@undefineds.co/xpod 0.4.3 → 0.4.5

package/config/cloud.json

@@ -139,7 +139,7 @@
       "unstructuredDataAccessor": {
         "@id": "urn:undefineds:xpod:RemoteDataAccessor"
       },
-      "presignedRedirectEnabled": true,
+      "presignedRedirectEnabled": false,
       "textSearchIndexingEnabled": true,
       "rdfSearchIntentSink": {
         "@id": "urn:undefineds:xpod:RdfSearchIntentSink"

package/config/main.json

@@ -1,5 +1,8 @@
 {
-    "@context": "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld",
+    "@context": [
+      "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld",
+      "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld"
+    ],
     "import": [
       "css:config/app/init/static-root.json",
       "css:config/app/main/default.json",
@@ -67,7 +70,38 @@
           "@id": "urn:solid-server:default:IdentityProviderFactory"
         },
         "overrideParameters": {
-          "@type": "IdentityProviderFactory",
+          "@type": "SessionBoundIdentityProviderFactory",
+          "args_promptFactory": {
+            "@id": "urn:solid-server:default:PromptFactory"
+          },
+          "args_adapterFactory": {
+            "@id": "urn:solid-server:default:IdpAdapterFactory"
+          },
+          "args_baseUrl": {
+            "@id": "urn:solid-server:default:variable:baseUrl"
+          },
+          "args_oidcPath": "/.oidc",
+          "args_clientCredentialsStore": {
+            "@id": "urn:solid-server:default:ClientCredentialsStore"
+          },
+          "args_storage": {
+            "@id": "urn:solid-server:default:KeyStorage"
+          },
+          "args_jwkGenerator": {
+            "@id": "urn:solid-server:default:JwkGenerator"
+          },
+          "args_showStackTrace": {
+            "@id": "urn:solid-server:default:variable:showStackTrace"
+          },
+          "args_errorHandler": {
+            "@id": "urn:solid-server:default:ErrorHandler"
+          },
+          "args_responseWriter": {
+            "@id": "urn:solid-server:default:ResponseWriter"
+          },
+          "args_interactionRoute": {
+            "@id": "urn:solid-server:default:IndexRoute"
+          },
           "config": {
             "extraParams": [
               "provisionCode"

package/dist/api/ai-gateway/auth/GatewayApiKeyAuthenticator.d.ts

@@ -5,6 +5,9 @@ import { type GatewayDeployment } from './GatewayApiKey';
 import type { InvocationTokenCodec } from './InvocationTokenCodec';
 export interface GatewayAccessKeyRecord {
     id: string;
+    /** CSS credentials are saved configuration, never legacy Gateway authentication records. */
+    kind?: 'client-credentials';
+    credentialResource?: string;
     owner: string;
     secretHash: string;
     deployment: GatewayDeployment;

package/dist/api/ai-gateway/auth/GatewayApiKeyAuthenticator.js

@@ -53,7 +53,7 @@ class GatewayApiKeyAuthenticator {
         catch (cause) {
             return infrastructureError(cause);
         }
-        if (!record) {
+        if (!record || record.kind === 'client-credentials') {
             await (0, GatewayApiKey_1.verifyGatewayApiKeySecret)(parsed.secret, await this.dummyHash);
             return invalidGatewayApiKey();
         }

package/dist/api/ai-gateway/auth/PodGatewayAccessKeyRepository.d.ts

@@ -64,8 +64,9 @@ export declare class PodGatewayAccessKeyRepository implements GatewayAccessKeyRe
     private resolveTrustedFetch;
     private wrapPodFetch;
     private readSecrets;
+    private readSecretSnapshot;
     private writeSecret;
     private deleteSecret;
-    private writeSecrets;
+    private mutateSecrets;
 }
 export {};

package/dist/api/ai-gateway/auth/PodGatewayAccessKeyRepository.js

@@ -20,6 +20,23 @@ class PodGatewayAccessKeyRepository {
     }
     async create(record, context) {
         const { db, resource, fetch, podUrl } = await this.dbForOwner(record.owner, context);
+        if (record.kind === 'client-credentials') {
+            if (!record.plaintext || !record.credentialResource) {
+                throw new Error('client_credentials_registration_incomplete');
+            }
+            const locator = this.locatorCodec.decode(record.id);
+            if (locator?.owner !== record.owner || locator.deployment !== record.deployment) {
+                throw new Error('client_credentials_registration_owner_mismatch');
+            }
+            await this.mutateSecrets(record.owner, podUrl, fetch, (secrets) => {
+                secrets.keys[record.id] = {
+                    kind: 'client-credentials', plaintext: record.plaintext, createdAt: record.createdAt.toISOString(),
+                    name: record.name, owner: record.owner, deployment: record.deployment,
+                    credentialResource: record.credentialResource,
+                };
+            });
+            return { ...record, scopes: [], secretHash: '' };
+        }
         const valid = models_1.aiGatewayRepository.validateAccessKey(toGatewayAccessKeyInsert(record));
         await db.insert(resource).values(valid).execute();
         if (record.plaintext) {
@@ -33,19 +50,30 @@ class PodGatewayAccessKeyRepository {
         if (!locator) {
             return undefined;
         }
-        const { db, resource } = await this.dbForOwner(locator.owner, context);
+        const { db, resource, fetch, podUrl } = await this.dbForOwner(locator.owner, context);
+        // Legacy authentication reads only its RDF verifier rows. Recoverable CSS
+        // credentials belong exclusively to owner-authorized management requests.
+        if (!context?.internalPodAccess) {
+            const saved = (await this.readSecrets(locator.owner, podUrl, fetch)).keys[id];
+            if (saved?.kind === 'client-credentials')
+                return clientCredentialRecord(id, locator.owner, saved);
+        }
         const row = await db.findById(resource, gatewayAccessKeyStorageId(id));
         return row ? recordFromRow(row) : undefined;
     }
     async listByOwner(owner, context) {
-        const { db, listResource } = await this.dbForOwner(owner, context);
+        const { db, listResource, fetch, podUrl } = await this.dbForOwner(owner, context);
+        const secrets = await this.readSecrets(owner, podUrl, fetch);
         const rows = await db
             .select()
             .from(listResource)
             .where((0, drizzle_solid_1.eq)(listResource.owner, owner))
             .execute();
-        return rows
-            .map(recordFromRow)
+        const credentials = Object.entries(secrets.keys)
+            .filter(([id]) => this.locatorCodec.decode(id)?.owner === owner)
+            .map(([id, saved]) => clientCredentialRecord(id, owner, saved))
+            .filter((record) => Boolean(record));
+        return [...rows.map(recordFromRow).filter((record) => secrets.keys[record.id]?.kind !== 'client-credentials'), ...credentials]
             .filter((record) => !record.revokedAt)
             .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
     }
@@ -54,7 +82,10 @@ class PodGatewayAccessKeyRepository {
         if (!locator) {
             return undefined;
         }
-        const { db, resource } = await this.dbForOwner(locator.owner, context);
+        const { db, resource, fetch, podUrl } = await this.dbForOwner(locator.owner, context);
+        if ((await this.readSecrets(locator.owner, podUrl, fetch)).keys[id]?.kind === 'client-credentials') {
+            throw new Error('client_credentials_suspension_unsupported');
+        }
         const row = await db.updateById(resource, gatewayAccessKeyStorageId(id), { disabledAt: enabled ? null : changedAt });
         return row ? recordFromRow(row) : undefined;
     }
@@ -63,7 +94,10 @@ class PodGatewayAccessKeyRepository {
         if (!locator) {
             return undefined;
         }
-        const { db, resource } = await this.dbForOwner(locator.owner, context);
+        const { db, resource, fetch, podUrl } = await this.dbForOwner(locator.owner, context);
+        if ((await this.readSecrets(locator.owner, podUrl, fetch)).keys[id]?.kind === 'client-credentials') {
+            throw new Error('client_credentials_revocation_requires_account');
+        }
         const row = await db.updateById(resource, gatewayAccessKeyStorageId(id), { revokedAt });
         return row ? recordFromRow(row) : undefined;
     }
@@ -73,6 +107,12 @@ class PodGatewayAccessKeyRepository {
             return false;
         }
         const { db, resource, fetch, podUrl } = await this.dbForOwner(locator.owner, context);
+        if ((await this.readSecrets(locator.owner, podUrl, fetch)).keys[id]?.kind === 'client-credentials') {
+            // The Account host revokes the actual CSS credential. This operation
+            // removes only its saved client configuration, not an authentication row.
+            await this.deleteSecret(locator.owner, podUrl, id, fetch);
+            return true;
+        }
         const storageId = gatewayAccessKeyStorageId(id);
         await db.updateById(resource, storageId, { revokedAt: new Date() });
         await this.deleteSecret(locator.owner, podUrl, id, fetch);
@@ -162,56 +202,85 @@ class PodGatewayAccessKeyRepository {
         };
     }
     async readSecrets(owner, podUrl, trustedFetch) {
+        return (await this.readSecretSnapshot(owner, podUrl, trustedFetch)).secrets;
+    }
+    async readSecretSnapshot(owner, podUrl, trustedFetch) {
         const response = await trustedFetch((0, AiConnectionsServiceAccess_1.resolveGatewayAccessKeySecretResourceUrl)(owner, podUrl), {
             method: 'GET',
             headers: { Accept: 'application/json' },
         });
-        if (!response.ok) {
-            return emptySecrets();
-        }
+        if (response.status === 404)
+            return { secrets: emptySecrets(), exists: false };
+        if (!response.ok)
+            throw new Error('gateway_key_secret_read_failed');
         const text = (await response.text()).trim();
         if (!text || !response.headers.get('content-type')?.toLowerCase().includes('application/json')) {
-            return emptySecrets();
+            throw new Error('gateway_key_secret_invalid_document');
         }
         try {
             const parsed = JSON.parse(text);
-            if (parsed.version !== 1 || !parsed.keys || typeof parsed.keys !== 'object') {
-                return emptySecrets();
+            if (parsed.version !== 1 || !parsed.keys || typeof parsed.keys !== 'object' || Array.isArray(parsed.keys)) {
+                throw new Error('gateway_key_secret_invalid_document');
+            }
+            if (Object.values(parsed.keys).some((value) => !value || typeof value !== 'object' || typeof value.plaintext !== 'string')) {
+                throw new Error('gateway_key_secret_invalid_document');
             }
             return {
-                version: 1,
-                keys: Object.fromEntries(Object.entries(parsed.keys).filter(([, value]) => value && typeof value === 'object' && typeof value.plaintext === 'string')),
+                exists: true,
+                etag: response.headers.get('etag') ?? undefined,
+                secrets: {
+                    version: 1,
+                    keys: parsed.keys,
+                },
             };
         }
         catch {
-            return emptySecrets();
+            throw new Error('gateway_key_secret_invalid_document');
         }
     }
     async writeSecret(owner, podUrl, keyId, plaintext, trustedFetch) {
-        const secrets = await this.readSecrets(owner, podUrl, trustedFetch);
-        secrets.keys[keyId] = {
-            plaintext,
-            createdAt: new Date().toISOString(),
-        };
-        await this.writeSecrets(owner, podUrl, secrets, trustedFetch);
+        await this.mutateSecrets(owner, podUrl, trustedFetch, (secrets) => {
+            secrets.keys[keyId] = { plaintext, createdAt: new Date().toISOString() };
+        });
     }
     async deleteSecret(owner, podUrl, keyId, trustedFetch) {
-        const secrets = await this.readSecrets(owner, podUrl, trustedFetch);
-        delete secrets.keys[keyId];
-        await this.writeSecrets(owner, podUrl, secrets, trustedFetch);
+        await this.mutateSecrets(owner, podUrl, trustedFetch, (secrets) => { delete secrets.keys[keyId]; });
     }
-    async writeSecrets(owner, podUrl, secrets, trustedFetch) {
-        const response = await trustedFetch((0, AiConnectionsServiceAccess_1.resolveGatewayAccessKeySecretResourceUrl)(owner, podUrl), {
-            method: 'PUT',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify(secrets, null, 2),
-        });
-        if (!response.ok) {
-            throw new Error('gateway_key_secret_write_failed');
+    async mutateSecrets(owner, podUrl, trustedFetch, mutate) {
+        for (let attempt = 0; attempt < 3; attempt++) {
+            const snapshot = await this.readSecretSnapshot(owner, podUrl, trustedFetch);
+            if (snapshot.exists && (!snapshot.etag || !/^"[^"]*"$/u.test(snapshot.etag))) {
+                throw new Error('gateway_key_secret_etag_required');
+            }
+            mutate(snapshot.secrets);
+            const response = await trustedFetch((0, AiConnectionsServiceAccess_1.resolveGatewayAccessKeySecretResourceUrl)(owner, podUrl), {
+                method: 'PUT',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(snapshot.exists ? { 'If-Match': snapshot.etag } : { 'If-None-Match': '*' }),
+                },
+                body: JSON.stringify(snapshot.secrets, null, 2),
+            });
+            if (response.status === 412)
+                continue;
+            if (!response.ok)
+                throw new Error('gateway_key_secret_write_failed');
+            return;
         }
+        throw new Error('gateway_key_secret_write_conflict');
     }
 }
 exports.PodGatewayAccessKeyRepository = PodGatewayAccessKeyRepository;
+function clientCredentialRecord(id, owner, saved) {
+    const createdAt = toDate(saved.createdAt);
+    if (saved.kind !== 'client-credentials' || saved.owner !== owner || !saved.credentialResource || !createdAt
+        || (saved.deployment !== 'cloud' && saved.deployment !== 'local'))
+        return undefined;
+    return {
+        id, owner, kind: 'client-credentials', credentialResource: saved.credentialResource,
+        name: saved.name, createdAt, deployment: saved.deployment, scopes: [], secretHash: '',
+    };
+}
 function createDefaultGatewayAccessKeyDb(input) {
     const resource = input.resource ?? models_1.gatewayAccessKeyResource;
     const listResource = input.listResource ?? resource;

package/dist/api/ai-gateway/connect/DeviceCodeProtocol.d.ts

@@ -0,0 +1,80 @@
+export type DeviceCodeHttpBodyEncoding = 'form' | 'json';
+export type DeviceCodeBeginCodec = 'oauthDeviceCode' | 'oauthDeviceCodePkce' | 'deviceCodeJson';
+export type DeviceCodePollCodec = 'oauthDeviceCode' | 'oauthDeviceCodePkce' | 'deviceCodeJson';
+export type DeviceCodeTokenExchangeCodec = 'none' | 'authorizationCodeForm';
+export type OAuthConnectMode = 'deviceCodeOAuth' | 'authorizationCodeOAuth';
+export interface DeviceCodeEndpointDescriptor {
+    endpoint: string;
+    headers?: Record<string, string>;
+}
+export interface DeviceCodeProtocolDescriptor {
+    id: string;
+    verificationUriOrigins?: string[];
+    begin: DeviceCodeEndpointDescriptor & {
+        codec: DeviceCodeBeginCodec;
+        deviceCodeField?: string;
+        userCodeField?: string;
+        verificationUriField?: string;
+        verificationUriCompleteField?: string;
+        expiresInField?: string;
+        expiresAtField?: string;
+        intervalField?: string;
+        defaultExpiresInSeconds?: number;
+        defaultIntervalSeconds?: number;
+    };
+    poll: DeviceCodeEndpointDescriptor & {
+        codec: DeviceCodePollCodec;
+        deviceCodeField?: string;
+        pendingHttpStatuses?: number[];
+    };
+    tokenExchange?: DeviceCodeEndpointDescriptor & {
+        codec: DeviceCodeTokenExchangeCodec;
+        redirectUri?: string;
+        codeField?: string;
+        codeVerifierField?: string;
+    };
+    refresh?: DeviceCodeEndpointDescriptor & {
+        codec: 'refreshTokenForm';
+    };
+    defaultVerificationUri?: string;
+    accountIdClaim?: string | string[];
+}
+export interface AuthorizationCodeProtocolDescriptor {
+    id: string;
+    authorization: DeviceCodeEndpointDescriptor & {
+        redirectUris: string[];
+        scopes?: string[];
+        responseType?: 'code';
+        codeChallengeMethod?: 'S256';
+        extraParams?: Record<string, string>;
+    };
+    token: DeviceCodeEndpointDescriptor & {
+        codec: 'authorizationCodeForm';
+        codeField?: string;
+        codeVerifierField?: string;
+    };
+    refresh?: DeviceCodeEndpointDescriptor & {
+        codec: 'refreshTokenForm';
+    };
+    accountIdClaim?: string | string[];
+}
+interface BaseOAuthIntegration {
+    provider: string;
+    offeringId: string;
+    mode: OAuthConnectMode;
+    integrationId: string;
+    issuedBy: string;
+    clientId: string;
+    accountLabel?: string;
+    accountId?: string;
+}
+export interface DeviceCodeOAuthIntegration extends BaseOAuthIntegration {
+    mode: 'deviceCodeOAuth';
+    protocol: DeviceCodeProtocolDescriptor;
+}
+export interface AuthorizationCodeOAuthIntegration extends BaseOAuthIntegration {
+    mode: 'authorizationCodeOAuth';
+    protocol: AuthorizationCodeProtocolDescriptor;
+}
+export type OAuthIntegration = DeviceCodeOAuthIntegration | AuthorizationCodeOAuthIntegration;
+export {};

package/dist/api/ai-gateway/connect/DeviceCodeProtocol.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=DeviceCodeProtocol.js.map

package/dist/api/ai-gateway/connect/FileSessionImportAdapter.d.ts

@@ -0,0 +1,38 @@
+import type { ProviderSecret } from '../credentials/CredentialVault';
+import type { GatewayDeployment } from '../auth/InvocationTokenCodec';
+import type { SessionImportProfile } from './SessionImportProfiles';
+export interface LocalSessionImportResult {
+    secret: ProviderSecret;
+    /**
+     * How the imported credential authenticates upstream. The import itself is
+     * local, but an imported subscription session is still an OAuth credential.
+     */
+    credentialAuthMode?: 'deviceCodeOAuth' | 'local';
+    accountLabel?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface LocalSessionImportInput {
+    deployment: GatewayDeployment;
+}
+export interface LocalSessionImportAdapter {
+    provider: string;
+    offeringId: string;
+    importSession(input: LocalSessionImportInput): Promise<LocalSessionImportResult>;
+}
+export interface FileSessionImportAdapterOptions {
+    profile: SessionImportProfile;
+    homeDir?: string;
+    readFile?: (filePath: string, encoding: BufferEncoding) => Promise<string>;
+    maxBytes?: number;
+}
+export declare class FileSessionImportAdapter implements LocalSessionImportAdapter {
+    readonly provider: string;
+    readonly offeringId: string;
+    private readonly profile;
+    private readonly homeDir;
+    private readonly readFile;
+    private readonly maxBytes;
+    constructor(options: FileSessionImportAdapterOptions);
+    importSession(input: LocalSessionImportInput): Promise<LocalSessionImportResult>;
+    private readSessionFile;
+}

package/dist/api/ai-gateway/connect/FileSessionImportAdapter.js

@@ -0,0 +1,63 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileSessionImportAdapter = void 0;
+const node_fs_1 = require("node:fs");
+const node_os_1 = __importDefault(require("node:os"));
+const DEFAULT_MAX_SESSION_FILE_BYTES = 256 * 1024;
+class FileSessionImportAdapter {
+    constructor(options) {
+        this.profile = options.profile;
+        this.provider = options.profile.provider;
+        this.offeringId = options.profile.offeringId;
+        this.homeDir = options.homeDir ?? node_os_1.default.homedir();
+        this.readFile = options.readFile ?? node_fs_1.promises.readFile;
+        this.maxBytes = options.maxBytes ?? DEFAULT_MAX_SESSION_FILE_BYTES;
+    }
+    async importSession(input) {
+        if (input.deployment !== 'local') {
+            throw new Error('local_session_import_unavailable_in_cloud');
+        }
+        const raw = await this.readSessionFile(this.profile.resolvePath(this.homeDir));
+        const payload = parseJsonObject(raw);
+        return this.profile.importSession(payload);
+    }
+    async readSessionFile(filePath) {
+        let raw;
+        try {
+            raw = await this.readFile(filePath, 'utf8');
+        }
+        catch (error) {
+            if (isErrno(error, 'ENOENT')) {
+                throw new Error('local_session_file_missing');
+            }
+            throw new Error('local_session_file_read_failed');
+        }
+        if (Buffer.byteLength(raw, 'utf8') > this.maxBytes) {
+            throw new Error('local_session_file_too_large');
+        }
+        return raw;
+    }
+}
+exports.FileSessionImportAdapter = FileSessionImportAdapter;
+function parseJsonObject(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('local_session_file_invalid_json');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('local_session_file_invalid_json');
+    }
+    return parsed;
+}
+function isErrno(error, code) {
+    return error instanceof Error
+        && 'code' in error
+        && error.code === code;
+}
+//# sourceMappingURL=FileSessionImportAdapter.js.map

package/dist/api/ai-gateway/connect/LoopbackAuthorizationCallbackReceiver.d.ts

@@ -0,0 +1,24 @@
+export interface AuthorizationCodeCallbackReceiver {
+    register(input: {
+        redirectUris: string[];
+        state: string;
+        expiresAt: Date;
+        onCallback(result: {
+            code?: string;
+            error?: string;
+        }): Promise<void> | void;
+    }): Promise<{
+        redirectUri: string;
+        close(): void;
+    }>;
+}
+type RegistrationInput = Parameters<AuthorizationCodeCallbackReceiver['register']>[0];
+/** Receives authorization codes locally; credential exchange belongs to the authenticated caller. */
+export declare class LoopbackAuthorizationCallbackReceiver implements AuthorizationCodeCallbackReceiver {
+    private readonly listeners;
+    private pending;
+    register(input: RegistrationInput): ReturnType<AuthorizationCodeCallbackReceiver['register']>;
+    private registerSerial;
+    private handle;
+}
+export {};

package/dist/api/ai-gateway/connect/LoopbackAuthorizationCallbackReceiver.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LoopbackAuthorizationCallbackReceiver = void 0;
+const node_http_1 = require("node:http");
+/** Receives authorization codes locally; credential exchange belongs to the authenticated caller. */
+class LoopbackAuthorizationCallbackReceiver {
+    constructor() {
+        this.listeners = new Map();
+        this.pending = Promise.resolve();
+    }
+    register(input) {
+        const result = this.pending.then(() => this.registerSerial(input));
+        this.pending = result.catch(() => undefined);
+        return result;
+    }
+    async registerSerial(input) {
+        if (!input.state || !Number.isFinite(input.expiresAt.getTime()) || input.expiresAt.getTime() <= Date.now()) {
+            throw new Error('Authorization callback registration is invalid or expired.');
+        }
+        if ([...this.listeners.values()].some(listener => listener.registrations.has(input.state))) {
+            throw new Error('Authorization callback state is already registered.');
+        }
+        const uris = input.redirectUris.map(value => {
+            let uri;
+            try {
+                uri = new URL(value);
+            }
+            catch {
+                throw new Error('Invalid loopback authorization redirect URI.');
+            }
+            if (uri.protocol !== 'http:' || !['localhost', '127.0.0.1'].includes(uri.hostname) ||
+                uri.username || uri.password || uri.search || uri.hash || uri.port === '0') {
+                throw new Error('Invalid loopback authorization redirect URI.');
+            }
+            return uri;
+        });
+        for (const uri of uris) {
+            const port = Number(uri.port || 80);
+            let listener = this.listeners.get(port);
+            if (!listener) {
+                const registrations = new Map();
+                const server = (0, node_http_1.createServer)((request, response) => {
+                    void this.handle(request, response, port, registrations);
+                });
+                try {
+                    await new Promise((resolve, reject) => {
+                        server.once('error', reject);
+                        server.listen(port, '127.0.0.1', () => {
+                            server.removeListener('error', reject);
+                            resolve();
+                        });
+                    });
+                }
+                catch (error) {
+                    if (error.code === 'EADDRINUSE') {
+                        continue;
+                    }
+                    throw new Error('Unable to start the local authorization callback listener.');
+                }
+                server.unref();
+                listener = { server, registrations };
+                this.listeners.set(port, listener);
+            }
+            const selected = listener;
+            let timer;
+            let active = true;
+            const close = () => {
+                if (!active) {
+                    return;
+                }
+                active = false;
+                clearTimeout(timer);
+                selected.registrations.delete(input.state);
+                if (selected.registrations.size === 0 && this.listeners.get(port) === selected) {
+                    this.listeners.delete(port);
+                    selected.server.close();
+                }
+            };
+            selected.registrations.set(input.state, { ...input, path: uri.pathname, close });
+            timer = setTimeout(close, Math.max(0, Math.min(input.expiresAt.getTime() - Date.now(), 2_147_483_647)));
+            timer.unref();
+            return { redirectUri: uri.toString(), close };
+        }
+        throw new Error('The registered local authorization callback ports are unavailable. Close the application using them and retry.');
+    }
+    async handle(request, response, port, registrations) {
+        const reply = (status, success = false) => {
+            response.writeHead(status, {
+                'Content-Type': 'text/html; charset=utf-8',
+                'Cache-Control': 'no-store',
+                'Connection': 'close',
+                'Content-Security-Policy': "default-src 'none'; frame-ancestors 'none'",
+                'Referrer-Policy': 'no-referrer',
+            });
+            response.end(success ? '授权已返回 Xpod，请切回应用完成连接。' : '授权回调无效或已过期，请返回应用重试。');
+        };
+        const allowedHosts = ['localhost', '127.0.0.1'].map(host => port === 80 ? host : `${host}:${port}`);
+        if (request.method !== 'GET' || !allowedHosts.includes(request.headers.host ?? '') ||
+            !request.url?.startsWith('/') || request.url.startsWith('//') ||
+            request.rawHeaders.filter((value, index) => index % 2 === 0 && value.toLowerCase() === 'host').length !== 1) {
+            reply(400);
+            return;
+        }
+        let uri;
+        try {
+            uri = new URL(request.url, `http://127.0.0.1:${port}`);
+        }
+        catch {
+            reply(400);
+            return;
+        }
+        const query = uri.searchParams;
+        if (['state', 'code', 'error'].some(key => query.getAll(key).length > 1) ||
+            !query.get('state') || (!!query.get('code') === !!query.get('error')) ||
+            (query.has('code') && query.has('error'))) {
+            reply(400);
+            return;
+        }
+        const registration = registrations.get(query.get('state'));
+        if (!registration || registration.path !== request.url.split('?')[0] || uri.hash ||
+            registration.expiresAt.getTime() <= Date.now()) {
+            reply(400);
+            return;
+        }
+        registration.close();
+        try {
+            await registration.onCallback(query.has('code') ? { code: query.get('code') } : { error: query.get('error') });
+            reply(200, !query.has('error'));
+        }
+        catch {
+            reply(500);
+        }
+    }
+}
+exports.LoopbackAuthorizationCallbackReceiver = LoopbackAuthorizationCallbackReceiver;
+//# sourceMappingURL=LoopbackAuthorizationCallbackReceiver.js.map

package/dist/api/ai-gateway/connect/OAuthConnectAdapter.d.ts

@@ -4,12 +4,14 @@ import type { AuthContext } from '../../auth/AuthContext';
 import type { ConnectCredentialRecord, PodCredentialRepository } from './index';
 export interface OAuthConnectCredentialStoreOptions {
     provider: string;
+    offeringId: string;
     deployment: GatewayDeployment;
     credentialRepository: PodCredentialRepository;
     vault: CredentialVault;
 }
 export declare class OAuthConnectCredentialStore {
     private readonly provider;
+    private readonly offeringId;
     private readonly credentialRepository;
     private readonly vault;
     constructor(options: OAuthConnectCredentialStoreOptions);