opencode-openwebui-authentik 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 FedotCompot
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,202 @@
-# Temporary Holding Version
+# opencode-openwebui-authentik
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Server plugin for [opencode](https://opencode.ai) v2 (tested against v2.1.2). It lets opencode
+use an [Open WebUI](https://openwebui.com) instance that sits behind
+[authentik](https://goauthentik.io) forward auth. You log in with your authentik account, so
+you don't need an Open WebUI API key.
+
+- A provider opts in with `"openwebuiAuthentik": true` in its `settings`, whatever its name.
+  You can mark several providers, one per Open WebUI instance.
+- It needs no other settings. Open WebUI is the provider's `settings.baseURL`, and the
+  redirect that Open WebUI sends to logged-out clients gives both the authentik address
+  and the client ID of the Open WebUI proxy provider. See [Options](#options) to pin them.
+- `opencode auth login` runs the authentik device-code login against a public OAuth2 client.
+- The plugin exchanges that login for an authentik token of the Open WebUI proxy provider.
+  The exchange runs the Open WebUI application's access policies. The plugin then signs in
+  to Open WebUI to get a session token for your email.
+- Each model request sends `Authorization: Bearer <authentik token>` and
+  `X-Open-WebUI-Token: <Open WebUI token>`.
+- The plugin keeps each managed provider's model list in sync with what Open WebUI serves
+  you: right after login and every 5 minutes. Models from `/api/models` that aren't in your
+  config are added; configured models that Open WebUI no longer serves are removed. Models
+  you configure keep your settings (name, limits), so list a model only to override them.
+- Tokens refresh automatically. If authentik rejects a request, the plugin asks authentik
+  whether the token is still valid. Only a dead token marks the login as needing a new
+  sign-in; a passing glitch is retried once and clears itself.
+
+## Server setup
+
+The plugin expects this on the authentik and Open WebUI side:
+
+- **CLI provider**: a public OAuth2 provider for the plugin, client ID `open-webui-cli`
+  unless you set `cliClientID`, with the `device_code` and `refresh_token` grants and the
+  `openid email profile offline_access` scopes. Use an authorization flow with explicit consent that is not
+  remembered: remembered consent lets anyone who tricks a user into opening a device link
+  log in silently.
+- **Open WebUI proxy provider**: the forward-auth proxy provider of the Open WebUI
+  application. List the CLI provider under its JWT federation providers, so that a CLI
+  access token can be swapped for a proxy token (`client_credentials` grant with a JWT
+  assertion and the `ak_proxy` scope). Bind the users or groups allowed to use Open WebUI to
+  this application.
+- **Reverse proxy in front of Open WebUI**: it checks every request against the authentik
+  outpost and passes the user's email on as Open WebUI's trusted email header
+  (`WEBUI_AUTH_TRUSTED_EMAIL_HEADER`). It also turns `X-Open-WebUI-Token` into the
+  `Authorization` header that Open WebUI sees. With nginx:
+
+  ```nginx
+  # only JWT-shaped Open WebUI tokens, never sk- keys
+  map $http_x_open_webui_token $owui_authorization {
+      "" $http_authorization;
+      "~^eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$" "Bearer $http_x_open_webui_token";
+      default "Bearer invalid";
+  }
+
+  location / {
+      auth_request /_authentik;
+      auth_request_set $ak_email $upstream_http_x_authentik_email;
+      proxy_set_header X-authentik-email $ak_email;
+      proxy_set_header Authorization $owui_authorization;
+      proxy_set_header X-Open-WebUI-Token "";
+      proxy_pass http://open-webui;
+  }
+  ```
+
+  Don't forward `X-Open-WebUI-Token` to the outpost in the `/_authentik` subrequest.
+
+## Install
+
+1. Install the plugin from npm. This adds it to `plugins` in your global opencode config:
+
+   ```sh
+   opencode plugin add opencode-openwebui-authentik
+   ```
+
+2. In `~/.config/opencode/opencode.jsonc`, mark each Open WebUI provider with
+   `"openwebuiAuthentik": true` in its `settings`, and remove `settings.apiKey` from it.
+
+   ```jsonc
+   {
+     "plugins": ["opencode-openwebui-authentik"],
+     "providers": {
+       "home-ai": {
+         "package": "@opencode/ai/providers/openai-compatible",
+         "settings": { "baseURL": "https://openwebui.example.com/api", "openwebuiAuthentik": true },
+         "models": {}
+       }
+     }
+   }
+   ```
+
+   The marker stays inside opencode: it isn't sent with model requests. Providers without it
+   are left alone.
+3. Check that it loaded: `opencode plugin list` should show `openwebui-authentik`.
+
+To upgrade later, run `opencode plugin update opencode-openwebui-authentik`.
+
+### Manual install
+
+1. Clone this repo somewhere stable.
+2. In `~/.config/opencode/opencode.jsonc`, add the clone's directory to `plugins` and mark
+   your providers as in step 2 above. The plugin path must be the directory, not `index.js`;
+   opencode ignores file paths here.
+
+   ```jsonc
+   {
+     "plugins": ["/home/<you>/code/opencode-openwebui-authentik"]
+   }
+   ```
+
+   Don't also copy the directory into `~/.config/opencode/plugins/`: that folder is loaded
+   automatically, so opencode would find the plugin twice and report the second copy as a
+   duplicate plugin ID.
+3. Check that it loaded: `opencode plugin list` should show `openwebui-authentik`.
+4. To upgrade, `git pull` in the clone.
+
+## Options
+
+All options are optional. Set them on the provider marker, as an object instead of `true`,
+for that provider only:
+
+```jsonc
+"settings": {
+  "baseURL": "https://openwebui.example.com/api",
+  "openwebuiAuthentik": { "authentikURL": "https://authentik.example.com" }
+}
+```
+
+or in the plugin entry `{ "package": "opencode-openwebui-authentik", "options": { ... } }`
+for every marked provider. A marker's settings win over the plugin options.
+
+- `authentikURL`: the authentik address. Discovered from Open WebUI's redirect when unset;
+  when set, the plugin refuses a redirect anywhere else. Set it to keep a compromised Open
+  WebUI host from sending you to a fake authentik login.
+- `proxyClientID`: the client ID of the Open WebUI proxy provider, discovered when unset.
+  With both `authentikURL` and `proxyClientID` set, the plugin skips the discovery request.
+- `cliClientID`: the client ID of the CLI provider, default `open-webui-cli`.
+- `modelsRefreshMinutes` (plugin options only): how often to re-sync models, default `5`.
+  `0` turns the sync off and leaves the configured models alone.
+
+Changing a provider's marker or `baseURL` takes effect without a restart.
+
+## Log in
+
+```sh
+opencode auth login home-ai --method authentik
+```
+
+Use the provider ID of each marked provider.
+
+Open the URL it prints. authentik shows a consent screen; approve it only if you started this
+login yourself. The code is in the browser's address bar, not on the page. `opencode auth
+list` should then list your email under the provider.
+
+Never approve a device login from a link someone sent you. That gives them your Open WebUI
+access.
+
+## Log out
+
+```sh
+opencode auth logout home-ai
+```
+
+This deletes the stored credential on this machine. The authentik refresh token stays valid
+until it expires or an admin revokes it in authentik.
+
+## Errors
+
+- `Set settings.baseURL on the <id> provider`: the provider is marked but has no valid
+  `baseURL`, so the plugin can't tell where Open WebUI is.
+- `No authentik login is active for <id>`: run the login command for that provider.
+- `authentik rejected the Open WebUI credential`: an admin revoked your Open WebUI token, or it
+  expired. Log in again.
+- `authentik could not verify the Open WebUI credential`: authentik rejected the request but
+  still reports the token as valid, usually because authentik was briefly unreachable. The
+  plugin retries once; otherwise try again shortly.
+- `Could not find the Open WebUI authentik client`: Open WebUI did not redirect to an
+  authentik authorize URL, redirected to a different `authentikURL` than the one you pinned,
+  or redirected from HTTPS to plain HTTP. Check the provider's `baseURL`, or pin
+  `authentikURL` and `proxyClientID`.
+- `Could not get an Open WebUI token from authentik`: the token exchange failed. Usually this
+  means the access policies deny you, or your email is missing or duplicated. The plugin
+  keeps your login and retries after 30 seconds.
+
+## Removing access
+
+authentik runs the access policies only when it issues an Open WebUI token. A user who loses
+access keeps it until their current proxy token expires, then gets the token exchange error
+above. To cut someone off immediately, deactivate them in authentik, which deletes all their
+tokens. To keep the account active instead, delete their OAuth access tokens for the Open
+WebUI proxy provider and their refresh tokens for the CLI provider (Directory > Users > user >
+Credentials / Tokens). Revoking sessions is not enough. The outpost can take up to a minute to
+notice.
+
+## Tests
+
+`bun test` runs the plugin against mock authentik and Open WebUI servers.
+
+## Known limitation
+
+If authentik rejects the token (after an admin revokes it, or when authentik is briefly
+unreachable), the forward auth redirects the request to authentik. opencode follows the
+redirect and still sends the `X-Open-WebUI-Token` header, so that request leaks the Open WebUI
+token to authentik. The plugin then drops that token and does not send it again.

package/index.js

@@ -0,0 +1,654 @@
+const MARKER = "openwebuiAuthentik"
+const SETTINGS = ["authentikURL", "cliClientID", "proxyClientID"]
+const DEFAULT_CLI_CLIENT_ID = "open-webui-cli"
+const MODELS_REFRESH_MINUTES = 5
+
+const METHOD_ID = "authentik"
+const AUTHORIZE_PATH = "/application/o/authorize/"
+const CLI_SCOPE = "openid email profile offline_access"
+const PROXY_SCOPE = "openid email profile ak_proxy"
+const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code"
+const JWT_ASSERTION = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
+const REFRESH_GRACE_MS = 30_000
+const HTTP_TIMEOUT_MS = 30_000
+const SLOW_DOWN_MS = 5_000
+const REREAD_MS = 10_000
+const REREAD_INTERVAL_MS = 1_000
+const REJECTED_RETRY_MS = 2_000
+// core rejects an empty secret before hooks run
+const MINT_FAILED = "authentik-mint-failed"
+
+export default {
+  id: "openwebui-authentik",
+  setup: async (ctx) => {
+    const shutdown = new AbortController()
+    const managed = new Map()
+    const refreshMs = modelsRefreshMinutes(ctx.options) * 60_000
+    const syncAll = () => refreshMs > 0 && managed.forEach((provider) => provider.sync())
+    let adopting = Promise.resolve()
+    const reconcile = () =>
+      (adopting = adopting.then(() => adopt(ctx, managed, shutdown.signal, refreshMs > 0)).catch(() => {}))
+    await reconcile()
+    if (refreshMs > 0) every(refreshMs, syncAll, shutdown.signal).catch(() => {})
+    onEvents(ctx, { credential: syncAll, provider: reconcile }, shutdown.signal).catch(() => {})
+    return () => shutdown.abort()
+  },
+}
+
+// unlisted providers stay managed; the list is partial at startup
+async function adopt(ctx, managed, shutdown, sync) {
+  const { data = [] } = await ctx.provider.list()
+  for (const provider of data) {
+    const marked = Boolean(provider.settings?.[MARKER])
+    const config = marked ? configure(ctx.options, provider) : undefined
+    const current = managed.get(provider.id)
+    if (current?.key === config?.key) continue
+    if (current) {
+      managed.delete(provider.id)
+      await current.dispose()
+    }
+    if (!config) continue
+    const adopted = await manage(ctx, config, shutdown)
+    managed.set(provider.id, adopted)
+    if (sync) adopted.sync()
+  }
+}
+
+async function manage(ctx, settings, shutdown) {
+  const stop = new AbortController()
+  const signal = AbortSignal.any([shutdown, stop.signal])
+  const config = {
+    ...settings,
+    origin: async () => {
+      if (!settings.openwebuiOrigin) throw new Error(`Set settings.baseURL on the ${settings.providerID} provider`)
+      return settings.openwebuiOrigin
+    },
+  }
+  const registrations = []
+  const relogin = `run: opencode auth login ${config.providerID} --method ${METHOD_ID}`
+  const reread = async () => {
+    const connection = await ctx.integration.connection.active(config.providerID)
+    return connection && ctx.integration.connection.resolve(connection)
+  }
+  const authentik = createAuthentik(config, relogin, signal, reread)
+  const openwebui = createOpenWebUI(config, signal, authentik.rejection)
+  const pending = new Map()
+  const retried = new Set()
+  let flagged
+  let models
+  let syncing = Promise.resolve()
+
+  registrations.push(
+    await ctx.integration.transform((editor) => {
+      editor.method.remove(config.providerID, { type: "key" })
+      editor.method.update({
+        integrationID: config.providerID,
+        method: { id: METHOD_ID, type: "oauth", label: "authentik (device login)" },
+        authorize: () => authentik.authorize(),
+        refresh: (credential) => authentik.refresh(credential),
+        label: (credential) => account(credential.access),
+      })
+    }),
+  )
+
+  registrations.push(
+    await ctx.model.transform((editor) => {
+      if (!models) return
+      const configured = new Set(editor.list(config.providerID).map((model) => model.id))
+      for (const id of configured) if (!models.has(id)) editor.remove(config.providerID, id)
+      for (const [id, name] of models) {
+        if (configured.has(id)) continue
+        editor.update(config.providerID, id, (model) => {
+          model.name = name
+        })
+      }
+    }),
+  )
+
+  const current = async () => {
+    const connection = await ctx.integration.connection.active(config.providerID)
+    if (connection?.type !== "credential" || connection.method !== "oauth")
+      throw new Error(`No authentik login is active for ${config.providerID}; ${relogin}`)
+    const credential = await ctx.integration.connection.resolve(connection)
+    if (credential?.type !== "oauth" || credential.methodID !== METHOD_ID)
+      throw new Error(`The active ${config.providerID} credential is not an authentik login; ${relogin}`)
+    if (!credential.access || credential.access === MINT_FAILED)
+      throw new Error(authentik.mintFailure(credential.refresh))
+    return { connection, credential }
+  }
+
+  const setStatus = (connection, status) =>
+    ctx.integration.connection.status({ integrationID: config.providerID, connection, status }).catch(() => {})
+
+  const needsAuth = async (connection, message) => {
+    flagged = connection
+    await setStatus(connection, { status: "needs_auth", message })
+  }
+
+  const flagRevoked = (connection) => async (error) => {
+    if (error instanceof AuthentikRejected && error.revoked) await needsAuth(connection, error.message)
+    throw error
+  }
+
+  const healthy = async () => {
+    if (!flagged) return
+    const connection = flagged
+    flagged = undefined
+    await setStatus(connection, undefined)
+  }
+
+  const fetchModels = async () => {
+    const { connection, credential } = await current()
+    const served = await openwebui.models(credential.access).catch(flagRevoked(connection))
+    if (models && sameModels(models, served)) return
+    models = served
+    await ctx.model.reload()
+  }
+
+  registrations.push(
+    await ctx.session.hook(
+      "http.request",
+      async (event) => {
+        const origin = new URL(event.request.url).origin
+        const expected = await config.origin()
+        if (origin !== expected)
+          throw new Error(`Refusing to send authentik credentials to ${origin}; expected ${expected}`)
+        const { connection, credential } = await current()
+        const token = await openwebui.token(credential.access).catch(flagRevoked(connection))
+        event.request.headers.set("authorization", `Bearer ${credential.access}`)
+        event.request.headers.set("x-open-webui-token", token)
+      },
+      { providerID: config.providerID },
+    ),
+  )
+
+  registrations.push(
+    await ctx.session.hook(
+      "http.response",
+      async (event) => {
+        const response = event.response
+        const session = event.sessionID
+        // title and generate requests never reach the retry hook
+        const tracked = event.kind === "primary" || event.kind === "compaction"
+        if (tracked) pending.delete(session)
+        if (rejectedByAuthentik(response)) {
+          await response.body?.cancel().catch(() => {})
+          const proxyToken = bearer(event.request)
+          await openwebui.forget(proxyToken)
+          const error = await authentik.rejection(response, proxyToken)
+          if (error.revoked) {
+            const connection = await ctx.integration.connection.active(config.providerID).catch(() => undefined)
+            if (connection) await needsAuth(connection, error.message)
+          } else if (tracked) pending.set(session, REJECTED_RETRY_MS)
+          event.response = Response.json(
+            { error: { type: "authentication_error", message: error.message } },
+            { status: 401 },
+          )
+          return
+        }
+        if (response.status === 401) {
+          await openwebui.forget(bearer(event.request), event.request.headers.get("x-open-webui-token"))
+          if (tracked) pending.set(session, 0)
+          return
+        }
+        if (tracked) retried.delete(session)
+        if (response.ok) await healthy()
+      },
+      { providerID: config.providerID },
+    ),
+  )
+
+  registrations.push(
+    await ctx.session.hook(
+      "retry",
+      (event) => {
+        const delay = pending.get(event.sessionID)
+        pending.delete(event.sessionID)
+        if (delay === undefined || event.error.status !== 401 || retried.has(event.sessionID)) return
+        retried.add(event.sessionID)
+        event.decision = { retry: true, delay }
+      },
+      { providerID: config.providerID },
+    ),
+  )
+
+  return {
+    key: config.key,
+    sync: () => (syncing = syncing.then(() => fetchModels().catch(() => {}))),
+    dispose: async () => {
+      stop.abort()
+      await Promise.all(registrations.map((registration) => registration.dispose()))
+      await ctx.model.reload().catch(() => {})
+    },
+  }
+}
+
+function configure(options, provider) {
+  const marker = provider.settings[MARKER]
+  const baseURL = provider.settings.baseURL
+  const merged = {
+    authentikURL: "",
+    cliClientID: DEFAULT_CLI_CLIENT_ID,
+    proxyClientID: "",
+    ...strings(options),
+    ...strings(isObject(marker) ? marker : {}),
+  }
+  return {
+    ...merged,
+    providerID: provider.id,
+    authentikURL: merged.authentikURL.replace(/\/+$/, ""),
+    openwebuiOrigin: originOf(baseURL),
+    key: JSON.stringify([marker, baseURL]),
+  }
+}
+
+function originOf(url) {
+  try {
+    return new URL(url).origin
+  } catch {
+    return undefined
+  }
+}
+
+function strings(options) {
+  return Object.fromEntries(
+    SETTINGS.filter((key) => typeof options?.[key] === "string" && options[key]).map((key) => [key, options[key]]),
+  )
+}
+
+function modelsRefreshMinutes(options) {
+  const minutes = options?.modelsRefreshMinutes
+  return Number.isFinite(minutes) && minutes >= 0 ? minutes : MODELS_REFRESH_MINUTES
+}
+
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+async function every(ms, fn, signal) {
+  while (true) {
+    await sleep(ms, signal)
+    fn()
+  }
+}
+
+async function onEvents(ctx, handlers, signal) {
+  for await (const event of ctx.event.subscribe({ signal })) {
+    if (typeof event?.type !== "string") continue
+    if (event.type.startsWith("credential.")) handlers.credential()
+    else if (event.type === "provider.updated") handlers.provider()
+  }
+}
+
+function sameModels(a, b) {
+  return a.size === b.size && [...a].every(([id, name]) => b.get(id) === name)
+}
+
+function createAuthentik(config, relogin, shutdown, reread) {
+  const flights = new Map()
+  const mintErrors = new Map()
+  const rereading = new Set()
+  let site =
+    config.authentikURL && config.proxyClientID
+      ? Promise.resolve({ authentikURL: config.authentikURL, proxyClientID: config.proxyClientID })
+      : undefined
+
+  const discover = async () => {
+    const origin = await config.origin()
+    const response = await fetch(`${origin}/`, { redirect: "manual", signal: timeout(shutdown) })
+    await response.body?.cancel().catch(() => {})
+    const location = response.headers.get("location")
+    const target = location ? new URL(location, origin) : undefined
+    const authentikURL = target?.pathname.endsWith(AUTHORIZE_PATH)
+      ? `${target.origin}${target.pathname.slice(0, -AUTHORIZE_PATH.length)}`
+      : undefined
+    const clientID = target?.searchParams.get("client_id")
+    const downgraded = target?.protocol !== "https:" && origin.startsWith("https:")
+    if (!authentikURL || !clientID || downgraded || (config.authentikURL && authentikURL !== config.authentikURL))
+      throw new Error(`Could not find the Open WebUI authentik client at ${origin} (HTTP ${response.status})`)
+    return { authentikURL: config.authentikURL || authentikURL, proxyClientID: config.proxyClientID || clientID }
+  }
+
+  const discovered = () => {
+    site ??= discover().catch((error) => {
+      site = undefined
+      throw error
+    })
+    return site
+  }
+
+  const endpoint = async (path) => `${(await discovered()).authentikURL}/application/o/${path}/`
+
+  const credential = (refresh, minted) => ({
+    type: "oauth",
+    methodID: METHOD_ID,
+    refresh,
+    access: minted.access,
+    expires: minted.expires,
+  })
+
+  const mint = async (cliAccess) => {
+    const response = await postForm(
+      await endpoint("token"),
+      {
+        grant_type: "client_credentials",
+        client_id: (await discovered()).proxyClientID,
+        client_assertion_type: JWT_ASSERTION,
+        client_assertion: cliAccess,
+        scope: PROXY_SCOPE,
+      },
+      shutdown,
+    )
+    if (!response.ok || typeof response.body.access_token !== "string") {
+      if (response.body.error === "invalid_client" && !config.proxyClientID) site = undefined
+      throw new Error(`authentik refused to mint an Open WebUI token (${describe(response)})`)
+    }
+    return { access: response.body.access_token, expires: expiry(response.body) }
+  }
+
+  const poll = async (device, deadline) => {
+    let interval = (Number.isFinite(device.interval) ? device.interval : 5) * 1000
+    while (true) {
+      await sleep(interval, shutdown)
+      if (Date.now() >= deadline) throw new Error(`The authentik device code expired before approval; ${relogin}`)
+      const response = await postForm(
+        await endpoint("token"),
+        { grant_type: DEVICE_GRANT, client_id: config.cliClientID, device_code: device.device_code },
+        shutdown,
+      )
+      if (response.ok) return response.body
+      const error = response.body.error
+      if (error === "authorization_pending") continue
+      if (error === "slow_down") {
+        interval += SLOW_DOWN_MS
+        continue
+      }
+      if (error === "expired_token") throw new Error(`The authentik device code expired before approval; ${relogin}`)
+      if (error === "access_denied") throw new Error("The sign-in was denied in authentik")
+      throw new Error(`authentik device login failed (${describe(response)})`)
+    }
+  }
+
+  const authorize = async () => {
+    const response = await postForm(
+      await endpoint("device"),
+      { client_id: config.cliClientID, scope: CLI_SCOPE },
+      shutdown,
+    )
+    const device = response.body
+    if (!response.ok || typeof device.device_code !== "string" || typeof device.user_code !== "string")
+      throw new Error(`authentik device authorization failed (${describe(response)})`)
+    const expiresAt = Date.now() + (Number.isFinite(device.expires_in) ? device.expires_in : 600) * 1000
+    const callback = poll(device, expiresAt).then(async (tokens) => {
+      if (typeof tokens.refresh_token !== "string" || !tokens.refresh_token)
+        throw new Error("authentik issued no refresh token; the CLI provider must grant offline_access")
+      return credential(tokens.refresh_token, await mint(tokens.access_token))
+    })
+    // core awaits it later
+    callback.catch(() => {})
+    return {
+      mode: "auto",
+      url: device.verification_uri_complete ?? device.verification_uri,
+      instructions: `Approve only if you started this login yourself. The browser address bar shows the code ${device.user_code}; to type it in, open ${device.verification_uri}`,
+      expiresAt,
+      callback,
+    }
+  }
+
+  const rotate = async (stored) => {
+    if (!stored.refresh) throw new Error(`The authentik login has no refresh token; ${relogin}`)
+    const response = await postForm(
+      await endpoint("token"),
+      { grant_type: "refresh_token", client_id: config.cliClientID, refresh_token: stored.refresh },
+      shutdown,
+    )
+    if (response.body.error === "invalid_grant") {
+      const current = await rotatedElsewhere(stored.refresh)
+      if (current) return credential(current.refresh, current)
+    }
+    if (!response.ok || typeof response.body.access_token !== "string")
+      throw new Error(`authentik refused to refresh the login (${describe(response)}); ${relogin}`)
+    const refresh = response.body.refresh_token || stored.refresh
+    try {
+      return credential(refresh, await mint(response.body.access_token))
+    } catch (error) {
+      const failed = credential(refresh, { access: MINT_FAILED, expires: 0 })
+      mintErrors.set(refresh, error instanceof Error ? error.message : String(error))
+      remember(refresh, Promise.resolve(failed))
+      return failed
+    }
+  }
+
+  // another opencode process may have rotated it first
+  const rotatedElsewhere = async (spent) => {
+    rereading.add(spent)
+    try {
+      const deadline = Date.now() + REREAD_MS
+      while (true) {
+        const current = await reread().catch(() => undefined)
+        if (current?.type === "oauth" && current.methodID === METHOD_ID && current.refresh && current.refresh !== spent)
+          return current
+        if (Date.now() >= deadline) return undefined
+        await sleep(REREAD_INTERVAL_MS, shutdown)
+      }
+    } finally {
+      rereading.delete(spent)
+    }
+  }
+
+  const prune = () => {
+    const now = Date.now()
+    for (const [key, flight] of flights) {
+      if (flight.settled !== undefined && now - flight.settled > REFRESH_GRACE_MS) {
+        flights.delete(key)
+        mintErrors.delete(key)
+      }
+    }
+  }
+
+  const remember = (key, promise) => {
+    const flight = { promise, settled: undefined }
+    flights.set(key, flight)
+    promise.then(
+      () => (flight.settled = Date.now()),
+      () => (flight.settled = Date.now()),
+    )
+    return flight
+  }
+
+  const refresh = (stored) => {
+    // core re-enters refresh while we re-read the spent token
+    if (rereading.has(stored.refresh)) return Promise.reject(new Error("The authentik refresh token was already used"))
+    prune()
+    const existing = flights.get(stored.refresh)
+    if (existing) return existing.promise
+    return remember(stored.refresh, rotate(stored)).promise
+  }
+
+  const mintFailure = (refreshToken) => {
+    const reason = mintErrors.get(refreshToken)
+    return `Could not get an Open WebUI token from authentik${reason ? `: ${reason}` : ""}; it is retried after ${
+      REFRESH_GRACE_MS / 1000
+    }s, or ${relogin}`
+  }
+
+  const revoked = async (proxyToken) => {
+    const response = await endpoint("userinfo")
+      .then((url) =>
+        fetch(url, {
+          headers: { authorization: `Bearer ${proxyToken}`, accept: "application/json" },
+          redirect: "manual",
+          signal: timeout(shutdown),
+        }),
+      )
+      .catch(() => undefined)
+    await response?.body?.cancel().catch(() => {})
+    return response?.status === 401 && (response.headers.get("www-authenticate") ?? "").includes("invalid_token")
+  }
+
+  const rejection = async (response, proxyToken) => {
+    const seen = response.status >= 300 && response.status < 400 ? "a redirect" : "the sign-in page"
+    if (await revoked(proxyToken))
+      return new AuthentikRejected(
+        `authentik rejected the Open WebUI credential (got ${seen}, HTTP ${response.status}); ${relogin}`,
+        true,
+      )
+    return new AuthentikRejected(
+      `authentik could not verify the Open WebUI credential (got ${seen}, HTTP ${response.status}); try again shortly`,
+      false,
+    )
+  }
+
+  return { authorize, refresh, mintFailure, rejection }
+}
+
+function createOpenWebUI(config, shutdown, rejection) {
+  const sessions = new Map()
+
+  const signIn = async (proxyToken) => {
+    const response = await fetch(`${await config.origin()}/api/v1/auths/signin`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${proxyToken}`,
+        "content-type": "application/json",
+        accept: "application/json",
+      },
+      body: JSON.stringify({ email: "", password: "" }),
+      redirect: "manual",
+      signal: timeout(shutdown),
+    })
+    if (rejectedByAuthentik(response)) {
+      await response.body?.cancel().catch(() => {})
+      throw await rejection(response, proxyToken)
+    }
+    const body = await response.json().catch(() => ({}))
+    if (!response.ok || typeof body.token !== "string")
+      throw new Error(`Open WebUI sign-in failed (HTTP ${response.status}${body.detail ? `: ${body.detail}` : ""})`)
+    return { token: body.token, expires: Number.isFinite(body.expires_at) ? body.expires_at * 1000 - 60_000 : Infinity }
+  }
+
+  const token = async (proxyToken) => {
+    for (const key of sessions.keys()) if (key !== proxyToken) sessions.delete(key)
+    const cached = sessions.get(proxyToken)
+    if (cached && (cached.expires === undefined || cached.expires > Date.now())) return (await cached.promise).token
+    const entry = { promise: signIn(proxyToken), expires: undefined }
+    sessions.set(proxyToken, entry)
+    try {
+      const session = await entry.promise
+      entry.expires = session.expires
+      return session.token
+    } catch (error) {
+      if (sessions.get(proxyToken) === entry) sessions.delete(proxyToken)
+      throw error
+    }
+  }
+
+  const models = async (proxyToken) => {
+    const session = await token(proxyToken)
+    const response = await fetch(`${await config.origin()}/api/models`, {
+      headers: { authorization: `Bearer ${proxyToken}`, "x-open-webui-token": session, accept: "application/json" },
+      redirect: "manual",
+      signal: timeout(shutdown),
+    })
+    if (rejectedByAuthentik(response)) {
+      await response.body?.cancel().catch(() => {})
+      await forget(proxyToken)
+      throw await rejection(response, proxyToken)
+    }
+    if (response.status === 401) await forget(proxyToken, session)
+    const body = await response.json().catch(() => ({}))
+    if (!response.ok || !Array.isArray(body?.data))
+      throw new Error(`Open WebUI model list failed (HTTP ${response.status})`)
+    return new Map(
+      body.data
+        .filter((model) => typeof model?.id === "string" && model.id && !model.info?.meta?.hidden)
+        .map((model) => [model.id, typeof model.name === "string" && model.name ? model.name : model.id]),
+    )
+  }
+
+  const forget = async (proxyToken, rejected) => {
+    const cached = sessions.get(proxyToken)
+    if (!cached) return
+    const session = await cached.promise.catch(() => undefined)
+    if (rejected && session && session.token !== rejected) return
+    if (sessions.get(proxyToken) === cached) sessions.delete(proxyToken)
+  }
+
+  return { token, models, forget }
+}
+
+class AuthentikRejected extends Error {
+  constructor(message, revoked) {
+    super(message)
+    this.revoked = revoked
+  }
+}
+
+function rejectedByAuthentik(response) {
+  if (response.status >= 300 && response.status < 400) return true
+  const html = (response.headers.get("content-type") ?? "").includes("text/html")
+  return html && (response.status < 300 || response.status === 401 || response.status === 403)
+}
+
+function bearer(request) {
+  const value = request.headers.get("authorization") ?? ""
+  return value.toLowerCase().startsWith("bearer ") ? value.slice(7) : ""
+}
+
+async function postForm(url, params, shutdown) {
+  const response = await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body: new URLSearchParams(params),
+    redirect: "manual",
+    signal: timeout(shutdown),
+  })
+  const body = await response.json().catch(() => ({}))
+  return { ok: response.ok, status: response.status, body: body && typeof body === "object" ? body : {} }
+}
+
+function describe(response) {
+  const { error, error_description: detail } = response.body
+  if (typeof error !== "string") return `HTTP ${response.status}`
+  return detail ? `${error}: ${detail}` : error
+}
+
+function expiry(body) {
+  if (Number.isFinite(body.expires_in)) return Date.now() + Math.floor(body.expires_in * 1000)
+  const exp = claims(body.access_token)?.exp
+  return Number.isFinite(exp) ? exp * 1000 : Date.now()
+}
+
+function account(token) {
+  const payload = claims(token)
+  const name = payload?.email ?? payload?.preferred_username
+  return typeof name === "string" && name ? name : undefined
+}
+
+function claims(token) {
+  try {
+    const payload = token.split(".")[1]
+    return JSON.parse(Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8"))
+  } catch {
+    return undefined
+  }
+}
+
+function timeout(shutdown) {
+  return AbortSignal.any([shutdown, AbortSignal.timeout(HTTP_TIMEOUT_MS)])
+}
+
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) return reject(signal.reason)
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", abort)
+      resolve()
+    }, ms)
+    const abort = () => {
+      clearTimeout(timer)
+      reject(signal.reason)
+    }
+    signal.addEventListener("abort", abort, { once: true })
+  })
+}

package/package.json

@@ -1,6 +1,21 @@
 {
   "name": "opencode-openwebui-authentik",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "opencode plugin: use Open WebUI behind authentik forward auth with your authentik login",
+  "keywords": ["opencode", "opencode-plugin", "open-webui", "authentik"],
+  "license": "MIT",
+  "author": "FedotCompot",
+  "type": "module",
+  "main": "index.js",
+  "exports": "./index.js",
+  "files": ["index.js"],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/FedotCompot/opencode-openwebui-authentik.git"
+  },
+  "homepage": "https://github.com/FedotCompot/opencode-openwebui-authentik#readme",
+  "bugs": "https://github.com/FedotCompot/opencode-openwebui-authentik/issues",
+  "scripts": {
+    "test": "bun test"
+  }
+}