@nocobase/plugin-ai 2.1.6 → 2.1.8

package/dist/node_modules/openai/src/auth/types.ts

@@ -0,0 +1,28 @@
+export interface SubjectTokenProvider {
+  tokenType: 'jwt' | 'id';
+  getToken: () => Promise<string>;
+}
+
+export interface WorkloadIdentity {
+  /**Optional client identifier for token exchange compatibility.*/
+  clientId?: string;
+
+  /**Identity provider resource id in WIFAPI.*/
+  identityProviderId: string;
+
+  /**OpenAI Service account id to bind the verified external identity to.*/
+  serviceAccountId: string;
+
+  /**The provider configuration for obtaining the subject token.*/
+  provider: SubjectTokenProvider;
+
+  /**Optional buffer time in seconds to refresh the OpenAI token before it expires. Defaults to 1200 seconds (20 minutes).*/
+  refreshBufferSeconds?: number;
+}
+
+export interface TokenExchangeResponse {
+  access_token: string;
+  issued_token_type: string;
+  token_type: string;
+  expires_in?: number;
+}

package/dist/node_modules/openai/src/auth/workload-identity-auth.ts

@@ -0,0 +1,122 @@
+import type { WorkloadIdentity, TokenExchangeResponse } from './types';
+import type { Fetch } from '../internal/builtin-types';
+import * as Shims from '../internal/shims';
+import { APIError, OAuthError } from '../core/error';
+
+interface CachedToken {
+  token: string;
+  expiresAt: number;
+}
+
+const SUBJECT_TOKEN_TYPES: Record<WorkloadIdentity['provider']['tokenType'], string> = {
+  jwt: 'urn:ietf:params:oauth:token-type:jwt',
+  id: 'urn:ietf:params:oauth:token-type:id_token',
+};
+
+const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+
+export class WorkloadIdentityAuth {
+  private cachedToken: CachedToken | null = null;
+  private refreshPromise: Promise<string> | null = null;
+  private readonly config: WorkloadIdentity;
+  private readonly tokenExchangeUrl: string = 'https://auth.openai.com/oauth/token';
+  private readonly fetch: Fetch;
+
+  constructor(config: WorkloadIdentity, fetch?: Fetch) {
+    this.config = config;
+    this.fetch = fetch ?? Shims.getDefaultFetch();
+  }
+
+  async getToken(): Promise<string> {
+    if (!this.cachedToken || this.isTokenExpired(this.cachedToken)) {
+      if (this.refreshPromise) {
+        return await this.refreshPromise;
+      }
+
+      this.refreshPromise = this.refreshToken();
+
+      try {
+        const token = await this.refreshPromise;
+        return token;
+      } finally {
+        this.refreshPromise = null;
+      }
+    }
+
+    if (this.needsRefresh(this.cachedToken) && !this.refreshPromise) {
+      this.refreshPromise = this.refreshToken().finally(() => {
+        this.refreshPromise = null;
+      });
+    }
+
+    return this.cachedToken.token;
+  }
+
+  private async refreshToken(): Promise<string> {
+    const subjectToken = await this.config.provider.getToken();
+    const body: Record<string, string> = {
+      grant_type: TOKEN_EXCHANGE_GRANT_TYPE,
+      subject_token: subjectToken,
+      subject_token_type: SUBJECT_TOKEN_TYPES[this.config.provider.tokenType],
+      identity_provider_id: this.config.identityProviderId,
+      service_account_id: this.config.serviceAccountId,
+    };
+
+    if (this.config.clientId) {
+      body['client_id'] = this.config.clientId;
+    }
+
+    const response = await this.fetch(this.tokenExchangeUrl, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(body),
+    });
+
+    if (!response.ok) {
+      const errorText = await response.text();
+      let body: any = undefined;
+
+      try {
+        body = JSON.parse(errorText);
+      } catch {}
+
+      if (response.status === 400 || response.status === 401 || response.status === 403) {
+        throw new OAuthError(response.status as 400 | 401 | 403, body, response.headers);
+      }
+      throw APIError.generate(
+        response.status,
+        body,
+        `Token exchange failed with status ${response.status}`,
+        response.headers,
+      );
+    }
+
+    const tokenResponse = (await response.json()) as TokenExchangeResponse;
+    const expiresIn = tokenResponse.expires_in || 3600;
+    const expiresAt = Date.now() + expiresIn * 1000;
+
+    this.cachedToken = {
+      token: tokenResponse.access_token,
+      expiresAt,
+    };
+
+    return tokenResponse.access_token;
+  }
+
+  private isTokenExpired(cachedToken: CachedToken): boolean {
+    return Date.now() >= cachedToken.expiresAt;
+  }
+
+  private needsRefresh(cachedToken: CachedToken): boolean {
+    const bufferSeconds = this.config.refreshBufferSeconds ?? 1200;
+    const bufferMs = bufferSeconds * 1000;
+    return Date.now() >= cachedToken.expiresAt - bufferMs;
+  }
+
+  invalidateToken(): void {
+    this.cachedToken = null;
+    this.refreshPromise = null;
+  }
+}

package/dist/node_modules/openai/src/azure.ts

@@ -4,7 +4,8 @@ import { buildHeaders } from './internal/headers';
 import * as Errors from './error';
 import { FinalRequestOptions } from './internal/request-options';
 import { isObj, readEnv } from './internal/utils';
-import { ClientOptions, OpenAI } from './client';
+import { OpenAI } from './client';
+import type { ClientOptions } from './client';
 
 /** API Client for interfacing with the Azure OpenAI API. */
 export interface AzureClientOptions extends ClientOptions {
@@ -137,11 +138,15 @@ export class AzureOpenAI extends OpenAI {
     return super.buildRequest(options, props);
   }
 
-  protected override async authHeaders(opts: FinalRequestOptions): Promise<NullableHeaders | undefined> {
-    if (typeof this._options.apiKey === 'string') {
+  protected override async authHeaders(
+    opts: FinalRequestOptions,
+    schemes?: { bearerAuth?: boolean; adminAPIKeyAuth?: boolean },
+  ): Promise<NullableHeaders | undefined> {
+    const security = schemes ?? { bearerAuth: true, adminAPIKeyAuth: true };
+    if (security.bearerAuth && typeof this._options.apiKey === 'string') {
       return buildHeaders([{ 'api-key': this.apiKey }]);
     }
-    return super.authHeaders(opts);
+    return super.authHeaders(opts, security);
   }
 }
 

package/dist/node_modules/openai/src/beta/realtime/websocket.ts

@@ -117,11 +117,16 @@ export class OpenAIRealtimeWebSocket extends OpenAIRealtimeEmitter {
     options: { deploymentName?: string; dangerouslyAllowBrowser?: boolean } = {},
   ): Promise<OpenAIRealtimeWebSocket> {
     const isApiKeyProvider = await client._callApiKey();
+    const apiKey = client.apiKey;
+    if (!apiKey) {
+      throw new Error('Azure OpenAI Realtime requires an API key');
+    }
+    const azureApiKey = apiKey;
     function onURL(url: URL) {
       if (isApiKeyProvider) {
-        url.searchParams.set('Authorization', `Bearer ${client.apiKey}`);
+        url.searchParams.set('Authorization', `Bearer ${azureApiKey}`);
       } else {
-        url.searchParams.set('api-key', client.apiKey);
+        url.searchParams.set('api-key', azureApiKey);
       }
     }
     const deploymentName = options.deploymentName ?? client.deploymentName;

package/dist/node_modules/openai/src/beta/realtime/ws.ts

@@ -76,6 +76,10 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
     props: { deploymentName?: string; options?: WS.ClientOptions | undefined } = {},
   ): Promise<OpenAIRealtimeWS> {
     const isApiKeyProvider = await client._callApiKey();
+    const apiKey = client.apiKey;
+    if (!apiKey) {
+      throw new Error('Azure OpenAI Realtime requires an API key');
+    }
     const deploymentName = props.deploymentName ?? client.deploymentName;
     if (!deploymentName) {
       throw new Error('No deployment name provided');
@@ -87,7 +91,7 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
           ...props.options,
           headers: {
             ...props.options?.headers,
-            ...(isApiKeyProvider ? {} : { 'api-key': client.apiKey }),
+            ...(isApiKeyProvider ? {} : { 'api-key': apiKey }),
           },
         },
         __resolvedApiKey: isApiKeyProvider,