@jsonstudio/rcc 0.89.1968 → 0.89.2202

package/dist/providers/auth/oauth-lifecycle.js

@@ -14,199 +14,66 @@ import { HTTP_PROTOCOLS, LOCAL_HOSTS } from '../../constants/index.js';
 import { withOAuthRepairEnv } from './oauth-repair-env.js';
 import { markInteractiveOAuthRepairAttempt, markInteractiveOAuthRepairSuccess, shouldSkipInteractiveOAuthRepair } from './oauth-repair-cooldown.js';
 import { openAuthInCamoufox } from '../core/config/camoufox-launcher.js';
+import { isGeminiCliFamily, resolveTokenFilePath, resolveCamoufoxAliasForAuth, resolveIflowCredentialCandidates } from './oauth-lifecycle/path-resolver.js';
+import { keyFor, shouldThrottle, updateThrottle, inFlight, interactiveTail } from './oauth-lifecycle/throttle.js';
+import { extractStatusCode, isGoogleAccountVerificationRequiredMessage, extractGoogleAccountVerificationUrl } from './oauth-lifecycle/error-detection.js';
+import { hasNonEmptyString, extractAccessToken, extractApiKey, hasApiKeyField, hasStableQwenApiKey, hasAccessToken, getExpiresAt, resolveProjectId, coerceExpiryTimestampSeconds, hasNoRefreshFlag, evaluateTokenState } from './oauth-lifecycle/token-helpers.js';
+import { normalizeGeminiCliAccountToken, sanitizeToken, readTokenFromFile, backupTokenFile, restoreTokenFileFromBackup, discardBackupFile, readRawTokenFile } from './oauth-lifecycle/token-io.js';
 const TOKEN_REFRESH_SKEW_MS = 60_000;
-const inFlight = new Map();
-const lastRunAt = new Map();
-let interactiveTail = Promise.resolve();
-const GEMINI_CLI_PROVIDER_IDS = new Set(['gemini-cli', 'antigravity']);
-function isGeminiCliFamily(providerType) {
-    return GEMINI_CLI_PROVIDER_IDS.has(providerType.toLowerCase());
-}
-function keyFor(providerType, tokenFile) {
-    return `${providerType}::${tokenFile || ''}`;
-}
-function expandHome(p) {
-    return p.startsWith('~/') ? p.replace(/^~\//, `${process.env.HOME || ''}/`) : p;
-}
-function defaultTokenFile(providerType) {
-    const home = process.env.HOME || '';
-    if (providerType === 'iflow') {
-        return path.join(home, '.iflow', 'oauth_creds.json');
-    }
-    if (providerType === 'qwen') {
-        // Align with TokenFileAuthProvider + token-daemon defaults:
-        // keep a stable, well-known Qwen token file for alias="default".
-        return path.join(home, '.routecodex', 'auth', 'qwen-oauth-1-default.json');
-    }
-    if (isGeminiCliFamily(providerType)) {
-        const file = providerType.toLowerCase() === 'antigravity'
-            ? 'antigravity-oauth.json'
-            : 'gemini-oauth.json';
-        return path.join(home, '.routecodex', 'auth', file);
-    }
-    return path.join(home, '.routecodex', 'tokens', `${providerType}-default.json`);
-}
-function resolveTokenFilePath(auth, providerType) {
-    const raw = typeof auth.tokenFile === 'string' ? auth.tokenFile.trim() : '';
-    // 没有任何配置：使用 provider 默认 token 文件（兼容单 token 场景）
-    if (!raw) {
-        const fallback = defaultTokenFile(providerType);
-        auth.tokenFile = fallback;
-        return fallback;
-    }
-    // 显式路径（包含路径分隔符或 .json），直接扩展 ~ 并返回
-    if (raw.includes('/') || raw.includes('\\') || raw.endsWith('.json')) {
-        const resolved = expandHome(raw);
-        auth.tokenFile = resolved;
-        return resolved;
-    }
-    // 纯 alias：在 ~/.routecodex/auth 下按 <provider>-oauth-*-<alias>.json 规则匹配（同步版本）
-    const alias = raw;
-    const homeDir = process.env.HOME || os.homedir();
-    const authDir = path.join(homeDir, '.routecodex', 'auth');
-    const pattern = new RegExp(`^${providerType}-oauth-(\\d+)(?:-(.+))?\\.json$`, 'i');
-    const pt = providerType.toLowerCase();
-    // Qwen: keep a stable "default" file name whenever possible.
-    if (pt === 'qwen' && alias === 'default') {
-        const pinned = path.join(authDir, 'qwen-oauth-1-default.json');
-        try {
-            if (fsSync.existsSync(pinned)) {
-                auth.tokenFile = pinned;
-                return pinned;
-            }
+async function selectBestIflowTokenCandidate(targetTokenFilePath) {
+    const targetResolved = path.resolve(targetTokenFilePath);
+    const candidates = resolveIflowCredentialCandidates();
+    let best = null;
+    for (const candidatePath of candidates) {
+        if (!candidatePath) {
+            continue;
         }
-        catch {
-            // ignore and fall back to scanning
+        const resolved = path.resolve(candidatePath);
+        if (resolved === targetResolved) {
+            continue;
         }
-    }
-    let existingPath = null;
-    let bestSeqForAlias = 0;
-    let maxSeq = 0;
-    try {
-        const entries = fsSync.readdirSync(authDir);
-        for (const entry of entries) {
-            const match = entry.match(pattern);
-            if (!match) {
-                continue;
-            }
-            const seq = parseInt(match[1], 10);
-            if (!Number.isFinite(seq) || seq <= 0) {
-                continue;
-            }
-            const entryAlias = (match[2] || 'default');
-            if (entryAlias === alias && seq >= bestSeqForAlias) {
-                bestSeqForAlias = seq;
-                existingPath = path.join(authDir, entry);
-            }
-            if (seq > maxSeq) {
-                maxSeq = seq;
-            }
+        const token = await readTokenFromFile(candidatePath);
+        if (!token) {
+            continue;
         }
-    }
-    catch {
-        // ignore directory errors; treat as no existing tokens
-    }
-    if (existingPath) {
-        auth.tokenFile = existingPath;
-        return existingPath;
-    }
-    // When we don't have any existing token for this alias:
-    // - Qwen default alias should always map to seq=1 for stability.
-    // - Otherwise, allocate next seq to avoid collisions.
-    const nextSeq = (pt === 'qwen' && alias === 'default') ? 1 : (maxSeq + 1);
-    const fileName = `${providerType}-oauth-${nextSeq}-${alias}.json`;
-    const fullPath = path.join(authDir, fileName);
-    auth.tokenFile = fullPath;
-    return fullPath;
-}
-function shouldThrottle(k, ms = 60_000) {
-    const t = lastRunAt.get(k) || 0;
-    return Date.now() - t < ms;
-}
-function updateThrottle(k) {
-    lastRunAt.set(k, Date.now());
-}
-function extractStatusCode(upstreamError) {
-    if (!upstreamError || typeof upstreamError !== 'object') {
-        return undefined;
-    }
-    const anyErr = upstreamError;
-    const direct = anyErr.statusCode;
-    if (typeof direct === 'number' && Number.isFinite(direct)) {
-        return direct;
-    }
-    const status = anyErr.status;
-    if (typeof status === 'number' && Number.isFinite(status)) {
-        return status;
-    }
-    const response = anyErr.response;
-    if (response && typeof response === 'object') {
-        const respStatus = response.status;
-        if (typeof respStatus === 'number' && Number.isFinite(respStatus)) {
-            return respStatus;
+        const state = evaluateTokenState(token, 'iflow');
+        if (!state.validAccess) {
+            continue;
         }
-        const respStatusCode = response.statusCode;
-        if (typeof respStatusCode === 'number' && Number.isFinite(respStatusCode)) {
-            return respStatusCode;
+        const expiresAt = state.expiresAt ?? null;
+        if (!best) {
+            best = { token, sourcePath: candidatePath, expiresAt };
+            continue;
+        }
+        const bestExpiry = best.expiresAt ?? -1;
+        const currentExpiry = expiresAt ?? -1;
+        if (currentExpiry > bestExpiry) {
+            best = { token, sourcePath: candidatePath, expiresAt };
         }
     }
-    return undefined;
+    return best;
 }
-function isGoogleAccountVerificationRequiredMessage(lower) {
-    if (!lower) {
-        return false;
+async function maybeAdoptIflowExternalToken(strategy, tokenFilePath, existingToken) {
+    const currentState = evaluateTokenState(existingToken, 'iflow');
+    if (currentState.validAccess) {
+        return existingToken;
     }
-    return (lower.includes('verify your account') ||
-        lower.includes('validation_required') ||
-        lower.includes('validation required') ||
-        lower.includes('validation_url') ||
-        lower.includes('validation url') ||
-        lower.includes('accounts.google.com/signin/continue') ||
-        lower.includes('support.google.com/accounts?p=al_alert'));
-}
-function extractGoogleAccountVerificationUrl(message) {
-    const msg = typeof message === 'string' ? message : '';
-    if (!msg) {
-        return null;
+    const bestCandidate = await selectBestIflowTokenCandidate(tokenFilePath);
+    if (!bestCandidate) {
+        return existingToken;
     }
-    const normalized = msg
-        .replace(/\\\//g, '/')
-        .replace(/\\u0026/gi, '&')
-        .replace(/\\u003d/gi, '=')
-        .replace(/\\x26/gi, '&')
-        .replace(/\\x3d/gi, '=');
-    const patterns = [
-        /https:\/\/accounts\.google\.com\/signin\/continue[^\s"'\\<>)]*/i,
-        /https:\/\/accounts\.google\.com\/[^\s"'\\<>)]*/i,
-        /https:\/\/support\.google\.com\/accounts\?p=al_alert[^\s"'\\<>)]*/i
-    ];
-    for (const re of patterns) {
-        const m = normalized.match(re);
-        if (m && m[0]) {
-            const url = String(m[0]).trim().replace(/[\\"']+$/g, '').replace(/[),.]+$/g, '');
-            if (url) {
-                return url;
-            }
-        }
+    // Keep per-alias token files in RouteCodex, but adopt fresh credentials from iFlow-native stores when available.
+    const prepared = await prepareTokenForStorage('iflow', tokenFilePath, bestCandidate.token);
+    if (typeof strategy.saveToken === 'function') {
+        await strategy.saveToken(prepared);
     }
-    return null;
-}
-function resolveCamoufoxAliasForAuth(providerType, auth) {
-    const raw = typeof auth.tokenFile === 'string' ? auth.tokenFile.trim() : '';
-    if (raw && !raw.includes('/') && !raw.includes('\\') && !raw.endsWith('.json')) {
-        return raw;
-    }
-    const base = raw ? path.basename(raw) : '';
-    const pt = String(providerType || '').trim().toLowerCase();
-    if (base && pt) {
-        const re = new RegExp(`^${pt}-oauth-\\d+(?:-(.+))?\\.json$`, 'i');
-        const m = base.match(re);
-        const alias = m && m[1] ? String(m[1]).trim() : '';
-        if (alias) {
-            return alias;
-        }
-    }
-    return 'default';
+    else {
+        await fs.mkdir(path.dirname(tokenFilePath), { recursive: true });
+        await fs.writeFile(tokenFilePath, `${JSON.stringify(prepared, null, 2)}\n`, 'utf8');
+    }
+    const normalized = sanitizeToken(prepared) ?? bestCandidate.token;
+    logOAuthDebug(`[OAuth] iflow token adopted from ${bestCandidate.sourcePath} -> ${tokenFilePath}`);
+    return normalized;
 }
 async function openGoogleAccountVerificationInCamoufox(args) {
     const providerType = args.providerType;
@@ -262,236 +129,10 @@ async function openGoogleAccountVerificationInCamoufox(args) {
 function isOAuthConfig(auth) {
     return Boolean(auth && typeof auth.type === 'string' && auth.type.toLowerCase().includes('oauth'));
 }
-function hasNonEmptyString(value) {
-    return typeof value === 'string' && value.trim().length > 0;
-}
-function normalizeGeminiCliAccountToken(token) {
-    const raw = token;
-    const tokenNode = raw.token;
-    if (!tokenNode || typeof tokenNode !== 'object') {
-        return null;
-    }
-    const tokenObj = tokenNode;
-    const access = tokenObj.access_token;
-    if (!hasNonEmptyString(access)) {
-        return null;
-    }
-    const out = { ...tokenObj };
-    const root = token;
-    if (typeof root.disabled === 'boolean')
-        out.disabled = root.disabled;
-    if (typeof root.disabled_reason === 'string')
-        out.disabled_reason = root.disabled_reason;
-    if (typeof root.disabled_at === 'number' || typeof root.disabled_at === 'string')
-        out.disabled_at = root.disabled_at;
-    if (typeof root.proxy_disabled === 'boolean')
-        out.proxy_disabled = root.proxy_disabled;
-    if (typeof root.proxyDisabled === 'boolean')
-        out.proxyDisabled = root.proxyDisabled;
-    if (typeof root.proxy_disabled_reason === 'string')
-        out.proxy_disabled_reason = root.proxy_disabled_reason;
-    if (typeof root.proxy_disabled_at === 'number' || typeof root.proxy_disabled_at === 'string') {
-        out.proxy_disabled_at = root.proxy_disabled_at;
-    }
-    if (Array.isArray(root.protected_models))
-        out.protected_models = root.protected_models;
-    if (Array.isArray(root.protectedModels))
-        out.protectedModels = root.protectedModels;
-    if (!hasNonEmptyString(out.project_id) && hasNonEmptyString(root.project_id)) {
-        out.project_id = String(root.project_id);
-    }
-    if (!hasNonEmptyString(out.projectId) && hasNonEmptyString(root.projectId)) {
-        out.projectId = String(root.projectId);
-    }
-    if (!Array.isArray(out.projects) && Array.isArray(root.projects)) {
-        out.projects = root.projects;
-    }
-    if (!hasNonEmptyString(out.email) && hasNonEmptyString(root.email)) {
-        out.email = String(root.email);
-    }
-    const expiryTimestamp = tokenObj.expiry_timestamp;
-    if (!hasNonEmptyString(out.expires_at) && typeof expiryTimestamp === 'number') {
-        out.expires_at = expiryTimestamp > 10_000_000_000 ? expiryTimestamp : expiryTimestamp * 1000;
-    }
-    return out;
-}
-function sanitizeToken(token) {
-    if (!token || typeof token !== 'object') {
-        return null;
-    }
-    const normalized = normalizeGeminiCliAccountToken(token);
-    if (normalized) {
-        return normalized;
-    }
-    const copy = { ...token };
-    if (!hasNonEmptyString(copy.apiKey) && hasNonEmptyString(copy.api_key)) {
-        copy.apiKey = copy.api_key;
-    }
-    return copy;
-}
-async function readTokenFromFile(file) {
-    try {
-        const txt = await fs.readFile(file, 'utf-8');
-        return sanitizeToken(JSON.parse(txt));
-    }
-    catch {
-        return null;
-    }
-}
-async function backupTokenFile(file) {
-    if (!file) {
-        return null;
-    }
-    try {
-        await fs.access(file);
-    }
-    catch (error) {
-        const code = error?.code;
-        if (code === 'ENOENT') {
-            return null;
-        }
-        throw error;
-    }
-    const backup = `${file}.${Date.now()}.bak`;
-    try {
-        await fs.copyFile(file, backup);
-        logOAuthDebug(`[OAuth] token.backup: ${backup}`);
-        return backup;
-    }
-    catch (error) {
-        logOAuthDebug(`[OAuth] token.backup failed (${file}): ${error instanceof Error ? error.message : String(error)}`);
-        return null;
-    }
-}
-async function restoreTokenFileFromBackup(backupFile, target) {
-    if (!backupFile) {
-        return;
-    }
-    try {
-        await fs.copyFile(backupFile, target);
-        logOAuthDebug(`[OAuth] token.restore: ${target}`);
-    }
-    catch (error) {
-        logOAuthDebug(`[OAuth] token.restore failed (${target}): ${error instanceof Error ? error.message : String(error)}`);
-    }
-    finally {
-        try {
-            await fs.unlink(backupFile);
-        }
-        catch {
-            // ignore cleanup failure
-        }
-    }
-}
-async function discardBackupFile(backupFile) {
-    if (!backupFile) {
-        return;
-    }
-    try {
-        await fs.unlink(backupFile);
-    }
-    catch {
-        // ignore
-    }
-}
-function extractAccessToken(token) {
-    if (!token) {
-        return undefined;
-    }
-    if (hasNonEmptyString(token.access_token)) {
-        return token.access_token;
-    }
-    if (hasNonEmptyString(token.AccessToken)) {
-        return token.AccessToken;
-    }
-    return undefined;
-}
-function extractApiKey(token) {
-    if (!token) {
-        return undefined;
-    }
-    const candidate = token.apiKey ?? token.api_key;
-    return hasNonEmptyString(candidate) ? String(candidate) : undefined;
-}
-function hasApiKeyField(token) {
-    if (!token) {
-        return false;
-    }
-    return hasNonEmptyString(token.apiKey ?? token.api_key);
-}
 /**
- * Qwen: api_key 可能被降级为 access_token（userInfo 404 时的兼容写法），这种情况不应被视为“稳定 API Key”。
+ * Qwen: api_key 可能被降级为 access_token（userInfo 404 时的兼容写法），这种情况不应被视为"稳定 API Key"。
  * 只有当 api_key 存在且与 access_token 不同（或缺失 access_token）时，才认为可以长期复用并跳过刷新。
  */
-function hasStableQwenApiKey(token) {
-    const apiKey = extractApiKey(token);
-    if (!apiKey) {
-        return false;
-    }
-    const access = extractAccessToken(token);
-    return !access || apiKey !== access;
-}
-function hasAccessToken(token) {
-    return hasNonEmptyString(token?.access_token) || hasNonEmptyString(token?.AccessToken);
-}
-function getExpiresAt(token) {
-    if (!token) {
-        return null;
-    }
-    const raw = token.expires_at ?? token.expired ?? token.expiry_date;
-    if (typeof raw === 'number' && Number.isFinite(raw)) {
-        return raw;
-    }
-    if (typeof raw === 'string') {
-        const parsed = Number(raw);
-        if (Number.isFinite(parsed)) {
-            return parsed;
-        }
-        const ts = Date.parse(raw);
-        return Number.isFinite(ts) ? ts : null;
-    }
-    return null;
-}
-function resolveProjectId(token) {
-    if (!token || typeof token !== 'object') {
-        return undefined;
-    }
-    const record = token;
-    if (hasNonEmptyString(record.project_id)) {
-        return record.project_id;
-    }
-    if (hasNonEmptyString(record.projectId)) {
-        return record.projectId;
-    }
-    return undefined;
-}
-async function readRawTokenFile(file) {
-    if (!file) {
-        return null;
-    }
-    try {
-        const txt = await fs.readFile(file, 'utf-8');
-        const parsed = JSON.parse(txt);
-        return parsed && typeof parsed === 'object' ? parsed : null;
-    }
-    catch {
-        return null;
-    }
-}
-function coerceExpiryTimestampSeconds(token) {
-    if (!token) {
-        return undefined;
-    }
-    const rawExpiry = token.expiry_timestamp;
-    if (typeof rawExpiry === 'number' && Number.isFinite(rawExpiry)) {
-        return rawExpiry > 10_000_000_000 ? Math.floor(rawExpiry / 1000) : rawExpiry;
-    }
-    const expiresAt = getExpiresAt(token);
-    if (!expiresAt) {
-        return undefined;
-    }
-    return expiresAt > 10_000_000_000 ? Math.floor(expiresAt / 1000) : Math.floor(expiresAt);
-}
 async function wrapGeminiCliTokenForStorage(tokenData, tokenFilePath) {
     const rawExisting = await readRawTokenFile(tokenFilePath);
     const existing = rawExisting && typeof rawExisting === 'object' ? rawExisting : null;
@@ -596,40 +237,19 @@ async function prepareTokenForStorage(providerType, tokenFilePath, tokenData) {
     if (isGeminiCliFamily(providerType)) {
         return await wrapGeminiCliTokenForStorage(tokenData, tokenFilePath);
     }
-    return tokenData;
-}
-function hasNoRefreshFlag(token) {
-    if (!token) {
-        return false;
-    }
-    const direct = token.norefresh ?? token.noRefresh;
-    if (typeof direct === 'boolean') {
-        return direct;
-    }
-    if (typeof direct === 'string') {
-        const normalized = direct.trim().toLowerCase();
-        return normalized === '1' || normalized === 'true' || normalized === 'yes';
-    }
-    return false;
-}
-function evaluateTokenState(token, providerType) {
-    const hasApiKey = hasApiKeyField(token);
-    const hasAccess = hasAccessToken(token);
-    const expiresAt = getExpiresAt(token);
-    const isExpiredOrNear = expiresAt !== null && Date.now() >= (expiresAt - TOKEN_REFRESH_SKEW_MS);
-    let validAccess;
-    const pt = providerType.toLowerCase();
-    if (pt === 'iflow') {
-        validAccess = hasApiKey || (!isExpiredOrNear && hasAccess);
-    }
-    else if (pt === 'qwen') {
-        // Qwen: 当获取到稳定 api_key 后，可跳过 refresh/reauth；否则仍依赖 access_token 的有效期。
-        validAccess = hasStableQwenApiKey(token) || (!isExpiredOrNear && (hasAccess || hasApiKey));
-    }
-    else {
-        validAccess = (hasApiKey || hasAccess) && !isExpiredOrNear;
+    if (providerType === 'iflow') {
+        const token = sanitizeToken(tokenData) ?? tokenData;
+        const expiresAt = getExpiresAt(token);
+        if (typeof expiresAt === 'number' && Number.isFinite(expiresAt)) {
+            const expiresAtMs = expiresAt > 10_000_000_000 ? Math.floor(expiresAt) : Math.floor(expiresAt * 1000);
+            return {
+                ...tokenData,
+                expires_at: expiresAtMs,
+                expired: new Date(expiresAtMs).toISOString()
+            };
+        }
     }
-    return { hasApiKey, hasAccess, expiresAt, isExpiredOrNear, validAccess };
+    return tokenData;
 }
 function logTokenSnapshot(providerType, token, endpoints) {
     try {
@@ -1024,7 +644,7 @@ async function runInteractiveAuthorizationFlow(providerType, overrides, tokenFil
         return;
     }
     const label = `${providerType}:${tokenFilePath}`;
-    const queued = interactiveTail
+    const queued = interactiveTail.current
         .catch(() => {
         // ignore previous rejection so queue continues
     })
@@ -1037,7 +657,7 @@ async function runInteractiveAuthorizationFlow(providerType, overrides, tokenFil
             logOAuthDebug(`[OAuth] interactive queue leave ${label}`);
         }
     });
-    interactiveTail = queued.then(() => undefined, () => undefined);
+    interactiveTail.next = queued.then(() => undefined, () => undefined);
     await queued;
 }
 async function runIflowAuthorizationSequence(providerType, overrides, tokenFilePath, forceReauth) {
@@ -1084,8 +704,9 @@ export async function ensureValidOAuthToken(providerType, auth, opts = {}) {
         updateThrottle(cacheKey);
         return;
     }
-    const envAutoOpen = String(process.env.ROUTECODEX_OAUTH_AUTO_OPEN || '1') === '1';
-    const openBrowser = opts.openBrowser ?? envAutoOpen;
+    // Browser-based OAuth must be opt-in by caller.
+    // This prevents server startup / preflight paths from accidentally entering interactive flow.
+    const openBrowser = opts.openBrowser === true;
     const forceReauth = opts.forceReauthorize === true || String(process.env.ROUTECODEX_OAUTH_FORCE_REAUTH || '0') === '1';
     const runPromise = (async () => {
         const defaults = getProviderOAuthConfig(providerType, {});
@@ -1093,6 +714,9 @@ export async function ensureValidOAuthToken(providerType, auth, opts = {}) {
         logOAuthSetup(providerType, defaults, overrides, endpoints, client, tokenFilePath, openBrowser, forceReauth);
         const strategy = createStrategy(providerType, overrides, tokenFilePath);
         let token = await readTokenFromFile(tokenFilePath);
+        if (providerType === 'iflow') {
+            token = await maybeAdoptIflowExternalToken(strategy, tokenFilePath, token);
+        }
         const hadExistingTokenFile = token !== null;
         // Qwen: ensure api_key is present even when access_token is still valid.
         // Qwen OpenAI-compatible endpoints may require api_key (not access_token) for business requests.