@modelprofile.com/authswitch 8.0.0 → 8.1.0

package/ts/ts_migration/legacysources/shared.ts

@@ -0,0 +1,220 @@
+import * as plugins from '../../plugins.js';
+import { readCredentialRaw } from '../../classes.credentialstore.js';
+import type { TAuthSwitchImportProof, TAuthSwitchImportSourceKind,
+  TAuthSwitchImportTreatment } from '../../authority-import-contract.js';
+
+/**
+ * Shared vocabulary of the legacy-source readers.
+ *
+ * These readers exist for one migration and are deliberately isolated from the runtime: nothing here is a
+ * fallback an ordinary command may reach for. They only read, and they report what they could not read
+ * instead of returning a shorter list -- a silently skipped entry is an account the owner would lose.
+ */
+
+/** One source as the readers see it. `path` stays inside the daemon; only `sourcePathHash` is published. */
+export interface ILegacySourceRecord {
+  id: string;
+  sourceKind: TAuthSwitchImportSourceKind;
+  path: string;
+  sourcePathHash: string;
+  sourceDigest: string;
+  treatment: TAuthSwitchImportTreatment;
+  proof: TAuthSwitchImportProof;
+  accountId: string | null;
+  /** The provider's own stable identity, kept on the account so a sealed credential can be matched to it. */
+  subject: string | null;
+  workspaceId: string | null;
+  providerId: string | null;
+  email: string | null;
+  plan: string | null;
+  label: string | null;
+  accessExpiresAt: string | null;
+  enrollmentCount: number | null;
+  problems: string[];
+}
+
+export interface ILegacySourceReport {
+  sources: ILegacySourceRecord[];
+  /** Locations that could not be read at all, so an empty result is never mistaken for an empty store. */
+  problems: string[];
+}
+
+/**
+ * Where the legacy stores live.
+ *
+ * Each field repeats the rule of the class that owns that location, so a fixture can point the whole reader
+ * at a temporary directory: `authSwitchHome` (ts/classes.credentialstore.ts), `CodexHome`
+ * (ts/classes.codexhome.ts), `ClaudeCodeHarness` (ts/classes.claudecodeharness.ts) and `OpenCodeHarness`
+ * (ts/classes.opencodeharness.ts). Drift in any of those is a bug here, not a reason to guess.
+ */
+export interface ILegacySourceLocations {
+  authSwitchHome: string;
+  codexHome: string;
+  claudeCredentialFile: string;
+  claudeConfigFile: string;
+  openCodeAuthFile: string;
+}
+
+export const resolveLegacySourceLocations = (env: NodeJS.ProcessEnv,
+  homeDirectory: string): ILegacySourceLocations => {
+  const claudeConfigDirectory = env.CLAUDE_CONFIG_DIR || plugins.path.join(homeDirectory, '.claude');
+  const dataHome = env.XDG_DATA_HOME || plugins.path.join(homeDirectory, '.local', 'share');
+  return {
+    authSwitchHome: env.AUTHSWITCH_HOME || plugins.path.join(homeDirectory, '.authswitch'),
+    codexHome: env.CODEX_HOME || plugins.path.join(homeDirectory, '.codex'),
+    claudeCredentialFile: plugins.path.join(claudeConfigDirectory, '.credentials.json'),
+    // Claude Code keeps its account metadata beside the home directory, not inside a custom config directory.
+    claudeConfigFile: plugins.path.join(env.CLAUDE_CONFIG_DIR || homeDirectory, '.claude.json'),
+    openCodeAuthFile: plugins.path.join(dataHome, 'opencode', 'auth.json'),
+  };
+};
+
+export const legacyHash = (value: string): string =>
+  plugins.crypto.createHash('sha256').update(value).digest('hex');
+
+/** The ledger row id of a source. Stable across inventory runs, so a resumed import finds its own row. */
+export const legacySourceId = (sourceKind: TAuthSwitchImportSourceKind, sourcePathHash: string): string =>
+  legacyHash(JSON.stringify(['authswitch-migration-v1', sourceKind, sourcePathHash]));
+
+/**
+ * The digest that binds an import to exactly these bytes.
+ *
+ * A source is often more than one file -- a stash directory, or Claude's credential/config pair -- so the
+ * digest covers an ordered list of per-file digests rather than one file. The file names are part of it: a
+ * source that gains or loses a file is a different source.
+ */
+export const legacySourceDigest = (files: ReadonlyArray<{ name: string; raw: string }>): string =>
+  legacyHash(JSON.stringify([...files]
+    .sort((left, right) => left.name.localeCompare(right.name))
+    .map(file => [file.name, legacyHash(file.raw)])));
+
+export interface ILegacySourceFile {
+  name: string;
+  raw: string;
+}
+
+/** A bounded read that reports unreadable and absent apart, through the store's own reader. */
+export const readLegacyFile = (file: string, name: string):
+{ file: ILegacySourceFile | null; problem: string | null } => {
+  try {
+    const raw = readCredentialRaw(file);
+    return { file: raw === null ? null : { name, raw }, problem: null };
+  } catch {
+    return { file: null, problem: `${name} is unreadable, malformed or too large` };
+  }
+};
+
+export const parseLegacyJson = (raw: string): Record<string, unknown> | null => {
+  try {
+    const value: unknown = JSON.parse(raw);
+    return value && typeof value === 'object' && !Array.isArray(value)
+      ? value as Record<string, unknown> : null;
+  } catch { return null; }
+};
+
+export interface IOpenAiSourceIdentity {
+  accountId: string;
+  /** The stable provider identity the account record keeps, so a sealed credential can be matched to it. */
+  subject: string;
+  workspaceId: string;
+  email: string | null;
+  plan: string | null;
+}
+
+/**
+ * The authority account a ChatGPT login resolves to.
+ *
+ * Derived from the id_token's claims exactly as `AuthSwitchAuthorityBroker.identity` derives it
+ * (ts/classes.authoritybroker.ts), because an import that produced a different account id would create a
+ * second account for a login the owner already has. No provider call is involved: this is a local read of
+ * claims the token already carries, which is what lets the inventory run offline.
+ */
+export const openAiSourceIdentity = (idToken: string): IOpenAiSourceIdentity | null => {
+  let info: ReturnType<typeof plugins.flexAuth.parseOpenAiChatGptTokenInfo>;
+  try { info = plugins.flexAuth.parseOpenAiChatGptTokenInfo(idToken); }
+  catch { return null; }
+  if (!info.chatgptUserId || !info.chatgptAccountId) return null;
+  return {
+    accountId: legacyHash(JSON.stringify(['authswitch-account-v1', 'openai',
+      info.chatgptUserId, info.chatgptAccountId])),
+    subject: info.chatgptUserId,
+    workspaceId: info.chatgptAccountId,
+    email: info.email?.toLowerCase() ?? null,
+    plan: info.chatgptPlanType ?? null,
+  };
+};
+
+export interface IClaudeSourceIdentity {
+  accountId: string;
+  /** Claude's immutable pair, kept as the account's subject and workspace so a sealed login matches it. */
+  subject: string;
+  workspaceId: string;
+  email: string | null;
+  accessExpiresAt: string | null;
+}
+
+/**
+ * The authority account a Claude subscriber login resolves to.
+ *
+ * Claude's immutable identity is the account/organization UUID pair that `ClaudeNativeAdapter` proves
+ * against the provider (ts/classes.claudenative.ts). Nothing in the package derived an authority account id
+ * from it before this import, so it follows the OpenAI rule -- provider, subject, workspace -- and stays the
+ * single formula both the inventory and the import use.
+ */
+export const claudeSourceIdentity = (credential: Record<string, unknown>): IClaudeSourceIdentity | null => {
+  const oauth = credential.claudeAiOauth;
+  const account = credential.oauthAccount;
+  if (!oauth || typeof oauth !== 'object' || Array.isArray(oauth)
+    || !account || typeof account !== 'object' || Array.isArray(account)) return null;
+  const oauthRecord = oauth as Record<string, unknown>;
+  const accountRecord = account as Record<string, unknown>;
+  const accountUuid = accountRecord.accountUuid;
+  const organizationUuid = accountRecord.organizationUuid;
+  if (typeof accountUuid !== 'string' || !accountUuid || typeof organizationUuid !== 'string'
+    || !organizationUuid) return null;
+  const expiresAt = oauthRecord.expiresAt;
+  const email = accountRecord.emailAddress;
+  return {
+    accountId: legacyHash(JSON.stringify(['authswitch-account-v1', 'anthropic',
+      accountUuid, organizationUuid])),
+    subject: accountUuid,
+    workspaceId: organizationUuid,
+    email: typeof email === 'string' && email ? email.toLowerCase() : null,
+    accessExpiresAt: typeof expiresAt === 'number' && Number.isFinite(expiresAt)
+      ? new Date(expiresAt).toISOString() : null,
+  };
+};
+
+/**
+ * The identity of an OpenCode OpenAI provider entry.
+ *
+ * OpenCode stores no id_token, so `OpenCodeHarness.openAiInfo` (ts/classes.opencodeharness.ts) reads the
+ * claims of the access token instead. An expired or opaque access token therefore leaves such an entry
+ * without a derivable identity, which is reported rather than guessed.
+ */
+export const openCodeOpenAiIdentity = (entry: Record<string, unknown>):
+{ identity: IOpenAiSourceIdentity | null; accessExpiresAt: string | null } => {
+  const access = typeof entry.access === 'string' ? entry.access : null;
+  const expires = entry.expires;
+  const accessExpiresAt = typeof expires === 'number' && Number.isFinite(expires)
+    ? new Date(expires).toISOString() : accessTokenExpiry(access);
+  return { identity: access === null ? null : openAiSourceIdentity(access), accessExpiresAt };
+};
+
+/** The expiry claim of an access token, as the broker reads it. Absent or unparsable means unknown. */
+export const accessTokenExpiry = (accessToken: string | null): string | null => {
+  if (!accessToken) return null;
+  try { return plugins.flexAuth.parseOpenAiChatGptTokenInfo(accessToken).expiresAt ?? null; }
+  catch { return null; }
+};
+
+/** Whether a non-rotating proof can still be taken with this access token. */
+export const accessProofAvailable = (expiresAt: string | null, now: number): boolean => {
+  if (expiresAt === null) return false;
+  const value = Date.parse(expiresAt);
+  return Number.isFinite(value) && value > now;
+};
+
+export const EXPIRED_ACCESS_PROBLEM =
+  'the stored access token has expired, so the non-rotating proof is unavailable until the native tool '
+  + 'refreshes its own store';