@modelprofile.com/authswitch-signin 10.4.0

package/ts_signin/signin.credential.ts

@@ -0,0 +1,91 @@
+// OpenAI protocol portions are adapted in TypeScript from OpenAI Codex (Apache-2.0) and modified by Task Venture Capital GmbH; see third-party-notices.md.
+
+import {
+  OpenAiAuthError, parseOpenAiTokenClaims, refreshOpenAiTokens, type IOpenAiTokenSet,
+} from './signin.protocol.js';
+import type {
+  IOpenAiAccountSummary, IOpenAiOAuthCredential, TOpenAiRefreshResult,
+} from './signin.interfaces.js';
+
+/** A stored credential that is not a ChatGPT sign-in this package can read. It names no token. */
+export class OpenAiCredentialError extends Error {
+  constructor() {
+    super('The OpenAI credential is invalid.');
+    this.name = 'OpenAiCredentialError';
+  }
+}
+
+/**
+ * The token set a stored credential holds, with its ID-token claims. Throws `OpenAiCredentialError` for anything
+ * but a complete ChatGPT sign-in.
+ */
+export const openAiTokensOfCredential = (credential: IOpenAiOAuthCredential): IOpenAiTokenSet => {
+  if (credential === null || typeof credential !== 'object' || credential.kind !== 'chatgptOAuth'
+    || credential.providerId !== 'openai' || typeof credential.accessToken !== 'string' || !credential.accessToken
+    || typeof credential.refreshToken !== 'string' || !credential.refreshToken
+    || typeof credential.idToken !== 'string' || !credential.idToken) {
+    throw new OpenAiCredentialError();
+  }
+  try {
+    return { accessToken: credential.accessToken, refreshToken: credential.refreshToken, idToken: credential.idToken,
+      claims: parseOpenAiTokenClaims(credential.idToken) };
+  } catch { throw new OpenAiCredentialError(); }
+};
+
+/** The credential a sign-in or refresh produced; one without an ID token is refused. */
+export const openAiCredentialOfTokens = (tokens: IOpenAiTokenSet, lastRefreshAt?: string): IOpenAiOAuthCredential => {
+  if (!tokens.idToken) throw new OpenAiCredentialError();
+  return { kind: 'chatgptOAuth', providerId: 'openai', accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken, idToken: tokens.idToken,
+    ...(lastRefreshAt === undefined ? {} : { lastRefreshAt }) };
+};
+
+/** What a credential's claims say about its account; no token. */
+export const summarizeOpenAiCredential = (credential: IOpenAiOAuthCredential): IOpenAiAccountSummary => {
+  const claims = openAiTokensOfCredential(credential).claims;
+  return {
+    providerId: 'openai', authKind: 'chatgptOAuth',
+    ...(claims.chatgptAccountId ? { accountId: claims.chatgptAccountId } : {}),
+    ...(claims.email ? { email: claims.email } : {}),
+    ...(claims.chatgptPlanType ? { plan: claims.chatgptPlanType } : {}),
+  };
+};
+
+export interface IOpenAiRefreshCredentialOptions {
+  fetch?: typeof fetch;
+  /** Aborting it after the request was handed to fetch leaves the outcome unknown. */
+  signal?: AbortSignal;
+  now?: () => Date;
+}
+
+/**
+ * Sends one refresh-token grant for a credential and answers the rotated credential, or why there is none.
+ * A refresh that returned the same tokens, or no ID token, proves nothing about the grant it used and fails as
+ * `outcomeUnknown`. `requestOutcome: 'notSent'` is the only failure after which the same refresh token may be
+ * sent again: after any other the service may already have rotated it. `lastRefreshAt` rises strictly.
+ * Throws `OpenAiCredentialError` for a credential that is not a complete ChatGPT sign-in.
+ */
+export const refreshOpenAiCredential = async (credential: IOpenAiOAuthCredential,
+  options: IOpenAiRefreshCredentialOptions = {}): Promise<TOpenAiRefreshResult> => {
+  const input = openAiTokensOfCredential(credential);
+  try {
+    const refreshed = await refreshOpenAiTokens(input, { fetch: options.fetch, signal: options.signal });
+    if ((refreshed.accessToken === input.accessToken && refreshed.refreshToken === input.refreshToken)
+      || !refreshed.idToken) {
+      return { success: false, credential, errorCode: 'REFRESH_FAILED', requestOutcome: 'outcomeUnknown' };
+    }
+    const previous = credential.lastRefreshAt === undefined ? 0 : Date.parse(credential.lastRefreshAt);
+    const now = (options.now ?? (() => new Date()))().getTime();
+    const lastRefreshAt = new Date(Math.max(now, Number.isFinite(previous) ? previous + 1 : now)).toISOString();
+    const next = openAiCredentialOfTokens(refreshed, lastRefreshAt);
+    return { success: true, credential: next, account: summarizeOpenAiCredential(next) };
+  } catch (error) {
+    return {
+      success: false, credential,
+      errorCode: options.signal?.aborted ? 'ABORTED' : 'REFRESH_FAILED',
+      requestOutcome: error instanceof OpenAiAuthError ? error.requestOutcome ?? 'outcomeUnknown' : 'outcomeUnknown',
+      ...(error instanceof OpenAiAuthError && error.status !== undefined ? { responseStatus: error.status } : {}),
+      ...(error instanceof OpenAiAuthError && error.retryAfterMs !== undefined ? { retryAfterMs: error.retryAfterMs } : {}),
+    };
+  }
+};

package/ts_signin/signin.device.ts

@@ -0,0 +1,137 @@
+// OpenAI protocol portions are adapted in TypeScript from OpenAI Codex (Apache-2.0) and modified by Task Venture Capital GmbH; see third-party-notices.md.
+
+import {
+  exchangeOpenAiDeviceAuthorization, OPENAI_DEVICE_CODE_LIFETIME_MS, OpenAiAuthError, pollOpenAiDeviceCodeOnce,
+  requestOpenAiDeviceCode, type IOpenAiAuthOptions,
+} from './signin.protocol.js';
+import { openAiCredentialOfTokens, summarizeOpenAiCredential } from './signin.credential.js';
+import type { IOpenAiDevicePrompt, IOpenAiLoginResult } from './signin.interfaces.js';
+
+const MAX_STATE_STRING_BYTES = 4096;
+const REQUEST_TIMEOUT_MS = 30_000;
+
+/**
+ * A device sign-in that any process can continue after a restart. It is a secret: its `deviceAuthId` with its
+ * `userCode` complete the sign-in, so it is stored sealed, like a credential, and deleted once it is done.
+ */
+export interface IOpenAiDeviceSignInState {
+  verificationUrl: string;
+  userCode: string;
+  deviceAuthId: string;
+  intervalSeconds: number;
+  /** When the device code was issued, ISO 8601. */
+  issuedAt: string;
+  /** When the device code stops being accepted: fifteen minutes after `issuedAt`, as Codex tells the person. */
+  expiresAt: string;
+}
+
+/** What the person signing in is shown, with the time the code expires. */
+export interface IOpenAiDeviceSignInPrompt extends IOpenAiDevicePrompt {
+  expiresAt: string;
+}
+
+export interface IOpenAiDeviceSignInStart {
+  prompt: IOpenAiDeviceSignInPrompt;
+  state: IOpenAiDeviceSignInState;
+}
+
+/**
+ * What one poll found:
+ * - `pending`: not approved yet; poll again at `nextPollAt` at the earliest.
+ * - `expired`: the code is past `expiresAt`; nothing was sent. Start a new sign-in.
+ * - `approved`: the person approved it; `result` holds the credential. The state is spent.
+ */
+export type TOpenAiDeviceSignInPoll =
+  | { status: 'pending'; nextPollAt: string }
+  | { status: 'expired' }
+  | { status: 'approved'; result: IOpenAiLoginResult };
+
+export interface IOpenAiDeviceSignInOptions extends IOpenAiAuthOptions {
+  now?: () => Date;
+}
+
+const invalidState = (): OpenAiAuthError =>
+  new OpenAiAuthError('OpenAI device sign-in state is invalid.', { requestOutcome: 'notSent' });
+
+const isBoundedString = (value: unknown): value is string =>
+  typeof value === 'string' && value.length > 0 && Buffer.byteLength(value, 'utf8') <= MAX_STATE_STRING_BYTES;
+
+const timeOf = (value: unknown): number => {
+  if (typeof value !== 'string') return NaN;
+  const time = Date.parse(value);
+  return Number.isFinite(time) && new Date(time).toISOString() === value ? time : NaN;
+};
+
+/**
+ * Checks a stored state before anything is sent with it: a malformed one (its shape, or a window longer than the
+ * fifteen minutes a code lives) is refused. Only shape and window are checked, not where the state came from.
+ */
+const readState = (state: IOpenAiDeviceSignInState): { issuedAt: number; expiresAt: number } => {
+  if (state === null || typeof state !== 'object' || !isBoundedString(state.verificationUrl)
+    || !isBoundedString(state.userCode) || !isBoundedString(state.deviceAuthId)
+    || !Number.isSafeInteger(state.intervalSeconds) || state.intervalSeconds < 1 || state.intervalSeconds > 300) {
+    throw invalidState();
+  }
+  const issuedAt = timeOf(state.issuedAt);
+  const expiresAt = timeOf(state.expiresAt);
+  if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || expiresAt <= issuedAt
+    || expiresAt - issuedAt > OPENAI_DEVICE_CODE_LIFETIME_MS) {
+    throw invalidState();
+  }
+  return { issuedAt, expiresAt };
+};
+
+/**
+ * Starts a device sign-in and returns what to show the person and the state to keep. The code lives fifteen
+ * minutes from the moment it was requested; `issuedAt` is taken before the request, so `expiresAt` never
+ * outlives the code.
+ */
+export const startOpenAiDeviceSignIn = async (
+  options: IOpenAiDeviceSignInOptions = {},
+): Promise<IOpenAiDeviceSignInStart> => {
+  const now = options.now ?? (() => new Date());
+  const issuedAt = now().getTime();
+  const deviceCode = await requestOpenAiDeviceCode(options);
+  const state: IOpenAiDeviceSignInState = {
+    verificationUrl: deviceCode.verificationUrl,
+    userCode: deviceCode.userCode,
+    deviceAuthId: deviceCode.deviceAuthId,
+    intervalSeconds: deviceCode.intervalSeconds,
+    issuedAt: new Date(issuedAt).toISOString(),
+    expiresAt: new Date(issuedAt + OPENAI_DEVICE_CODE_LIFETIME_MS).toISOString(),
+  };
+  return {
+    prompt: { flow: 'device', verificationUrl: state.verificationUrl, userCode: state.userCode, expiresAt: state.expiresAt },
+    state,
+  };
+};
+
+/**
+ * Asks once whether the person approved the sign-in, and on approval exchanges it for the credential. A state
+ * past `expiresAt` answers `expired` without a request. One request is bounded by the time the code has left
+ * and by thirty seconds. The authorization the service answers is single-use: poll one state from one caller
+ * at a time, and after `approved`, or after a failure of the exchange, start a new sign-in rather than polling
+ * the same state again. Failures are `OpenAiAuthError`s with fixed messages.
+ */
+export const pollOpenAiDeviceSignIn = async (
+  state: IOpenAiDeviceSignInState,
+  options: IOpenAiDeviceSignInOptions = {},
+): Promise<TOpenAiDeviceSignInPoll> => {
+  const { expiresAt } = readState(state);
+  const now = options.now ?? (() => new Date());
+  const remaining = expiresAt - now().getTime();
+  if (remaining <= 0) return { status: 'expired' };
+  const poll = await pollOpenAiDeviceCodeOnce({
+    verificationUrl: state.verificationUrl, userCode: state.userCode,
+    deviceAuthId: state.deviceAuthId, intervalSeconds: state.intervalSeconds,
+  }, { fetch: options.fetch, signal: options.signal, timeoutMs: Math.min(remaining, REQUEST_TIMEOUT_MS) });
+  if (poll.status === 'pending') {
+    const nextPollAt = Math.min(now().getTime() + state.intervalSeconds * 1000, expiresAt);
+    return { status: 'pending', nextPollAt: new Date(nextPollAt).toISOString() };
+  }
+  const tokens = await exchangeOpenAiDeviceAuthorization(poll.authorization, { fetch: options.fetch, signal: options.signal });
+  let credential;
+  try { credential = openAiCredentialOfTokens(tokens); }
+  catch { throw new OpenAiAuthError('OpenAI auth response is missing id_token.', { requestOutcome: 'outcomeUnknown' }); }
+  return { status: 'approved', result: { credential, account: summarizeOpenAiCredential(credential) } };
+};