dsh-subscriptions 0.1.4 → 0.1.5

package/lib/auth/device-flow.js

@@ -8,6 +8,7 @@
  * engines uniformly.
  */
 import { hostFetch } from '../http.js';
+import { parseProviderJson } from '../providers/common.js';
 /** Default poll interval when the device-code response omits one. */
 const DEFAULT_INTERVAL_SEC = 5;
 /** Default device-code lifetime when the response omits one (GitHub: 15 minutes). */
@@ -77,7 +78,7 @@ export class DeviceFlowManager {
         if (!response.ok) {
             throw new Error(`${provider} device-code request failed (HTTP ${String(response.status)})`);
         }
-        const wire = await response.json();
+        const wire = await parseProviderJson(response, 'device code request');
         if (typeof wire.device_code !== 'string' || wire.device_code.length === 0
             || typeof wire.user_code !== 'string' || wire.user_code.length === 0
             || typeof wire.verification_uri !== 'string' || wire.verification_uri.length === 0) {
@@ -133,7 +134,7 @@ export class DeviceFlowManager {
                     }).toString(),
                     signal: controller.signal,
                 });
-                const result = await pollResponse.json();
+                const result = await parseProviderJson(pollResponse, 'device token poll');
                 if (typeof result.access_token === 'string' && result.access_token.length > 0) {
                     settle(undefined, result.access_token);
                     return;
@@ -152,7 +153,9 @@ export class DeviceFlowManager {
                         settle(new Error('the device code expired before authorization completed'));
                         return;
                     default:
-                        settle(new Error(`${provider} device-flow polling failed: ${result.error_description ?? result.error ?? `HTTP ${String(pollResponse.status)}`}`));
+                        // Safe means this failure path carries no provider-controlled free text,
+                        // not that no secret can exist elsewhere in the system.
+                        settle(new Error(`${provider} device-flow polling failed (HTTP ${String(pollResponse.status)}): [provider response body omitted]`));
                         return;
                 }
             }

package/lib/auth/oauth-flow.js

@@ -12,6 +12,38 @@ export const DEFAULT_FLOW_TIMEOUT_MS = 180_000;
 const SUCCESS_PAGE = '<!doctype html><html><head><meta charset="utf-8"><title>Login successful</title></head>'
     + '<body style="font-family:sans-serif"><h1>Login successful</h1>'
     + '<p>You can close this tab and return to DeepSeek Harness.</p></body></html>';
+function authorizationFailure(error) {
+    // Safe means this failure path carries no provider-controlled free text,
+    // not that no secret can exist elsewhere in the system.
+    // RFC 6749 §4.1.2.1 categories select local literals, never provider prose.
+    let category;
+    switch (error) {
+        case 'invalid_request':
+            category = 'invalid_request';
+            break;
+        case 'unauthorized_client':
+            category = 'unauthorized_client';
+            break;
+        case 'access_denied':
+            category = 'access_denied';
+            break;
+        case 'unsupported_response_type':
+            category = 'unsupported_response_type';
+            break;
+        case 'invalid_scope':
+            category = 'invalid_scope';
+            break;
+        case 'server_error':
+            category = 'server_error';
+            break;
+        case 'temporarily_unavailable':
+            category = 'temporarily_unavailable';
+            break;
+    }
+    return 'authorization failed'
+        + (category === undefined ? '' : ` (${category})`)
+        + ': [provider message omitted]';
+}
 function failurePage(detail) {
     return '<!doctype html><html><head><meta charset="utf-8"><title>Login failed</title></head>'
         + `<body style="font-family:sans-serif"><h1>Login failed</h1><p>${detail.replace(/[<>&]/g, '')}</p></body></html>`;
@@ -138,19 +170,20 @@ export class OAuthFlowManager {
                 response.end('not found');
                 return;
             }
-            const errorDescription = url.searchParams.get('error_description') ?? url.searchParams.get('error');
-            if (errorDescription !== null) {
-                response.writeHead(200, { 'content-type': 'text/html' });
-                response.end(failurePage(errorDescription));
-                settle(new Error(`authorization failed: ${errorDescription}`));
-                return;
-            }
             if (url.searchParams.get('state') !== input.state) {
-                // A stray or replayed redirect must not kill the real attempt.
+                // A stray or replayed redirect must not kill the real attempt, even on error.
+                // RFC 6749 §4.1.2.1 requires errors to echo the state sent in the request.
                 response.writeHead(400, { 'content-type': 'text/plain' });
                 response.end('state mismatch');
                 return;
             }
+            if (url.searchParams.has('error_description') || url.searchParams.has('error')) {
+                const detail = authorizationFailure(url.searchParams.get('error'));
+                response.writeHead(200, { 'content-type': 'text/html' });
+                response.end(failurePage(detail));
+                settle(new Error(detail));
+                return;
+            }
             const code = url.searchParams.get('code');
             if (code === null || code.length === 0) {
                 response.writeHead(400, { 'content-type': 'text/plain' });

package/lib/client/SubscriptionsSection.d.ts

@@ -64,23 +64,6 @@ export interface ResetCreditView {
     /** Epoch milliseconds until which the grant is visible but not usable. */
     cooldownUntil?: number;
 }
-/** One model's default-effort picker state as answered by `modelDefaults`. */
-export interface ModelDefaultView {
-    id: string;
-    name: string;
-    /** Advertised effort levels, in catalog order (empty when the model has no reasoning). */
-    efforts: {
-        id: string;
-        name: string;
-    }[];
-    /** The user-configured default effort, when set. */
-    configured?: string;
-}
-/** `modelDefaults` endpoint value: one provider's picker state. */
-export interface ModelDefaultsCatalog {
-    provider: SubscriptionProvider;
-    models: ModelDefaultView[];
-}
 /** Injected dependencies of {@link SubscriptionsSection} (slot `inject`). */
 export interface SubscriptionsSectionInjected {
     /** Generic logical-RPC caller over the Connection transport. */
@@ -102,63 +85,6 @@ export type SubscriptionsSectionProps = Partial<SubscriptionsSectionInjected>;
 export declare function clientVersionText(t: SubscriptionsSectionInjected['t'], clientVersion: ProviderStatus['clientVersion']): string;
 /** Meter fill color lives with the pace logic: fresh 90%+ is red, pace presets add a yellow lead threshold. */
 export { usageBarColor } from './usage-pace.js';
-/** What one provider's collapsible default-effort section renders. */
-export interface ModelDefaultsView {
-    /** Models with reasoning levels, after the name filter — one row each. */
-    shown: ModelDefaultView[];
-    /** Models with reasoning levels before filtering (the header total). */
-    total: number;
-    /** How many of those carry a user override (the header count). */
-    overridden: number;
-    /** Models without reasoning levels: one count line, never a row each. */
-    withoutEfforts: number;
-    /** Whether the list is long enough to deserve a filter box. */
-    showFilter: boolean;
-}
-/**
- * Derive one provider's default-effort section from its catalog and filter.
- * Pure so the collapsed-header counts and the filter stay testable without a
- * DOM: rows come only from models that advertise levels, the count of the rest
- * rides as one line, and the filter matches display name or model id.
- * @param models - the provider's catalog models, or undefined while loading.
- * @param filter - the raw filter input (trimmed and lowercased here).
- * @returns the section's rows and header counts.
- */
-export declare function deriveModelDefaultsView(models: readonly ModelDefaultView[] | undefined, filter: string): ModelDefaultsView;
-/** Inputs of the default-effort fetch decision (see {@link shouldFetchModelDefaults}). */
-export interface ModelDefaultsFetchInput {
-    /** Providers that currently have at least one account. */
-    loggedIn: readonly SubscriptionProvider[];
-    /** Providers whose disclosure is open. */
-    open: readonly SubscriptionProvider[];
-    /** The account signature the last completed fetch was answered for. */
-    loadedFor: string | undefined;
-    /** The account signature of the current status snapshot. */
-    signature: string;
-    /** Whether the last attempt failed (a failure latches until Retry). */
-    failed: boolean;
-}
-/**
- * Whether the default-effort catalog needs (re)fetching.
- *
- * Fetching is gated on an *attempt* signature rather than on the payload
- * being empty: an empty answer is a legitimate result (a narrowed
- * `config.providers`, or a catalog that is momentarily unavailable), and
- * treating it as "not loaded yet" re-ran this effect forever. The signature
- * also covers the accounts, so logging a second provider in refetches
- * instead of leaving that card on the previous answer.
- * @param input - the decision inputs.
- * @returns true when the caller should start a fetch.
- */
-export declare function shouldFetchModelDefaults(input: ModelDefaultsFetchInput): boolean;
-/**
- * Stable signature of the accounts a catalog answer depends on. A change
- * means a previous answer is stale (an account arrived or left), so the next
- * open disclosure refetches.
- * @param statuses - the per-provider status snapshot.
- * @returns a signature string, stable across renders with equal accounts.
- */
-export declare function modelDefaultsSignature(statuses: Partial<Record<SubscriptionProvider, ProviderStatus>>): string;
 /**
  * The Subscriptions settings page component.
  * @param props - the slot inject face ({@link SubscriptionsSectionInjected}).

package/lib/client/SubscriptionsSection.js

@@ -1,8 +1,8 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 /**
  * Subscriptions settings section: one card per subscription provider with an
- * OAuth login/logout flow driven by the node half's `/subscriptions-auth` RPC
- * channel. Login state lives server-side; the page polls `status` only while
+ * OAuth login/logout flow driven by the node half's
+ * `/api/subscriptions-auth.<endpoint>` RPC routes. Login state lives server-side; the page polls `status` only while
  * a login attempt is busy, so an idle page never polls. All state is local
  * React state — the page has no store.
  *
@@ -29,11 +29,6 @@ import { callSubscriptionsAuth, SubscriptionsAuthError } from './subscriptions-r
 export { callSubscriptionsAuth } from './subscriptions-rpc.js';
 /** Poll cadence while a provider login attempt is busy. */
 const POLL_INTERVAL_MS = 2000;
-/**
- * Model count above which the expanded default-effort list also offers a name
- * filter; below it the list is short enough to scan.
- */
-const MODEL_FILTER_THRESHOLD = 8;
 const CLIENT_VERSION_SOURCES = {
     npm: 'clientVersionNpm',
     local: 'clientVersionLocal',
@@ -192,65 +187,6 @@ function usageWindowLabel(t, window) {
 }
 /** Meter fill color lives with the pace logic: fresh 90%+ is red, pace presets add a yellow lead threshold. */
 export { usageBarColor } from './usage-pace.js';
-/**
- * Derive one provider's default-effort section from its catalog and filter.
- * Pure so the collapsed-header counts and the filter stay testable without a
- * DOM: rows come only from models that advertise levels, the count of the rest
- * rides as one line, and the filter matches display name or model id.
- * @param models - the provider's catalog models, or undefined while loading.
- * @param filter - the raw filter input (trimmed and lowercased here).
- * @returns the section's rows and header counts.
- */
-export function deriveModelDefaultsView(models, filter) {
-    const all = models ?? [];
-    const withEfforts = all.filter(model => model.efforts.length > 0);
-    const query = filter.trim().toLowerCase();
-    const shown = query === ''
-        ? withEfforts
-        : withEfforts.filter(model => model.name.toLowerCase().includes(query)
-            || model.id.toLowerCase().includes(query));
-    return {
-        shown,
-        total: withEfforts.length,
-        overridden: withEfforts.filter(model => model.configured !== undefined).length,
-        withoutEfforts: all.length - withEfforts.length,
-        showFilter: withEfforts.length > MODEL_FILTER_THRESHOLD,
-    };
-}
-/**
- * Whether the default-effort catalog needs (re)fetching.
- *
- * Fetching is gated on an *attempt* signature rather than on the payload
- * being empty: an empty answer is a legitimate result (a narrowed
- * `config.providers`, or a catalog that is momentarily unavailable), and
- * treating it as "not loaded yet" re-ran this effect forever. The signature
- * also covers the accounts, so logging a second provider in refetches
- * instead of leaving that card on the previous answer.
- * @param input - the decision inputs.
- * @returns true when the caller should start a fetch.
- */
-export function shouldFetchModelDefaults(input) {
-    if (input.failed)
-        return false;
-    if (input.loggedIn.length === 0)
-        return false;
-    // Only an open disclosure pays for the per-model live resolve.
-    if (!input.open.some(provider => input.loggedIn.includes(provider)))
-        return false;
-    return input.loadedFor !== input.signature;
-}
-/**
- * Stable signature of the accounts a catalog answer depends on. A change
- * means a previous answer is stale (an account arrived or left), so the next
- * open disclosure refetches.
- * @param statuses - the per-provider status snapshot.
- * @returns a signature string, stable across renders with equal accounts.
- */
-export function modelDefaultsSignature(statuses) {
-    return PROVIDERS
-        .map(({ id }) => `${id}:${(statuses[id]?.accounts ?? []).map(account => account.key).sort().join(',')}`)
-        .join('|');
-}
 /**
  * The Subscriptions settings page component.
  * @param props - the slot inject face ({@link SubscriptionsSectionInjected}).