@modelprofile.com/authswitch-signin 10.4.0

package/ts_signin/signin.protocol.ts

@@ -0,0 +1,454 @@
+// OpenAI protocol portions are adapted in TypeScript from OpenAI Codex (Apache-2.0) and modified by Task Venture Capital GmbH; see third-party-notices.md.
+
+import type { TOpenAiRequestOutcome } from './signin.interfaces.js';
+
+/**
+ * The ChatGPT sign-in protocol Codex uses (`codex-rs/login`: `device_code_auth.rs`, `auth/manager.rs`,
+ * `auth/revoke.rs`, `oauth/client.rs`), for the one party that signs an account in and refreshes it: the device
+ * code, its poll, the authorization-code exchange, the refresh-token grant, the revocation and the claims of the
+ * tokens. Every failure is a fixed message: no response body, token or header crosses an error.
+ */
+
+export const OPENAI_AUTH_ISSUER = 'https://auth.openai.com';
+export const OPENAI_AUTH_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+
+/** How long a device code lives: Codex polls it for fifteen minutes and tells the person it expires then. */
+export const OPENAI_DEVICE_CODE_LIFETIME_MS = 15 * 60 * 1000;
+const DEVICE_CODE_TIMEOUT_MS = OPENAI_DEVICE_CODE_LIFETIME_MS;
+/** Codex's `REVOKE_HTTP_TIMEOUT`. */
+const REVOKE_TIMEOUT_MS = 10_000;
+const MAX_RESPONSE_BYTES = 64 * 1024;
+const MAX_TOKEN_BYTES = 16 * 1024;
+const MAX_AUTHORIZATION_CODE_BYTES = 8 * 1024;
+const MAX_IDENTIFIER_BYTES = 1024;
+const REQUEST_TIMEOUT_MS = 30_000;
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
+const utf8ByteLength = (valueArg: string): number => textEncoder.encode(valueArg).byteLength;
+
+export class OpenAiAuthError extends Error {
+  public readonly status?: number;
+  public readonly requestOutcome?: TOpenAiRequestOutcome;
+  public readonly retryAfterMs?: number;
+
+  constructor(message: string, options: { status?: number; requestOutcome?: TOpenAiRequestOutcome;
+    retryAfterMs?: number } = {}) {
+    super(message);
+    this.name = 'OpenAiAuthError';
+    this.status = options.status;
+    this.requestOutcome = options.requestOutcome;
+    this.retryAfterMs = options.retryAfterMs;
+  }
+}
+
+export interface IOpenAiAuthOptions {
+  fetch?: typeof fetch;
+  /** Aborts network requests and device-code polling. */
+  signal?: AbortSignal;
+}
+
+export interface IOpenAiDeviceCodePollOptions extends IOpenAiAuthOptions {
+  timeoutMs?: number;
+  sleep?: (ms: number) => Promise<void>;
+}
+
+/** What the claims of a ChatGPT token say about its account; never the token itself. */
+export interface IOpenAiTokenClaims {
+  email?: string;
+  chatgptPlanType?: string;
+  chatgptUserId?: string;
+  chatgptAccountId?: string;
+  chatgptAccountIsFedramp: boolean;
+  expiresAt?: string;
+}
+
+export interface IOpenAiDeviceCode {
+  verificationUrl: string;
+  userCode: string;
+  deviceAuthId: string;
+  intervalSeconds: number;
+}
+
+export interface IOpenAiDeviceAuthorization {
+  authorizationCode: string;
+  codeChallenge: string;
+  codeVerifier: string;
+}
+
+/** The tokens one exchange or refresh produced, with the claims of the ID token (or access token). */
+export interface IOpenAiTokenSet {
+  accessToken: string;
+  refreshToken: string;
+  idToken?: string;
+  claims: IOpenAiTokenClaims;
+}
+
+interface ITokenResponse {
+  id_token?: unknown;
+  access_token?: unknown;
+  refresh_token?: unknown;
+}
+
+const getFetch = (options: IOpenAiAuthOptions): typeof fetch => {
+  const fetchFunction = options.fetch ?? globalThis.fetch;
+  if (!fetchFunction) throw new OpenAiAuthError('fetch is not available for OpenAI authentication.');
+  return fetchFunction;
+};
+
+const throwIfAborted = (options: IOpenAiAuthOptions): void => {
+  if (options.signal?.aborted) throw new OpenAiAuthError('OpenAI authentication was aborted.');
+};
+
+const asString = (value: unknown, name: string, maximumBytes = MAX_IDENTIFIER_BYTES): string => {
+  if (typeof value !== 'string' || value.length === 0) {
+    throw new OpenAiAuthError(`OpenAI auth response is missing ${name}.`);
+  }
+  if (utf8ByteLength(value) > maximumBytes) throw new OpenAiAuthError(`OpenAI auth response contains an invalid ${name}.`);
+  return value;
+};
+
+const asOptionalString = (value: unknown, maximumBytes = MAX_IDENTIFIER_BYTES): string | undefined => {
+  if (typeof value !== 'string' || value.length === 0) return undefined;
+  if (utf8ByteLength(value) > maximumBytes) throw new OpenAiAuthError('OpenAI auth response contains an oversized string.');
+  return value;
+};
+
+/** Codex reads the interval as a string (`deserialize_interval`); both a number and a numeric string are taken. */
+const asIntervalSeconds = (value: unknown): number => {
+  const interval = typeof value === 'number' ? value : Number.parseInt(String(value ?? ''), 10);
+  if (!Number.isFinite(interval) || interval <= 0 || interval > 300) {
+    throw new OpenAiAuthError('OpenAI device-code response has an invalid interval.');
+  }
+  return interval;
+};
+
+const readResponseText = async (response: Response, options: IOpenAiAuthOptions): Promise<string> => {
+  const contentLength = response.headers.get('content-length');
+  if (contentLength !== null && (!/^\d+$/.test(contentLength) || Number(contentLength) > MAX_RESPONSE_BYTES)) {
+    await response.body?.cancel().catch(() => undefined);
+    throw new OpenAiAuthError('OpenAI auth response exceeded its size limit.', { status: response.status });
+  }
+  if (!response.body) return '';
+  const reader = response.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let byteLength = 0;
+  let completed = false;
+  const onAbort = (): void => { void reader.cancel().catch(() => undefined); };
+  options.signal?.addEventListener('abort', onAbort, { once: true });
+  if (options.signal?.aborted) onAbort();
+  try {
+    while (true) {
+      throwIfAborted(options);
+      const { done, value } = await reader.read();
+      throwIfAborted(options);
+      if (done) break;
+      byteLength += value.byteLength;
+      if (byteLength > MAX_RESPONSE_BYTES) {
+        await reader.cancel().catch(() => undefined);
+        throw new OpenAiAuthError('OpenAI auth response exceeded its size limit.', { status: response.status });
+      }
+      chunks.push(value);
+    }
+    completed = true;
+  } finally {
+    options.signal?.removeEventListener('abort', onAbort);
+    if (!completed) void reader.cancel().catch(() => undefined);
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(byteLength);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return textDecoder.decode(bytes);
+};
+
+const readJson = async (response: Response, context: string, options: IOpenAiAuthOptions): Promise<unknown> => {
+  const body = await readResponseText(response, options);
+  if (!response.ok) throw new OpenAiAuthError(`${context} failed with status ${response.status}.`, { status: response.status });
+  try { return body ? JSON.parse(body) : {}; }
+  catch { throw new OpenAiAuthError(`${context} returned invalid JSON.`, { status: response.status }); }
+};
+
+const parseRetryAfterMs = (header: string | null): number | undefined => {
+  if (!header || header.length > 128) return undefined;
+  const maximumDelayMs = 24 * 60 * 60 * 1000;
+  if (/^\d{1,10}$/.test(header)) return Math.min(Number(header) * 1000, maximumDelayMs);
+  const retryAt = Date.parse(header);
+  if (!Number.isFinite(retryAt)) return undefined;
+  return Math.min(Math.max(0, retryAt - Date.now()), maximumDelayMs);
+};
+
+/**
+ * One bounded request. Its failure says whether the request was handed to fetch at all: a refresh whose outcome
+ * is `outcomeUnknown` may have rotated the grant and is never sent again.
+ */
+const runFetch = async <TResult>(url: string, init: RequestInit, options: IOpenAiAuthOptions,
+  handle: (response: Response, requestOptions: IOpenAiAuthOptions) => Promise<TResult>,
+  timeoutMs = REQUEST_TIMEOUT_MS): Promise<TResult> => {
+  if (options.signal?.aborted) {
+    throw new OpenAiAuthError('OpenAI authentication was aborted.', { requestOutcome: 'notSent' });
+  }
+  const controller = new AbortController();
+  let response: Response | undefined;
+  let requestStarted = false;
+  const onExternalAbort = (): void => controller.abort();
+  const onRequestAbort = (): void => { void response?.body?.cancel().catch(() => undefined); };
+  options.signal?.addEventListener('abort', onExternalAbort, { once: true });
+  let rejectOnAbort!: () => void;
+  const aborted = new Promise<never>((_resolve, reject) => {
+    rejectOnAbort = () => reject(new Error('OpenAI authentication request aborted.'));
+    controller.signal.addEventListener('abort', rejectOnAbort, { once: true });
+  });
+  controller.signal.addEventListener('abort', onRequestAbort, { once: true });
+  if (options.signal?.aborted) controller.abort();
+  const timer = setTimeout(() => controller.abort(), Math.min(timeoutMs, REQUEST_TIMEOUT_MS));
+  const requestOptions = { ...options, signal: controller.signal };
+  try {
+    return await Promise.race([
+      (async () => {
+        const fetchImplementation = getFetch(options);
+        requestStarted = true;
+        response = await fetchImplementation(url, { ...init, redirect: 'error', signal: controller.signal });
+        if (controller.signal.aborted) await response.body?.cancel().catch(() => undefined);
+        throwIfAborted(requestOptions);
+        return handle(response, requestOptions);
+      })(),
+      aborted,
+    ]);
+  } catch (error) {
+    const requestOutcome: TOpenAiRequestOutcome = requestStarted ? 'outcomeUnknown' : 'notSent';
+    const retryAfterMs = response ? parseRetryAfterMs(response.headers.get('retry-after')) : undefined;
+    const status = error instanceof OpenAiAuthError && error.status !== undefined ? error.status : response?.status;
+    throw new OpenAiAuthError(error instanceof OpenAiAuthError ? error.message
+      : options.signal?.aborted ? 'OpenAI authentication was aborted.' : 'OpenAI authentication request failed.', {
+      requestOutcome,
+      ...(status !== undefined ? { status } : {}),
+      ...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
+    });
+  } finally {
+    clearTimeout(timer);
+    options.signal?.removeEventListener('abort', onExternalAbort);
+    controller.signal.removeEventListener('abort', rejectOnAbort);
+    controller.signal.removeEventListener('abort', onRequestAbort);
+  }
+};
+
+const postJson = (url: string, body: unknown, options: IOpenAiAuthOptions): Promise<unknown> =>
+  runFetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) },
+    options, (response, requestOptions) => readJson(response, `POST ${url}`, requestOptions));
+
+const postForm = (url: string, body: URLSearchParams, options: IOpenAiAuthOptions): Promise<unknown> =>
+  runFetch(url, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: body.toString() },
+    options, (response, requestOptions) => readJson(response, `POST ${url}`, requestOptions));
+
+const sleep = (ms: number): Promise<void> => new Promise(resolve => setTimeout(resolve, ms));
+
+const sleepWithAbort = async (milliseconds: number, options: IOpenAiDeviceCodePollOptions): Promise<void> => {
+  throwIfAborted(options);
+  const signal = options.signal;
+  if (!signal) {
+    await (options.sleep ?? sleep)(milliseconds);
+    return;
+  }
+  let abortListener: (() => void) | undefined;
+  let timer: NodeJS.Timeout | undefined;
+  try {
+    await Promise.race([
+      options.sleep ? options.sleep(milliseconds) : new Promise<void>(resolve => { timer = setTimeout(resolve, milliseconds); }),
+      new Promise<never>((_resolve, reject) => {
+        abortListener = () => reject(new OpenAiAuthError('OpenAI authentication was aborted.'));
+        signal.addEventListener('abort', abortListener, { once: true });
+        if (signal.aborted) abortListener();
+      }),
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+    if (abortListener) signal.removeEventListener('abort', abortListener);
+  }
+};
+
+const parseJwtPayload = (jwt: string): Record<string, unknown> => {
+  const parts = jwt.split('.');
+  if (parts.length !== 3 || !parts[1]) throw new OpenAiAuthError('OpenAI auth returned an invalid token.');
+  try {
+    const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+    const binary = atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, '='));
+    const value: unknown = JSON.parse(textDecoder.decode(Uint8Array.from(binary, character => character.charCodeAt(0))));
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) throw new Error();
+    return value as Record<string, unknown>;
+  } catch { throw new OpenAiAuthError('OpenAI token claims could not be parsed.'); }
+};
+
+const claimRecord = (value: unknown): Record<string, unknown> | undefined =>
+  value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+
+/** Reads the account claims of a ChatGPT ID or access token. Throws `OpenAiAuthError` for anything but a JWT. */
+export const parseOpenAiTokenClaims = (token: string): IOpenAiTokenClaims => {
+  const claims = parseJwtPayload(token);
+  const profile = claimRecord(claims['https://api.openai.com/profile']);
+  const auth = claimRecord(claims['https://api.openai.com/auth']);
+  const expiresAtSeconds = typeof claims.exp === 'number' ? claims.exp : undefined;
+  return {
+    email: asOptionalString(claims.email) ?? asOptionalString(profile?.email),
+    chatgptPlanType: asOptionalString(auth?.chatgpt_plan_type),
+    chatgptUserId: asOptionalString(auth?.chatgpt_user_id) ?? asOptionalString(auth?.user_id),
+    chatgptAccountId: asOptionalString(auth?.chatgpt_account_id),
+    chatgptAccountIsFedramp: auth?.chatgpt_account_is_fedramp === true,
+    expiresAt: expiresAtSeconds !== undefined ? new Date(expiresAtSeconds * 1000).toISOString() : undefined,
+  };
+};
+
+const createTokenSet = (response: ITokenResponse, existing?: IOpenAiTokenSet): IOpenAiTokenSet => {
+  const accessToken = asOptionalString(response.access_token, MAX_TOKEN_BYTES) ?? existing?.accessToken;
+  const refreshToken = asOptionalString(response.refresh_token, MAX_TOKEN_BYTES) ?? existing?.refreshToken;
+  const idToken = asOptionalString(response.id_token, MAX_TOKEN_BYTES) ?? existing?.idToken;
+  if (!accessToken) throw new OpenAiAuthError('OpenAI auth response is missing access_token.');
+  if (!refreshToken) throw new OpenAiAuthError('OpenAI auth response is missing refresh_token.');
+  let claims: IOpenAiTokenClaims;
+  try { claims = parseOpenAiTokenClaims(idToken ?? accessToken); }
+  catch { throw new OpenAiAuthError('OpenAI auth returned an invalid token.'); }
+  return { accessToken, refreshToken, ...(idToken ? { idToken } : {}), claims };
+};
+
+/** Starts a device sign-in (`POST {issuer}/api/accounts/deviceauth/usercode`). */
+export const requestOpenAiDeviceCode = async (options: IOpenAiAuthOptions = {}): Promise<IOpenAiDeviceCode> => {
+  const response = await postJson(`${OPENAI_AUTH_ISSUER}/api/accounts/deviceauth/usercode`,
+    { client_id: OPENAI_AUTH_CLIENT_ID }, options) as Record<string, unknown>;
+  return {
+    verificationUrl: `${OPENAI_AUTH_ISSUER}/codex/device`,
+    userCode: asString(response.user_code ?? response.usercode, 'user_code'),
+    deviceAuthId: asString(response.device_auth_id, 'device_auth_id'),
+    intervalSeconds: asIntervalSeconds(response.interval),
+  };
+};
+
+/** What one poll of a device sign-in found: the person has not approved it yet, or has, with its authorization. */
+export type TOpenAiDeviceCodePoll =
+  | { status: 'pending' }
+  | { status: 'approved'; authorization: IOpenAiDeviceAuthorization };
+
+const assertDeviceCode = (deviceCode: IOpenAiDeviceCode): void => {
+  if (deviceCode === null || typeof deviceCode !== 'object'
+    || typeof deviceCode.deviceAuthId !== 'string' || !deviceCode.deviceAuthId
+    || typeof deviceCode.userCode !== 'string' || !deviceCode.userCode
+    || utf8ByteLength(deviceCode.deviceAuthId) > MAX_IDENTIFIER_BYTES
+    || utf8ByteLength(deviceCode.userCode) > MAX_IDENTIFIER_BYTES
+    || !Number.isSafeInteger(deviceCode.intervalSeconds) || deviceCode.intervalSeconds < 1
+    || deviceCode.intervalSeconds > 300) {
+    throw new OpenAiAuthError('OpenAI device-code input is invalid.', { requestOutcome: 'notSent' });
+  }
+};
+
+/**
+ * Asks once whether the person approved the sign-in (`POST {issuer}/api/accounts/deviceauth/token`): 403 and 404
+ * mean pending, as in Codex. `timeoutMs` bounds the one request (at most thirty seconds). The authorization it
+ * answers is single-use, so one sign-in is polled by one caller at a time.
+ */
+export const pollOpenAiDeviceCodeOnce = async (deviceCode: IOpenAiDeviceCode,
+  options: IOpenAiAuthOptions & { timeoutMs?: number } = {}): Promise<TOpenAiDeviceCodePoll> => {
+  assertDeviceCode(deviceCode);
+  const timeoutMs = options.timeoutMs ?? REQUEST_TIMEOUT_MS;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1) {
+    throw new OpenAiAuthError('OpenAI device-code timeout is invalid.', { requestOutcome: 'notSent' });
+  }
+  const pollUrl = `${OPENAI_AUTH_ISSUER}/api/accounts/deviceauth/token`;
+  const pollResult = await runFetch(pollUrl, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ device_auth_id: deviceCode.deviceAuthId, user_code: deviceCode.userCode }),
+  }, options, async (response, requestOptions) => {
+    if (response.ok) {
+      return { status: 'complete' as const,
+        body: await readJson(response, `POST ${pollUrl}`, requestOptions) as Record<string, unknown> };
+    }
+    await readResponseText(response, requestOptions);
+    if (response.status !== 403 && response.status !== 404) {
+      throw new OpenAiAuthError(`OpenAI device-code polling failed with status ${response.status}.`,
+        { status: response.status });
+    }
+    return { status: 'pending' as const };
+  }, timeoutMs);
+  if (pollResult.status === 'pending') return { status: 'pending' };
+  return {
+    status: 'approved',
+    authorization: {
+      authorizationCode: asString(pollResult.body.authorization_code, 'authorization_code', MAX_AUTHORIZATION_CODE_BYTES),
+      codeChallenge: asString(pollResult.body.code_challenge, 'code_challenge'),
+      codeVerifier: asString(pollResult.body.code_verifier, 'code_verifier'),
+    },
+  };
+};
+
+/**
+ * Polls until the person approved the sign-in, at the interval the service asked for, and gives up after at most
+ * fifteen minutes, as Codex does.
+ */
+export const pollOpenAiDeviceCode = async (deviceCode: IOpenAiDeviceCode,
+  options: IOpenAiDeviceCodePollOptions = {}): Promise<IOpenAiDeviceAuthorization> => {
+  const timeoutMs = options.timeoutMs ?? DEVICE_CODE_TIMEOUT_MS;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > DEVICE_CODE_TIMEOUT_MS) {
+    throw new OpenAiAuthError('OpenAI device-code timeout is invalid.');
+  }
+  assertDeviceCode(deviceCode);
+  const startedAt = Date.now();
+  while (Date.now() - startedAt < timeoutMs) {
+    const remainingBeforeRequest = timeoutMs - (Date.now() - startedAt);
+    const poll = await pollOpenAiDeviceCodeOnce(deviceCode, { ...options, timeoutMs: Math.max(remainingBeforeRequest, 1) });
+    if (poll.status === 'approved') return poll.authorization;
+    const remaining = timeoutMs - (Date.now() - startedAt);
+    await sleepWithAbort(Math.min(deviceCode.intervalSeconds * 1000, Math.max(remaining, 0)), options);
+  }
+  throw new OpenAiAuthError('OpenAI device-code login timed out.');
+};
+
+/** Exchanges an approved device sign-in for tokens (`POST {issuer}/oauth/token`, PKCE, form-encoded). */
+export const exchangeOpenAiDeviceAuthorization = async (authorization: IOpenAiDeviceAuthorization,
+  options: IOpenAiAuthOptions = {}): Promise<IOpenAiTokenSet> => {
+  const response = await postForm(`${OPENAI_AUTH_ISSUER}/oauth/token`, new URLSearchParams({
+    grant_type: 'authorization_code',
+    code: authorization.authorizationCode,
+    redirect_uri: `${OPENAI_AUTH_ISSUER}/deviceauth/callback`,
+    client_id: OPENAI_AUTH_CLIENT_ID,
+    code_verifier: authorization.codeVerifier,
+  }), options) as ITokenResponse;
+  return createTokenSet(response);
+};
+
+/**
+ * Sends one refresh-token grant (`POST {issuer}/oauth/token`, JSON). A response without a new refresh token keeps
+ * the one that was sent, as Codex does.
+ */
+export const refreshOpenAiTokens = async (tokens: IOpenAiTokenSet,
+  options: IOpenAiAuthOptions = {}): Promise<IOpenAiTokenSet> => {
+  const response = await postJson(`${OPENAI_AUTH_ISSUER}/oauth/token`, {
+    client_id: OPENAI_AUTH_CLIENT_ID,
+    grant_type: 'refresh_token',
+    refresh_token: tokens.refreshToken,
+  }, options) as ITokenResponse;
+  return createTokenSet({
+    id_token: response.id_token ?? tokens.idToken,
+    access_token: response.access_token ?? tokens.accessToken,
+    refresh_token: response.refresh_token ?? tokens.refreshToken,
+  }, tokens);
+};
+
+/**
+ * Revokes a refresh token (`POST {issuer}/oauth/revoke`, JSON), as Codex does when it logs out: the grant then
+ * refreshes nothing anywhere. It resolves only once the service accepted the revocation.
+ */
+export const revokeOpenAiRefreshToken = async (refreshToken: string, options: IOpenAiAuthOptions = {}): Promise<void> => {
+  if (typeof refreshToken !== 'string' || !refreshToken || utf8ByteLength(refreshToken) > MAX_TOKEN_BYTES) {
+    throw new OpenAiAuthError('OpenAI revocation input is invalid.', { requestOutcome: 'notSent' });
+  }
+  const url = `${OPENAI_AUTH_ISSUER}/oauth/revoke`;
+  await runFetch(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ token: refreshToken, token_type_hint: 'refresh_token', client_id: OPENAI_AUTH_CLIENT_ID }),
+  }, options, async (response, requestOptions) => {
+    await readResponseText(response, requestOptions);
+    if (!response.ok) throw new OpenAiAuthError(`POST ${url} failed with status ${response.status}.`, { status: response.status });
+  }, REVOKE_TIMEOUT_MS);
+};