@taico/taico 0.6.0 → 0.8.0

package/dist/ai-providers/chatgpt-subscription/chatgpt-connections.service.d.ts

@@ -0,0 +1,50 @@
+import { DataSource, Repository } from 'typeorm';
+import { User } from "../../identity-provider/user.entity";
+import { SecretsEncryptionService } from "../../secrets/secrets-encryption.service";
+import { AiProviderAuthorizationAttemptEntity } from '../ai-provider-authorization-attempt.entity';
+import { AiProviderConnectionEntity } from '../ai-provider-connection.entity';
+import { AiProviderEntity } from '../ai-provider.entity';
+import { AiProviderConnectionResult, CompleteAiProviderAuthorizationInput, DisconnectAiProviderResult, OnBehalfOf, StartAiProviderAuthorizationResult } from '../dto/service/ai-providers.service.types';
+import { ChatgptOAuthClient } from './chatgpt-oauth.client';
+export declare function chatgptSubscriptionUnavailableReason(encryption: Pick<SecretsEncryptionService, 'isEncrypting'>): string | null;
+export declare class ChatgptConnectionsService {
+    private readonly connections;
+    private readonly attempts;
+    private readonly providers;
+    private readonly users;
+    private readonly dataSource;
+    private readonly encryption;
+    private readonly oauth;
+    private readonly logger;
+    private readonly refreshing;
+    constructor(connections: Repository<AiProviderConnectionEntity>, attempts: Repository<AiProviderAuthorizationAttemptEntity>, providers: Repository<AiProviderEntity>, users: Repository<User>, dataSource: DataSource, encryption: SecretsEncryptionService, oauth: ChatgptOAuthClient);
+    assertAvailable(): void;
+    getConnection(providerId: string, actorId: string): Promise<AiProviderConnectionResult>;
+    startAuthorization(providerId: string, actorId: string): Promise<StartAiProviderAuthorizationResult>;
+    completeAuthorization(providerId: string, actorId: string, callback: CompleteAiProviderAuthorizationInput): Promise<AiProviderConnectionResult>;
+    setAutomatedTurnsAllowed(providerId: string, actorId: string, allowed: boolean): Promise<AiProviderConnectionResult>;
+    disconnect(providerId: string, actorId: string): Promise<DisconnectAiProviderResult>;
+    disconnectAll(providerId: string): Promise<void>;
+    authorizeTurn(providerId: string, onBehalfOf: OnBehalfOf): Promise<{
+        connectionId: string;
+    }>;
+    requireOwnConnection(providerId: string, actorId: string): Promise<{
+        connectionId: string;
+    }>;
+    getAccessToken(connectionId: string): Promise<string>;
+    recordOutcome(connectionId: string, upstreamCode: string | null): Promise<void>;
+    private refresh;
+    private signInAgainError;
+    private markNeedsReauthorization;
+    private clear;
+    private usableAccessToken;
+    private readCredentials;
+    private writeCredentials;
+    private loadWithCredentials;
+    private describe;
+    private toResult;
+    private getProvider;
+    private ensureHostId;
+    private findUser;
+    private requireUser;
+}

package/dist/ai-providers/chatgpt-subscription/chatgpt-connections.service.js

@@ -0,0 +1,607 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ChatgptConnectionsService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChatgptConnectionsService = void 0;
+exports.chatgptSubscriptionUnavailableReason = chatgptSubscriptionUnavailableReason;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const node_crypto_1 = require("node:crypto");
+const typeorm_2 = require("typeorm");
+const env_config_1 = require("../../config/env.config");
+const user_entity_1 = require("../../identity-provider/user.entity");
+const secrets_encryption_service_1 = require("../../secrets/secrets-encryption.service");
+const ai_provider_authorization_attempt_entity_1 = require("../ai-provider-authorization-attempt.entity");
+const ai_provider_connection_entity_1 = require("../ai-provider-connection.entity");
+const ai_provider_entity_1 = require("../ai-provider.entity");
+const enums_1 = require("../enums");
+const ai_providers_errors_1 = require("../errors/ai-providers.errors");
+const chatgpt_oauth_client_1 = require("./chatgpt-oauth.client");
+const chatgpt_subscription_constants_1 = require("./chatgpt-subscription.constants");
+const REFRESH_SKEW_MS = 60_000;
+const NO_FALLBACK = 'No other provider was used.';
+const WHERE_TO_CONNECT = 'Settings → AI models';
+function withoutQuery(address) {
+    const url = new URL(address);
+    return `${url.origin}${url.pathname}`;
+}
+function hashState(state) {
+    return (0, node_crypto_1.createHash)('sha256').update(state).digest('hex');
+}
+function grantsPlanUsage(scope) {
+    return !!scope && scope.split(/\s+/).includes(chatgpt_subscription_constants_1.PLAN_USAGE_SCOPE);
+}
+function chatgptSubscriptionUnavailableReason(encryption) {
+    if (!(0, env_config_1.isChatgptSubscriptionEnabled)()) {
+        return ('Sign in with ChatGPT is turned off on this server. It is only for a Taico you run ' +
+            'yourself: set CHATGPT_SUBSCRIPTION_ENABLED=true if that is the case.');
+    }
+    if (!encryption.isEncrypting()) {
+        return ('Sign in with ChatGPT needs encrypted secret storage. Set SECRETS_ENABLED=true and ' +
+            'SECRETS_ENCRYPTION_KEY; plaintext mode is not accepted for these tokens.');
+    }
+    return null;
+}
+let ChatgptConnectionsService = ChatgptConnectionsService_1 = class ChatgptConnectionsService {
+    connections;
+    attempts;
+    providers;
+    users;
+    dataSource;
+    encryption;
+    oauth;
+    logger = new common_1.Logger(ChatgptConnectionsService_1.name);
+    refreshing = new Map();
+    constructor(connections, attempts, providers, users, dataSource, encryption, oauth) {
+        this.connections = connections;
+        this.attempts = attempts;
+        this.providers = providers;
+        this.users = users;
+        this.dataSource = dataSource;
+        this.encryption = encryption;
+        this.oauth = oauth;
+    }
+    assertAvailable() {
+        const reason = chatgptSubscriptionUnavailableReason(this.encryption);
+        if (reason) {
+            throw new ai_providers_errors_1.AiProviderTypeDisabledError(enums_1.AiProviderType.CHATGPT_SUBSCRIPTION, reason);
+        }
+    }
+    async getConnection(providerId, actorId) {
+        await this.getProvider(providerId);
+        const user = await this.findUser(actorId);
+        if (!user) {
+            return this.toResult(providerId, null, false);
+        }
+        return this.describe(providerId, user.id);
+    }
+    async startAuthorization(providerId, actorId) {
+        this.assertAvailable();
+        const provider = await this.getProvider(providerId);
+        const user = await this.requireUser(providerId, actorId);
+        const connection = await this.loadWithCredentials(this.connections.manager, { aiProviderId: providerId, userId: user.id });
+        const issuedClientId = connection &&
+            connection.status !== enums_1.AiProviderConnectionStatus.DISCONNECTED
+            ? connection.externalClientId
+            : null;
+        const credentials = connection ? this.readCredentials(connection) : null;
+        const state = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+        const nonce = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+        const codeVerifier = (0, node_crypto_1.randomBytes)(48).toString('base64url');
+        const expiresAt = new Date(Date.now() + chatgpt_subscription_constants_1.AUTHORIZATION_ATTEMPT_TTL_MS);
+        const redirectUri = `http://${chatgpt_subscription_constants_1.REDIRECT_HOST}:${(0, env_config_1.getChatgptSubscriptionCallbackPort)()}${chatgpt_subscription_constants_1.REDIRECT_PATH}`;
+        await this.attempts.delete({ aiProviderId: providerId, userId: user.id });
+        await this.attempts.delete({ expiresAt: (0, typeorm_2.LessThan)(new Date()) });
+        await this.attempts.insert({
+            aiProviderId: providerId,
+            userId: user.id,
+            stateHash: hashState(state),
+            nonce,
+            codeVerifier: this.encryption.encrypt(codeVerifier),
+            redirectUri,
+            clientId: issuedClientId ?? chatgpt_subscription_constants_1.REGISTRATION_CLIENT_ID,
+            isRegistration: !issuedClientId,
+            expiresAt,
+        });
+        const authorizationUrl = this.oauth.buildAuthorizationUrl({
+            issuedClientId,
+            redirectUri,
+            state,
+            nonce,
+            codeVerifier,
+            hostId: await this.ensureHostId(provider),
+            idTokenHint: credentials?.idToken,
+            loginHint: connection?.externalEmail,
+        });
+        this.logger.log({
+            message: 'Started Sign in with ChatGPT',
+            providerId,
+            userId: user.id,
+            isRegistration: !issuedClientId,
+        });
+        return { authorizationUrl, expiresAt };
+    }
+    async completeAuthorization(providerId, actorId, callback) {
+        this.assertAvailable();
+        await this.getProvider(providerId);
+        const user = await this.requireUser(providerId, actorId);
+        const claimed = await this.attempts
+            .createQueryBuilder()
+            .delete()
+            .where('state_hash = :stateHash AND user_id = :userId AND ai_provider_id = :providerId', {
+            stateHash: hashState(callback.state),
+            userId: user.id,
+            providerId,
+        })
+            .returning('*')
+            .execute();
+        const row = claimed.raw[0];
+        if (!row || new Date(row.expires_at).getTime() < Date.now()) {
+            throw new ai_providers_errors_1.AiProviderAuthorizationFailedError('This sign-in is unknown, was already used, or has expired. Start again.');
+        }
+        const attempt = {
+            nonce: row.nonce,
+            codeVerifier: this.encryption.decrypt(row.code_verifier),
+            redirectUri: row.redirect_uri,
+            clientId: row.client_id,
+            isRegistration: row.is_registration,
+        };
+        if (callback.redirectAddress &&
+            callback.redirectAddress !== withoutQuery(attempt.redirectUri)) {
+            throw new ai_providers_errors_1.AiProviderAuthorizationFailedError(`That address is not where OpenAI sends this sign-in back to (${attempt.redirectUri}). Start again and paste the address your browser lands on.`);
+        }
+        if (callback.error) {
+            throw new ai_providers_errors_1.AiProviderAuthorizationFailedError(callback.error === 'access_denied'
+                ? 'You did not approve the request at OpenAI, so nothing was connected.'
+                : `OpenAI did not complete the sign-in (${callback.error}). Nothing was connected.`, {
+                oauthError: callback.error,
+                description: callback.errorDescription ?? null,
+            });
+        }
+        if (!callback.code) {
+            throw new ai_providers_errors_1.AiProviderAuthorizationFailedError('The address OpenAI sent you back to has no authorization code. Start again.');
+        }
+        let clientId;
+        if (attempt.isRegistration) {
+            if (!callback.clientId || callback.clientId === chatgpt_subscription_constants_1.REGISTRATION_CLIENT_ID) {
+                throw new ai_providers_errors_1.AiProviderAuthorizationFailedError('OpenAI did not issue a client for this installation. Start again.');
+            }
+            clientId = callback.clientId;
+        }
+        else {
+            if (callback.clientId && callback.clientId !== attempt.clientId) {
+                throw new ai_providers_errors_1.AiProviderAuthorizationFailedError('OpenAI answered for a different client than the one that was connected. Nothing was changed.');
+            }
+            clientId = attempt.clientId;
+        }
+        let tokens;
+        try {
+            tokens = await this.oauth.exchangeCode({
+                clientId,
+                code: callback.code,
+                codeVerifier: attempt.codeVerifier,
+                redirectUri: attempt.redirectUri,
+            });
+        }
+        catch (error) {
+            throw new ai_providers_errors_1.AiProviderAuthorizationFailedError('OpenAI rejected the sign-in when Taico tried to finish it. Start again.', { reason: error instanceof Error ? error.message : String(error) });
+        }
+        if (!tokens.idToken) {
+            await this.oauth.revoke({ clientId, refreshToken: tokens.refreshToken });
+            throw new ai_providers_errors_1.AiProviderAuthorizationFailedError('OpenAI did not say which account signed in. Nothing was connected.');
+        }
+        let identity;
+        try {
+            identity = await this.oauth.verifyIdToken({
+                idToken: tokens.idToken,
+                clientId,
+                nonce: attempt.nonce,
+            });
+        }
+        catch (error) {
+            await this.oauth.revoke({ clientId, refreshToken: tokens.refreshToken });
+            throw error;
+        }
+        const existing = await this.connections.findOne({
+            where: { aiProviderId: providerId, userId: user.id },
+        });
+        if (!attempt.isRegistration &&
+            existing?.externalSubject &&
+            (existing.externalSubject !== identity.subject ||
+                existing.externalIssuer !== identity.issuer)) {
+            await this.oauth.revoke({ clientId, refreshToken: tokens.refreshToken });
+            throw new ai_providers_errors_1.AiProviderAuthorizationFailedError('You signed in with a different ChatGPT account than the one that was connected. ' +
+                'Disconnect first to switch accounts.');
+        }
+        const canUsePlan = grantsPlanUsage(tokens.scope);
+        const connection = existing ??
+            this.connections.create({ aiProviderId: providerId, userId: user.id });
+        connection.status = canUsePlan
+            ? enums_1.AiProviderConnectionStatus.CONNECTED
+            : enums_1.AiProviderConnectionStatus.PLAN_ACCESS_NOT_GRANTED;
+        connection.externalClientId = clientId;
+        connection.externalIssuer = identity.issuer;
+        connection.externalSubject = identity.subject;
+        connection.externalEmail = identity.email;
+        connection.grantedScopes = tokens.scope;
+        connection.credentials = this.writeCredentials({
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            idToken: tokens.idToken,
+        });
+        connection.accessTokenExpiresAt = new Date(Date.now() + tokens.expiresInSeconds * 1000);
+        connection.automatedTurnsAllowedAt =
+            existing?.automatedTurnsAllowedAt ?? null;
+        connection.lastErrorCode = null;
+        connection.lastErrorAt = null;
+        await this.connections.save(connection);
+        this.logger.log({
+            message: 'Connected a ChatGPT account',
+            providerId,
+            userId: user.id,
+            canUsePlan,
+        });
+        return this.describe(providerId, user.id);
+    }
+    async setAutomatedTurnsAllowed(providerId, actorId, allowed) {
+        await this.getProvider(providerId);
+        const user = await this.requireUser(providerId, actorId);
+        const connection = await this.connections.findOne({
+            where: { aiProviderId: providerId, userId: user.id },
+        });
+        if (connection?.status !== enums_1.AiProviderConnectionStatus.CONNECTED) {
+            throw new ai_providers_errors_1.AiProviderConnectionRequiredError(providerId, 'Connect your ChatGPT account before changing this.');
+        }
+        if (allowed !== !!connection.automatedTurnsAllowedAt) {
+            connection.automatedTurnsAllowedAt = allowed ? new Date() : null;
+            await this.connections.save(connection);
+        }
+        return this.describe(providerId, user.id);
+    }
+    async disconnect(providerId, actorId) {
+        await this.getProvider(providerId);
+        const user = await this.requireUser(providerId, actorId);
+        await this.attempts.delete({ aiProviderId: providerId, userId: user.id });
+        const connection = await this.loadWithCredentials(this.connections.manager, {
+            aiProviderId: providerId,
+            userId: user.id,
+        });
+        if (!connection) {
+            return { revokedAtProvider: true };
+        }
+        const revokedAtProvider = await this.clear(connection);
+        this.logger.log({
+            message: 'Disconnected a ChatGPT account',
+            providerId,
+            userId: user.id,
+            revokedAtProvider,
+        });
+        return { revokedAtProvider };
+    }
+    async disconnectAll(providerId) {
+        const rows = await this.connections.find({
+            where: { aiProviderId: providerId },
+        });
+        for (const row of rows) {
+            const connection = await this.loadWithCredentials(this.connections.manager, { id: row.id });
+            if (connection) {
+                await this.clear(connection);
+            }
+        }
+        await this.attempts.delete({ aiProviderId: providerId });
+    }
+    async authorizeTurn(providerId, onBehalfOf) {
+        this.assertAvailable();
+        const whose = onBehalfOf.description ??
+            (onBehalfOf.automated
+                ? 'the person this task update is for'
+                : 'the person who wrote the message');
+        const user = await this.findUser(onBehalfOf.actorId);
+        const connection = user
+            ? await this.connections.findOne({
+                where: { aiProviderId: providerId, userId: user.id },
+            })
+            : null;
+        const status = connection?.status ?? enums_1.AiProviderConnectionStatus.DISCONNECTED;
+        if (!connection || status !== enums_1.AiProviderConnectionStatus.CONNECTED) {
+            const problem = {
+                [enums_1.AiProviderConnectionStatus.DISCONNECTED]: 'has not connected a ChatGPT account',
+                [enums_1.AiProviderConnectionStatus.NEEDS_REAUTHORIZATION]: 'has to sign in to ChatGPT again, because the connection expired or was removed',
+                [enums_1.AiProviderConnectionStatus.PLAN_ACCESS_NOT_GRANTED]: 'connected a ChatGPT account without allowing use of its plan',
+                [enums_1.AiProviderConnectionStatus.CONNECTED]: '',
+            }[status];
+            throw new ai_providers_errors_1.AiProviderConnectionRequiredError(providerId, `This thread answers with the ChatGPT plan of ${whose}, who ${problem}. ` +
+                `Connect it in ${WHERE_TO_CONNECT}. ${NO_FALLBACK}`, { status, automated: onBehalfOf.automated });
+        }
+        if (onBehalfOf.automated && !connection.automatedTurnsAllowedAt) {
+            throw new ai_providers_errors_1.AiProviderConnectionConsentRequiredError(providerId, 'A task update arrived, but answering it would use a ChatGPT plan without anyone ' +
+                `asking, and ${whose} has not allowed that (${WHERE_TO_CONNECT}). ${NO_FALLBACK}`);
+        }
+        return { connectionId: connection.id };
+    }
+    async requireOwnConnection(providerId, actorId) {
+        return this.authorizeTurn(providerId, { actorId, automated: false });
+    }
+    async getAccessToken(connectionId) {
+        const connection = await this.loadWithCredentials(this.connections.manager, {
+            id: connectionId,
+        });
+        const usable = connection ? this.usableAccessToken(connection) : null;
+        if (usable) {
+            return usable;
+        }
+        if (!connection ||
+            connection.status !== enums_1.AiProviderConnectionStatus.CONNECTED) {
+            throw this.signInAgainError(connection?.aiProviderId ?? null);
+        }
+        let pending = this.refreshing.get(connectionId);
+        if (!pending) {
+            pending = this.refresh(connectionId).finally(() => this.refreshing.delete(connectionId));
+            this.refreshing.set(connectionId, pending);
+        }
+        return pending;
+    }
+    async recordOutcome(connectionId, upstreamCode) {
+        try {
+            if (upstreamCode) {
+                await this.connections.update(connectionId, {
+                    lastErrorCode: upstreamCode,
+                    lastErrorAt: new Date(),
+                });
+            }
+            else {
+                await this.connections
+                    .createQueryBuilder()
+                    .update()
+                    .set({ lastErrorCode: null, lastErrorAt: null })
+                    .where('id = :id AND last_error_code IS NOT NULL', {
+                    id: connectionId,
+                })
+                    .execute();
+            }
+        }
+        catch (error) {
+            this.logger.warn({
+                message: 'Could not record the outcome of a ChatGPT plan request',
+                connectionId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    async refresh(connectionId) {
+        let providerId = null;
+        const outcome = await this.dataSource.transaction(async (manager) => {
+            const connection = await this.loadWithCredentials(manager, { id: connectionId }, true);
+            providerId = connection?.aiProviderId ?? null;
+            if (!connection ||
+                connection.status !== enums_1.AiProviderConnectionStatus.CONNECTED) {
+                return { kind: 'reauthorize' };
+            }
+            const fresh = this.usableAccessToken(connection);
+            if (fresh) {
+                return { kind: 'token', accessToken: fresh };
+            }
+            const credentials = this.readCredentials(connection);
+            if (!credentials || !connection.externalClientId) {
+                await this.markNeedsReauthorization(manager, connection);
+                return { kind: 'reauthorize' };
+            }
+            let tokens;
+            try {
+                tokens = await this.oauth.refresh({
+                    clientId: connection.externalClientId,
+                    refreshToken: credentials.refreshToken,
+                });
+            }
+            catch (error) {
+                if (error instanceof chatgpt_oauth_client_1.ChatgptTokenEndpointError && error.isTerminal) {
+                    await this.markNeedsReauthorization(manager, connection);
+                    return { kind: 'reauthorize' };
+                }
+                return {
+                    kind: 'failed',
+                    error: error instanceof Error ? error : new Error(String(error)),
+                };
+            }
+            const scope = tokens.scope ?? connection.grantedScopes;
+            const canUsePlan = grantsPlanUsage(scope);
+            connection.credentials = this.writeCredentials({
+                accessToken: tokens.accessToken,
+                refreshToken: tokens.refreshToken,
+                idToken: tokens.idToken ?? credentials.idToken,
+            });
+            connection.accessTokenExpiresAt = new Date(Date.now() + tokens.expiresInSeconds * 1000);
+            connection.grantedScopes = scope;
+            if (!canUsePlan) {
+                connection.status =
+                    enums_1.AiProviderConnectionStatus.PLAN_ACCESS_NOT_GRANTED;
+            }
+            await manager.save(connection);
+            return canUsePlan
+                ? { kind: 'token', accessToken: tokens.accessToken }
+                : { kind: 'plan_access_lost' };
+        });
+        switch (outcome.kind) {
+            case 'token':
+                return outcome.accessToken;
+            case 'reauthorize':
+                throw this.signInAgainError(providerId);
+            case 'plan_access_lost':
+                throw new ai_providers_errors_1.AiProviderConnectionRequiredError(providerId ?? '', `The connected ChatGPT account no longer allows use of its plan. Connect it again in ${WHERE_TO_CONNECT}. ${NO_FALLBACK}`, { status: enums_1.AiProviderConnectionStatus.PLAN_ACCESS_NOT_GRANTED });
+            case 'failed': {
+                const oauthError = outcome.error instanceof chatgpt_oauth_client_1.ChatgptTokenEndpointError
+                    ? outcome.error.oauthError
+                    : null;
+                this.logger.warn({
+                    message: 'Refreshing a ChatGPT connection failed',
+                    connectionId,
+                    oauthError,
+                    error: outcome.error.message,
+                });
+                throw new ai_providers_errors_1.AiProviderRequestFailedError(oauthError === 'invalid_client'
+                    ? `OpenAI no longer accepts this installation's client. Disconnect and connect again in ${WHERE_TO_CONNECT}. ${NO_FALLBACK}`
+                    : `Could not renew the ChatGPT sign-in right now. The connection was kept; try again shortly. ${NO_FALLBACK}`, { upstreamCode: oauthError ?? 'refresh_unavailable' });
+            }
+        }
+    }
+    signInAgainError(providerId) {
+        return new ai_providers_errors_1.AiProviderConnectionRequiredError(providerId ?? '', `The ChatGPT sign-in expired or was removed. Sign in again in ${WHERE_TO_CONNECT}. ${NO_FALLBACK}`, { status: enums_1.AiProviderConnectionStatus.NEEDS_REAUTHORIZATION });
+    }
+    async markNeedsReauthorization(manager, connection) {
+        connection.status = enums_1.AiProviderConnectionStatus.NEEDS_REAUTHORIZATION;
+        connection.credentials = null;
+        connection.accessTokenExpiresAt = null;
+        await manager.save(connection);
+    }
+    async clear(connection) {
+        let revoked = true;
+        const credentials = this.readCredentials(connection);
+        if (credentials && connection.externalClientId) {
+            revoked = await this.oauth.revoke({
+                clientId: connection.externalClientId,
+                refreshToken: credentials.refreshToken,
+            });
+        }
+        connection.status = enums_1.AiProviderConnectionStatus.DISCONNECTED;
+        connection.credentials = null;
+        connection.accessTokenExpiresAt = null;
+        connection.externalClientId = null;
+        connection.externalIssuer = null;
+        connection.externalSubject = null;
+        connection.externalEmail = null;
+        connection.grantedScopes = null;
+        connection.automatedTurnsAllowedAt = null;
+        connection.lastErrorCode = null;
+        connection.lastErrorAt = null;
+        await this.connections.save(connection);
+        return revoked;
+    }
+    usableAccessToken(connection) {
+        if (connection.status !== enums_1.AiProviderConnectionStatus.CONNECTED ||
+            !connection.accessTokenExpiresAt ||
+            connection.accessTokenExpiresAt.getTime() - Date.now() <= REFRESH_SKEW_MS) {
+            return null;
+        }
+        return this.readCredentials(connection)?.accessToken ?? null;
+    }
+    readCredentials(connection) {
+        if (!connection.credentials) {
+            return null;
+        }
+        try {
+            return JSON.parse(this.encryption.decrypt(connection.credentials));
+        }
+        catch (error) {
+            this.logger.warn({
+                message: 'Stored ChatGPT credentials could not be read',
+                connectionId: connection.id,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return null;
+        }
+    }
+    writeCredentials(credentials) {
+        return this.encryption.encrypt(JSON.stringify(credentials));
+    }
+    loadWithCredentials(manager, where, lock = false) {
+        const query = manager
+            .createQueryBuilder(ai_provider_connection_entity_1.AiProviderConnectionEntity, 'connection')
+            .addSelect('connection.credentials')
+            .where(where);
+        if (lock) {
+            query.setLock('pessimistic_write');
+        }
+        return query.getOne();
+    }
+    async describe(providerId, userId) {
+        const [connection, pending] = await Promise.all([
+            this.connections.findOne({ where: { aiProviderId: providerId, userId } }),
+            this.attempts.count({
+                where: {
+                    aiProviderId: providerId,
+                    userId,
+                    expiresAt: (0, typeorm_2.MoreThan)(new Date()),
+                },
+            }),
+        ]);
+        return this.toResult(providerId, connection, pending > 0);
+    }
+    toResult(providerId, connection, isAuthorizationPending) {
+        const status = connection?.status ?? enums_1.AiProviderConnectionStatus.DISCONNECTED;
+        return {
+            aiProviderId: providerId,
+            status,
+            accountEmail: connection?.externalEmail ?? null,
+            canUsePlan: status === enums_1.AiProviderConnectionStatus.CONNECTED,
+            automatedTurnsAllowed: !!connection?.automatedTurnsAllowedAt,
+            isAuthorizationPending,
+            lastErrorCode: connection?.lastErrorCode ?? null,
+            lastErrorAt: connection?.lastErrorAt ?? null,
+            manageUsageUrl: chatgpt_subscription_constants_1.MANAGE_USAGE_URL,
+        };
+    }
+    async getProvider(providerId) {
+        const provider = await this.providers.findOne({
+            where: { id: providerId },
+        });
+        if (!provider) {
+            throw new ai_providers_errors_1.AiProviderNotFoundError(providerId);
+        }
+        if (provider.type !== enums_1.AiProviderType.CHATGPT_SUBSCRIPTION) {
+            throw new ai_providers_errors_1.AiProviderConnectionNotSupportedError(providerId);
+        }
+        return provider;
+    }
+    async ensureHostId(provider) {
+        if (provider.hostId) {
+            return provider.hostId;
+        }
+        await this.providers
+            .createQueryBuilder()
+            .update()
+            .set({ hostId: `urn:uuid:${(0, node_crypto_1.randomUUID)()}` })
+            .where('id = :id AND host_id IS NULL', { id: provider.id })
+            .execute();
+        const saved = await this.providers.findOneOrFail({
+            where: { id: provider.id },
+        });
+        return saved.hostId;
+    }
+    findUser(actorId) {
+        return this.users.findOne({ where: { actorId, isActive: true } });
+    }
+    async requireUser(providerId, actorId) {
+        const user = await this.findUser(actorId);
+        if (!user) {
+            throw new ai_providers_errors_1.AiProviderConnectionRequiredError(providerId, 'Only a person signed in to Taico can connect a ChatGPT account.');
+        }
+        return user;
+    }
+};
+exports.ChatgptConnectionsService = ChatgptConnectionsService;
+exports.ChatgptConnectionsService = ChatgptConnectionsService = ChatgptConnectionsService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(ai_provider_connection_entity_1.AiProviderConnectionEntity)),
+    __param(1, (0, typeorm_1.InjectRepository)(ai_provider_authorization_attempt_entity_1.AiProviderAuthorizationAttemptEntity)),
+    __param(2, (0, typeorm_1.InjectRepository)(ai_provider_entity_1.AiProviderEntity)),
+    __param(3, (0, typeorm_1.InjectRepository)(user_entity_1.User)),
+    __metadata("design:paramtypes", [typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.DataSource,
+        secrets_encryption_service_1.SecretsEncryptionService,
+        chatgpt_oauth_client_1.ChatgptOAuthClient])
+], ChatgptConnectionsService);
+//# sourceMappingURL=chatgpt-connections.service.js.map