@modelprofile.com/flexharness-providers 7.0.1 → 8.0.0

package/ts_openai_auth/readme.md

@@ -11,6 +11,18 @@ pnpm add @modelprofile.com/flexharness-providers
 See the [toolbox usage and migration guide](https://code.foss.global/modelprofile.com/flexharness#readme)
 for composition examples and the SmartAI/SmartAgent migration map.
 
+The refresh helper preserves safe request-outcome metadata on
+`OpenAiChatGptAuthError`: `requestOutcome` is `notSent` only before the HTTP
+request is handed to `fetch`, and `outcomeUnknown` afterward. An observed
+response can also supply `status` and a bounded `retryAfterMs`. A 429 response
+does not prove that a rotating grant remained usable. The default safe-error
+mode omits provider response bodies.
+
+`createOpenAiChatGptModelConnection()` derives account and FedRAMP headers from
+the current access token. The token must contain an unexpired `exp` claim;
+supplied `accountId`, `isFedrampAccount`, and `tokenInfo` must agree with its
+claims. A saved ID-token snapshot cannot override current access-token facts.
+
 ## Issue Reporting and Security
 
 Report issues and security concerns through [community.foss.global](https://community.foss.global).

package/ts_openai_auth/smartai.auth.openai.ts

@@ -13,6 +13,7 @@ import type {
   IOpenAiChatGptTokenData,
   IOpenAiChatGptTokenInfo,
   TOpenAiChatGptBrowserCallback,
+  TOpenAiChatGptRequestOutcome,
 } from './interfaces.js';
 
 export const OPENAI_CHATGPT_AUTH_ISSUER = 'https://auth.openai.com';
@@ -43,12 +44,21 @@ const utf8ByteLength = (valueArg: string): number => textEncoder.encode(valueArg
 export class OpenAiChatGptAuthError extends Error {
   public status?: number;
   public body?: string;
-
-  constructor(message: string, options: { status?: number; body?: string } = {}) {
+  public requestOutcome?: TOpenAiChatGptRequestOutcome;
+  public retryAfterMs?: number;
+
+  constructor(message: string, options: {
+    status?: number;
+    body?: string;
+    requestOutcome?: TOpenAiChatGptRequestOutcome;
+    retryAfterMs?: number;
+  } = {}) {
     super(message);
     this.name = 'OpenAiChatGptAuthError';
     this.status = options.status;
     this.body = options.body;
+    this.requestOutcome = options.requestOutcome;
+    this.retryAfterMs = options.retryAfterMs;
   }
 }
 
@@ -215,6 +225,17 @@ async function readJson(
   }
 }
 
+const parseRetryAfterMs = (headerArg: string | null): number | undefined => {
+  if (!headerArg || headerArg.length > 128) return undefined;
+  const maximumDelayMs = 24 * 60 * 60 * 1000;
+  if (/^\d{1,10}$/.test(headerArg)) {
+    return Math.min(Number(headerArg) * 1000, maximumDelayMs);
+  }
+  const retryAt = Date.parse(headerArg);
+  if (!Number.isFinite(retryAt)) return undefined;
+  return Math.min(Math.max(0, retryAt - Date.now()), maximumDelayMs);
+};
+
 async function runFetch<TResult>(
   url: string,
   init: RequestInit,
@@ -225,9 +246,14 @@ async function runFetch<TResult>(
   ) => Promise<TResult>,
   timeoutMsArg = AUTH_REQUEST_TIMEOUT_MS,
 ): Promise<TResult> {
-  throwIfAborted(options);
+  if (options.signal?.aborted) {
+    throw new OpenAiChatGptAuthError('OpenAI ChatGPT authentication was aborted.', {
+      requestOutcome: 'notSent',
+    });
+  }
   const controller = new AbortController();
   let response: Response | undefined;
+  let requestStarted = false;
   const onExternalAbort = (): void => controller.abort();
   const onRequestAbort = (): void => {
     void response?.body?.cancel().catch(() => undefined);
@@ -245,7 +271,9 @@ async function runFetch<TResult>(
   try {
     return await Promise.race([
       (async () => {
-        response = await getFetch(options)(url, {
+        const fetchImplementation = getFetch(options);
+        requestStarted = true;
+        response = await fetchImplementation(url, {
           ...init,
           redirect: 'error',
           signal: controller.signal,
@@ -259,13 +287,29 @@ async function runFetch<TResult>(
       aborted,
     ]);
   } catch (error) {
-    if (error instanceof OpenAiChatGptAuthError) throw error;
+    const requestOutcome: TOpenAiChatGptRequestOutcome = requestStarted
+      ? 'outcomeUnknown'
+      : 'notSent';
+    const retryAfterMs = response ? parseRetryAfterMs(response.headers.get('retry-after')) : undefined;
+    if (error instanceof OpenAiChatGptAuthError) {
+      throw new OpenAiChatGptAuthError(error.message, {
+        ...(error.status !== undefined ? { status: error.status }
+          : response ? { status: response.status } : {}),
+        ...(error.body !== undefined ? { body: error.body } : {}),
+        requestOutcome,
+        ...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
+      });
+    }
     if (!usesSafeErrors(options)) throw error;
-    throw authError(
+    throw new OpenAiChatGptAuthError(
       options.signal?.aborted
         ? 'OpenAI ChatGPT authentication was aborted.'
         : 'OpenAI ChatGPT authentication request failed.',
-      options,
+      {
+        requestOutcome,
+        ...(response ? { status: response.status } : {}),
+        ...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
+      },
     );
   } finally {
     clearTimeout(timer);
@@ -370,7 +414,9 @@ export function parseOpenAiChatGptTokenInfo(token: string): IOpenAiChatGptTokenI
     chatgptUserId: asOptionalString(auth?.chatgpt_user_id) ?? asOptionalString(auth?.user_id),
     chatgptAccountId: asOptionalString(auth?.chatgpt_account_id),
     chatgptAccountIsFedramp: auth?.chatgpt_account_is_fedramp === true,
-    expiresAt: expiresAtSeconds ? new Date(expiresAtSeconds * 1000).toISOString() : undefined,
+    expiresAt: expiresAtSeconds !== undefined
+      ? new Date(expiresAtSeconds * 1000).toISOString()
+      : undefined,
     rawJwt: token,
   };
 }
@@ -760,16 +806,40 @@ export function createOpenAiChatGptProviderSettings(credentials: IOpenAiChatGptA
   baseURL: string;
   headers: Record<string, string>;
 } {
-  const tokenAccountId = credentials.tokenInfo?.chatgptAccountId;
+  const currentTokenInfo = parseOpenAiChatGptTokenInfo(credentials.accessToken);
+  if (
+    currentTokenInfo.expiresAt === undefined
+    || Date.parse(currentTokenInfo.expiresAt) <= Date.now()
+  ) {
+    throw new OpenAiChatGptAuthError('OpenAI ChatGPT access token has no valid future expiry.');
+  }
+  const tokenAccountId = currentTokenInfo.chatgptAccountId;
   if (
     credentials.accountId !== undefined
-    && tokenAccountId !== undefined
     && credentials.accountId !== tokenAccountId
   ) {
     throw new OpenAiChatGptAuthError('OpenAI ChatGPT account ID does not match the token claim.');
   }
-  const accountId = tokenAccountId ?? credentials.accountId;
-  const isFedrampAccount = credentials.tokenInfo?.chatgptAccountIsFedramp === true;
+  if (
+    credentials.tokenInfo !== undefined
+    && (
+      credentials.tokenInfo.chatgptAccountId !== tokenAccountId
+      || credentials.tokenInfo.chatgptAccountIsFedramp !== currentTokenInfo.chatgptAccountIsFedramp
+    )
+  ) {
+    throw new OpenAiChatGptAuthError('OpenAI ChatGPT token information does not match the current access token.');
+  }
+  if (
+    credentials.isFedrampAccount !== undefined
+    && (
+      typeof credentials.isFedrampAccount !== 'boolean'
+      || credentials.isFedrampAccount !== currentTokenInfo.chatgptAccountIsFedramp
+    )
+  ) {
+    throw new OpenAiChatGptAuthError('OpenAI ChatGPT FedRAMP status does not match the token claim.');
+  }
+  const accountId = tokenAccountId;
+  const isFedrampAccount = currentTokenInfo.chatgptAccountIsFedramp;
   const headers: Record<string, string> = {
     originator: credentials.originator ?? OPENAI_CHATGPT_DEFAULT_ORIGINATOR,
   };