offrouter-core 0.2.1 → 0.2.2

package/src/auth/credential-chain.test.ts

@@ -1,326 +0,0 @@
-/**
- * Tests for credential-chain resolver.
- */
-import { describe, expect, it, vi } from "vitest";
-import {
-  Redacted,
-  resolveCredential,
-  type CredentialSource,
-} from "./credential-chain.js";
-import type { SecretStore } from "../secrets.js";
-
-function stubStore(entries: Record<string, string>): SecretStore {
-  return {
-    get: vi.fn(async (id: string) => entries[id]),
-    set: vi.fn(),
-    delete: vi.fn(),
-    listProviders: vi.fn(async () => Object.keys(entries)),
-    redact: vi.fn((v: string) => v),
-    toJSON: vi.fn(() => ({})),
-  };
-}
-
-describe("Redacted", () => {
-  it("wraps a value and hides it in toJSON", () => {
-    const r = new Redacted("sk-ant-test123");
-    expect(r.rawValue).toBe("sk-ant-test123");
-    expect(r.toJSON()).toBe("[REDACTED]");
-    expect(JSON.stringify(r)).toBe('"[REDACTED]"');
-    expect(String(r)).toBe("[REDACTED]");
-  });
-
-  it("returns a non-empty rawValue", () => {
-    const r = new Redacted("some-token");
-    expect(r.rawValue).toBe("some-token");
-    expect(r.rawValue.length).toBeGreaterThan(0);
-  });
-});
-
-describe("resolveCredential", () => {
-  it("returns null for empty sources array", async () => {
-    const result = await resolveCredential([], { store: stubStore({}) });
-    expect(result).toBeNull();
-  });
-
-  describe("env source", () => {
-    it("returns value from process.env", async () => {
-      const prev = process.env["OFFROUTER_TEST_KEY"];
-      process.env["OFFROUTER_TEST_KEY"] = "env-value";
-      try {
-        const sources: CredentialSource[] = [
-          { type: "env", name: "OFFROUTER_TEST_KEY" },
-        ];
-        const result = await resolveCredential(sources, { store: stubStore({}) });
-        expect(result).not.toBeNull();
-        expect(result!.value.rawValue).toBe("env-value");
-        expect(result!.source).toBe("env");
-      } finally {
-        if (prev === undefined) {
-          delete process.env["OFFROUTER_TEST_KEY"];
-        } else {
-          process.env["OFFROUTER_TEST_KEY"] = prev;
-        }
-      }
-    });
-
-    it("skips env when variable is undefined", async () => {
-      const sources: CredentialSource[] = [
-        { type: "env", name: "OFFROUTER_DOES_NOT_EXIST_XYZ" },
-      ];
-      const result = await resolveCredential(sources, { store: stubStore({}) });
-      expect(result).toBeNull();
-    });
-  });
-
-  describe("keychain source", () => {
-    it("returns value from secret store", async () => {
-      const store = stubStore({ "anthropic": "sk-ant-keychain-test" });
-      const sources: CredentialSource[] = [
-        { type: "keychain", providerId: "anthropic" },
-      ];
-      const result = await resolveCredential(sources, { store });
-      expect(result).not.toBeNull();
-      expect(result!.value.rawValue).toBe("sk-ant-keychain-test");
-      expect(result!.source).toBe("keychain");
-    });
-
-    it("skips keychain when store returns undefined", async () => {
-      const store = stubStore({});
-      const sources: CredentialSource[] = [
-        { type: "keychain", providerId: "unknown" },
-      ];
-      const result = await resolveCredential(sources, { store });
-      expect(result).toBeNull();
-    });
-  });
-
-  describe("chain order", () => {
-    it("returns first non-empty source (env beats keychain)", async () => {
-      process.env["ANTHROPIC_API_KEY"] = "from-env";
-      try {
-        const store = stubStore({ "anthropic": "from-keychain" });
-        const sources: CredentialSource[] = [
-          { type: "env", name: "ANTHROPIC_API_KEY" },
-          { type: "keychain", providerId: "anthropic" },
-        ];
-        const result = await resolveCredential(sources, { store });
-        expect(result).not.toBeNull();
-        expect(result!.value.rawValue).toBe("from-env");
-        expect(result!.source).toBe("env");
-      } finally {
-        delete process.env["ANTHROPIC_API_KEY"];
-      }
-    });
-
-    it("falls through to keychain when env is missing", async () => {
-      const store = stubStore({ "openai": "sk-from-keychain" });
-      const sources: CredentialSource[] = [
-        { type: "env", name: "OPENAI_API_KEY_MISSING" },
-        { type: "keychain", providerId: "openai" },
-      ];
-      const result = await resolveCredential(sources, { store });
-      expect(result).not.toBeNull();
-      expect(result!.value.rawValue).toBe("sk-from-keychain");
-      expect(result!.source).toBe("keychain");
-    });
-
-    it("returns null when all sources fail", async () => {
-      const store = stubStore({});
-      const sources: CredentialSource[] = [
-        { type: "env", name: "MISSING_VAR_1" },
-        { type: "env", name: "MISSING_VAR_2" },
-        { type: "keychain", providerId: "nonexistent" },
-      ];
-      const result = await resolveCredential(sources, { store });
-      expect(result).toBeNull();
-    });
-  });
-
-  describe("config source (trusted config)", () => {
-    it("returns value from trusted config provider apiKey", async () => {
-      const store = stubStore({});
-      const sources: CredentialSource[] = [
-        { type: "config", key: "providers.anthropic.apiKey" },
-      ];
-      const result = await resolveCredential(sources, {
-        store,
-        config: { providers: { anthropic: { apiKey: "sk-ant-config" } } } as Record<string, unknown>,
-      });
-      expect(result).not.toBeNull();
-      expect(result!.value.rawValue).toBe("sk-ant-config");
-      expect(result!.source).toBe("config");
-    });
-
-    it("returns null when config is not provided", async () => {
-      const store = stubStore({});
-      const sources: CredentialSource[] = [
-        { type: "config", key: "providers.anthropic.apiKey" },
-      ];
-      const result = await resolveCredential(sources, { store });
-      expect(result).toBeNull();
-    });
-
-    it("handles dot-notation path", async () => {
-      const store = stubStore({});
-      const sources: CredentialSource[] = [
-        { type: "config", key: "providers.openai.apiKey" },
-      ];
-      const result = await resolveCredential(sources, {
-        store,
-        config: {
-          providers: {
-            openai: { enabled: true },
-            anthropic: { apiKey: "wrong-key" },
-          },
-        } as Record<string, unknown>,
-      });
-      expect(result).toBeNull();
-    });
-  });
-});
-
-describe("credentialSource type narrowing", () => {
-  it("env source type is correct literal", () => {
-    const s: CredentialSource = { type: "env", name: "API_KEY" };
-    expect(s.type).toBe("env");
-  });
-
-  it("keychain source type is correct literal", () => {
-    const s: CredentialSource = { type: "keychain", providerId: "anthropic" };
-    expect(s.type).toBe("keychain");
-  });
-
-  it("config source type is correct literal", () => {
-    const s: CredentialSource = { type: "config", key: "providers.anthropic.apiKey" };
-    expect(s.type).toBe("config");
-  });
-
-  it("oauth source type is correct literal", () => {
-    const s: CredentialSource = { type: "oauth", provider: "anthropic" };
-    expect(s.type).toBe("oauth");
-  });
-});
-
-describe("oauth credential source", () => {
-  function storeWithOAuth(
-    accessToken: string,
-    refreshToken?: string,
-    expiresAt?: number,
-  ): SecretStore {
-    const tokens = {
-      accessToken,
-      refreshToken,
-      expiresAt,
-      obtainedAt: 1_000,
-    };
-    return {
-      get: vi.fn(async (id: string) =>
-        id === "anthropic:oauth" ? JSON.stringify(tokens) : undefined,
-      ),
-      set: vi.fn(),
-      delete: vi.fn(),
-      listProviders: vi.fn(async () => ["anthropic:oauth"]),
-      redact: vi.fn((v: string) => v),
-      toJSON: vi.fn(() => ({})),
-    };
-  }
-
-  it("resolves a stored (non-expired) OAuth token", async () => {
-    const store = storeWithOAuth(
-      "ant-oauth-token",
-      "ant-refresh",
-      Date.now() + 3600_000,
-    );
-    const sources: CredentialSource[] = [
-      { type: "oauth", provider: "anthropic" },
-    ];
-    const result = await resolveCredential(sources, { store });
-    expect(result).not.toBeNull();
-    expect(result!.value.rawValue).toBe("ant-oauth-token");
-    expect(result!.source).toBe("oauth");
-  });
-
-  it("returns null when no OAuth tokens are stored", async () => {
-    const store = stubStore({});
-    const sources: CredentialSource[] = [
-      { type: "oauth", provider: "anthropic" },
-    ];
-    const result = await resolveCredential(sources, { store });
-    expect(result).toBeNull();
-  });
-
-  it("returns null for an expired token without a refresh callback", async () => {
-    const store = storeWithOAuth(
-      "ant-oauth-expired",
-      "ant-refresh",
-      Date.now() - 1000,
-    );
-    const sources: CredentialSource[] = [
-      { type: "oauth", provider: "anthropic" },
-    ];
-    const result = await resolveCredential(sources, { store });
-    expect(result).toBeNull();
-  });
-
-  it("calls refreshOAuthToken for expired tokens when callback is provided", async () => {
-    const store = storeWithOAuth(
-      "ant-oauth-expired",
-      "ant-refresh",
-      Date.now() - 1000,
-    );
-    const refreshCallback = vi.fn(async (provider: string) => {
-      expect(provider).toBe("anthropic");
-      return "ant-oauth-refreshed";
-    });
-    const sources: CredentialSource[] = [
-      { type: "oauth", provider: "anthropic" },
-    ];
-    const result = await resolveCredential(sources, {
-      store,
-      refreshOAuthToken: refreshCallback,
-    });
-    expect(result).not.toBeNull();
-    expect(result!.value.rawValue).toBe("ant-oauth-refreshed");
-    expect(result!.source).toBe("oauth");
-    expect(refreshCallback).toHaveBeenCalledWith("anthropic");
-  });
-
-  it("falls through when refreshOAuthToken returns null", async () => {
-    const store = storeWithOAuth(
-      "ant-oauth-expired",
-      "ant-refresh",
-      Date.now() - 1000,
-    );
-    const refreshCallback = vi.fn(async () => null);
-    const sources: CredentialSource[] = [
-      { type: "oauth", provider: "anthropic" },
-      { type: "keychain", providerId: "fallback" },
-    ];
-    // No fallback token stored, so overall null.
-    const result = await resolveCredential(sources, {
-      store,
-      refreshOAuthToken: refreshCallback,
-    });
-    expect(result).toBeNull();
-    expect(refreshCallback).toHaveBeenCalledWith("anthropic");
-  });
-
-  it("falls through when refreshOAuthToken throws", async () => {
-    const store = storeWithOAuth(
-      "ant-oauth-expired",
-      "ant-refresh",
-      Date.now() - 1000,
-    );
-    const refreshCallback = vi.fn(async () => {
-      throw new Error("network error");
-    });
-    const sources: CredentialSource[] = [
-      { type: "oauth", provider: "anthropic" },
-    ];
-    const result = await resolveCredential(sources, {
-      store,
-      refreshOAuthToken: refreshCallback,
-    });
-    expect(result).toBeNull();
-  });
-});

package/src/auth/credential-chain.ts

@@ -1,235 +0,0 @@
-/**
- * Credential-chain resolution for OffRouter.
- *
- * Tries each source in order: env -> config -> keychain -> (oauth, opt-in).
- * Never logs secret values. Uses Redacted<T> wrapper for safe output.
- * Never scrapes other CLI credential stores.
- */
-
-import type { SecretStore } from "../secrets.js";
-import {
-  accountStorageKey,
-  getOAuthTokens,
-  isOAuthTokenExpired,
-} from "./keychain.js";
-
-// ---------------------------------------------------------------------------
-// Redacted wrapper
-// ---------------------------------------------------------------------------
-
-/**
- * Wrapper that hides secret material from JSON serialization and string
- * conversion. The raw value is accessible via `.rawValue` for use in
- * Authorization headers, never for logging.
- */
-export class Redacted<T extends string = string> {
-  readonly #value: T;
-
-  constructor(value: T) {
-    this.#value = value;
-  }
-
-  /** Access the raw secret value. Use only for provider API calls. */
-  get rawValue(): T {
-    return this.#value;
-  }
-
-  /** Returns a constant redacted string for JSON serialization. */
-  toJSON(): string {
-    return "[REDACTED]";
-  }
-
-  /** Returns a constant redacted string for debugging. */
-  toString(): string {
-    return "[REDACTED]";
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Credential source types
-// ---------------------------------------------------------------------------
-
-/**
- * A single credential source in the chain.
- * Each source is tried in order; the first non-empty value wins.
- */
-export type CredentialSource =
-  | { type: "env"; name: string }
-  | { type: "config"; key: string }
-  | { type: "keychain"; providerId: string; accountId?: string }
-  | { type: "oauth"; provider: string };
-
-/**
- * Result of a successful credential resolution.
- */
-export interface CredentialResult {
-  /**
-   * The resolved credential value, wrapped in Redacted so it cannot be
-   * accidentally logged or serialized.
-   */
-  value: Redacted<string>;
-  /** Which source type produced the value. */
-  source: "env" | "config" | "keychain" | "oauth";
-}
-
-/**
- * Options for resolveCredential.
- */
-export interface ResolveCredentialOptions {
-  /** Secret store for keychain lookups. */
-  store: SecretStore;
-  /**
-   * Optional trusted config object. When provided, config sources can read
-   * provider-level apiKey values. Only use with trusted config from the
-   * user's OffRouter home directory.
-   */
-  config?: Record<string, unknown>;
-  /**
-   * Injectable fetch for any network calls during credential resolution
-   * (e.g. OAuth token refresh). Defaults to globalThis.fetch.
-   */
-  fetch?: typeof globalThis.fetch;
-  /**
-   * Optional OAuth token refresher. Given a provider id, refreshes the stored
-   * OAuth token (if possible) and returns the new access token, or null if
-   * refresh is not possible. When omitted, expired OAuth tokens resolve as
-   * null (no silent refresh during credential resolution).
-   */
-  refreshOAuthToken?: (provider: string) => Promise<string | null>;
-}
-
-/**
- * Resolve a credential by trying each source in order.
- * Returns the first non-empty value, or null if all sources are empty.
- */
-export async function resolveCredential(
-  sources: CredentialSource[],
-  opts: ResolveCredentialOptions,
-): Promise<CredentialResult | null> {
-  for (const source of sources) {
-    const value = await trySource(source, opts);
-    if (value !== null) {
-      return { value: new Redacted(value), source: source.type };
-    }
-  }
-  return null;
-}
-
-/**
- * Try a single credential source.
- * Returns the raw secret string or null if not found.
- */
-async function trySource(
-  source: CredentialSource,
-  opts: ResolveCredentialOptions,
-): Promise<string | null> {
-  switch (source.type) {
-    case "env": {
-      return tryEnv(source.name);
-    }
-    case "config": {
-      return tryConfig(source.key, opts.config);
-    }
-    case "keychain": {
-      return tryKeychain(source.providerId, opts.store, source.accountId);
-    }
-    case "oauth": {
-      // Resolve stored OAuth tokens. This does NOT trigger a login flow;
-      // it resolves tokens already obtained via the `login` command.
-      // If the token is expired and a refresher is wired, try refreshing.
-      return tryOAuth(
-        source.provider,
-        opts.store,
-        opts.refreshOAuthToken,
-      );
-    }
-  }
-}
-
-/**
- * Read a value from environment variables.
- */
-function tryEnv(name: string): string | null {
-  const value = process.env[name];
-  if (typeof value === "string" && value.trim().length > 0) {
-    return value.trim();
-  }
-  return null;
-}
-
-/**
- * Read a value from trusted config using dot-notation path.
- * Only reads from config if provided (trusted source).
- * Path format: "providers.{providerId}.apiKey"
- */
-function tryConfig(key: string, config?: Record<string, unknown>): string | null {
-  if (!config) {
-    return null;
-  }
-  const parts = key.split(".");
-  let current: unknown = config;
-  for (const part of parts) {
-    if (typeof current !== "object" || current === null) {
-      return null;
-    }
-    const obj = current as Record<string, unknown>;
-    if (!(part in obj)) {
-      return null;
-    }
-    current = obj[part];
-  }
-  if (typeof current === "string" && current.trim().length > 0) {
-    return current.trim();
-  }
-  return null;
-}
-
-/**
- * Read a value from the secret store (keychain-backed).
- */
-async function tryKeychain(
-  providerId: string,
-  store: SecretStore,
-  accountId?: string,
-): Promise<string | null> {
-  try {
-    const key = accountStorageKey(providerId, accountId);
-    const value = await store.get(key);
-    if (typeof value === "string" && value.trim().length > 0) {
-      return value.trim();
-    }
-  } catch {
-    // KeychainUnavailableError or other errors: treat as missing.
-  }
-  return null;
-}
-
-/**
- * Resolve a credential from stored OAuth tokens (no new login flow).
- * Returns the access token if valid, triggers refresh if expired + wired,
- * or returns null if no tokens exist or refresh fails.
- */
-async function tryOAuth(
-  providerId: string,
-  store: SecretStore,
-  refresh?: (provider: string) => Promise<string | null>,
-): Promise<string | null> {
-  try {
-    const tokens = await getOAuthTokens(providerId, store);
-    if (!tokens) return null;
-
-    if (!isOAuthTokenExpired(tokens)) {
-      return tokens.accessToken;
-    }
-
-    // Expired: try refresh if a refresher is wired.
-    if (!refresh) return null;
-    try {
-      return await refresh(providerId);
-    } catch {
-      return null;
-    }
-  } catch {
-    return null;
-  }
-}

package/src/auth/index.ts

@@ -1,45 +0,0 @@
-/**
- * Auth module barrel export for OffRouter.
- */
-export {
-  Redacted,
-  resolveCredential,
-} from "./credential-chain.js";
-export type {
-  CredentialResult,
-  CredentialSource,
-  ResolveCredentialOptions,
-} from "./credential-chain.js";
-
-export {
-  deleteOAuthTokens,
-  getOAuthTokens,
-  getProviderToken,
-  isOAuthTokenExpired,
-  setOAuthTokens,
-  setProviderToken,
-} from "./keychain.js";
-export type { OAuthStoredTokens } from "./keychain.js";
-
-export {
-  defaultCallbackPort,
-  exchangeCodeForTokens,
-  generateCodeChallenge,
-  generateCodeVerifier,
-  isOAuthProvider,
-  PKCE_CONFIGS,
-  refreshTokens,
-  resolveClientId,
-  runOAuthLogin,
-  startOAuthFlow,
-} from "./oauth-pkce.js";
-export type {
-  OAuthFlowResult,
-  OAuthFlowState,
-  OAuthProviderConfig,
-  OAuthStartOptions,
-  OAuthTokenOptions,
-  OAuthTokenResponse,
-  RunOAuthLoginOptions,
-  RunOAuthLoginResult,
-} from "./oauth-pkce.js";