opencode-deepseek-auth 1.0.3 → 2.0.1

package/src/plugin.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeepSeekAuthPlugin = void 0;
+const constants_1 = require("./constants");
+const auth_1 = require("./deepseek/auth");
+/**
+ * Prepares the request to DeepSeek API by setting appropriate headers and transforming the payload
+ */
+function prepareDeepSeekRequest(input, init, accessToken) {
+    // Clone the original init to avoid mutating it
+    const transformedInit = { ...init };
+    // Set authorization header
+    transformedInit.headers = {
+        ...transformedInit.headers,
+        ...constants_1.DEEPSEEK_BASE_HEADERS,
+        "authorization": `Bearer ${accessToken}`
+    };
+    // Construct the request
+    const request = new Request(input, transformedInit);
+    return { request, init: transformedInit };
+}
+/**
+ * Transforms the DeepSeek API response to match expected format
+ */
+async function transformDeepSeekResponse(response) {
+    // For now, just pass through the response
+    return response;
+}
+/**
+ * Validates if this is a DeepSeek API request
+ */
+function isDeepSeekRequest(input) {
+    const urlString = typeof input === 'string' ? input :
+        input instanceof URL ? input.toString() :
+            input.url || '';
+    return urlString.includes('deepseek.com') || urlString.includes('/v1/chat/completions');
+}
+/**
+ * Registers the DeepSeek simple API key provider for Opencode.
+ * Users can configure their credentials using `opencode connect` with format: email:password or phone:password
+ */
+const DeepSeekAuthPlugin = async ({ client }) => ({
+    auth: {
+        provider: constants_1.DEEPSEEK_PROVIDER_ID,
+        loader: async (getAuth, provider) => {
+            const auth = await getAuth();
+            // This plugin only handles API key authentication
+            if (!auth?.apiKey) {
+                return null;
+            }
+            // Determine if this is a DeepSeek-specific authentication by checking the auth metadata
+            const isDeepSeekAuth = auth.provider === 'deepseek' || auth.type === 'deepseek-email-password';
+            const apiKeyValue = auth.apiKey;
+            // If explicitly marked as DeepSeek auth, process as email:password
+            if (isDeepSeekAuth) {
+                const parts = apiKeyValue.split(':');
+                if (parts.length === 2) {
+                    const [identifier, password] = parts;
+                    // Convert credentials to DeepSeek access token
+                    const result = await (0, auth_1.loginDeepSeek)(identifier, password);
+                    if (result.type !== "success") {
+                        console.error(`Failed to authenticate with provided credentials: ${result.error}`);
+                        throw new Error(`Authentication failed: ${result.error}`);
+                    }
+                    // Successfully obtained access token from credentials
+                    const accessToken = result.access;
+                    // If models are defined in the provider, set cost to 0 to indicate free usage
+                    if (provider.models) {
+                        for (const model of Object.values(provider.models)) {
+                            if (model) {
+                                model.cost = { input: 0, output: 0 };
+                            }
+                        }
+                    }
+                    return {
+                        apiKey: accessToken,
+                        async fetch(input, init) {
+                            // If this isn't a DeepSeek request, pass through normally
+                            if (!isDeepSeekRequest(input)) {
+                                return fetch(input, init);
+                            }
+                            // Prepare the request with proper headers
+                            const { request, init: transformedInit } = prepareDeepSeekRequest(input, init, accessToken);
+                            // Make the API call
+                            const response = await fetch(request, transformedInit);
+                            // Transform response if needed
+                            return transformDeepSeekResponse(response);
+                        },
+                    };
+                }
+                else {
+                    // If explicitly marked as DeepSeek auth but not in correct format, throw error
+                    throw new Error(`DeepSeek authentication requires email:password format`);
+                }
+            }
+            else {
+                // Otherwise, check if this looks like email:password format but isn't explicitly marked
+                const parts = apiKeyValue.split(':');
+                if (parts.length === 2) {
+                    const [potentialIdentifier, potentialPassword] = parts;
+                    // Heuristic: Check if it looks like an email or phone number format, and password seems reasonable
+                    const isEmailFormat = potentialIdentifier.includes('@');
+                    const isPhoneFormat = /^[0-9+\-\s()]+$/.test(potentialIdentifier.trim());
+                    const isPasswordReasonableLength = potentialPassword.length >= 6;
+                    // Only attempt email:password processing if both parts seem valid
+                    if ((isEmailFormat || isPhoneFormat) && isPasswordReasonableLength) {
+                        try {
+                            // Try to use as email:password
+                            const result = await (0, auth_1.loginDeepSeek)(potentialIdentifier, potentialPassword);
+                            if (result.type === "success") {
+                                // Successfully authenticated with email:password
+                                const accessToken = result.access;
+                                // If models are defined in the provider, set cost to 0 to indicate free usage
+                                if (provider.models) {
+                                    for (const model of Object.values(provider.models)) {
+                                        if (model) {
+                                            model.cost = { input: 0, output: 0 };
+                                        }
+                                    }
+                                }
+                                return {
+                                    apiKey: accessToken,
+                                    async fetch(input, init) {
+                                        // If this isn't a DeepSeek request, pass through normally
+                                        if (!isDeepSeekRequest(input)) {
+                                            return fetch(input, init);
+                                        }
+                                        // Prepare the request with proper headers
+                                        const { request, init: transformedInit } = prepareDeepSeekRequest(input, init, accessToken);
+                                        // Make the API call
+                                        const response = await fetch(request, transformedInit);
+                                        // Transform response if needed
+                                        return transformDeepSeekResponse(response);
+                                    },
+                                };
+                            }
+                        }
+                        catch (error) {
+                            console.warn("Email:password authentication failed, treating as regular API key:", error);
+                            // Fall through to treat as regular API key
+                        }
+                    }
+                }
+                // Default: treat as direct DeepSeek access token or other API key
+                const accessToken = apiKeyValue;
+                return {
+                    apiKey: accessToken,
+                    async fetch(input, init) {
+                        // If this isn't a DeepSeek request, pass through normally
+                        if (!isDeepSeekRequest(input)) {
+                            return fetch(input, init);
+                        }
+                        // Prepare the request with proper headers
+                        const { request, init: transformedInit } = prepareDeepSeekRequest(input, init, accessToken);
+                        // Make the API call
+                        const response = await fetch(request, transformedInit);
+                        // Transform response if needed
+                        return transformDeepSeekResponse(response);
+                    },
+                };
+            }
+        },
+        methods: [], // Empty methods array since we're using config-based auth
+    },
+});
+exports.DeepSeekAuthPlugin = DeepSeekAuthPlugin;

package/src/plugin.ts

@@ -2,8 +2,6 @@ import { spawn } from "node:child_process";
 
 import { DEEPSEEK_PROVIDER_ID, DEEPSEEK_REDIRECT_URI, DEEPSEEK_BASE_HEADERS } from "./constants";
 import {
-  authorizeDeepSeek,
-  exchangeDeepSeek,
   loginDeepSeek
 } from "./deepseek/auth";
 import type { DeepSeekTokenExchangeResult } from "./deepseek/auth";
@@ -13,64 +11,9 @@ import type {
   LoaderResult,
   PluginContext,
   PluginResult,
-  Provider,
-  FormConfig
+  Provider
 } from "./types";
 
-// Keep track of active tokens
-const tokenCache = new Map<string, { token: string, expires: number, email: string }>();
-
-/**
- * Checks if an access token has expired
- */
-function accessTokenExpired(authRecord: any): boolean {
-  const now = Date.now();
-  return !authRecord.expires || now >= authRecord.expires - 60000; // 1 minute before expiry
-}
-
-/**
- * Determines if the auth method is OAuth-based
- */
-function isOAuthAuth(auth: any): boolean {
-  return auth && auth.type === "oauth";
-}
-
-/**
- * Refresh access token if expired
- */
-async function refreshAccessToken(authRecord: any, client: any): Promise<any | null> {
-  // DeepSeek doesn't have refresh tokens, so a full re-login is required
-  const email = authRecord.email;
-  const password = authRecord.password;
-  
-  if (!email || !password) {
-    return null;
-  }
-  
-  const result = await loginDeepSeek(email, password);
-  if (result.type === "success") {
-    // Update the stored credentials
-    const newAuth = {
-      type: "oauth",
-      access: result.access,
-      expires: result.expires,
-      email: result.email || email,
-      password: password  // Store password for refresh
-    };
-    
-    // Update cache
-    tokenCache.set(email, {
-      token: result.access,
-      expires: result.expires,
-      email: result.email || email
-    });
-    
-    return newAuth;
-  }
-  
-  return null;
-}
-
 /**
  * Prepares the request to DeepSeek API by setting appropriate headers and transforming the payload
  */
@@ -102,7 +45,6 @@ async function transformDeepSeekResponse(
   response: Response
 ): Promise<Response> {
   // For now, just pass through the response
-  // If needed, we could transform to match OpenAI format
   return response;
 }
 
@@ -117,160 +59,163 @@ function isDeepSeekRequest(input: Parameters<typeof fetch>[0]): boolean {
 }
 
 /**
- * Registers the DeepSeek Auth provider for Opencode, handling auth, request rewriting,
- * and response normalization for DeepSeek requests.
+ * Registers the DeepSeek simple API key provider for Opencode.
+ * Users can configure their credentials using `opencode connect` with format: email:password or phone:password
  */
 export const DeepSeekAuthPlugin = async (
   { client }: PluginContext,
 ): Promise<PluginResult> => ({
   auth: {
     provider: DEEPSEEK_PROVIDER_ID,
-     loader: async (getAuth: GetAuth, provider: Provider): Promise<LoaderResult | null> => {
-       const auth = await getAuth();
-       
-       // Handle both OAuth-based auth and API key formatted credentials
-       if (!isOAuthAuth(auth) && !auth.apiKey) {
-         return null;
-       }
- 
-       // If models are defined in the provider, set cost to 0 to indicate free usage
-       if (provider.models) {
-         for (const model of Object.values(provider.models)) {
-           if (model) {
-             model.cost = { input: 0, output: 0 };
-           }
-         }
-       }
-       
-       // Handle the case where API key contains email:password
-       let resolvedAccessToken = "";
-       if (auth.apiKey) {
-         // Check if API key contains email:password or phone:password format
-         const credentialParts = auth.apiKey.split(':');
-         if (credentialParts.length === 2) {
-           const [identifier, password] = credentialParts;
-           // Try to login with these credentials
-           const result = await loginDeepSeek(identifier, password);
-           if (result.type === "success") {
-             resolvedAccessToken = result.access;
-             // Cache this for potential future use
-             tokenCache.set(identifier, {
-               token: result.access,
-               expires: result.expires,
-               email: result.email || identifier
-             });
-           } else {
-             throw new Error(`Failed to authenticate with provided credentials: ${result.error}`);
-           }
-         } else {
-           // If it's not in email:password format, assume it's already a valid access token
-           resolvedAccessToken = auth.apiKey;
-         }
-       } else if (isOAuthAuth(auth)) {
-         // Handle normal OAuth flow
-         let authRecord = auth;
-         
-         // Check if token has expired and refresh if possible
-         if (accessTokenExpired(authRecord)) {
-           const refreshed = await refreshAccessToken(authRecord, client);
-           if (!refreshed) {
-             console.warn("Could not refresh DeepSeek access token");
-             return null;
-           }
-           authRecord = refreshed;
-         }
- 
-         resolvedAccessToken = authRecord.access;
-         if (!resolvedAccessToken) {
-           return null;
-         }
-       }
- 
-       return {
-         apiKey: resolvedAccessToken || "",
-         async fetch(input: Parameters<typeof fetch>[0], init?: RequestInit) {
-           // If this isn't a DeepSeek request, pass through normally
-           if (!isDeepSeekRequest(input)) {
-             return fetch(input as RequestInfo, init);
-           }
- 
-           // Prepare the request with proper headers
-           const { request, init: transformedInit } = prepareDeepSeekRequest(
-             input,
-             init,
-             resolvedAccessToken
-           );
- 
-           // Make the API call
-           const response = await fetch(request, transformedInit);
-           
-           // Transform response if needed
-           return transformDeepSeekResponse(response);
-         },
-       };
-     },
-     methods: [
-       {
-         label: "Login with DeepSeek Account",
-         type: "oauth",
-         authorize: async () => {
-           // Direct credential form for DeepSeek as they don't use standard OAuth
-           const form: FormConfig = {
-             fields: [
-               {
-                 name: "email",
-                 label: "Email",
-                 type: "email",
-                 required: true,
-               },
-               {
-                 name: "password", 
-                 label: "Password",
-                 type: "password",
-                 required: true,
-               }
-             ]
-           };
-         
-           return {
-             url: "https://chat.deepseek.com",
-             instructions: "Enter your DeepSeek account credentials below. Your credentials will be stored securely and used for authentication.",
-             method: "form",
-             form: form,
-             callback: async (formData: Record<string, string>): Promise<DeepSeekTokenExchangeResult> => {
-               const email = formData.email;
-               const password = formData.password;
-               
-               // Validate inputs
-               if (!email || !password) {
-                 return {
-                   type: "failed",
-                   error: "Email and password are required for DeepSeek authentication"
-                 };
-               }
+    loader: async (getAuth: GetAuth, provider: Provider): Promise<LoaderResult | null> => {
+      const auth = await getAuth();
+
+      // This plugin only handles API key authentication
+      if (!auth?.apiKey) {
+        return null;
+      }
+
+      // Determine if this is a DeepSeek-specific authentication by checking the auth metadata
+      const isDeepSeekAuth = auth.provider === 'deepseek' || auth.type === 'deepseek-email-password';
+      const apiKeyValue = auth.apiKey;
+      
+      // If explicitly marked as DeepSeek auth, process as email:password
+      if (isDeepSeekAuth) {
+        const parts = apiKeyValue.split(':');
+        if (parts.length === 2) {
+          const [identifier, password] = parts;
+          
+          // Convert credentials to DeepSeek access token
+          const result = await loginDeepSeek(identifier, password);
+          if (result.type !== "success") {
+            console.error(`Failed to authenticate with provided credentials: ${result.error}`);
+            throw new Error(`Authentication failed: ${result.error}`);
+          }
+          
+          // Successfully obtained access token from credentials
+          const accessToken = result.access;
+          
+          // If models are defined in the provider, set cost to 0 to indicate free usage
+          if (provider.models) {
+            for (const model of Object.values(provider.models)) {
+              if (model) {
+                model.cost = { input: 0, output: 0 };
+              }
+            }
+          }
+
+          return {
+            apiKey: accessToken,
+            async fetch(input: Parameters<typeof fetch>[0], init?: RequestInit) {
+              // If this isn't a DeepSeek request, pass through normally
+              if (!isDeepSeekRequest(input)) {
+                return fetch(input as RequestInfo, init);
+              }
+              
+              // Prepare the request with proper headers
+              const { request, init: transformedInit } = prepareDeepSeekRequest(
+                input,
+                init,
+                accessToken
+              );
+
+              // Make the API call
+              const response = await fetch(request, transformedInit);
+              
+              // Transform response if needed
+              return transformDeepSeekResponse(response);
+            },
+          };
+        } else {
+          // If explicitly marked as DeepSeek auth but not in correct format, throw error
+          throw new Error(`DeepSeek authentication requires email:password format`);
+        }
+      } else {
+        // Otherwise, check if this looks like email:password format but isn't explicitly marked
+        const parts = apiKeyValue.split(':');
+        if (parts.length === 2) {
+          const [potentialIdentifier, potentialPassword] = parts;
+          
+          // Heuristic: Check if it looks like an email or phone number format, and password seems reasonable
+          const isEmailFormat = potentialIdentifier.includes('@');
+          const isPhoneFormat = /^[0-9+\-\s()]+$/.test(potentialIdentifier.trim());
+          const isPasswordReasonableLength = potentialPassword.length >= 6;
+          
+          // Only attempt email:password processing if both parts seem valid
+          if ((isEmailFormat || isPhoneFormat) && isPasswordReasonableLength) {
+            try {
+              // Try to use as email:password
+              const result = await loginDeepSeek(potentialIdentifier, potentialPassword);
+              if (result.type === "success") {
+                // Successfully authenticated with email:password
+                const accessToken = result.access;
+                
+                // If models are defined in the provider, set cost to 0 to indicate free usage
+                if (provider.models) {
+                  for (const model of Object.values(provider.models)) {
+                    if (model) {
+                      model.cost = { input: 0, output: 0 };
+                    }
+                  }
+                }
+
+                return {
+                  apiKey: accessToken,
+                  async fetch(input: Parameters<typeof fetch>[0], init?: RequestInit) {
+                    // If this isn't a DeepSeek request, pass through normally
+                    if (!isDeepSeekRequest(input)) {
+                      return fetch(input as RequestInfo, init);
+                    }
+                    
+                    // Prepare the request with proper headers
+                    const { request, init: transformedInit } = prepareDeepSeekRequest(
+                      input,
+                      init,
+                      accessToken
+                    );
+
+                    // Make the API call
+                    const response = await fetch(request, transformedInit);
+                    
+                    // Transform response if needed
+                    return transformDeepSeekResponse(response);
+                  },
+                };
+              }
+            } catch (error) {
+              console.warn("Email:password authentication failed, treating as regular API key:", error);
+              // Fall through to treat as regular API key
+            }
+          }
+        }
+        
+        // Default: treat as direct DeepSeek access token or other API key
+        const accessToken = apiKeyValue;
+        
+        return {
+          apiKey: accessToken,
+          async fetch(input: Parameters<typeof fetch>[0], init?: RequestInit) {
+            // If this isn't a DeepSeek request, pass through normally
+            if (!isDeepSeekRequest(input)) {
+              return fetch(input as RequestInfo, init);
+            }
+            
+            // Prepare the request with proper headers
+            const { request, init: transformedInit } = prepareDeepSeekRequest(
+              input,
+              init,
+              accessToken
+            );
 
-               // Attempt to log in using the provided credentials
-               const result = await loginDeepSeek(email, password);
-               
-               if (result.type === "success") {
-                 // Cache the token
-                 tokenCache.set(email, {
-                   token: result.access,
-                   expires: result.expires,
-                   email: result.email || email
-                 });
-               }
-               
-               return result;
-             },
-           };
-         },
-       },
-       {
-         provider: DEEPSEEK_PROVIDER_ID,
-         label: "Enter credentials (email:password or phone:password)",
-         type: "api",
-       },
-     ],
+            // Make the API call
+            const response = await fetch(request, transformedInit);
+            
+            // Transform response if needed
+            return transformDeepSeekResponse(response);
+          },
+        };
+      }
+    },
+    methods: [], // Empty methods array since we're using config-based auth
   },
 });

package/src/types.js

@@ -0,0 +1,5 @@
+"use strict";
+/**
+ * Types for the DeepSeek Auth plugin
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/src/types.ts

@@ -26,7 +26,11 @@ export interface PluginResult {
 }
 
 export interface GetAuth {
-  (): Promise<any>;
+  (): Promise<{
+    apiKey?: string;
+    type?: string;  // Additional field to specify the type of authentication
+    provider?: string;  // Additional field to specify which provider this auth is for
+  }>;
 }
 
 export interface LoaderResult {