opencode-codebuddy-external-auth 1.0.2 → 1.0.4

package/dist/plugin.js

@@ -20,9 +20,6 @@ const CONFIG = {
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function generateState() {
-    return crypto.randomUUID();
-}
 /**
  * Creates an authenticated fetch function with CodeBuddy headers
  */
@@ -46,18 +43,50 @@ function createAuthenticatedFetch(accessToken, userId) {
 // OAuth Flow Implementation (IOA Login)
 // ============================================================================
 /**
- * Build the login URL for IOA authentication
+ * Request auth state from server - the state is generated by server, not client!
+ *
+ * 关键发现：
+ * 1. 使用 POST 方法，不是 GET
+ * 2. 路径是 /v2/plugin/auth/state，不是 /plugin/auth/state
+ * 3. 需要设置 X-No-Authorization 等 Headers
  */
-function buildLoginUrl(state) {
+async function requestAuthState() {
     const params = new URLSearchParams({
         platform: CONFIG.platform,
-        state: state,
-        ioa: "1", // IOA version flag
+        ioa: "1",
+    });
+    const response = await fetch(`${CONFIG.serverUrl}/v2/plugin/auth/state?${params.toString()}`, {
+        method: "POST", // 关键：使用 POST 方法
+        headers: {
+            "Accept": "application/json",
+            "Content-Type": "application/json",
+            // 这些 Headers 告诉服务端跳过认证检查
+            "X-No-Authorization": "true",
+            "X-No-User-Id": "true",
+            "X-No-Enterprise-Id": "true",
+            "X-No-Department-Info": "true",
+        },
     });
-    return `${CONFIG.serverUrl}/login?${params.toString()}`;
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`Auth state request failed: ${response.status} - ${text}`);
+    }
+    const data = await response.json();
+    if (data.code !== 0 || !data.data?.state) {
+        throw new Error(`Invalid auth state response: ${JSON.stringify(data)}`);
+    }
+    // 使用服务端返回的 authUrl，或构造默认 URL
+    const loginUrl = data.data.authUrl ||
+        `${CONFIG.serverUrl}/login?platform=${CONFIG.platform}&state=${data.data.state}&ioa=1`;
+    return {
+        state: data.data.state,
+        url: loginUrl,
+    };
 }
 /**
  * Poll for token after user completes browser authentication
+ *
+ * 注意：token 端点也需要使用 /v2 前缀
  */
 async function pollForToken(state, expiresAt, signal) {
     const pollInterval = 3000; // 3 seconds
@@ -67,17 +96,20 @@ async function pollForToken(state, expiresAt, signal) {
         }
         await sleep(pollInterval);
         try {
-            const response = await fetch(`${CONFIG.serverUrl}/plugin/auth/token?state=${state}`, {
+            const response = await fetch(`${CONFIG.serverUrl}/v2/plugin/auth/token?state=${state}`, {
                 method: "GET",
                 headers: {
-                    "Content-Type": "application/json",
                     "Accept": "application/json",
+                    "X-No-Authorization": "true",
+                    "X-No-User-Id": "true",
+                    "X-No-Enterprise-Id": "true",
+                    "X-No-Department-Info": "true",
                 },
                 signal,
             });
             if (response.ok) {
                 const data = await response.json();
-                if (data.data?.accessToken) {
+                if (data.code === 0 && data.data?.accessToken) {
                     return data.data;
                 }
             }
@@ -97,11 +129,12 @@ async function pollForToken(state, expiresAt, signal) {
  */
 async function refreshAccessToken(refreshToken) {
     try {
-        const response = await fetch(`${CONFIG.serverUrl}/plugin/auth/token/refresh`, {
+        const response = await fetch(`${CONFIG.serverUrl}/v2/plugin/auth/token/refresh`, {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
-                Authorization: `Bearer ${refreshToken}`,
+                "Accept": "application/json",
+                "Authorization": `Bearer ${refreshToken}`,
             },
         });
         if (!response.ok) {
@@ -109,6 +142,10 @@ async function refreshAccessToken(refreshToken) {
             return null;
         }
         const data = await response.json();
+        if (data.code !== 0) {
+            console.warn(`[codebuddy-external] Token refresh error: ${data.msg}`);
+            return null;
+        }
         return data.data || null;
     }
     catch (error) {
@@ -155,17 +192,16 @@ const CodeBuddyExternalAuthPlugin = async (_input) => {
                     label: "IOA 登录 (浏览器)",
                     type: "oauth",
                     async authorize() {
-                        // Generate state for CSRF protection
-                        const state = generateState();
-                        const loginUrl = buildLoginUrl(state);
+                        // 从服务端获取 state（服务端生成，非客户端）
+                        const authState = await requestAuthState();
                         const expiresAt = Date.now() + 10 * 60 * 1000; // 10 minutes
                         return {
-                            url: loginUrl,
+                            url: authState.url,
                             instructions: `请在浏览器中完成 IOA 登录`,
                             method: "auto",
                             async callback() {
-                                // Poll for token
-                                const tokenData = await pollForToken(state, expiresAt);
+                                // 使用服务端返回的 state 轮询 token
+                                const tokenData = await pollForToken(authState.state, expiresAt);
                                 if (!tokenData) {
                                     return { type: "failed" };
                                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-codebuddy-external-auth",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "OpenCode plugin for CodeBuddy External (IOA) authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",