offrouter-core 0.2.0 → 0.2.2

package/src/auth/keychain.test.ts

@@ -1,265 +0,0 @@
-/**
- * Tests for keychain-backed token helpers.
- */
-import { describe, expect, it } from "vitest";
-import {
-  deleteOAuthTokens,
-  getOAuthTokens,
-  getProviderToken,
-  isOAuthTokenExpired,
-  setOAuthTokens,
-  setProviderToken,
-  type OAuthStoredTokens,
-} from "./keychain.js";
-import { FileSecretStore } from "../secrets.js";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { mkdtempSync, rmSync } from "node:fs";
-
-describe("getProviderToken", () => {
-  it("returns undefined when no token is stored", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "offrouter-keychain-test-"));
-    try {
-      const store = new FileSecretStore({ filePath: join(dir, "secrets.json") });
-      const result = await getProviderToken("anthropic", store);
-      expect(result).toBeUndefined();
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("returns the token when stored", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "offrouter-keychain-test-"));
-    try {
-      const store = new FileSecretStore({ filePath: join(dir, "secrets.json") });
-      await store.set("anthropic", "sk-ant-stored-value");
-      const result = await getProviderToken("anthropic", store);
-      expect(result).not.toBeUndefined();
-      expect(result!.rawValue).toBe("sk-ant-stored-value");
-      expect(JSON.stringify(result)).toBe('"[REDACTED]"');
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("returns undefined for nonexistent provider", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "offrouter-keychain-test-"));
-    try {
-      const store = new FileSecretStore({ filePath: join(dir, "secrets.json") });
-      const result = await getProviderToken("nonexistent", store);
-      expect(result).toBeUndefined();
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});
-
-describe("setProviderToken", () => {
-  it("stores a token and retrieves it", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "offrouter-keychain-test-"));
-    try {
-      const store = new FileSecretStore({ filePath: join(dir, "secrets.json") });
-      await setProviderToken("openai", "sk-openai-test", store);
-      const token = await getProviderToken("openai", store);
-      expect(token).not.toBeUndefined();
-      expect(token!.rawValue).toBe("sk-openai-test");
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("overwrites existing token", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "offrouter-keychain-test-"));
-    try {
-      const store = new FileSecretStore({ filePath: join(dir, "secrets.json") });
-      await setProviderToken("test", "first-value", store);
-      await setProviderToken("test", "second-value", store);
-      const token = await getProviderToken("test", store);
-      expect(token!.rawValue).toBe("second-value");
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});
-
-describe("multi-account tokens", () => {
-  it("stores and retrieves per-account tokens with backward compatibility", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "offrouter-keychain-test-"));
-    try {
-      const store = new FileSecretStore({ filePath: join(dir, "secrets.json") });
-      await setProviderToken("anthropic", "tok-legacy", store);
-      await setProviderToken("anthropic", "tok-2", store, "anthropic-2");
-
-      const legacy = await getProviderToken("anthropic", store);
-      expect(legacy!.rawValue).toBe("tok-legacy");
-
-      const acct2 = await getProviderToken("anthropic", store, "anthropic-2");
-      expect(acct2!.rawValue).toBe("tok-2");
-
-      // accountId === providerId uses legacy key
-      const explicitDefault = await getProviderToken("anthropic", store, "anthropic");
-      expect(explicitDefault!.rawValue).toBe("tok-legacy");
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("setProviderToken with accountId matching providerId overwrites legacy slot", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "offrouter-keychain-test-"));
-    try {
-      const store = new FileSecretStore({ filePath: join(dir, "secrets.json") });
-      await setProviderToken("anthropic", "tok-legacy", store);
-      await setProviderToken("anthropic", "tok-implicit", store, "anthropic");
-
-      const result = await getProviderToken("anthropic", store);
-      expect(result!.rawValue).toBe("tok-implicit");
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});
-
-describe("OAuth token storage", () => {
-  function freshStore() {
-    const dir = mkdtempSync(join(tmpdir(), "offrouter-oauth-test-"));
-    const store = new FileSecretStore({ filePath: join(dir, "secrets.json") });
-    return { store, dir };
-  }
-
-  it("getOAuthTokens returns undefined when nothing is stored", async () => {
-    const { store, dir } = freshStore();
-    try {
-      const result = await getOAuthTokens("anthropic", store);
-      expect(result).toBeUndefined();
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("stores and retrieves structured OAuth tokens", async () => {
-    const { store, dir } = freshStore();
-    try {
-      const tokens: OAuthStoredTokens = {
-        accessToken: "access-abc",
-        refreshToken: "refresh-xyz",
-        expiresAt: 9_999_999_999_000,
-        scope: "api offline_access",
-        obtainedAt: 1_000,
-      };
-      await setOAuthTokens("anthropic", tokens, store);
-      const result = await getOAuthTokens("anthropic", store);
-      expect(result).toEqual(tokens);
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("stores tokens under a separate key from plain API-key tokens", async () => {
-    const { store, dir } = freshStore();
-    try {
-      await setProviderToken("anthropic", "sk-ant-apikey", store);
-      await setOAuthTokens(
-        "anthropic",
-        { accessToken: "access-oauth", obtainedAt: 1 },
-        store,
-      );
-      const apiToken = await getProviderToken("anthropic", store);
-      const oauthTokens = await getOAuthTokens("anthropic", store);
-      expect(apiToken!.rawValue).toBe("sk-ant-apikey");
-      expect(oauthTokens!.accessToken).toBe("access-oauth");
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("deleteOAuthTokens removes only the OAuth entry", async () => {
-    const { store, dir } = freshStore();
-    try {
-      await setOAuthTokens(
-        "openai",
-        { accessToken: "a", obtainedAt: 1 },
-        store,
-      );
-      await setProviderToken("openai", "sk-openai", store);
-      await deleteOAuthTokens("openai", store);
-      expect(await getOAuthTokens("openai", store)).toBeUndefined();
-      expect((await getProviderToken("openai", store))!.rawValue).toBe(
-        "sk-openai",
-      );
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("supports per-account OAuth token storage", async () => {
-    const { store, dir } = freshStore();
-    try {
-      await setOAuthTokens(
-        "anthropic",
-        { accessToken: "default", obtainedAt: 1 },
-        store,
-      );
-      await setOAuthTokens(
-        "anthropic",
-        { accessToken: "acct2", obtainedAt: 1 },
-        store,
-        "anthropic-2",
-      );
-      const def = await getOAuthTokens("anthropic", store);
-      const acct2 = await getOAuthTokens("anthropic", store, "anthropic-2");
-      expect(def!.accessToken).toBe("default");
-      expect(acct2!.accessToken).toBe("acct2");
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  it("returns undefined for corrupt stored JSON", async () => {
-    const { store, dir } = freshStore();
-    try {
-      await store.set("anthropic:oauth", "{not json");
-      const result = await getOAuthTokens("anthropic", store);
-      expect(result).toBeUndefined();
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});
-
-describe("isOAuthTokenExpired", () => {
-  it("treats tokens without expiresAt as not expired", () => {
-    expect(
-      isOAuthTokenExpired({ accessToken: "a", obtainedAt: 1 }),
-    ).toBe(false);
-  });
-
-  it("treats future expiry as valid", () => {
-    expect(
-      isOAuthTokenExpired(
-        { accessToken: "a", expiresAt: 10_000, obtainedAt: 1 },
-        5_000,
-        1_000,
-      ),
-    ).toBe(false);
-  });
-
-  it("treats tokens within the skew window as expired", () => {
-    // now=5000, skew=1000 => anything expiring <= 6000 is expired
-    expect(
-      isOAuthTokenExpired(
-        { accessToken: "a", expiresAt: 6_000, obtainedAt: 1 },
-        5_000,
-        1_000,
-      ),
-    ).toBe(true);
-  });
-
-  it("treats past expiry as expired", () => {
-    expect(
-      isOAuthTokenExpired(
-        { accessToken: "a", expiresAt: 1_000, obtainedAt: 0 },
-        5_000,
-      ),
-    ).toBe(true);
-  });
-});

package/src/auth/keychain.ts

@@ -1,168 +0,0 @@
-/**
- * Keychain-backed token helpers for OffRouter.
- *
- * Provides getProviderToken/setProviderToken that use the SecretStore
- * abstraction (file or OS keychain). Never scrapes other CLI credential stores.
- *
- * Per-account token storage: when accountId is provided and differs from
- * providerId, the storage key is "${providerId}:${accountId}". Otherwise the
- * plain providerId is used for backward compatibility with existing tokens.
- */
-import type { SecretStore } from "../secrets.js";
-import { Redacted } from "./credential-chain.js";
-
-/**
- * Compute the storage key for a provider+account combination.
- * Backward compatible: when accountId is absent or equals providerId, returns
- * the plain providerId so existing tokens resolve.
- */
-export function accountStorageKey(providerId: string, accountId?: string): string {
-  if (!accountId || accountId === providerId) return providerId;
-  return `${providerId}:${accountId}`;
-}
-
-/**
- * Retrieve a provider token from the secret store.
- * Returns undefined if no token is stored or the store is unavailable.
- */
-export async function getProviderToken(
-  providerId: string,
-  store: SecretStore,
-  accountId?: string,
-): Promise<Redacted<string> | undefined> {
-  try {
-    const key = accountStorageKey(providerId, accountId);
-    const value = await store.get(key);
-    if (typeof value === "string" && value.length > 0) {
-      return new Redacted(value);
-    }
-  } catch {
-    // KeychainUnavailableError or other errors: treat as missing.
-  }
-  return undefined;
-}
-
-/**
- * Store a provider token in the secret store.
- * Throws if the store is unavailable (e.g., KeychainUnavailableError).
- */
-export async function setProviderToken(
-  providerId: string,
-  token: string,
-  store: SecretStore,
-  accountId?: string,
-): Promise<void> {
-  const key = accountStorageKey(providerId, accountId);
-  await store.set(key, token);
-}
-
-// ---------------------------------------------------------------------------
-// OAuth token storage (structured, separate from API-key tokens)
-// ---------------------------------------------------------------------------
-
-/** Suffix that namespaces structured OAuth token blobs in the secret store. */
-const OAUTH_SUFFIX = ":oauth";
-
-/**
- * Structured OAuth token material stored under "${providerId}[:account]:oauth".
- * accessToken is the bearer used for provider calls; refreshToken drives
- * silent refresh; expiresAt/obtainedAt are epoch milliseconds. Stored as JSON
- * so the whole token set moves atomically and stays separate from API keys.
- */
-export interface OAuthStoredTokens {
-  accessToken: string;
-  refreshToken?: string;
-  expiresAt?: number;
-  scope?: string;
-  obtainedAt: number;
-}
-
-/** Compute the secret-store key for a provider+account OAuth token set. */
-export function oauthStorageKey(
-  providerId: string,
-  accountId?: string,
-): string {
-  return `${accountStorageKey(providerId, accountId)}${OAUTH_SUFFIX}`;
-}
-
-/**
- * Store structured OAuth tokens (access, optional refresh, expiry, scope).
- */
-export async function setOAuthTokens(
-  providerId: string,
-  tokens: OAuthStoredTokens,
-  store: SecretStore,
-  accountId?: string,
-): Promise<void> {
-  const key = oauthStorageKey(providerId, accountId);
-  await store.set(key, JSON.stringify(tokens));
-}
-
-/**
- * Retrieve structured OAuth tokens. Returns undefined if nothing is stored,
- * the store is unavailable, or the stored payload is corrupt.
- */
-export async function getOAuthTokens(
-  providerId: string,
-  store: SecretStore,
-  accountId?: string,
-): Promise<OAuthStoredTokens | undefined> {
-  try {
-    const key = oauthStorageKey(providerId, accountId);
-    const raw = await store.get(key);
-    if (typeof raw !== "string" || raw.length === 0) {
-      return undefined;
-    }
-    const parsed = JSON.parse(raw) as Partial<OAuthStoredTokens>;
-    if (
-      typeof parsed.accessToken !== "string" ||
-      parsed.accessToken.length === 0
-    ) {
-      return undefined;
-    }
-    return {
-      accessToken: parsed.accessToken,
-      refreshToken:
-        typeof parsed.refreshToken === "string" && parsed.refreshToken.length > 0
-          ? parsed.refreshToken
-          : undefined,
-      expiresAt:
-        typeof parsed.expiresAt === "number" ? parsed.expiresAt : undefined,
-      scope: typeof parsed.scope === "string" ? parsed.scope : undefined,
-      obtainedAt:
-        typeof parsed.obtainedAt === "number" ? parsed.obtainedAt : Date.now(),
-    };
-  } catch {
-    // Corrupt payload or unavailable store: treat as missing.
-    return undefined;
-  }
-}
-
-/** Remove stored OAuth tokens for a provider+account. */
-export async function deleteOAuthTokens(
-  providerId: string,
-  store: SecretStore,
-  accountId?: string,
-): Promise<void> {
-  try {
-    const key = oauthStorageKey(providerId, accountId);
-    await store.delete(key);
-  } catch {
-    // Unavailable store: nothing to delete.
-  }
-}
-
-/**
- * Returns true when the access token is expired or within the skew window.
- * Tokens without an expiresAt are treated as not expired (no expiry known).
- */
-export function isOAuthTokenExpired(
-  tokens: OAuthStoredTokens,
-  now: number = Date.now(),
-  skewMs = 60_000,
-): boolean {
-  if (typeof tokens.expiresAt !== "number") {
-    return false;
-  }
-  return now + skewMs >= tokens.expiresAt;
-}