@magpie-community/opencode-qoder-auth 0.2.7 → 0.2.8

package/README.md

@@ -151,6 +151,37 @@ Neither magpie's built-in Qoder CN nor this plugin has been checked against
 every kind of qoder.cn account. If a sign-in or a chat fails, please open
 an issue with the error.
 
+### Enterprise VPC
+
+A Qoder CN enterprise on its own VPC instance signs in with **Sign in with
+Qoder CN Enterprise (VPC)** (since 0.2.8). It asks for the instance: its
+name (`acme`) or one of its addresses (`acme.vpc.qoder.com.cn`,
+`https://acme.vpc.qoder.com.cn`). Only https and hosts under
+`vpc.qoder.com.cn` are taken.
+
+The account then uses the instance's own hosts, as Qoder CN's CLI
+(`@qodercn-ai/qoderclicn` 1.1.64) does once a VPC instance is set. The
+paths, client id and protocol are the public ones:
+
+| | Public Qoder CN | VPC instance `acme` |
+|---|---|---|
+| Sign-in page | qoder.cn | acme.vpc.qoder.com.cn |
+| Accounts: poll, tokens, user info, usage | openapi.qoder.com.cn | acme-openapi.vpc.qoder.com.cn |
+| Models and chat | gateway.qoder.com.cn | acme-gateway.vpc.qoder.com.cn |
+
+- The instance is kept with the account, so its refreshes, models, usage
+  and check-in go to the instance too. An account kept with an instance
+  that isn't one is asked to sign in again; it is never sent to the public
+  hosts.
+- The account is named `<email> (<instance>)`, so it is listed apart from
+  the same person's public account.
+- An enterprise's usage shows as the Enterprise plan.
+- **Sign in with Qoder CN** is unchanged and still the first way. An
+  account signed in without an instance works as before.
+
+The hosts and reply shapes come from a real VPC account's report
+(yetone/magpie#312). This plugin has not been tried with a VPC account.
+
 ## Daily check-in
 
 Qoder gives credits for a daily claim (the Qoder client's campaign

package/index.mjs

@@ -25,6 +25,15 @@
 // gateway.qoder.com.cn, with the device-flow client id that CLI sends in
 // production and no redirect_uri. That CLI chats on the device token itself;
 // if qoder.cn won't trade it for a job token, the account does the same.
+//
+// A Qoder CN enterprise VPC account (yetone/magpie#312) is signed in to with
+// its own method, which asks for the enterprise's instance name. Its calls go
+// to the same paths on the instance's own hosts, as Qoder CN's CLI 1.1.64
+// rewrites them once a VPC instance is set: qoder.cn becomes
+// <instance>.vpc.qoder.com.cn, openapi.qoder.com.cn becomes
+// <instance>-openapi.vpc.qoder.com.cn, and gateway.qoder.com.cn becomes
+// <instance>-gateway.vpc.qoder.com.cn. The instance is kept on the account,
+// and an account with none is served as before.
 import { createCipheriv, createHash, publicEncrypt, randomBytes, randomUUID, constants } from "node:crypto"
 import { STATUS_CODES } from "node:http"
 
@@ -180,6 +189,59 @@ function deviceExpiry(dt) {
   return Date.now() + DAY
 }
 
+// ---- enterprise VPC (Qoder CN) --------------------------------------------------
+
+const VPC_NAME = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/i
+
+// vpcInstance is the instance named by what the user entered, as Qoder CN's
+// CLI reads its VPC endpoint: a bare name ("acme"), or one of the instance's
+// hosts (acme.vpc.qoder.com.cn, acme-openapi.…, acme-gateway.…), here also as
+// an https:// address with no path. Anything else (http://, an IP, another
+// domain, a path or query) names none: undefined.
+function vpcInstance(input, domain) {
+  let e = String(input ?? "").trim().toLowerCase()
+  if (!e || !domain) return undefined
+  if (/^[a-z][a-z\d+.-]*:\/\//.test(e)) {
+    let u
+    try {
+      u = new URL(e)
+    } catch {
+      return undefined
+    }
+    if (u.protocol !== "https:" || u.username || u.password || u.port || u.search || u.hash || (u.pathname !== "" && u.pathname !== "/")) return undefined
+    if (e.endsWith("/")) e = e.slice(0, -1)
+    if (u.hostname + "" !== e.slice("https://".length)) return undefined
+    e = u.hostname
+  }
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(e)) return undefined
+  let name = e
+  if (e.endsWith("." + domain)) {
+    name = e.slice(0, e.length - domain.length - 1)
+    if (name.endsWith("-openapi") || name.endsWith("-gateway")) name = name.slice(0, -8)
+  } else if (e.includes(".")) return undefined
+  return VPC_NAME.test(name) ? name : undefined
+}
+
+// vpcSite is site served from a VPC instance's own hosts, the paths
+// unchanged; undefined when the site has no VPC or instance names none.
+function vpcSite(site, instance) {
+  const name = vpcInstance(instance, site.vpcDomain)
+  if (!name) return undefined
+  const d = site.vpcDomain
+  return { ...site, web: `https://${name}.${d}`, openapi: `https://${name}-openapi.${d}`, api: `https://${name}-gateway.${d}`, vpc: name }
+}
+
+// siteOf is the site an account is served from: its VPC instance's when it
+// was signed in to one, else site. An instance on record that names none
+// is not read as "no VPC", which would send the enterprise's tokens to the
+// public hosts: the account has to be signed in to again.
+function siteOf(site, a) {
+  if (a?.vpc === undefined || a?.vpc === null || a?.vpc === "") return site
+  const s = vpcSite(site, a.vpc)
+  if (!s) throw new SignInGone(`${site.name}: the account's VPC instance "${a.vpc}" isn't one; sign in again`)
+  return s
+}
+
 async function deviceSignIn(site) {
   const verifier = b64url(randomBytes(64))
   const challenge = b64url(createHash("sha256").update(verifier).digest())
@@ -217,20 +279,29 @@ async function deviceSignIn(site) {
       } else throw new Error(`${site.name} job token: status ${jr.status}: ${jr.text.trim().slice(0, 300)}`)
       let email = ""
       let name = ""
+      let uid = dt.user_id
       try {
         const ui = await openapi(site, "/api/v1/userinfo", { token: dt.token })
-        if (ui.status >= 200 && ui.status < 300) [email, name] = [ui.json?.email ?? "", ui.json?.name ?? ""]
+        if (ui.status >= 200 && ui.status < 300) {
+          ;[email, name] = [ui.json?.email ?? "", ui.json?.name ?? ""]
+          // a VPC poll may give the token alone: the user is then the one
+          // user info names (id, or its user_id / uid aliases)
+          if (site.vpc && !String(uid ?? "").trim()) uid = String(ui.json?.id ?? ui.json?.user_id ?? ui.json?.uid ?? "") || undefined
+        }
       } catch {}
+      if (site.vpc && !String(uid ?? "").trim()) throw new Error(`${site.name} (${site.vpc}): the sign-in named no user`)
       return {
         type: "success",
         ...chat,
-        accountId: email || dt.user_id,
-        uid: dt.user_id,
+        // a VPC account is told apart from the same person's public one
+        accountId: site.vpc ? `${email || uid} (${site.vpc})` : email || dt.user_id,
+        uid,
         email,
         name: name || dt.user_name || "",
         machineId,
         deviceToken: dt.token,
         deviceRefresh: dt.refresh_token ?? "",
+        ...(site.vpc ? { vpc: site.vpc } : {}),
       }
     },
   }
@@ -969,6 +1040,21 @@ function campaignPage(site, url) {
   }
 }
 
+// campaignTarget is where a campaigns page url is asked for an account
+// served from s: url itself on s's accounts host, or, on a VPC account, the
+// same page on its instance when url names the public host (magpie's
+// check-in knows only that), as Qoder CN's CLI rewrites it. null: url isn't
+// one.
+function campaignTarget(base, s, url) {
+  if (campaignPage(s, url)) return url
+  if (s === base || !campaignPage(base, url)) return null
+  const u = new URL(url)
+  const to = new URL(s.openapi)
+  u.protocol = to.protocol
+  u.host = to.host
+  return u.href
+}
+
 // campaignCall is url asked with the device token; Qoder's answer comes back
 // as it is.
 async function campaignCall(url, method, body, deviceToken, signal) {
@@ -1080,13 +1166,15 @@ const SITES = {
     api: "https://gateway.qoder.com.cn",
     redirect: "", // Qoder CN's CLI sends none
     deviceChat: true, // a refused job token falls back to the CLI's device-token chat
+    // an enterprise's own instance, <instance>.vpc.qoder.com.cn and its
+    // -openapi and -gateway hosts, as Qoder CN's CLI builds it in
+    vpcDomain: "vpc.qoder.com.cn",
     models: CN_MODELS,
   },
 }
 
 const makePlugin = (site) => async ({ client }) => {
   const ID = site.id
-  const CHAT_URL = site.api + CHAT_PATH
   // serializes checking, rotating and saving tokens: a refresh token is
   // spent once, so two refreshes would spend it twice
   let lock = Promise.resolve()
@@ -1118,13 +1206,14 @@ const makePlugin = (site) => async ({ client }) => {
   // renew spends a's chat refresh token, under the lock: the fields it
   // changes, recorded in spent.
   const renew = async (a) => {
+    const s = siteOf(site, a)
     if (a.deviceChat) {
       // the device token is the chat token: renewed as a device token,
       // both pairs being the one pair
-      const dt = await refreshDevice(site, a.refresh, true)
+      const dt = await refreshDevice(s, a.refresh, true)
       return spend(a.refresh, { access: dt.token, refresh: dt.refresh, expires: dt.expires, deviceToken: dt.token, deviceRefresh: dt.refresh })
     }
-    const jt = await refreshJob(site, a.refresh, a.accountId || a.email || a.uid)
+    const jt = await refreshJob(s, a.refresh, a.accountId || a.email || a.uid)
     return spend(a.refresh, { access: jt.token, refresh: jt.refresh_token, expires: expiresAt(jt) })
   }
   // each account's listing, the model configs a request carries
@@ -1147,6 +1236,7 @@ const makePlugin = (site) => async ({ client }) => {
     locked(async () => {
       const stored = await getAuth()
       if (stored?.type !== "oauth" || !stored.access || !stored.uid) throw new SignInGone(`${site.name}: not signed in`)
+      siteOf(site, stored) // a VPC instance on record that names none is no sign-in
       // renewed already (by magpie's auth.refresh), the store not yet saying so
       const a = latest(stored)
       if (a.expires - Date.now() > REFRESH_LEAD) return a
@@ -1159,7 +1249,7 @@ const makePlugin = (site) => async ({ client }) => {
   const models = async (cred, again = false) => {
     let l = listings.get(cred.uid)
     if (!l || again) {
-      l = modelInfos(await fetchListing(site, cred))
+      l = modelInfos(await fetchListing(siteOf(site, cred), cred))
       listings.set(cred.uid, l)
     }
     return l
@@ -1171,7 +1261,7 @@ const makePlugin = (site) => async ({ client }) => {
     locked(async () => {
       const a = latest(await getAuth())
       if (a?.deviceToken !== attempted) return a?.deviceToken
-      const dt = await refreshDevice(site, a.deviceRefresh, !!a.deviceChat)
+      const dt = await refreshDevice(siteOf(site, a), a.deviceRefresh, !!a.deviceChat)
       const next = { ...a, deviceToken: dt.token, deviceRefresh: dt.refresh }
       // the pair it spent was the chat pair too
       if (a.deviceChat) Object.assign(next, spend(a.refresh, { access: dt.token, refresh: dt.refresh, expires: dt.expires, deviceToken: dt.token, deviceRefresh: dt.refresh }))
@@ -1190,10 +1280,10 @@ const makePlugin = (site) => async ({ client }) => {
       if (renewed(cred)) signIn = "renewed"
       let env
       try {
-        env = await fetchUsage(site, cred.deviceToken)
+        env = await fetchUsage(siteOf(site, cred), cred.deviceToken)
       } catch (e) {
         if (!(e instanceof UsageStatus) || (e.status !== 401 && e.status !== 403)) throw e
-        env = await fetchUsage(site, await deviceToken(getAuth, cred.deviceToken))
+        env = await fetchUsage(siteOf(site, cred), await deviceToken(getAuth, cred.deviceToken))
       }
       return { ...parseUsage(env), signIn }
     } catch (e) {
@@ -1208,9 +1298,11 @@ const makePlugin = (site) => async ({ client }) => {
     let cred
     try {
       cred = await fresh(getAuth)
+      url = campaignTarget(site, siteOf(site, cred), url)
     } catch (e) {
       return signedInError(e)
     }
+    if (!url) return errorResponse({ status: 404, message: "only chat completions are served" })
     const method = String(init.method ?? input?.method ?? "GET").toUpperCase()
     try {
       let res = await campaignCall(url, method, body, cred.deviceToken, init.signal)
@@ -1240,6 +1332,7 @@ const makePlugin = (site) => async ({ client }) => {
       return errorResponse({ status: 400, message: e.message })
     }
     if (!m) return errorResponse({ status: 400, message: `unknown or disabled model "${chat.model}"` })
+    const CHAT_URL = siteOf(site, cred).api + CHAT_PATH
     const wire = encodeBody(JSON.stringify(qoderBody(chat, m)))
     const headers = {
       ...cosyHeaders(CHAT_URL, cred, wire),
@@ -1286,13 +1379,17 @@ const makePlugin = (site) => async ({ client }) => {
       async loader(getAuth) {
         const a = await getAuth()
         if (a?.type !== "oauth") return {}
+        let base = site
+        try {
+          base = siteOf(site, a)
+        } catch {} // its requests say so
         return {
-          baseURL: site.api,
+          baseURL: base.api,
           apiKey: "qoder",
           // every chat completion written as Qoder's own request
           async fetch(input, init = {}) {
             const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url
-            if (campaignPage(site, url)) return campaign(getAuth, input, url, init)
+            if (campaignPage(site, url) || campaignPage(base, url)) return campaign(getAuth, input, url, init)
             if (!/\/chat\/completions$/.test(new URL(url).pathname))
               return errorResponse({ status: 404, message: "only chat completions are served" })
             let chat
@@ -1311,7 +1408,33 @@ const makePlugin = (site) => async ({ client }) => {
           },
         }
       },
-      methods: [{ type: "oauth", label: `Sign in with ${site.name}`, authorize: () => deviceSignIn(site) }],
+      methods: [
+        { type: "oauth", label: `Sign in with ${site.name}`, authorize: () => deviceSignIn(site) },
+        // an enterprise VPC instance (Qoder CN), a method of its own so
+        // that the sign-in above asks nothing new
+        ...(site.vpcDomain
+          ? [
+              {
+                type: "oauth",
+                label: `Sign in with ${site.name} Enterprise (VPC)`,
+                prompts: [
+                  {
+                    type: "text",
+                    key: "vpc",
+                    message: `Your enterprise's VPC instance: its name, or its address (<instance>.${site.vpcDomain})`,
+                    placeholder: `acme or acme.${site.vpcDomain}`,
+                    validate: (v) => (vpcInstance(v, site.vpcDomain) ? undefined : `Not a VPC instance: enter its name (letters, digits, -) or https://<instance>.${site.vpcDomain}`),
+                  },
+                ],
+                authorize: (inputs) => {
+                  const s = vpcSite(site, inputs?.vpc)
+                  if (!s) throw new Error(`Not a VPC instance: ${String(inputs?.vpc ?? "").slice(0, 100)}`)
+                  return deviceSignIn(s)
+                },
+              },
+            ]
+          : []),
+      ],
       usage,
     },
     async config(config) {
@@ -1343,8 +1466,9 @@ const makePlugin = (site) => async ({ client }) => {
         try {
           const ms = await models(cred, true)
           if (!ms.length) return provider.models
+          const s = siteOf(site, cred)
           return Object.fromEntries(
-            ms.map((m) => [m.key, runtimeModel(site, { id: m.key, name: m.name, context: m.context, images: m.images, efforts: m.thinks ? m.efforts : [], free: m.free, rate: m.rate, rateWas: m.rateWas })]),
+            ms.map((m) => [m.key, runtimeModel(s, { id: m.key, name: m.name, context: m.context, images: m.images, efforts: m.thinks ? m.efforts : [], free: m.free, rate: m.rate, rateWas: m.rateWas })]),
           )
         } catch {
           return provider.models
@@ -1358,4 +1482,4 @@ export const QoderAuthPlugin = makePlugin(SITES.qoder)
 export const QoderCNAuthPlugin = makePlugin(SITES["qoder-cn"])
 
 // for tests
-export const _internal = { campaignPage, parseUsage, gfmt, when, failure, modelInfo, qoderBody, SITES, decodeBody, events }
+export const _internal = { campaignPage, campaignTarget, vpcInstance, vpcSite, parseUsage, gfmt, when, failure, modelInfo, qoderBody, SITES, decodeBody, events }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-qoder-auth",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "Qoder subscriptions in OpenCode and magpie: Qoder (qoder.com) and Qoder CN (qoder.cn)",
   "type": "module",
   "main": "./index.mjs",