fluxy-bot 0.8.9 → 0.9.0

package/worker/codex-auth.ts

@@ -14,12 +14,12 @@ import os from 'os';
 import { log } from '../shared/logger.js';
 
 const OAUTH_CONFIG = {
-    AUTHORIZE_URL: 'https://auth.openai.com/oauth/authorize',
-    TOKEN_URL: 'https://auth.openai.com/oauth/token',
-    REDIRECT_URI: 'http://localhost:1455/auth/callback',
-    CLIENT_ID: 'app_EMoamEEZ73f0CkXaXp7hrann',
-    SCOPES: 'openid profile email offline_access',
-    PORT: 1455
+  AUTHORIZE_URL: 'https://auth.openai.com/oauth/authorize',
+  TOKEN_URL: 'https://auth.openai.com/oauth/token',
+  REDIRECT_URI: 'http://localhost:1455/auth/callback',
+  CLIENT_ID: 'app_EMoamEEZ73f0CkXaXp7hrann',
+  SCOPES: 'openid profile email offline_access',
+  PORT: 1455,
 };
 
 const AUTH_DIR = path.join(os.homedir(), '.codex');
@@ -32,205 +32,168 @@ let callbackServer: http.Server | null = null;
 /* ── Helpers ── */
 
 function stopCallbackServer(): void {
-    if (callbackServer) {
-        try {
-            callbackServer.close();
-        } catch {}
-        callbackServer = null;
-    }
+  if (callbackServer) {
+    try { callbackServer.close(); } catch {}
+    callbackServer = null;
+  }
 }
 
 function storeCredentials(tokens: any): void {
-    if (!fs.existsSync(AUTH_DIR)) {
-        fs.mkdirSync(AUTH_DIR, { recursive: true });
-    }
-
-    const credentials: Record<string, any> = {
-        access_token: tokens.access_token,
-        token_type: tokens.token_type || 'Bearer'
-    };
-
-    if (tokens.refresh_token) credentials.refresh_token = tokens.refresh_token;
-    if (tokens.id_token) credentials.id_token = tokens.id_token;
-    if (tokens.expires_in) {
-        credentials.expires_at = Date.now() + (tokens.expires_in - 300) * 1000;
-    }
+  if (!fs.existsSync(AUTH_DIR)) {
+    fs.mkdirSync(AUTH_DIR, { recursive: true });
+  }
+
+  const credentials: Record<string, any> = {
+    access_token: tokens.access_token,
+    token_type: tokens.token_type || 'Bearer',
+  };
+
+  if (tokens.refresh_token) credentials.refresh_token = tokens.refresh_token;
+  if (tokens.id_token) credentials.id_token = tokens.id_token;
+  if (tokens.expires_in) {
+    credentials.expires_at = Date.now() + (tokens.expires_in - 300) * 1000;
+  }
+
+  // Decode JWT claims for account info
+  try {
+    const payload = JSON.parse(Buffer.from(tokens.access_token.split('.')[1], 'base64url').toString());
+    const authClaims = payload['https://api.openai.com/auth'] || {};
+    if (authClaims.chatgpt_account_id) credentials.chatgpt_account_id = authClaims.chatgpt_account_id;
+    if (authClaims.chatgpt_plan_type) credentials.chatgpt_plan_type = authClaims.chatgpt_plan_type;
+  } catch {
+    log.warn('Codex: failed to decode JWT claims');
+  }
+
+  fs.writeFileSync(AUTH_FILE, JSON.stringify(credentials, null, 2), 'utf-8');
+  try { fs.chmodSync(AUTH_FILE, 0o600); } catch {}
+  log.ok('Codex credentials stored');
+}
 
-    // Decode JWT claims for account info
-    try {
-        const payload = JSON.parse(
-            Buffer.from(
-                tokens.access_token.split('.')[1],
-                'base64url'
-            ).toString()
-        );
-        const authClaims = payload['https://api.openai.com/auth'] || {};
-        if (authClaims.chatgpt_account_id)
-            credentials.chatgpt_account_id = authClaims.chatgpt_account_id;
-        if (authClaims.chatgpt_plan_type)
-            credentials.chatgpt_plan_type = authClaims.chatgpt_plan_type;
-    } catch {
-        log.warn('Codex: failed to decode JWT claims');
-    }
+async function exchangeCode(code: string): Promise<{ success: boolean; error?: string }> {
+  if (!codeVerifier) {
+    return { success: false, error: 'No code verifier — OAuth flow was not started.' };
+  }
+
+  try {
+    const payload = new URLSearchParams({
+      grant_type: 'authorization_code',
+      client_id: OAUTH_CONFIG.CLIENT_ID,
+      code,
+      redirect_uri: OAUTH_CONFIG.REDIRECT_URI,
+      code_verifier: codeVerifier,
+    });
 
-    fs.writeFileSync(AUTH_FILE, JSON.stringify(credentials, null, 2), 'utf-8');
-    try {
-        fs.chmodSync(AUTH_FILE, 0o600);
-    } catch {}
-    log.ok('Codex credentials stored');
-}
+    const response = await fetch(OAUTH_CONFIG.TOKEN_URL, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: payload.toString(),
+    });
 
-async function exchangeCode(
-    code: string
-): Promise<{ success: boolean; error?: string }> {
-    if (!codeVerifier) {
-        return {
-            success: false,
-            error: 'No code verifier — OAuth flow was not started.'
-        };
+    if (!response.ok) {
+      return { success: false, error: `Authentication failed (${response.status}). Please try again.` };
     }
 
-    try {
-        const payload = new URLSearchParams({
-            grant_type: 'authorization_code',
-            client_id: OAUTH_CONFIG.CLIENT_ID,
-            code,
-            redirect_uri: OAUTH_CONFIG.REDIRECT_URI,
-            code_verifier: codeVerifier
-        });
-
-        const response = await fetch(OAUTH_CONFIG.TOKEN_URL, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: payload.toString()
-        });
-
-        if (!response.ok) {
-            return {
-                success: false,
-                error: `Authentication failed (${response.status}). Please try again.`
-            };
-        }
-
-        const tokens = await response.json();
-        storeCredentials(tokens);
-        codeVerifier = null;
-        oauthState = null;
-        return { success: true };
-    } catch (err: any) {
-        return { success: false, error: err.message };
-    }
+    const tokens = await response.json();
+    storeCredentials(tokens);
+    codeVerifier = null;
+    oauthState = null;
+    return { success: true };
+  } catch (err: any) {
+    return { success: false, error: err.message };
+  }
 }
 
 /* ── Public API ── */
 
-export function startCodexOAuth(): Promise<{
-    success: boolean;
-    authUrl?: string;
-    error?: string;
-}> {
-    return new Promise(resolve => {
-        stopCallbackServer();
-
-        // Generate PKCE
-        codeVerifier = crypto.randomBytes(32).toString('base64url');
-        const codeChallenge = crypto
-            .createHash('sha256')
-            .update(codeVerifier)
-            .digest('base64url');
-        oauthState = crypto.randomUUID();
-
-        // Start local callback server
-        callbackServer = http.createServer((req, res) => {
-            if (!req.url?.startsWith('/auth/callback')) {
-                res.writeHead(404);
-                res.end();
-                return;
-            }
-
-            const url = new URL(
-                req.url,
-                `http://localhost:${OAUTH_CONFIG.PORT}`
-            );
-            const code = url.searchParams.get('code');
-            const returnedState = url.searchParams.get('state');
-            const error = url.searchParams.get('error');
-
-            res.writeHead(200, { 'Content-Type': 'text/html' });
-            res.end(`<html><body style="font-family:sans-serif;text-align:center;padding:60px;background:#0a0a0a;color:#fff">
+export function startCodexOAuth(): Promise<{ success: boolean; authUrl?: string; error?: string }> {
+  return new Promise((resolve) => {
+    stopCallbackServer();
+
+    // Generate PKCE
+    codeVerifier = crypto.randomBytes(32).toString('base64url');
+    const codeChallenge = crypto.createHash('sha256').update(codeVerifier).digest('base64url');
+    oauthState = crypto.randomUUID();
+
+    // Start local callback server
+    callbackServer = http.createServer((req, res) => {
+      if (!req.url?.startsWith('/auth/callback')) {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+
+      const url = new URL(req.url, `http://localhost:${OAUTH_CONFIG.PORT}`);
+      const code = url.searchParams.get('code');
+      const returnedState = url.searchParams.get('state');
+      const error = url.searchParams.get('error');
+
+      res.writeHead(200, { 'Content-Type': 'text/html' });
+      res.end(`<html><body style="font-family:sans-serif;text-align:center;padding:60px;background:#0a0a0a;color:#fff">
         <h2>${error ? 'Authentication Failed' : 'Authenticated!'}</h2>
         <p style="color:#888">${error || 'You can close this tab and return to Fluxy.'}</p>
       </body></html>`);
 
-            stopCallbackServer();
-
-            if (error || !code || returnedState !== oauthState) return;
-            exchangeCode(code);
-        });
-
-        callbackServer.listen(OAUTH_CONFIG.PORT, '127.0.0.1', () => {
-            log.ok(`Codex OAuth callback server on port ${OAUTH_CONFIG.PORT}`);
-
-            const params = new URLSearchParams({
-                response_type: 'code',
-                client_id: OAUTH_CONFIG.CLIENT_ID,
-                redirect_uri: OAUTH_CONFIG.REDIRECT_URI,
-                scope: OAUTH_CONFIG.SCOPES,
-                code_challenge: codeChallenge,
-                code_challenge_method: 'S256',
-                state: oauthState!,
-                id_token_add_organizations: 'true',
-                codex_cli_simplified_flow: 'true'
-            });
-
-            resolve({
-                success: true,
-                authUrl: `${OAUTH_CONFIG.AUTHORIZE_URL}?${params.toString()}`
-            });
-        });
-
-        callbackServer.on('error', (err: any) => {
-            const error =
-                err.code === 'EADDRINUSE'
-                    ? `Port ${OAUTH_CONFIG.PORT} is busy. Close other Codex instances.`
-                    : err.message;
-            resolve({ success: false, error });
-        });
+      stopCallbackServer();
+
+      if (error || !code || returnedState !== oauthState) return;
+      exchangeCode(code);
+    });
+
+    callbackServer.listen(OAUTH_CONFIG.PORT, '127.0.0.1', () => {
+      log.ok(`Codex OAuth callback server on port ${OAUTH_CONFIG.PORT}`);
+
+      const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: OAUTH_CONFIG.CLIENT_ID,
+        redirect_uri: OAUTH_CONFIG.REDIRECT_URI,
+        scope: OAUTH_CONFIG.SCOPES,
+        code_challenge: codeChallenge,
+        code_challenge_method: 'S256',
+        state: oauthState!,
+        id_token_add_organizations: 'true',
+        codex_cli_simplified_flow: 'true',
+      });
+
+      resolve({ success: true, authUrl: `${OAUTH_CONFIG.AUTHORIZE_URL}?${params.toString()}` });
     });
+
+    callbackServer.on('error', (err: any) => {
+      const error = err.code === 'EADDRINUSE'
+        ? `Port ${OAUTH_CONFIG.PORT} is busy. Close other Codex instances.`
+        : err.message;
+      resolve({ success: false, error });
+    });
+  });
 }
 
 export function cancelCodexOAuth(): void {
-    stopCallbackServer();
-    codeVerifier = null;
-    oauthState = null;
+  stopCallbackServer();
+  codeVerifier = null;
+  oauthState = null;
 }
 
-export function getCodexAuthStatus(): {
-    authenticated: boolean;
-    plan?: string;
-    error?: string;
-} {
-    try {
-        if (!fs.existsSync(AUTH_FILE)) return { authenticated: false };
-        const creds = JSON.parse(fs.readFileSync(AUTH_FILE, 'utf-8'));
-        if (!creds.access_token) return { authenticated: false };
-        if (creds.expires_at && Date.now() >= creds.expires_at) {
-            return { authenticated: false, error: 'Token expired' };
-        }
-        return { authenticated: true, plan: creds.chatgpt_plan_type || 'plus' };
-    } catch (err: any) {
-        return { authenticated: false, error: err.message };
+export function getCodexAuthStatus(): { authenticated: boolean; plan?: string; error?: string } {
+  try {
+    if (!fs.existsSync(AUTH_FILE)) return { authenticated: false };
+    const creds = JSON.parse(fs.readFileSync(AUTH_FILE, 'utf-8'));
+    if (!creds.access_token) return { authenticated: false };
+    if (creds.expires_at && Date.now() >= creds.expires_at) {
+      return { authenticated: false, error: 'Token expired' };
     }
+    return { authenticated: true, plan: creds.chatgpt_plan_type || 'plus' };
+  } catch (err: any) {
+    return { authenticated: false, error: err.message };
+  }
 }
 
 export function readCodexAccessToken(): string | null {
-    try {
-        if (!fs.existsSync(AUTH_FILE)) return null;
-        const creds = JSON.parse(fs.readFileSync(AUTH_FILE, 'utf-8'));
-        if (!creds.access_token) return null;
-        if (creds.expires_at && Date.now() >= creds.expires_at) return null;
-        return creds.access_token;
-    } catch {
-        return null;
-    }
+  try {
+    if (!fs.existsSync(AUTH_FILE)) return null;
+    const creds = JSON.parse(fs.readFileSync(AUTH_FILE, 'utf-8'));
+    if (!creds.access_token) return null;
+    if (creds.expires_at && Date.now() >= creds.expires_at) return null;
+    return creds.access_token;
+  } catch {
+    return null;
+  }
 }