@sriinnu/runic 1.0.0

package/Sources/RunicCore/Providers/Codex/CodexOAuth/CodexOAuthCredentials.swift

@@ -0,0 +1,146 @@
+import Foundation
+
+public struct CodexOAuthCredentials: Sendable {
+    public let accessToken: String
+    public let refreshToken: String
+    public let idToken: String?
+    public let accountId: String?
+    public let lastRefresh: Date?
+
+    public init(
+        accessToken: String,
+        refreshToken: String,
+        idToken: String?,
+        accountId: String?,
+        lastRefresh: Date?)
+    {
+        self.accessToken = accessToken
+        self.refreshToken = refreshToken
+        self.idToken = idToken
+        self.accountId = accountId
+        self.lastRefresh = lastRefresh
+    }
+
+    public var needsRefresh: Bool {
+        guard let lastRefresh else { return true }
+        let eightDays: TimeInterval = 8 * 24 * 60 * 60
+        return Date().timeIntervalSince(lastRefresh) > eightDays
+    }
+}
+
+public enum CodexOAuthCredentialsError: LocalizedError, Sendable {
+    case notFound
+    case decodeFailed(String)
+    case missingTokens
+
+    public var errorDescription: String? {
+        switch self {
+        case .notFound:
+            "Codex auth.json not found. Run `codex` to log in."
+        case let .decodeFailed(message):
+            "Failed to decode Codex credentials: \(message)"
+        case .missingTokens:
+            "Codex auth.json exists but contains no tokens."
+        }
+    }
+}
+
+public enum CodexOAuthCredentialsStore {
+    private static var authFilePath: URL {
+        let home = FileManager.default.homeDirectoryForCurrentUser
+        if let codexHome = ProcessInfo.processInfo.environment["CODEX_HOME"]?.trimmingCharacters(
+            in: .whitespacesAndNewlines),
+            !codexHome.isEmpty
+        {
+            return URL(fileURLWithPath: codexHome).appendingPathComponent("auth.json")
+        }
+        return home.appendingPathComponent(".codex").appendingPathComponent("auth.json")
+    }
+
+    public static func load() throws -> CodexOAuthCredentials {
+        let url = self.authFilePath
+        guard FileManager.default.fileExists(atPath: url.path) else {
+            throw CodexOAuthCredentialsError.notFound
+        }
+
+        let data = try Data(contentsOf: url)
+        return try self.parse(data: data)
+    }
+
+    public static func parse(data: Data) throws -> CodexOAuthCredentials {
+        guard let json = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+            throw CodexOAuthCredentialsError.decodeFailed("Invalid JSON")
+        }
+
+        if let apiKey = json["OPENAI_API_KEY"] as? String,
+           !apiKey.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
+        {
+            return CodexOAuthCredentials(
+                accessToken: apiKey,
+                refreshToken: "",
+                idToken: nil,
+                accountId: nil,
+                lastRefresh: nil)
+        }
+
+        guard let tokens = json["tokens"] as? [String: Any] else {
+            throw CodexOAuthCredentialsError.missingTokens
+        }
+        guard let accessToken = tokens["access_token"] as? String,
+              let refreshToken = tokens["refresh_token"] as? String,
+              !accessToken.isEmpty
+        else {
+            throw CodexOAuthCredentialsError.missingTokens
+        }
+
+        let idToken = tokens["id_token"] as? String
+        let accountId = tokens["account_id"] as? String
+        let lastRefresh = Self.parseLastRefresh(from: json["last_refresh"])
+
+        return CodexOAuthCredentials(
+            accessToken: accessToken,
+            refreshToken: refreshToken,
+            idToken: idToken,
+            accountId: accountId,
+            lastRefresh: lastRefresh)
+    }
+
+    public static func save(_ credentials: CodexOAuthCredentials) throws {
+        let url = self.authFilePath
+
+        var json: [String: Any] = [:]
+        if let data = try? Data(contentsOf: url),
+           let existing = try? JSONSerialization.jsonObject(with: data) as? [String: Any]
+        {
+            json = existing
+        }
+
+        var tokens: [String: Any] = [
+            "access_token": credentials.accessToken,
+            "refresh_token": credentials.refreshToken,
+        ]
+        if let idToken = credentials.idToken {
+            tokens["id_token"] = idToken
+        }
+        if let accountId = credentials.accountId {
+            tokens["account_id"] = accountId
+        }
+
+        json["tokens"] = tokens
+        json["last_refresh"] = ISO8601DateFormatter().string(from: Date())
+
+        let data = try JSONSerialization.data(withJSONObject: json, options: [.prettyPrinted, .sortedKeys])
+        let directory = url.deletingLastPathComponent()
+        try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+        try data.write(to: url, options: .atomic)
+    }
+
+    private static func parseLastRefresh(from raw: Any?) -> Date? {
+        guard let value = raw as? String, !value.isEmpty else { return nil }
+        let formatter = ISO8601DateFormatter()
+        formatter.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
+        if let date = formatter.date(from: value) { return date }
+        formatter.formatOptions = [.withInternetDateTime]
+        return formatter.date(from: value)
+    }
+}

package/Sources/RunicCore/Providers/Codex/CodexOAuth/CodexOAuthUsageFetcher.swift

@@ -0,0 +1,269 @@
+import Foundation
+#if canImport(FoundationNetworking)
+import FoundationNetworking
+#endif
+
+public struct CodexUsageResponse: Decodable, Sendable {
+    public let planType: PlanType?
+    public let rateLimit: RateLimitDetails?
+    public let credits: CreditDetails?
+
+    enum CodingKeys: String, CodingKey {
+        case planType = "plan_type"
+        case rateLimit = "rate_limit"
+        case credits
+    }
+
+    public enum PlanType: Sendable, Decodable, Equatable {
+        case guest
+        case free
+        case go
+        case plus
+        case pro
+        case freeWorkspace
+        case team
+        case business
+        case education
+        case quorum
+        case k12
+        case enterprise
+        case edu
+        case unknown(String)
+
+        public var rawValue: String {
+            switch self {
+            case .guest: "guest"
+            case .free: "free"
+            case .go: "go"
+            case .plus: "plus"
+            case .pro: "pro"
+            case .freeWorkspace: "free_workspace"
+            case .team: "team"
+            case .business: "business"
+            case .education: "education"
+            case .quorum: "quorum"
+            case .k12: "k12"
+            case .enterprise: "enterprise"
+            case .edu: "edu"
+            case let .unknown(value): value
+            }
+        }
+
+        public init(from decoder: Decoder) throws {
+            let container = try decoder.singleValueContainer()
+            let value = try container.decode(String.self)
+            switch value {
+            case "guest": self = .guest
+            case "free": self = .free
+            case "go": self = .go
+            case "plus": self = .plus
+            case "pro": self = .pro
+            case "free_workspace": self = .freeWorkspace
+            case "team": self = .team
+            case "business": self = .business
+            case "education": self = .education
+            case "quorum": self = .quorum
+            case "k12": self = .k12
+            case "enterprise": self = .enterprise
+            case "edu": self = .edu
+            default:
+                self = .unknown(value)
+            }
+        }
+    }
+
+    public struct RateLimitDetails: Decodable, Sendable {
+        public let primaryWindow: WindowSnapshot?
+        public let secondaryWindow: WindowSnapshot?
+
+        enum CodingKeys: String, CodingKey {
+            case primaryWindow = "primary_window"
+            case secondaryWindow = "secondary_window"
+        }
+    }
+
+    public struct WindowSnapshot: Decodable, Sendable {
+        public let usedPercent: Int
+        public let resetAt: Int
+        public let limitWindowSeconds: Int
+
+        enum CodingKeys: String, CodingKey {
+            case usedPercent = "used_percent"
+            case resetAt = "reset_at"
+            case limitWindowSeconds = "limit_window_seconds"
+        }
+    }
+
+    public struct CreditDetails: Decodable, Sendable {
+        public let hasCredits: Bool
+        public let unlimited: Bool
+        public let balance: Double?
+
+        enum CodingKeys: String, CodingKey {
+            case hasCredits = "has_credits"
+            case unlimited
+            case balance
+        }
+
+        public init(from decoder: Decoder) throws {
+            let container = try decoder.container(keyedBy: CodingKeys.self)
+            self.hasCredits = (try? container.decode(Bool.self, forKey: .hasCredits)) ?? false
+            self.unlimited = (try? container.decode(Bool.self, forKey: .unlimited)) ?? false
+            if let balance = try? container.decode(Double.self, forKey: .balance) {
+                self.balance = balance
+            } else if let balance = try? container.decode(String.self, forKey: .balance),
+                      let value = Double(balance)
+            {
+                self.balance = value
+            } else {
+                self.balance = nil
+            }
+        }
+    }
+}
+
+public enum CodexOAuthFetchError: LocalizedError, Sendable {
+    case unauthorized
+    case invalidResponse
+    case serverError(Int, String?)
+    case networkError(Error)
+
+    public var errorDescription: String? {
+        switch self {
+        case .unauthorized:
+            return "Codex OAuth token expired or invalid. Run `codex` to re-authenticate."
+        case .invalidResponse:
+            return "Invalid response from Codex usage API."
+        case let .serverError(code, message):
+            if let message, !message.isEmpty {
+                return "Codex API error \(code): \(message)"
+            }
+            return "Codex API error \(code)."
+        case let .networkError(error):
+            return "Network error: \(error.localizedDescription)"
+        }
+    }
+}
+
+public enum CodexOAuthUsageFetcher {
+    private static let defaultChatGPTBaseURL = "https://chatgpt.com/backend-api/"
+    private static let chatGPTUsagePath = "/wham/usage"
+    private static let codexUsagePath = "/api/codex/usage"
+
+    public static func fetchUsage(accessToken: String, accountId: String?) async throws -> CodexUsageResponse {
+        var request = URLRequest(url: Self.resolveUsageURL())
+        request.httpMethod = "GET"
+        request.timeoutInterval = 30
+        request.setValue("Bearer \(accessToken)", forHTTPHeaderField: "Authorization")
+        request.setValue("Runic", forHTTPHeaderField: "User-Agent")
+        request.setValue("application/json", forHTTPHeaderField: "Accept")
+
+        if let accountId, !accountId.isEmpty {
+            request.setValue(accountId, forHTTPHeaderField: "ChatGPT-Account-Id")
+        }
+
+        do {
+            let (data, response) = try await URLSession.shared.data(for: request)
+            guard let http = response as? HTTPURLResponse else {
+                throw CodexOAuthFetchError.invalidResponse
+            }
+
+            switch http.statusCode {
+            case 200...299:
+                do {
+                    return try JSONDecoder().decode(CodexUsageResponse.self, from: data)
+                } catch {
+                    throw CodexOAuthFetchError.invalidResponse
+                }
+            case 401, 403:
+                throw CodexOAuthFetchError.unauthorized
+            default:
+                let body = String(data: data, encoding: .utf8)
+                throw CodexOAuthFetchError.serverError(http.statusCode, body)
+            }
+        } catch let error as CodexOAuthFetchError {
+            throw error
+        } catch {
+            throw CodexOAuthFetchError.networkError(error)
+        }
+    }
+
+    private static func resolveUsageURL() -> URL {
+        self.resolveUsageURL(env: ProcessInfo.processInfo.environment, configContents: nil)
+    }
+
+    private static func resolveUsageURL(env: [String: String], configContents: String?) -> URL {
+        let baseURL = self.resolveChatGPTBaseURL(env: env, configContents: configContents)
+        let normalized = self.normalizeChatGPTBaseURL(baseURL)
+        let path = normalized.contains("/backend-api") ? Self.chatGPTUsagePath : Self.codexUsagePath
+        let full = normalized + path
+        return URL(string: full) ?? URL(string: Self.defaultChatGPTBaseURL + Self.chatGPTUsagePath)!
+    }
+
+    private static func resolveChatGPTBaseURL(env: [String: String], configContents: String?) -> String {
+        if let configContents, let parsed = self.parseChatGPTBaseURL(from: configContents) {
+            return parsed
+        }
+        if let contents = self.loadConfigContents(env: env),
+           let parsed = self.parseChatGPTBaseURL(from: contents)
+        {
+            return parsed
+        }
+        return Self.defaultChatGPTBaseURL
+    }
+
+    private static func normalizeChatGPTBaseURL(_ value: String) -> String {
+        var trimmed = value.trimmingCharacters(in: .whitespacesAndNewlines)
+        if trimmed.isEmpty { trimmed = Self.defaultChatGPTBaseURL }
+        while trimmed.hasSuffix("/") {
+            trimmed.removeLast()
+        }
+        if trimmed.hasPrefix("https://chatgpt.com") || trimmed.hasPrefix("https://chat.openai.com"),
+           !trimmed.contains("/backend-api")
+        {
+            trimmed += "/backend-api"
+        }
+        return trimmed
+    }
+
+    private static func parseChatGPTBaseURL(from contents: String) -> String? {
+        for rawLine in contents.split(whereSeparator: \.isNewline) {
+            let line = rawLine.split(separator: "#", maxSplits: 1, omittingEmptySubsequences: true).first
+            let trimmed = line?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
+            guard !trimmed.isEmpty else { continue }
+            let parts = trimmed.split(separator: "=", maxSplits: 1, omittingEmptySubsequences: true)
+            guard parts.count == 2 else { continue }
+            let key = parts[0].trimmingCharacters(in: .whitespacesAndNewlines)
+            guard key == "chatgpt_base_url" else { continue }
+            var value = parts[1].trimmingCharacters(in: .whitespacesAndNewlines)
+            if value.hasPrefix("\""), value.hasSuffix("\"") {
+                value = String(value.dropFirst().dropLast())
+            } else if value.hasPrefix("'"), value.hasSuffix("'") {
+                value = String(value.dropFirst().dropLast())
+            }
+            return value.trimmingCharacters(in: .whitespacesAndNewlines)
+        }
+        return nil
+    }
+
+    private static func loadConfigContents(env: [String: String]) -> String? {
+        let home = FileManager.default.homeDirectoryForCurrentUser
+        let codexHome = env["CODEX_HOME"]?.trimmingCharacters(in: .whitespacesAndNewlines)
+        let root = (codexHome?.isEmpty == false) ? URL(fileURLWithPath: codexHome!) : home
+            .appendingPathComponent(".codex")
+        let url = root.appendingPathComponent("config.toml")
+        return try? String(contentsOf: url, encoding: .utf8)
+    }
+}
+
+#if DEBUG
+extension CodexOAuthUsageFetcher {
+    static func _resolveUsageURLForTesting(env: [String: String] = [:], configContents: String? = nil) -> URL {
+        self.resolveUsageURL(env: env, configContents: configContents)
+    }
+
+    static func _decodeUsageResponseForTesting(_ data: Data) throws -> CodexUsageResponse {
+        try JSONDecoder().decode(CodexUsageResponse.self, from: data)
+    }
+}
+#endif

package/Sources/RunicCore/Providers/Codex/CodexOAuth/CodexTokenRefresher.swift

@@ -0,0 +1,100 @@
+import Foundation
+#if canImport(FoundationNetworking)
+import FoundationNetworking
+#endif
+
+public enum CodexTokenRefresher {
+    private static let refreshEndpoint = URL(string: "https://auth.openai.com/oauth/token")!
+    private static let clientID = "app_EMoamEEZ73f0CkXaXp7hrann"
+
+    public enum RefreshError: LocalizedError, Sendable {
+        case expired
+        case revoked
+        case reused
+        case networkError(Error)
+        case invalidResponse(String)
+
+        public var errorDescription: String? {
+            switch self {
+            case .expired:
+                "Refresh token expired. Please run `codex` to log in again."
+            case .revoked:
+                "Refresh token was revoked. Please run `codex` to log in again."
+            case .reused:
+                "Refresh token was already used. Please run `codex` to log in again."
+            case let .networkError(error):
+                "Network error during token refresh: \(error.localizedDescription)"
+            case let .invalidResponse(message):
+                "Invalid refresh response: \(message)"
+            }
+        }
+    }
+
+    public static func refresh(_ credentials: CodexOAuthCredentials) async throws -> CodexOAuthCredentials {
+        guard !credentials.refreshToken.isEmpty else {
+            return credentials
+        }
+
+        var request = URLRequest(url: Self.refreshEndpoint)
+        request.httpMethod = "POST"
+        request.timeoutInterval = 30
+        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
+
+        let body: [String: String] = [
+            "client_id": Self.clientID,
+            "grant_type": "refresh_token",
+            "refresh_token": credentials.refreshToken,
+            "scope": "openid profile email",
+        ]
+        request.httpBody = try JSONSerialization.data(withJSONObject: body)
+
+        do {
+            let (data, response) = try await URLSession.shared.data(for: request)
+            guard let http = response as? HTTPURLResponse else {
+                throw RefreshError.invalidResponse("No HTTP response")
+            }
+
+            if http.statusCode == 401 {
+                if let errorCode = Self.extractErrorCode(from: data) {
+                    switch errorCode.lowercased() {
+                    case "refresh_token_expired": throw RefreshError.expired
+                    case "refresh_token_reused": throw RefreshError.reused
+                    case "refresh_token_invalidated": throw RefreshError.revoked
+                    default: throw RefreshError.expired
+                    }
+                }
+                throw RefreshError.expired
+            }
+
+            guard http.statusCode == 200 else {
+                throw RefreshError.invalidResponse("Status \(http.statusCode)")
+            }
+
+            guard let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+                throw RefreshError.invalidResponse("Invalid JSON")
+            }
+
+            let newAccessToken = json["access_token"] as? String ?? credentials.accessToken
+            let newRefreshToken = json["refresh_token"] as? String ?? credentials.refreshToken
+            let newIdToken = json["id_token"] as? String ?? credentials.idToken
+
+            return CodexOAuthCredentials(
+                accessToken: newAccessToken,
+                refreshToken: newRefreshToken,
+                idToken: newIdToken,
+                accountId: credentials.accountId,
+                lastRefresh: Date())
+        } catch let error as RefreshError {
+            throw error
+        } catch {
+            throw RefreshError.networkError(error)
+        }
+    }
+
+    private static func extractErrorCode(from data: Data) -> String? {
+        guard let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else { return nil }
+        if let error = json["error"] as? [String: Any], let code = error["code"] as? String { return code }
+        if let error = json["error"] as? String { return error }
+        return json["code"] as? String
+    }
+}