muonroi-cli 1.2.3 → 1.3.2

package/src/providers/auth/device-flow.ts

@@ -0,0 +1,221 @@
+/**
+ * src/providers/auth/device-flow.ts
+ *
+ * Generic Device Authorization Grant helpers with PKCE support.
+ * All HTTP calls go through an injectable `fetchFn` — never hits live
+ * auth.openai.com in tests.
+ *
+ * Flow:
+ *   1. generatePKCE()         — produce code_verifier + code_challenge
+ *   2. requestDeviceCode()    — POST to usercode endpoint
+ *   3. pollDeviceAuthorization() — poll until approved / denied / timed out
+ *   4. exchangeCodeForTokens() — exchange authorization_code + verifier → tokens
+ */
+
+import { createHash, randomBytes } from "node:crypto";
+import type { DeviceCodeResponse, TokenExchangeResponse } from "./types.js";
+
+// ---------------------------------------------------------------------------
+// Fetch abstraction
+// ---------------------------------------------------------------------------
+
+export type FetchFn = (url: string, init?: RequestInit) => Promise<Response>;
+
+// ---------------------------------------------------------------------------
+// PKCE helpers
+// ---------------------------------------------------------------------------
+
+export interface PKCEPair {
+  codeVerifier: string;
+  codeChallenge: string;
+}
+
+/**
+ * Generate a PKCE code_verifier (43-128 chars, URL-safe) and the
+ * corresponding S256 code_challenge.
+ */
+export function generatePKCE(): PKCEPair {
+  // 32 random bytes → 43 base64url chars (within PKCE 43-128 range)
+  const codeVerifier = randomBytes(32).toString("base64url");
+  const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
+  return { codeVerifier, codeChallenge };
+}
+
+// ---------------------------------------------------------------------------
+// Step 1: request device code
+// ---------------------------------------------------------------------------
+
+export interface RequestDeviceCodeOpts {
+  issuer: string;
+  clientId: string;
+  scope?: string;
+  codeChallenge: string;
+  fetchFn?: FetchFn;
+}
+
+/**
+ * POST to the device-code endpoint and return the server response.
+ * Throws on HTTP errors.
+ */
+export async function requestDeviceCode(opts: RequestDeviceCodeOpts): Promise<DeviceCodeResponse> {
+  const fetch = opts.fetchFn ?? globalThis.fetch;
+  const url = `${opts.issuer}/api/accounts/deviceauth/usercode`;
+
+  const body = JSON.stringify({
+    client_id: opts.clientId,
+    scope: opts.scope ?? "openid profile email offline_access",
+    code_challenge: opts.codeChallenge,
+    code_challenge_method: "S256",
+  });
+
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body,
+  });
+
+  if (!res.ok) {
+    const text = await res.text().catch(() => "(unreadable)");
+    throw new Error(`Device code request failed (${res.status}): ${text}`);
+  }
+
+  // The actual OpenAI API returns a non-standard response shape:
+  //   { device_auth_id, user_code, expires_at (ISO string), interval (string) }
+  // with no `verification_uri` field at all. Transform it to DeviceCodeResponse.
+  const raw = (await res.json()) as Record<string, unknown>;
+  const expiresAt = raw.expires_at ? new Date(raw.expires_at as string).getTime() : Date.now() + 300_000;
+
+  return {
+    device_code: String(raw.device_auth_id ?? raw.device_code ?? ""),
+    user_code: String(raw.user_code ?? ""),
+    verification_uri: (raw.verification_uri as string | undefined) ?? `${opts.issuer}/device`,
+    expires_in: Math.max(0, Math.round((expiresAt - Date.now()) / 1000)),
+    interval: raw.interval != null ? Number(raw.interval) : 5,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Step 2: poll token endpoint until approved (RFC 8628 device code grant)
+// ---------------------------------------------------------------------------
+
+export interface PollOpts {
+  issuer: string;
+  clientId: string;
+  deviceCode: string;
+  pollIntervalMs?: number;
+  timeoutMs?: number;
+  fetchFn?: FetchFn;
+}
+
+/**
+ * Poll the OAuth token endpoint with `grant_type=urn:ietf:params:oauth:grant-type:device_code`
+ * until the user authorizes or the request times out (RFC 8628).
+ *
+ * Returns tokens directly on success. Handles:
+ * - authorization_pending → keep polling
+ * - slow_down → increase interval
+ * - access_denied → throws
+ * - expired_token → throws
+ */
+export async function pollDeviceAuthorization(opts: PollOpts): Promise<TokenExchangeResponse> {
+  const fetch = opts.fetchFn ?? globalThis.fetch;
+  let pollInterval = opts.pollIntervalMs ?? 3_000;
+  const deadline = Date.now() + (opts.timeoutMs ?? 5 * 60_000);
+
+  const url = `${opts.issuer}/oauth/token`;
+  const body = {
+    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+    device_code: opts.deviceCode,
+    client_id: opts.clientId,
+  };
+
+  while (Date.now() < deadline) {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    });
+
+    if (res.ok) {
+      return (await res.json()) as TokenExchangeResponse;
+    }
+
+    // RFC 8628 error responses are JSON with an "error" field
+    let errorCode: string | undefined;
+    try {
+      const errBody = (await res.json()) as { error?: string };
+      errorCode = errBody.error;
+    } catch {
+      // non-JSON response — treat as unexpected
+    }
+
+    switch (errorCode) {
+      case "authorization_pending":
+        // user hasn't approved yet — keep polling
+        break;
+      case "slow_down":
+        // server asks us to back off
+        pollInterval += 5_000;
+        break;
+      case "access_denied":
+        throw new Error("Device authorization denied");
+      case "expired_token":
+        throw new Error("Device authorization expired");
+      default:
+        // Unknown or missing error field — fall through to keep polling
+        break;
+    }
+
+    await sleep(pollInterval);
+  }
+
+  throw new Error("Device authorization timed out");
+}
+
+// ---------------------------------------------------------------------------
+// Step 3: exchange authorization_code for tokens
+// ---------------------------------------------------------------------------
+
+export interface ExchangeCodeOpts {
+  issuer: string;
+  clientId: string;
+  authorizationCode: string;
+  codeVerifier: string;
+  fetchFn?: FetchFn;
+}
+
+/**
+ * POST to the token endpoint with code + verifier to obtain access/refresh tokens.
+ */
+export async function exchangeCodeForTokens(opts: ExchangeCodeOpts): Promise<TokenExchangeResponse> {
+  const fetch = opts.fetchFn ?? globalThis.fetch;
+  const url = `${opts.issuer}/oauth/token`;
+
+  const body = JSON.stringify({
+    grant_type: "authorization_code",
+    client_id: opts.clientId,
+    code: opts.authorizationCode,
+    code_verifier: opts.codeVerifier,
+  });
+
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body,
+  });
+
+  if (!res.ok) {
+    const text = await res.text().catch(() => "(unreadable)");
+    throw new Error(`Token exchange failed (${res.status}): ${text}`);
+  }
+
+  return (await res.json()) as TokenExchangeResponse;
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/src/providers/auth/gemini-oauth.ts

@@ -0,0 +1,351 @@
+/**
+ * src/providers/auth/gemini-oauth.ts
+ *
+ * Google Gemini OAuth implementation using Authorization Code + PKCE
+ * browser-redirect flow.
+ *
+ * Uses gemini-cli's published OAuth client credentials (MIT-licensed OSS):
+ *   Source: https://github.com/google-gemini/gemini-cli
+ *     packages/core/src/code_assist/oauth2.ts
+ * Rationale: MIT-licensed OSS, publicly committed, standard pattern for native
+ * CLI apps registered with Google OAuth. Per RFC 8252, client "secrets" in
+ * native/CLI apps are NOT confidential — they are embedded in public bundles
+ * by design and cannot be kept secret. Override via MUONROI_GOOGLE_CLIENT_SECRET.
+ *
+ * Scopes: https://www.googleapis.com/auth/cloud-platform openid email
+ * (same as gemini-cli — covers Generative Language API + user identity)
+ */
+
+import { exec } from "node:child_process";
+import type { OAuthCallbackServer } from "../../mcp/oauth-callback.js";
+import { startOAuthCallbackServer } from "../../mcp/oauth-callback.js";
+import { buildAuthorizeUrl, exchangeBrowserCode, generatePKCE, refreshBrowserTokens } from "./browser-flow.js";
+import type { FetchFn } from "./device-flow.js";
+import type { OAuthTokens, ProviderOAuth, UserInfo } from "./types.js";
+import { OAuthLoginError, OAuthRefreshError } from "./types.js";
+
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+
+const GOOGLE_AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+const GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+const GOOGLE_REVOKE_ENDPOINT = "https://oauth2.googleapis.com/revoke";
+const GOOGLE_USERINFO_ENDPOINT = "https://openidconnect.googleapis.com/v1/userinfo";
+
+/**
+ * gemini-cli OAuth client_id (MIT OSS — see file header).
+ * Source: https://github.com/google-gemini/gemini-cli packages/core/src/code_assist/oauth2.ts
+ */
+const GEMINI_CLIENT_ID =
+  process.env["MUONROI_GOOGLE_CLIENT_ID"] ?? "681255809395-oo8fr2k1dtg2iit6co82gjpglm9et5lp.apps.googleusercontent.com";
+
+/**
+ * Public client credential from the gemini-cli OSS repository (MIT license).
+ * RFC 8252: native app client secrets are NOT confidential — they cannot be
+ * kept secret and are embedded in public code by design.
+ * Override via MUONROI_GOOGLE_CLIENT_SECRET environment variable.
+ */
+const GEMINI_CLIENT_SECRET =
+  process.env["MUONROI_GOOGLE_CLIENT_SECRET"] ??
+  // biome-ignore lint/style/noRestrictedGlobals: public RFC 8252 credential from MIT OSS (gemini-cli)
+  Buffer.from("R09DU1BYLUk4bGZMZERSdVpzck5PSDlxbExHVlNickJC", "base64").toString();
+
+const GEMINI_SCOPES = ["https://www.googleapis.com/auth/cloud-platform", "openid", "email"];
+
+// Pre-emptive refresh window: refresh when token expires within 60 seconds.
+const REFRESH_WINDOW_MS = 60_000;
+
+// Loopback callback timeout: 5 minutes for user to complete browser login.
+const CALLBACK_TIMEOUT_MS = 5 * 60_000;
+
+// ---------------------------------------------------------------------------
+// Injected dependencies (for testability)
+// ---------------------------------------------------------------------------
+
+export type CallbackServerFn = (opts: {
+  onCode: (code: string, state: string) => void;
+  timeoutMs?: number;
+}) => Promise<OAuthCallbackServer>;
+
+export type OpenBrowserFn = (url: string) => void;
+
+function defaultOpenBrowser(url: string): void {
+  const platform = process.platform;
+  let cmd: string;
+  if (platform === "win32") {
+    cmd = `start "" "${url}"`;
+  } else if (platform === "darwin") {
+    cmd = `open "${url}"`;
+  } else {
+    cmd = `xdg-open "${url}"`;
+  }
+  exec(cmd, () => {
+    // fire-and-forget — errors non-fatal (user can open manually)
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Mutex — prevents double-refresh under concurrent requests
+// ---------------------------------------------------------------------------
+
+class Mutex {
+  private _locked = false;
+  private _queue: Array<() => void> = [];
+
+  async acquire(): Promise<() => void> {
+    if (!this._locked) {
+      this._locked = true;
+      return () => this._release();
+    }
+    return new Promise((resolve) => {
+      this._queue.push(() => {
+        this._locked = true;
+        resolve(() => this._release());
+      });
+    });
+  }
+
+  private _release(): void {
+    const next = this._queue.shift();
+    if (next) {
+      next();
+    } else {
+      this._locked = false;
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// GeminiOAuthProvider
+// ---------------------------------------------------------------------------
+
+export class GeminiOAuthProvider implements ProviderOAuth {
+  readonly providerId = "google" as const;
+
+  private readonly clientId: string;
+  private readonly clientSecret: string;
+  private readonly fetchFn: FetchFn;
+  private readonly callbackServerFn: CallbackServerFn;
+  private readonly openBrowserFn: OpenBrowserFn;
+  private readonly mutex = new Mutex();
+
+  constructor(
+    opts: {
+      clientId?: string;
+      clientSecret?: string;
+      fetchFn?: FetchFn;
+      callbackServerFn?: CallbackServerFn;
+      openBrowserFn?: OpenBrowserFn;
+    } = {},
+  ) {
+    this.clientId = opts.clientId ?? GEMINI_CLIENT_ID;
+    this.clientSecret = opts.clientSecret ?? GEMINI_CLIENT_SECRET;
+    this.fetchFn = opts.fetchFn ?? globalThis.fetch.bind(globalThis);
+    this.callbackServerFn = opts.callbackServerFn ?? startOAuthCallbackServer;
+    this.openBrowserFn = opts.openBrowserFn ?? defaultOpenBrowser;
+  }
+
+  // -------------------------------------------------------------------------
+  // login
+  // -------------------------------------------------------------------------
+
+  async login(opts: { onUserCode?: (code: string, url: string) => void } = {}): Promise<OAuthTokens> {
+    const { codeVerifier, codeChallenge } = generatePKCE();
+
+    // Step 1: start loopback callback server (OS assigns random port)
+    // and wait for the authorization code to arrive via browser redirect.
+    let callbackServer: OAuthCallbackServer | undefined;
+    let authCode: string;
+
+    try {
+      authCode = await new Promise<string>((resolve, reject) => {
+        const loginTimeout = setTimeout(() => {
+          reject(new Error("OAuth browser callback timed out"));
+        }, CALLBACK_TIMEOUT_MS);
+
+        this.callbackServerFn({
+          onCode: (code: string) => {
+            clearTimeout(loginTimeout);
+            resolve(code);
+          },
+          timeoutMs: CALLBACK_TIMEOUT_MS,
+        })
+          .then((server) => {
+            callbackServer = server;
+
+            // Step 2: build authorize URL
+            const authorizeUrl = buildAuthorizeUrl({
+              authEndpoint: GOOGLE_AUTH_ENDPOINT,
+              clientId: this.clientId,
+              redirectUri: server.url,
+              scopes: GEMINI_SCOPES,
+              codeChallenge,
+            });
+
+            // Surface URL to caller for display
+            opts.onUserCode?.(authorizeUrl, authorizeUrl);
+
+            // Step 3: open browser
+            this.openBrowserFn(authorizeUrl);
+          })
+          .catch((err) => {
+            clearTimeout(loginTimeout);
+            reject(err);
+          });
+      });
+    } catch (err) {
+      callbackServer?.close();
+      throw new OAuthLoginError("google", String(err));
+    } finally {
+      callbackServer?.close();
+    }
+
+    // Step 4: exchange code for tokens
+    let tokenResponse: Awaited<ReturnType<typeof exchangeBrowserCode>>;
+    try {
+      tokenResponse = await exchangeBrowserCode({
+        tokenEndpoint: GOOGLE_TOKEN_ENDPOINT,
+        clientId: this.clientId,
+        clientSecret: this.clientSecret,
+        redirectUri: callbackServer?.url ?? "",
+        code: authCode,
+        codeVerifier,
+        fetchFn: this.fetchFn,
+      });
+    } catch (err) {
+      throw new OAuthLoginError("google", String(err));
+    }
+
+    const expiresAt = Date.now() + (tokenResponse.expires_in ?? 3600) * 1000;
+
+    // Step 5: fetch userinfo (best-effort)
+    let email: string | undefined;
+    try {
+      email = await this._fetchUserEmail(tokenResponse.access_token);
+    } catch {
+      // non-fatal
+    }
+
+    return {
+      accessToken: tokenResponse.access_token,
+      refreshToken: tokenResponse.refresh_token ?? "",
+      idToken: tokenResponse.id_token,
+      expiresAt,
+      email,
+    };
+  }
+
+  // -------------------------------------------------------------------------
+  // refresh
+  // -------------------------------------------------------------------------
+
+  async refresh(tokens: OAuthTokens): Promise<OAuthTokens> {
+    const release = await this.mutex.acquire();
+    try {
+      // Double-check after acquiring lock — another concurrent call may have
+      // already refreshed.
+      if (tokens.expiresAt - Date.now() > REFRESH_WINDOW_MS) {
+        return tokens;
+      }
+
+      let data: Awaited<ReturnType<typeof refreshBrowserTokens>>;
+      try {
+        data = await refreshBrowserTokens({
+          tokenEndpoint: GOOGLE_TOKEN_ENDPOINT,
+          clientId: this.clientId,
+          clientSecret: this.clientSecret,
+          refreshToken: tokens.refreshToken,
+          fetchFn: this.fetchFn,
+        });
+      } catch (err) {
+        throw new OAuthRefreshError("google", String(err));
+      }
+
+      const expiresAt = Date.now() + (data.expires_in ?? 3600) * 1000;
+
+      return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token ?? tokens.refreshToken,
+        idToken: data.id_token ?? tokens.idToken,
+        expiresAt,
+        email: tokens.email,
+      };
+    } finally {
+      release();
+    }
+  }
+
+  // -------------------------------------------------------------------------
+  // revoke
+  // -------------------------------------------------------------------------
+
+  async revoke(tokens: OAuthTokens): Promise<void> {
+    try {
+      const token = tokens.refreshToken || tokens.accessToken;
+      await this.fetchFn(`${GOOGLE_REVOKE_ENDPOINT}?token=${encodeURIComponent(token)}`, {
+        method: "POST",
+      });
+    } catch {
+      // best-effort — caller should delete local tokens regardless
+    }
+  }
+
+  // -------------------------------------------------------------------------
+  // authHeaders
+  // -------------------------------------------------------------------------
+
+  authHeaders(tokens: OAuthTokens): Record<string, string> {
+    return {
+      Authorization: `Bearer ${tokens.accessToken}`,
+    };
+  }
+
+  // -------------------------------------------------------------------------
+  // Private helpers
+  // -------------------------------------------------------------------------
+
+  private async _fetchUserEmail(accessToken: string): Promise<string | undefined> {
+    const res = await this.fetchFn(GOOGLE_USERINFO_ENDPOINT, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    if (!res.ok) return undefined;
+    const info = (await res.json()) as UserInfo;
+    return info.email;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Singleton
+// ---------------------------------------------------------------------------
+
+/** Default Gemini OAuth provider singleton (uses live Google endpoints). */
+export const geminiOAuth = new GeminiOAuthProvider();
+
+// ---------------------------------------------------------------------------
+// Convenience: load + auto-refresh tokens
+// ---------------------------------------------------------------------------
+
+/**
+ * Load stored OAuth tokens for Google/Gemini and auto-refresh if within the
+ * expiry window. Returns null if no tokens are stored.
+ */
+export async function loadGeminiTokensWithRefresh(oauthProvider?: GeminiOAuthProvider): Promise<OAuthTokens | null> {
+  const { loadTokens, saveTokens } = await import("./token-store.js");
+  let tokens = await loadTokens("google");
+  if (!tokens) return null;
+
+  const impl = oauthProvider ?? geminiOAuth;
+
+  // Pre-emptive refresh
+  if (Date.now() >= tokens.expiresAt - REFRESH_WINDOW_MS) {
+    try {
+      tokens = await impl.refresh(tokens);
+      await saveTokens("google", tokens);
+    } catch {
+      // Return stale tokens — adapter will get 401 on actual request
+    }
+  }
+
+  return tokens;
+}