opencode-codebuddy-external-auth 1.0.20 → 1.0.22

package/dist/plugin.js

@@ -9,7 +9,7 @@ const CONFIG = {
     // IOA 版本使用 copilot.tencent.com 进行认证
     serverUrl: "https://copilot.tencent.com",
     // 真实对话 API 路径
-    chatCompletionsPath: "/v2/chat/completions",
+    chatCompletionsPath: "/v2/plugin/chat/completions",
     // 平台标识
     platform: "CLI",
     appVersion: "2.37.20",
@@ -39,6 +39,35 @@ function generateUuid() {
     }
     return `${Date.now()}-${Math.random().toString(16).slice(2)}`;
 }
+function generateHexId(length) {
+    const bytes = Math.ceil(length / 2);
+    const buffer = new Uint8Array(bytes);
+    if (globalThis.crypto?.getRandomValues) {
+        globalThis.crypto.getRandomValues(buffer);
+    }
+    else {
+        for (let i = 0; i < buffer.length; i += 1) {
+            buffer[i] = Math.floor(Math.random() * 256);
+        }
+    }
+    return Array.from(buffer)
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("")
+        .slice(0, length);
+}
+function buildTraceHeaders() {
+    const traceId = generateHexId(32);
+    const spanId = generateHexId(16);
+    const parentSpanId = generateHexId(16);
+    const sampled = "1";
+    return {
+        "X-B3-TraceId": traceId,
+        "X-B3-ParentSpanId": parentSpanId,
+        "X-B3-SpanId": spanId,
+        "X-B3-Sampled": sampled,
+        b3: `${traceId}-${spanId}-${sampled}-${parentSpanId}`,
+    };
+}
 function decodeJwtPayload(token) {
     try {
         const parts = token.split(".");
@@ -204,8 +233,25 @@ function pickFallbackModel(models) {
         return "glm-4.7-ioa";
     return models[0] || "";
 }
-async function buildAuthHeaders(accessToken) {
+function buildEnterpriseHeaders(accessToken) {
     const tenantId = cachedTenantId || resolveTenantId(accessToken);
+    const enterpriseId = cachedEnterpriseId || resolveEnterpriseId(accessToken);
+    const resolvedTenantId = tenantId || enterpriseId;
+    if (tenantId)
+        cachedTenantId = tenantId;
+    if (enterpriseId)
+        cachedEnterpriseId = enterpriseId;
+    const headers = {};
+    if (resolvedTenantId)
+        headers["X-Tenant-Id"] = resolvedTenantId;
+    if (enterpriseId)
+        headers["X-Enterprise-Id"] = enterpriseId;
+    return headers;
+}
+async function buildAuthHeaders(accessToken) {
+    const payload = decodeJwtPayload(accessToken);
+    const roles = payload?.realm_access?.roles || payload?.resource_access?.account?.roles;
+    let tenantId = cachedTenantId || resolveTenantId(accessToken);
     let enterpriseId = cachedEnterpriseId || resolveEnterpriseId(accessToken);
     const userId = cachedUserId || resolveUserId(accessToken);
     if (!enterpriseId) {
@@ -215,6 +261,9 @@ async function buildAuthHeaders(accessToken) {
             cachedModelIds = config.models;
         }
     }
+    if (!tenantId && enterpriseId) {
+        tenantId = enterpriseId;
+    }
     if (tenantId)
         cachedTenantId = tenantId;
     if (enterpriseId)
@@ -224,6 +273,7 @@ async function buildAuthHeaders(accessToken) {
     if (!warnedIdSummary) {
         warnedIdSummary = true;
         console.log(`[codebuddy-external] IDs: tenant=${tenantId ? "ok" : "empty"}, enterprise=${enterpriseId ? "ok" : "empty"}, user=${userId ? "ok" : "empty"}`);
+        console.log(`[codebuddy-external] Token payload: iss=${payload?.iss ? "ok" : "empty"}, sub=${payload?.sub ? "ok" : "empty"}, roles=${Array.isArray(roles) ? roles.length : 0}`);
     }
     if (!tenantId && !warnedTenantId) {
         warnedTenantId = true;
@@ -240,6 +290,8 @@ async function buildAuthHeaders(accessToken) {
     const conversationId = generateUuid();
     const messageId = generateUuid();
     const requestId = messageId;
+    const traceHeaders = buildTraceHeaders();
+    const encodedUserId = userId ? encodeURIComponent(userId) : "";
     const headers = {
         "Accept": "application/json",
         "Content-Type": "application/json",
@@ -256,13 +308,14 @@ async function buildAuthHeaders(accessToken) {
         "X-Domain": CONFIG.domain,
         "X-Product": CONFIG.product,
         "User-Agent": `CLI/${CONFIG.appVersion} CodeBuddy/${CONFIG.appVersion}`,
+        ...traceHeaders,
     };
     if (tenantId)
         headers["X-Tenant-Id"] = tenantId;
     if (enterpriseId)
         headers["X-Enterprise-Id"] = enterpriseId;
-    if (userId)
-        headers["X-User-Id"] = userId;
+    if (encodedUserId)
+        headers["X-User-Id"] = encodedUserId;
     return headers;
 }
 /**
@@ -500,7 +553,7 @@ async function executeViaAuthApi(openaiRequest, auth) {
     };
     let response = await doRequest(accessToken);
     if ((response.status === 401 || response.status === 403) && auth.refresh) {
-        const refreshed = await refreshAccessToken(auth.refresh);
+        const refreshed = await refreshAccessToken(auth.refresh, accessToken);
         if (refreshed?.accessToken) {
             accessToken = refreshed.accessToken;
             response = await doRequest(accessToken);
@@ -713,15 +766,22 @@ async function pollForToken(state, expiresAt, signal) {
 /**
  * Refresh the access token
  */
-async function refreshAccessToken(refreshToken) {
+async function refreshAccessToken(refreshToken, accessToken) {
     try {
+        const traceHeaders = buildTraceHeaders();
+        const headers = {
+            "Content-Type": "application/json",
+            "Accept": "application/json",
+            "X-Refresh-Token": refreshToken,
+            ...traceHeaders,
+        };
+        if (accessToken) {
+            headers["Authorization"] = `Bearer ${accessToken}`;
+            Object.assign(headers, buildEnterpriseHeaders(accessToken));
+        }
         const response = await fetch(`${CONFIG.serverUrl}/v2/plugin/auth/token/refresh`, {
             method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                "Accept": "application/json",
-                "Authorization": `Bearer ${refreshToken}`,
-            },
+            headers,
         });
         if (!response.ok) {
             console.warn(`[codebuddy-external] Token refresh failed: ${response.status}`);
@@ -763,7 +823,7 @@ const CodeBuddyExternalAuthPlugin = async (_input) => {
                 if (auth.type !== "oauth" || !auth.refresh) {
                     return null;
                 }
-                const tokenData = await refreshAccessToken(auth.refresh);
+                const tokenData = await refreshAccessToken(auth.refresh, auth.access);
                 if (!tokenData) {
                     return null;
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-codebuddy-external-auth",
-  "version": "1.0.20",
+  "version": "1.0.22",
   "description": "OpenCode plugin for CodeBuddy External (IOA) authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",