@@ -398,12 +398,12 @@
 <div class="login-card">
     <img
       class="auth-logo"
-      src="/shared/agentsam-mark.svg"
-      alt="AgentSam"
+      src="/shared/app-icon.png"
+      alt="Sign in"
     />
 
     <h1>Create account</h1>
-    <p class="subtitle" data-company-subtitle="signup">Join AgentSam</p>
+    <p class="subtitle" data-company-subtitle="signup">Create an account</p>
     <p id="registeredMsg" class="subtitle" style="color: #10B981; display: none; margin-top: -16px; margin-bottom: 16px;">Account created. Sign in below.</p>
     <p id="oauthErrorMsg" class="subtitle" style="color: #FF3B30; display: none; margin-top: -16px; margin-bottom: 16px;"></p>
     <p id="cfConnectNotice" class="subtitle" style="color: #fdba74; display: none; margin-top: -12px; margin-bottom: 12px; font-size: 12px; line-height: 1.45; text-align: center; max-width: 320px;">Sign in with Google, GitHub, or Supabase first, then connect Cloudflare from Integrations.</p>
@@ -485,7 +485,7 @@
 </div>
 
 <footer class="auth-min-footer" aria-label="Legal">
-    <span data-company-name>AgentSam</span>
+    <span data-company-name>App</span>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
     <a href="/privacy">Privacy</a>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>

package/packages/identity/src/frontend/auth-portal/shared/company-branding.js

@@ -1,6 +1,6 @@
 /**
  * Auth portal branding from D1 `company` via GET /api/company.
- * Static HTML keeps portable AgentSam defaults as fallback when host branding is unavailable.
+ * Static HTML keeps neutral portable defaults as fallback when host branding is unavailable.
  */
 (function () {
   var SUBTITLE_PREFIX = {

package/packages/identity/src/frontend/auth-portal/shared/desktop-identity-bridge.js

@@ -12,8 +12,6 @@
   var invoke = getInvoke();
   if (!invoke) return;
 
-  var APP_ID = 'local-studio';
-  var SESSION_ACCOUNT = 'identity_session';
   var originalFetch = window.fetch.bind(window);
 
   async function callIdentity(payload) {
@@ -27,29 +25,6 @@
     return body;
   }
 
-  async function getSessionId() {
-    return await invoke('secure_store_get', {
-      appId: APP_ID,
-      account: SESSION_ACCOUNT,
-    });
-  }
-
-  async function setSessionId(sessionId) {
-    await invoke('secure_store_set', {
-      appId: APP_ID,
-      account: SESSION_ACCOUNT,
-      value: String(sessionId || ''),
-    });
-  }
-
-  async function clearSessionId() {
-    try {
-      await invoke('secure_store_delete', {
-        appId: APP_ID,
-        account: SESSION_ACCOUNT,
-      });
-    } catch {}
-  }
 
   function jsonResponse(body, status) {
     return new Response(JSON.stringify(body), {
@@ -87,9 +62,9 @@
 
     if (url.pathname === '/api/company') {
       return jsonResponse({
-        name: 'AgentSam',
-        tagline: 'Instant Access',
-        logoUrl: '/shared/agentsam-mark.svg',
+        name: 'App',
+        tagline: 'Welcome',
+        logoUrl: '/shared/app-icon.png',
         authBgColor: '#050508',
       });
     }
@@ -103,7 +78,6 @@
           password: loginBody.password,
           next: loginBody.next || '/agentsam',
         });
-        await setSessionId(login.session_id);
         notifyAuthenticated(login);
         return jsonResponse({ ok: true, user: login.user, redirect: '/agentsam' });
       } catch (error) {
@@ -121,7 +95,6 @@
           displayName: signupBody.name || signupBody.displayName || signupBody.display_name,
           next: signupBody.next || '/agentsam',
         });
-        await setSessionId(signup.session_id);
         notifyAuthenticated(signup);
         return jsonResponse({ ok: true, user: signup.user, redirect: '/agentsam' });
       } catch (error) {
@@ -159,13 +132,9 @@
     }
 
     if (url.pathname === '/api/auth/logout') {
-      var sessionId = await getSessionId();
-      if (sessionId) {
-        try {
-          await callIdentity({ op: 'logout', session_id: sessionId });
-        } catch {}
-      }
-      await clearSessionId();
+      try {
+        await callIdentity({ op: 'logout' });
+      } catch {}
       return jsonResponse({ ok: true });
     }
 

package/packages/identity/src/index.js

@@ -21,7 +21,21 @@ import {
   GcpProvider,
   EmailProvider,
   CloudflareProvider,
+  ChatGptProvider,
 } from './providers/index.js';
+import {
+  STOCK_SIGN_IN_OPTIONS,
+  CMS_STOCK_SIGN_IN_IDS,
+  listStockSignInOptions,
+  getStockSignInOption,
+} from './contracts/sign-in-options.js';
+import {
+  createChatGptCmsAuthHost,
+  normalizeChatGptIdentity,
+  readChatGptUserFromHeaders,
+  chatGPTSignInPath,
+  chatGPTSignOutPath,
+} from './providers/chatgpt/index.js';
 
 export {
   IdentityContractVersion,
@@ -40,6 +54,16 @@ export {
   GcpProvider,
   EmailProvider,
   CloudflareProvider,
+  ChatGptProvider,
+  STOCK_SIGN_IN_OPTIONS,
+  CMS_STOCK_SIGN_IN_IDS,
+  listStockSignInOptions,
+  getStockSignInOption,
+  createChatGptCmsAuthHost,
+  normalizeChatGptIdentity,
+  readChatGptUserFromHeaders,
+  chatGPTSignInPath,
+  chatGPTSignOutPath,
 };
 
 export * from './core/index.js';
@@ -88,11 +112,14 @@ export {
   handleGoogleDesktopExchangeRequest,
   resolveGoogleExchangeSecret,
 } from './oauth/google-desktop-exchange.js';
-export { createCloudflareD1Adapter } from './adapters/cloudflare-d1/index.js';
+export { createCloudflareD1Adapter, createIamCompatIdentityAdapter } from './adapters/cloudflare-d1/index.js';
 export {
   createSqliteIdentityAdapter,
   applySqliteIdentityMigrations,
+  applyPortableIdentityMigrations,
+  resolveIdentitySchemaPack,
 } from './adapters/sqlite/index.js';
+export { createPortableD1IdentityAdapter } from './adapters/portable-d1/index.js';
 export { createIdentityService } from './server/identity-service.js';
 export { handleIdentityWorkerRequest } from './server/worker-router.js';
 

package/packages/identity/src/migrations/README.md

@@ -1,31 +1,31 @@
-# Identity D1 migrations
+# Identity migrations under `src/migrations/` — IAM-compat scaffold / history
 
-Customer-scoped identity tables for `@inneranimalmedia/agentsam-sdk` identity apps.
+**This tree is NOT the portable customer D1 authority.**
 
-## Apply
+| Path | Authority |
+|---|---|
+| `packages/identity/migrations/sqlite/` | **Portable** `identity_*` SQL SSOT (`agentsam.identity` pack) |
+| `packages/identity/src/migrations/` | **IAM-shaped** scaffold / history (accounts, auth_users, company, …) |
 
-```bash
-# local
-wrangler d1 execute <database_name> --local --file=migrations/0001_identity_core.sql
+## When to use which
 
-# remote
-wrangler d1 execute <database_name> --remote --file=migrations/0001_identity_core.sql
-```
+| Audience | Adapter | Schema |
+|---|---|---|
+| New customer clean D1 / local SQLite | `createSqliteIdentityAdapter` / `createPortableD1IdentityAdapter` | Portable pack via `applyPortableIdentityMigrations` |
+| Existing InnerAnimalMedia / Local Studio hosted DB | `createIamCompatIdentityAdapter` (`createCloudflareD1Adapter` alias) | Live IAM tables — do not rename for portability |
 
-`agentsam identity init` copies this migration into the customer project automatically.
-
-Existing scaffolds missing `accounts`: also apply `0003_accounts_ssot.sql`.
-
-## Tables
+## IAM-shaped tables in this directory
 
 | Table | Purpose |
 |-------|---------|
-| `accounts` | **Account SSOT** — row of record (`au_*` ids shared with auth_users in portable scaffold) |
-| `auth_users` | Login principal (password hash, 1:1 with accounts.id) |
-| `auth_sessions` | Browser sessions |
-| `account_identities` | IdP linkage only (provider + subject → accounts.id) — **not** the account SSOT |
-| `oauth_states` | PKCE/state for OAuth start |
-| `password_reset_tokens` | Reset flow (grow when wired) |
-| `company` | Branding SSOT — name, logo, colors, support info (`GET /api/company`) |
-
-IAM production tables remain the reference; this schema is **portable and boring** for customer Workers.
+| `accounts` | Account SSOT on hosted IAM |
+| `auth_users` | Login principal |
+| `auth_sessions` | Browser/desktop sessions |
+| `account_identities` | IdP linkage |
+| `oauth_states` | Historical PKCE/state (note: missing `app_id` vs portable invariant) |
+| `password_reset_tokens` | Historical SQL reset tokens — runtime recovery uses KV/`createPasswordResetService` |
+| `company` | Hosted branding table |
+
+New generic scaffolds must be generated from the **portable** `agentsam.identity` pack, not by copying this tree as “portable D1.”
+
+Preserve these files for IAM-compat fixtures and historical feature resources. Do not delete until Lane 1 parity is proven and call sites no longer need them.

package/packages/identity/src/oauth/README.md

@@ -4,7 +4,7 @@
 |------|----------|------|
 | **IAM platform (default)** | `IAM_CLIENT_ID` + `IAM_CLIENT_SECRET` | Minted at install/build for every customer worker |
 | Developer Google (web) | `GOOGLE_CLIENT_ID` + `GOOGLE_CLIENT_SECRET` | Takes `/api/oauth/google/start` when set |
-| Google Desktop / CLI | `GOOGLE_DESKTOP_CLIENT_ID` (+ optional `GOOGLE_DESKTOP_CLIENT_SECRET`) | `POST /api/oauth/google/desktop-exchange` (loopback PKCE) |
+| Google Desktop / CLI | `GOOGLE_DESKTOP_CLIENT_ID` | Public Authorization Code + PKCE with loopback redirect; no desktop secret |
 | Developer GitHub | `GITHUB_CLIENT_ID` + `GITHUB_CLIENT_SECRET` | Takes `/api/oauth/github/start` when set |
 | Cloudflare sign-in | `CLOUDFLARE_OAUTH_CLIENT_ID` (+ optional secret) | Takes `/api/oauth/cloudflare/start` when set |
 

package/packages/identity/src/oauth/credentials.js

@@ -89,12 +89,11 @@ export function resolveOAuthCredentialLane(env, provider) {
 
   if (key === 'google_desktop') {
     const clientId = String(env?.GOOGLE_DESKTOP_CLIENT_ID || '').trim();
-    const clientSecret = String(env?.GOOGLE_DESKTOP_CLIENT_SECRET || '').trim();
     if (clientId) {
       return {
         lane: 'byok_google_desktop',
         clientId,
-        clientSecret,
+        clientSecret: '',
         provider: 'google_desktop',
       };
     }
@@ -122,18 +121,18 @@ export function resolveOAuthCredentialLane(env, provider) {
     return null;
   }
 
-  // Default: Google/GitHub buttons route through IAM platform when minted.
-  const iam = resolveIamPlatformCredentials(env);
-  if (iam) {
+  if (key === 'chatgpt' || key === 'openai' || key === 'chatgpt_hosted') {
+    // Hosted Apps SDK identity — no OAuth client secret. Selection is always
+    // available; runtime proof comes from oai-authenticated-* request headers.
     return {
-      lane: 'iam_platform',
-      clientId: iam.clientId,
-      clientSecret: iam.clientSecret,
-      origin: iam.origin,
-      issuer: iam.issuer,
-      provider: 'inneranimalmedia',
+      lane: 'hosted_chatgpt',
+      clientId: String(env?.CHATGPT_APP_ID || env?.OPENAI_APP_ID || 'chatgpt-hosted').trim(),
+      clientSecret: '',
+      provider: 'chatgpt',
     };
   }
 
+  // Provider selection is fail-closed. A Google or GitHub button must never
+  // silently become InnerAnimalMedia/IAM. IAM remains an explicit provider.
   return null;
 }

package/packages/identity/src/oauth/google-desktop-exchange.js

@@ -1,10 +1,14 @@
+import { fetchGoogleProfile } from '../providers/google/profile.js';
+import { SESSION_TYPES } from '../core/session-policy.js';
+
 /**
  * Server-side Google token exchange for CLI / desktop PKCE.
  *
- * Desktop/"installed" OAuth clients must be type Desktop in Google Console (no secret).
- * If the configured desktop client_id was created as a Web client, Google demands a secret.
- * Secrets never leave the Worker: GOOGLE_DESKTOP_CLIENT_SECRET (optional) or GOOGLE_CLIENT_SECRET
- * when client_id matches the web client.
+ * Desktop/"installed" OAuth clients are public PKCE clients. Some Google
+ * installed-app credentials still include a provider-issued client_secret.
+ * That value is not a confidentiality boundary, but if Google requires it for
+ * token exchange the service may keep it in GOOGLE_DESKTOP_CLIENT_SECRET.
+ * Hosted web OAuth remains confidential and uses GOOGLE_CLIENT_SECRET.
  */
 
 const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
@@ -40,17 +44,18 @@ export function resolveGoogleExchangeSecret(env, clientId) {
   const id = clean(clientId);
   const desktopId = clean(env?.GOOGLE_DESKTOP_CLIENT_ID);
   const webId = clean(env?.GOOGLE_CLIENT_ID);
-  const desktopSecret = clean(env?.GOOGLE_DESKTOP_CLIENT_SECRET);
   const webSecret = clean(env?.GOOGLE_CLIENT_SECRET);
+  const desktopSecret = clean(env?.GOOGLE_DESKTOP_CLIENT_SECRET);
 
-  if (id && desktopId && id === desktopId && desktopSecret) {
-    return { clientId: id, clientSecret: desktopSecret, mode: 'desktop_with_optional_secret' };
-  }
   if (id && webId && id === webId && webSecret) {
     return { clientId: id, clientSecret: webSecret, mode: 'web_confidential' };
   }
   if (id && desktopId && id === desktopId) {
-    return { clientId: id, clientSecret: null, mode: 'desktop_public_pkce' };
+    return {
+      clientId: id,
+      clientSecret: desktopSecret || null,
+      mode: 'desktop_public_pkce',
+    };
   }
   return { clientId: id || null, clientSecret: null, mode: 'unknown_client' };
 }
@@ -135,24 +140,6 @@ export async function handleGoogleDesktopExchangeRequest(request, env, opts = {}
   });
 
   const detail = String(result.data?.error_description || result.data?.error || '');
-  if (
-    !result.ok
-    && /client_secret/i.test(detail)
-    && resolved.mode === 'desktop_public_pkce'
-    && !resolved.clientSecret
-  ) {
-    return json({
-      ok: false,
-      error: 'desktop_client_requires_secret',
-      detail,
-      remediation: [
-        'In Google Cloud Console create OAuth client type Desktop app (no secret) and set GOOGLE_DESKTOP_CLIENT_ID to that client id.',
-        'Or if this client id is a Web app, put its secret on the Worker: wrangler secret put GOOGLE_DESKTOP_CLIENT_SECRET',
-        'Web browser login continues to use GOOGLE_CLIENT_ID + GOOGLE_CLIENT_SECRET.',
-      ],
-    }, 502);
-  }
-
   if (!result.ok) {
     return json({
       ok: false,
@@ -171,3 +158,184 @@ export async function handleGoogleDesktopExchangeRequest(request, env, opts = {}
     exchange_mode: resolved.mode,
   });
 }
+
+
+export const GOOGLE_DESKTOP_LOGIN_EXCHANGE_PATH = '/api/oauth/google/desktop-login-exchange';
+const GOOGLE_ID_TOKEN_INFO_URL = 'https://oauth2.googleapis.com/tokeninfo';
+
+async function verifyGoogleDesktopIdToken(idToken, clientId, fetchImpl = fetch) {
+  const url = new URL(GOOGLE_ID_TOKEN_INFO_URL);
+  url.searchParams.set('id_token', clean(idToken));
+  const response = await fetchImpl(url, {
+    headers: { Accept: 'application/json' },
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    return {
+      ok: false,
+      error: 'google_id_token_invalid',
+      detail: clean(data.error_description || data.error),
+    };
+  }
+
+  const audience = clean(data.aud);
+  const issuer = clean(data.iss);
+  const expiresAt = Number(data.exp || 0);
+  const emailVerified = data.email_verified === true || String(data.email_verified) === 'true';
+
+  if (audience !== clean(clientId)) {
+    return { ok: false, error: 'google_id_token_audience_mismatch' };
+  }
+  if (!['accounts.google.com', 'https://accounts.google.com'].includes(issuer)) {
+    return { ok: false, error: 'google_id_token_issuer_invalid' };
+  }
+  if (!Number.isFinite(expiresAt) || expiresAt <= Math.floor(Date.now() / 1000)) {
+    return { ok: false, error: 'google_id_token_expired' };
+  }
+  if (!emailVerified) {
+    return { ok: false, error: 'google_email_not_verified' };
+  }
+
+  return { ok: true, data };
+}
+
+/**
+ * Google Desktop account identity handoff.
+ *
+ * The installed app is the public OAuth client. It performs Google
+ * Authorization Code + PKCE + loopback; this endpoint receives the one-time
+ * code + verifier, performs the provider token exchange, validates the Google
+ * ID token against GOOGLE_DESKTOP_CLIENT_ID, resolves the profile, and mints
+ * the normal AgentSam desktop session. No Google access token is persisted in
+ * the desktop app for identity-only sign-in.
+ */
+export async function handleGoogleDesktopLoginExchangeRequest(request, env, opts = {}) {
+  if (request.method !== 'POST') {
+    return json({ ok: false, error: 'method_not_allowed' }, 405);
+  }
+  const identity = opts.identity;
+  const adapter = opts.adapter;
+  if (!identity || !adapter) {
+    return json({ ok: false, error: 'identity_service_unavailable' }, 503);
+  }
+
+  let payload = {};
+  try {
+    payload = await request.json();
+  } catch {
+    return json({ ok: false, error: 'invalid_json' }, 400);
+  }
+
+  let accessToken = clean(payload.access_token || payload.accessToken);
+  let idToken = clean(payload.id_token || payload.idToken);
+  const clientId = clean(payload.client_id || payload.clientId);
+
+  const desktopId = clean(env?.GOOGLE_DESKTOP_CLIENT_ID);
+  if (!desktopId || !clientId || clientId !== desktopId) {
+    return json({ ok: false, error: 'google_desktop_client_id_required' }, 403);
+  }
+
+  if (!accessToken || !idToken) {
+    const code = clean(payload.code);
+    const codeVerifier = clean(payload.code_verifier || payload.codeVerifier);
+    const redirectUri = clean(payload.redirect_uri || payload.redirectUri);
+    if (!code || !codeVerifier || !redirectUri) {
+      return json({
+        ok: false,
+        error: 'code_code_verifier_redirect_uri_required',
+      }, 400);
+    }
+    if (!isLoopbackRedirect(redirectUri)) {
+      return json({ ok: false, error: 'redirect_uri_must_be_loopback' }, 400);
+    }
+
+    const resolved = resolveGoogleExchangeSecret(env, clientId);
+    const exchanged = await exchangeGoogleAuthorizationCode({
+      code,
+      codeVerifier,
+      clientId,
+      redirectUri,
+      clientSecret: resolved.clientSecret,
+      fetchImpl: opts.fetchImpl || fetch,
+    });
+    if (!exchanged.ok) {
+      return json({
+        ok: false,
+        error: 'google_token_exchange_failed',
+        detail: clean(
+          exchanged.data?.error_description
+          || exchanged.data?.error
+          || ('http_' + exchanged.status),
+        ),
+      }, 502);
+    }
+    accessToken = clean(exchanged.data?.access_token);
+    idToken = clean(exchanged.data?.id_token);
+    if (!accessToken || !idToken) {
+      return json({ ok: false, error: 'google_token_payload_incomplete' }, 502);
+    }
+  }
+
+  const verified = await verifyGoogleDesktopIdToken(
+    idToken,
+    clientId,
+    opts.fetchImpl || fetch,
+  );
+  if (!verified.ok) {
+    return json({
+      ok: false,
+      error: verified.error,
+      detail: verified.detail || null,
+    }, 401);
+  }
+
+  const profile = opts.fetchProfile
+    ? await opts.fetchProfile(accessToken)
+    : await fetchGoogleProfile(accessToken);
+  if (!profile?.sub) {
+    return json({ ok: false, error: 'google_userinfo_failed' }, 502);
+  }
+  if (clean(verified.data.sub) && clean(verified.data.sub) !== clean(profile.sub)) {
+    return json({ ok: false, error: 'google_subject_mismatch' }, 401);
+  }
+  if (
+    clean(verified.data.email) &&
+    clean(profile.email) &&
+    clean(verified.data.email).toLowerCase() !== clean(profile.email).toLowerCase()
+  ) {
+    return json({ ok: false, error: 'google_email_mismatch' }, 401);
+  }
+
+  const provisioned = await identity.provisionOAuthUser({
+    provider: 'google',
+    providerSubject: String(profile.sub),
+    email: profile.email || verified.data.email || null,
+    displayName: profile.name || profile.email || verified.data.email || null,
+    sessionType: SESSION_TYPES.DESKTOP,
+  });
+  const user = await adapter.findUserById(provisioned.authUserId);
+  await adapter.logAuthEvent?.({
+    userId: provisioned.authUserId,
+    eventType: 'login',
+    status: 'ok',
+    provider: 'google',
+    request,
+    metadata: {
+      session_type: SESSION_TYPES.DESKTOP,
+      oauth_client_type: 'desktop_public_pkce',
+    },
+  });
+
+  return json({
+    ok: true,
+    authenticated: true,
+    session_id: provisioned.sessionId,
+    expires_at: provisioned.session?.expires_at ?? null,
+    user: user ? {
+      id: user.id,
+      email: user.email ?? null,
+      displayName: user.display_name ?? profile.name ?? null,
+    } : null,
+    exchange_mode: 'desktop_public_pkce_native_exchange',
+  });
+}

package/packages/identity/src/oauth/iam-platform.js

@@ -5,6 +5,7 @@ import {
   resolveIamPlatformCredentials,
 } from './credentials.js';
 import { pkceChallenge, pkceVerifier, randomOAuthState } from './pkce.js';
+import { finishOAuthLogin, parseNativeStart, sessionTypeForTransaction } from './native-handoff.js';
 import {
   exchangeIamCode,
   getIamAuthUrl,
@@ -33,12 +34,23 @@ export async function iamPlatformOAuthStart(request, env, adapter, identity) {
     url.searchParams.get('next') || url.searchParams.get('return_to'),
   ) || '/';
 
+  const nativeStart = parseNativeStart(url, env);
+  if (nativeStart.error) {
+    return Response.json({ ok: false, error: nativeStart.error }, { status: 400 });
+  }
   await adapter.saveOAuthState({
     state,
     provider: IAM_PLATFORM_STATE_PROVIDER,
     codeVerifier,
     redirectTo,
     appId: identity?.app?.id || null,
+    ...(nativeStart.native
+      ? {
+          clientType: nativeStart.clientType,
+          nativeChallenge: nativeStart.nativeChallenge,
+          nativeRedirect: nativeStart.nativeRedirect,
+        }
+      : {}),
   });
 
   const redirectUri = `${url.origin}${IAM_PLATFORM_CALLBACK_PATH}`;
@@ -106,17 +118,17 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
     providerSubject: normalized.subject,
     email: normalized.email,
     displayName: normalized.name || normalized.email.split('@')[0] || 'User',
+    sessionType: sessionTypeForTransaction(saved),
   });
 
-  const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
-  const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
-  const globeUrl = `${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
-  return new Response(null, {
-    status: 302,
-    headers: {
-      Location: globeUrl,
-      'Set-Cookie': res.headers.get('Set-Cookie') || '',
-    },
+  return finishOAuthLogin({
+    request,
+    env,
+    identity,
+    adapter,
+    saved,
+    result,
+    loginPath: identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN),
   });
 }