@nodetool-ai/websocket 0.7.0-rc.23 → 0.8.1

package/dist/oauth-api.js

@@ -6,7 +6,12 @@
  * Supports HuggingFace and GitHub OAuth flows with PKCE.
  */
 import { createHash, randomBytes } from "node:crypto";
-import { OAuthCredential } from "@nodetool-ai/models";
+import { createLogger, isAuthEnforced, isGoogleWorkspaceEnabled } from "@nodetool-ai/config";
+import { OAuthCredential, storeGoogleCredential, deleteGoogleCredentials, GOOGLE_CREDENTIAL_PROVIDER } from "@nodetool-ai/models";
+import { OAuthClient, LocalCallbackServer, ClaudeCodeLogin, extractChatGptAccountId, CODEX_OAUTH_CLIENT_ID, CODEX_CALLBACK_PORT, CODEX_CALLBACK_PATH, DEFAULT_CODEX_OAUTH_CONFIG } from "@nodetool-ai/runtime/oauth";
+import { clearProviderCache } from "@nodetool-ai/runtime";
+import { isFiniteNumber, isNonEmptyString, isString } from "./lib/wire-values.js";
+const logger = createLogger("nodetool.websocket.oauth");
 // ── Constants ────────────────────────────────────────────────────────
 const HF_AUTHORIZATION_URL = "https://huggingface.co/oauth/authorize";
 const HF_TOKEN_URL = "https://huggingface.co/oauth/token";
@@ -17,6 +22,18 @@ const GITHUB_AUTHORIZATION_URL = "https://github.com/login/oauth/authorize";
 const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
 const GITHUB_USER_URL = "https://api.github.com/user";
 const GITHUB_SCOPES = ["user:email", "read:user"];
+// OpenAI OAuth uses the public Codex CLI client (no client secret, no
+// per-deployment registration). The authorization server only accepts the
+// Codex-registered loopback redirect (http://localhost:1455/auth/callback), so
+// the browser is redirected to a local single-shot listener rather than back to
+// a server route. `localhost` resolves in the *browser's* machine, so binding
+// that port here only receives the code when the browser runs on this machine
+// too. On a shared server it does not, and the browser lands on its own
+// localhost with the code sitting in the address bar — so that host skips the
+// listener and the user pastes the address back instead.
+const OPENAI_USERINFO_URL = process.env.OPENAI_OAUTH_USERINFO_URL ?? "https://auth.openai.com/userinfo";
+/** The Codex-registered loopback redirect the client id is bound to. */
+const CODEX_REDIRECT_URI = `http://localhost:${CODEX_CALLBACK_PORT}${CODEX_CALLBACK_PATH}`;
 const STATE_TTL_MS = 5 * 60 * 1000; // 5 minutes
 // ── PKCE Utilities ───────────────────────────────────────────────────
 export function generatePkcePair() {
@@ -328,12 +345,17 @@ async function handleHfRefresh(request, getUserId) {
         return errorResponse(400, "No refresh token available. Please re-authenticate.");
     }
     try {
+        // Send the decrypted refresh token, not the at-rest ciphertext.
+        const currentRefreshToken = await credential.getDecryptedRefreshToken();
+        if (!currentRefreshToken) {
+            return errorResponse(400, "No refresh token available. Please re-authenticate.");
+        }
         const tokenRes = await fetch(HF_TOKEN_URL, {
             method: "POST",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             body: new URLSearchParams({
                 grant_type: "refresh_token",
-                refresh_token: credential.encrypted_refresh_token,
+                refresh_token: currentRefreshToken,
                 client_id: HF_CLIENT_ID
             })
         });
@@ -343,7 +365,8 @@ async function handleHfRefresh(request, getUserId) {
         }
         const tokenData = (await tokenRes.json());
         const accessToken = tokenData.access_token;
-        const newRefreshToken = tokenData.refresh_token ?? credential.encrypted_refresh_token;
+        // Reuse the current (plaintext) refresh token if the response omits one.
+        const newRefreshToken = tokenData.refresh_token ?? currentRefreshToken;
         const tokenType = tokenData.token_type ?? credential.token_type;
         const scope = tokenData.scope ?? credential.scope;
         const expiresIn = tokenData.expires_in;
@@ -354,13 +377,15 @@ async function handleHfRefresh(request, getUserId) {
         if (expiresIn) {
             expiresAt = new Date(Date.now() + expiresIn * 1000).toISOString();
         }
-        credential.encrypted_access_token = accessToken;
-        credential.encrypted_refresh_token = newRefreshToken;
-        credential.token_type = tokenType;
-        credential.scope = scope;
-        credential.received_at = new Date().toISOString();
-        credential.expires_at = expiresAt;
-        await credential.save();
+        // updateTokens encrypts before persisting — never assign plaintext to the
+        // encrypted_* columns directly.
+        await credential.updateTokens({
+            accessToken,
+            refreshToken: newRefreshToken,
+            tokenType,
+            scope,
+            expiresAt
+        });
         return jsonResponse({
             success: true,
             message: "Token refreshed successfully"
@@ -384,9 +409,11 @@ async function handleHfWhoami(request, getUserId) {
         return errorResponse(404, `No credential found for account_id: ${accountId}`);
     }
     try {
+        // Send the decrypted token, not the at-rest ciphertext, or HF always 401s.
+        const accessToken = await credential.getDecryptedAccessToken();
         const res = await fetch(HF_WHOAMI_URL, {
             headers: {
-                Authorization: `${credential.token_type} ${credential.encrypted_access_token}`
+                Authorization: `${credential.token_type} ${accessToken}`
             }
         });
         if (res.status === 401) {
@@ -607,9 +634,11 @@ async function handleGithubUser(request, getUserId) {
         return errorResponse(404, `No credential found for account_id: ${accountId}`);
     }
     try {
+        // Send the decrypted token, not the at-rest ciphertext, or GitHub 401s.
+        const accessToken = await credential.getDecryptedAccessToken();
         const res = await fetch(GITHUB_USER_URL, {
             headers: {
-                Authorization: `${credential.token_type} ${credential.encrypted_access_token}`,
+                Authorization: `${credential.token_type} ${accessToken}`,
                 Accept: "application/json"
             }
         });
@@ -628,6 +657,471 @@ async function handleGithubUser(request, getUserId) {
         return errorResponse(500, `Failed to communicate with GitHub: ${message}`);
     }
 }
+// ── OpenAI (Codex) Endpoints ─────────────────────────────────────────
+//
+// The login uses the public Codex CLI OAuth client. Because the Codex client's
+// only registered redirect is the loopback http://localhost:1455/auth/callback,
+// the flow can't bounce back through a server route. Two ways to finish, both
+// from the one authorization request `start` creates:
+//
+//  - **Loopback** — `start` binds a one-shot listener on port 1455 and finishes
+//    the exchange in the background. Only works when the browser runs on this
+//    machine (desktop, local dev).
+//  - **Manual** — the browser is redirected to its own localhost, where nothing
+//    answers, and the user pastes the address back to `/complete`. The only
+//    option on a shared server, which is what `start` offers there.
+//
+// The UI reflects success by polling `/api/oauth/openai/tokens`.
+/** How long a started login stays completable from a pasted address. */
+const CODEX_LOGIN_TTL_MS = 10 * 60 * 1000;
+/** Logins awaiting a pasted redirect address, keyed by their CSRF state. */
+export const pendingCodexLogins = new Map();
+function pruneExpiredCodexLogins() {
+    const now = Date.now();
+    for (const [state, pending] of pendingCodexLogins) {
+        if (now - pending.createdAt > CODEX_LOGIN_TTL_MS) {
+            pendingCodexLogins.delete(state);
+        }
+    }
+}
+/**
+ * Read `code` and `state` out of what the user pastes back — the whole address
+ * the browser was sent to, or just its query string. The state is required: it
+ * is the CSRF check, and a bare code cannot be tied to the login it belongs to.
+ */
+export function parseCodexRedirect(input) {
+    let query = input.trim();
+    const questionMark = query.indexOf("?");
+    if (questionMark >= 0) {
+        query = query.slice(questionMark + 1);
+        const hash = query.indexOf("#");
+        if (hash >= 0)
+            query = query.slice(0, hash);
+    }
+    const params = new URLSearchParams(query);
+    const error = params.get("error");
+    if (error) {
+        throw new Error(params.get("error_description") || `Sign-in was refused: ${error}`);
+    }
+    const code = params.get("code");
+    const state = params.get("state");
+    if (!code || !state) {
+        throw new Error("Paste the whole address the browser was sent to — it carries both the code and the state.");
+    }
+    return { code, state };
+}
+/** Build the Codex OAuth client (public client id, no secret). */
+function codexOAuthClient() {
+    const clientId = process.env.CODEX_OAUTH_CLIENT_ID || CODEX_OAUTH_CLIENT_ID;
+    return new OAuthClient({
+        config: { ...DEFAULT_CODEX_OAUTH_CONFIG, clientId }
+    });
+}
+/** The single in-flight login, so a re-click can supersede a stale listener. */
+let activeCodexLogin = null;
+/** Abort and tear down any in-flight Codex login listener. Idempotent. */
+export async function closeActiveCodexCallbackServer() {
+    const active = activeCodexLogin;
+    if (!active)
+        return;
+    activeCodexLogin = null;
+    active.abort.abort();
+    await active.server.close().catch(() => { });
+}
+async function handleOpenAIStart(request, getUserId) {
+    if (request.method !== "GET")
+        return errorResponse(405, "Method not allowed");
+    const userId = getUserId();
+    const url = new URL(request.url);
+    const client = codexOAuthClient();
+    const { codeVerifier, codeChallenge } = generatePkcePair();
+    const state = generateState();
+    // A shared server's users browse from their own machines, where the loopback
+    // redirect lands — so binding it here would receive nothing. The caller can
+    // also ask for the paste flow outright.
+    const manual = url.searchParams.get("manual") === "true" || isAuthEnforced();
+    pruneExpiredCodexLogins();
+    pendingCodexLogins.set(state, { userId, codeVerifier, createdAt: Date.now() });
+    // A new attempt supersedes any listener left over from an abandoned one.
+    await closeActiveCodexCallbackServer();
+    if (!manual) {
+        const server = new LocalCallbackServer({
+            host: "localhost",
+            port: CODEX_CALLBACK_PORT,
+            path: CODEX_CALLBACK_PATH
+        });
+        try {
+            await server.listen();
+        }
+        catch (err) {
+            pendingCodexLogins.delete(state);
+            const message = err instanceof Error ? err.message : String(err);
+            return errorResponse(500, `Could not start the OAuth callback listener on port ${CODEX_CALLBACK_PORT}: ${message}`);
+        }
+        const abort = new AbortController();
+        activeCodexLogin = { server, abort };
+        // Finish the exchange off the request path; the UI polls /tokens.
+        void completeCodexLogin({
+            server,
+            client,
+            state,
+            codeVerifier,
+            userId,
+            abort
+        });
+    }
+    const authUrl = client.buildAuthorizationUrl({
+        redirectUri: CODEX_REDIRECT_URI,
+        state,
+        codeChallenge,
+        codeChallengeMethod: "S256"
+    });
+    return jsonResponse({
+        auth_url: authUrl,
+        manual,
+        redirect_uri: CODEX_REDIRECT_URI
+    });
+}
+/** Await the loopback redirect, exchange the code, and persist credentials. */
+async function completeCodexLogin(args) {
+    const { server, client, state, codeVerifier, userId, abort } = args;
+    try {
+        const { code } = await server.waitForCode({
+            expectedState: state,
+            timeoutMs: STATE_TTL_MS,
+            signal: abort.signal
+        });
+        const tokens = await client.exchangeAuthorizationCode({
+            code,
+            codeVerifier,
+            redirectUri: CODEX_REDIRECT_URI,
+            signal: abort.signal
+        });
+        const accountId = await persistCodexTokens(tokens, userId);
+        logger.info("Codex OAuth login completed", { accountId });
+    }
+    catch (err) {
+        logger.warn("Codex OAuth login did not complete", {
+            error: err instanceof Error ? err.message : String(err)
+        });
+    }
+    finally {
+        pendingCodexLogins.delete(state);
+        await server.close().catch(() => { });
+        if (activeCodexLogin?.server === server)
+            activeCodexLogin = null;
+    }
+}
+/** Store exchanged Codex tokens against a user; returns the account id used. */
+async function persistCodexTokens(tokens, userId) {
+    // Prefer the ChatGPT account id embedded in the Codex access-token JWT — it
+    // is the stable identity the ChatGPT backend addresses accounts by. Falls
+    // back to the OIDC `sub`, then to an opaque token-derived id.
+    const chatgptAccountId = extractChatGptAccountId(tokens.accessToken);
+    let accountId = chatgptAccountId ?? String(Math.abs(hashCode(tokens.accessToken.slice(0, 24))));
+    // Best-effort OIDC userinfo for a friendly account label.
+    let username = null;
+    try {
+        const infoRes = await fetch(OPENAI_USERINFO_URL, {
+            headers: { Authorization: `${tokens.tokenType} ${tokens.accessToken}` }
+        });
+        if (infoRes.ok) {
+            const info = (await infoRes.json());
+            username =
+                info.email ?? info.name ?? info.sub ?? null;
+            if (!chatgptAccountId && isNonEmptyString(info.sub)) {
+                accountId = info.sub;
+            }
+        }
+    }
+    catch {
+        // userinfo is optional — keep the fallback account id.
+    }
+    await OAuthCredential.upsert({
+        user_id: userId,
+        provider: "openai",
+        account_id: accountId,
+        access_token: tokens.accessToken,
+        refresh_token: tokens.refreshToken,
+        username,
+        token_type: tokens.tokenType,
+        scope: tokens.scope,
+        received_at: new Date(tokens.receivedAt).toISOString(),
+        expires_at: tokens.expiresAt != null ? new Date(tokens.expiresAt).toISOString() : null
+    });
+    // The chat agent holds a per-user provider set built from the credentials it
+    // could resolve at the time. Without this the sign-in lands in the database
+    // and the agent goes on without Codex until the process restarts — which a
+    // production server does not do.
+    clearProviderCache();
+    return accountId;
+}
+/** Complete a started login from the address the browser was redirected to. */
+async function handleOpenAIComplete(request, getUserId) {
+    if (request.method !== "POST")
+        return errorResponse(405, "Method not allowed");
+    let body;
+    try {
+        body = (await request.json());
+    }
+    catch {
+        return errorResponse(400, "Invalid JSON body");
+    }
+    const raw = isString(body.code) ? body.code : "";
+    if (!raw.trim())
+        return errorResponse(400, "code is required");
+    let redirect;
+    try {
+        redirect = parseCodexRedirect(raw);
+    }
+    catch (err) {
+        return errorResponse(400, err instanceof Error ? err.message : String(err));
+    }
+    pruneExpiredCodexLogins();
+    const pending = pendingCodexLogins.get(redirect.state);
+    const userId = getUserId();
+    // An unknown state and another user's state are the same answer: this login
+    // is not one we can finish, and saying which it was leaks the difference.
+    if (!pending || pending.userId !== userId) {
+        return errorResponse(400, "That sign-in expired or was never started here. Start it again and paste the new address.");
+    }
+    pendingCodexLogins.delete(redirect.state);
+    // The code is spent; any loopback listener still up is waiting for nothing.
+    await closeActiveCodexCallbackServer();
+    try {
+        const tokens = await codexOAuthClient().exchangeAuthorizationCode({
+            code: redirect.code,
+            codeVerifier: pending.codeVerifier,
+            redirectUri: CODEX_REDIRECT_URI
+        });
+        const accountId = await persistCodexTokens(tokens, userId);
+        logger.info("Codex OAuth login completed from a pasted address", {
+            accountId
+        });
+        return jsonResponse({ success: true });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        logger.warn("Codex OAuth code exchange failed", { error: message });
+        return errorResponse(400, message);
+    }
+}
+async function handleOpenAITokens(getUserId) {
+    const userId = getUserId();
+    const credentials = await OAuthCredential.listForUserAndProvider(userId, "openai");
+    return jsonResponse({ tokens: credentials.map(toTokenMetadata) });
+}
+async function handleOpenAIDisconnect(request, getUserId) {
+    if (request.method !== "POST")
+        return errorResponse(405, "Method not allowed");
+    const userId = getUserId();
+    const credentials = await OAuthCredential.listForUserAndProvider(userId, "openai");
+    for (const credential of credentials) {
+        await credential.delete();
+    }
+    clearProviderCache();
+    return jsonResponse({ success: true, removed: credentials.length });
+}
+// ── Claude (subscription) Endpoints ──────────────────────────────────
+//
+// Signs in with a Claude subscription using the same public OAuth client the
+// `claude` CLI uses, and writes the tokens to the Claude Agent SDK's credential
+// file (`~/.claude/.credentials.json`). That file — not the database — is the
+// store, because the SDK spawns the `claude` binary as this process's user and
+// reads it directly; a per-user DB row would be invisible to it.
+//
+// Two ways to finish, both from the one authorization request `start` creates,
+// mirroring the Codex flow above:
+//
+//  - **Loopback** — `start` binds the `claude` CLI's own callback port (54545)
+//    and finishes the exchange in the background. Only works when the browser
+//    runs on this machine (desktop, local dev).
+//  - **Manual** — the browser is sent to the console, which displays a
+//    `code#state` the user pastes back to `/complete`. What `start` offers on a
+//    shared server (`isAuthEnforced()`) or when asked with `?manual=true`.
+//
+// The UI reflects success by polling `/api/oauth/claude/tokens`.
+/** The single in-flight login, so a re-click supersedes a stale listener. */
+let activeClaudeLogin = null;
+/** Abort and tear down any in-flight Claude login. Idempotent. */
+export async function closeActiveClaudeLogin() {
+    const active = activeClaudeLogin;
+    if (!active)
+        return;
+    activeClaudeLogin = null;
+    active.abort.abort();
+    await active.pending.cancel().catch(() => { });
+}
+async function handleClaudeStart(request) {
+    if (request.method !== "GET")
+        return errorResponse(405, "Method not allowed");
+    const url = new URL(request.url);
+    const loginMethod = url.searchParams.get("login_method") === "console" ? "console" : "claude-ai";
+    // A shared server's users browse from their own machines, where the loopback
+    // redirect lands — so binding it here would receive nothing. The caller can
+    // also ask for the paste flow outright.
+    const manual = url.searchParams.get("manual") === "true" || isAuthEnforced();
+    await closeActiveClaudeLogin();
+    const login = new ClaudeCodeLogin();
+    let pending;
+    try {
+        pending = await login.begin({ loginMethod, manualOnly: manual });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return errorResponse(500, `Could not start the Claude login: ${message}`);
+    }
+    const abort = new AbortController();
+    activeClaudeLogin = { pending, abort };
+    if (pending.authUrl) {
+        // Finish off the request path; the UI polls /tokens for success.
+        void pending
+            .waitForRedirect(abort.signal)
+            .then(() => logger.info("Claude OAuth login completed"))
+            .catch((err) => {
+            logger.warn("Claude OAuth login did not complete", {
+                error: err instanceof Error ? err.message : String(err)
+            });
+        })
+            .finally(() => {
+            if (activeClaudeLogin?.pending === pending)
+                activeClaudeLogin = null;
+        });
+    }
+    return jsonResponse({
+        auth_url: pending.authUrl ?? pending.manualAuthUrl,
+        manual_auth_url: pending.manualAuthUrl,
+        manual,
+        redirect_uri: pending.redirectUri,
+        state: pending.state
+    });
+}
+/** Complete a started login from the `code#state` the console displayed. */
+async function handleClaudeComplete(request) {
+    if (request.method !== "POST")
+        return errorResponse(405, "Method not allowed");
+    const active = activeClaudeLogin;
+    if (!active) {
+        return errorResponse(400, "No Claude login in progress. Start one and try again.");
+    }
+    let body;
+    try {
+        body = (await request.json());
+    }
+    catch {
+        return errorResponse(400, "Invalid JSON body");
+    }
+    const code = isString(body.code) ? body.code : "";
+    if (!code)
+        return errorResponse(400, "code is required");
+    try {
+        await active.pending.completeWithPastedCode(code);
+        logger.info("Claude OAuth login completed from a pasted code");
+        return jsonResponse({ success: true });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return errorResponse(400, message);
+    }
+    finally {
+        if (activeClaudeLogin === active)
+            activeClaudeLogin = null;
+    }
+}
+/**
+ * Connection status, shaped like the other providers' `tokens` responses so the
+ * shared `useOAuthConnection` hook works unchanged. There is at most one login.
+ */
+async function handleClaudeTokens() {
+    const status = await new ClaudeCodeLogin().status();
+    return jsonResponse({
+        tokens: status.connected
+            ? [
+                {
+                    provider: "claude",
+                    scope: status.scopes.join(" "),
+                    expires_at: status.expiresAt != null
+                        ? new Date(status.expiresAt).toISOString()
+                        : null,
+                    expired: status.expired,
+                    subscription_type: status.subscriptionType,
+                    rate_limit_tier: status.rateLimitTier,
+                    credentials_path: status.credentialsPath
+                }
+            ]
+            : []
+    });
+}
+async function handleClaudeDisconnect(request) {
+    if (request.method !== "POST")
+        return errorResponse(405, "Method not allowed");
+    await closeActiveClaudeLogin();
+    const removed = await new ClaudeCodeLogin().logout();
+    return jsonResponse({ success: true, removed: removed ? 1 : 0 });
+}
+/** Coerce Supabase's `expires_at` (unix seconds or ISO string) to ISO. */
+function toIsoExpiry(value) {
+    if (isFiniteNumber(value)) {
+        return new Date(value * 1000).toISOString();
+    }
+    if (isNonEmptyString(value)) {
+        const parsed = Date.parse(value);
+        if (!Number.isNaN(parsed))
+            return new Date(parsed).toISOString();
+    }
+    return null;
+}
+async function handleGoogleSession(request, getUserId) {
+    if (request.method !== "POST")
+        return errorResponse(405, "Method not allowed");
+    if (!isGoogleWorkspaceEnabled()) {
+        return errorResponse(404, "Google Workspace integration is not enabled");
+    }
+    let body;
+    try {
+        body = (await request.json());
+    }
+    catch {
+        return errorResponse(400, "Invalid JSON body");
+    }
+    const accessToken = isString(body.access_token) ? body.access_token : "";
+    if (!accessToken) {
+        return errorResponse(400, "access_token is required");
+    }
+    const userId = getUserId();
+    const email = isString(body.email) ? body.email : null;
+    const credential = await storeGoogleCredential({
+        userId,
+        // One credential row per Google account. The email is the stable identity
+        // the user recognises; fall back to the NodeTool user id.
+        accountId: (isNonEmptyString(body.account_id) && body.account_id) ||
+            email ||
+            userId,
+        accessToken,
+        refreshToken: isString(body.refresh_token) ? body.refresh_token : null,
+        email,
+        scope: isString(body.scope) ? body.scope : null,
+        expiresAt: toIsoExpiry(body.expires_at)
+    });
+    logger.info("Google session token stored", { accountId: credential.account_id });
+    return jsonResponse({ success: true, token: toTokenMetadata(credential) });
+}
+async function handleGoogleTokens(getUserId) {
+    if (!isGoogleWorkspaceEnabled()) {
+        return jsonResponse({ enabled: false, tokens: [] });
+    }
+    const credentials = await OAuthCredential.listForUserAndProvider(getUserId(), GOOGLE_CREDENTIAL_PROVIDER);
+    return jsonResponse({
+        enabled: true,
+        tokens: credentials.map(toTokenMetadata)
+    });
+}
+async function handleGoogleDisconnect(request, getUserId) {
+    if (request.method !== "POST")
+        return errorResponse(405, "Method not allowed");
+    const removed = await deleteGoogleCredentials(getUserId());
+    return jsonResponse({ success: true, removed });
+}
 // ── Simple hash helper (replicates Python's hash() for fallback) ─────
 function hashCode(str) {
     let hash = 0;
@@ -674,6 +1168,31 @@ export async function handleOAuthRequest(request, pathname, getUserId) {
             return handleGithubTokens(getUserId);
         case "/api/oauth/github/user":
             return handleGithubUser(request, getUserId);
+        // OpenAI (Codex)
+        case "/api/oauth/openai/start":
+            return handleOpenAIStart(request, getUserId);
+        case "/api/oauth/openai/complete":
+            return handleOpenAIComplete(request, getUserId);
+        case "/api/oauth/openai/tokens":
+            return handleOpenAITokens(getUserId);
+        case "/api/oauth/openai/disconnect":
+            return handleOpenAIDisconnect(request, getUserId);
+        // Claude subscription (Claude Agent SDK credentials)
+        case "/api/oauth/claude/start":
+            return handleClaudeStart(request);
+        case "/api/oauth/claude/complete":
+            return handleClaudeComplete(request);
+        case "/api/oauth/claude/tokens":
+            return handleClaudeTokens();
+        case "/api/oauth/claude/disconnect":
+            return handleClaudeDisconnect(request);
+        // Google Workspace (token comes from the Supabase Google login)
+        case "/api/oauth/google/session":
+            return handleGoogleSession(request, getUserId);
+        case "/api/oauth/google/tokens":
+            return handleGoogleTokens(getUserId);
+        case "/api/oauth/google/disconnect":
+            return handleGoogleDisconnect(request, getUserId);
         default:
             return null;
     }