responses-proxy 0.1.0

package/dist/telegram-bot/proxy-client.js

@@ -0,0 +1,174 @@
+import { extractResponseText } from "./format.js";
+export class ProxyClientError extends Error {
+    status;
+    body;
+    constructor(message, status, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+    }
+}
+export class ResponsesProxyClient {
+    baseUrl;
+    clientApiKey;
+    requestTimeoutMs;
+    constructor(baseUrl, clientApiKey, requestTimeoutMs = 30_000) {
+        this.baseUrl = baseUrl;
+        this.clientApiKey = clientApiKey;
+        this.requestTimeoutMs = requestTimeoutMs;
+    }
+    async getHealth() {
+        return this.requestJson("/health");
+    }
+    async getProviders() {
+        return this.requestJson("/api/providers");
+    }
+    async getUsageStats() {
+        return this.requestJson("/api/stats/usage");
+    }
+    async getLatestPromptCache() {
+        return this.requestJson("/api/debug/prompt-cache/latest");
+    }
+    async getClientConfigs() {
+        return this.requestJson("/api/client-configs/status");
+    }
+    async setClientRouteApiKeys(input) {
+        return this.requestJson("/api/client-route-keys", {
+            method: "POST",
+            body: input,
+        });
+    }
+    async getProviderDetails(providerId) {
+        return this.requestJson(`/api/providers/${encodeURIComponent(providerId)}`);
+    }
+    async getProviderModels(providerId) {
+        return this.requestJson(`/api/provider-models?providerId=${encodeURIComponent(providerId)}`);
+    }
+    async setProviderRoute(input) {
+        return this.requestJson("/api/provider-routes", {
+            method: "POST",
+            body: input,
+        });
+    }
+    async applyClientConfig(input) {
+        return this.requestJson("/api/client-configs/apply", {
+            method: "POST",
+            body: {
+                client: input.client,
+                model: input.model,
+                routeApiKey: input.routeApiKey,
+            },
+        });
+    }
+    async getOauthStatus() {
+        return this.requestJson("/api/chatgpt-oauth/status");
+    }
+    async startOauth() {
+        return this.requestJson("/api/chatgpt-oauth/start", { method: "POST" });
+    }
+    async completeOauth(callbackUrl) {
+        return this.requestJson("/api/chatgpt-oauth/callback", {
+            method: "POST",
+            body: {
+                callbackUrl,
+            },
+        });
+    }
+    async refreshAccount(accountId) {
+        return this.requestJson(`/api/account-auth/accounts/${encodeURIComponent(accountId)}/refresh`, {
+            method: "POST",
+        });
+    }
+    async disableAccount(accountId) {
+        return this.requestJson(`/api/account-auth/accounts/${encodeURIComponent(accountId)}/disable`, {
+            method: "POST",
+        });
+    }
+    async enableAccount(accountId) {
+        return this.requestJson(`/api/account-auth/accounts/${encodeURIComponent(accountId)}/enable`, {
+            method: "POST",
+        });
+    }
+    async deleteAccount(accountId) {
+        return this.requestJson(`/api/account-auth/accounts/${encodeURIComponent(accountId)}`, {
+            method: "DELETE",
+        });
+    }
+    async sendTestPrompt(input) {
+        const body = await this.requestJson("/v1/responses", {
+            method: "POST",
+            headers: this.clientApiKey
+                ? {
+                    Authorization: `Bearer ${this.clientApiKey}`,
+                }
+                : undefined,
+            body: {
+                model: input.model,
+                input: input.prompt,
+                metadata: input.providerId ? { provider_id: input.providerId } : undefined,
+            },
+        });
+        return {
+            outputText: extractResponseText(body),
+            requestId: typeof body?._request_id === "string" ? body._request_id : null,
+            raw: body,
+        };
+    }
+    async getModels() {
+        return this.requestJson("/v1/models", {
+            headers: this.clientApiKey
+                ? {
+                    Authorization: `Bearer ${this.clientApiKey}`,
+                }
+                : undefined,
+        });
+    }
+    async requestJson(pathname, options) {
+        let response;
+        try {
+            response = await fetch(`${this.baseUrl}${pathname}`, {
+                method: options?.method ?? "GET",
+                headers: {
+                    "content-type": "application/json",
+                    ...(this.clientApiKey
+                        ? {
+                            Authorization: `Bearer ${this.clientApiKey}`,
+                        }
+                        : {}),
+                    ...(options?.headers ?? {}),
+                },
+                body: options?.body ? JSON.stringify(options.body) : undefined,
+                signal: AbortSignal.timeout(this.requestTimeoutMs),
+            });
+        }
+        catch (error) {
+            if (error instanceof Error &&
+                (error.name === "TimeoutError" || error.name === "AbortError")) {
+                throw new ProxyClientError("Proxy request timed out", 504, {
+                    error: {
+                        type: "proxy_error",
+                        code: "BOT_PROXY_REQUEST_TIMEOUT",
+                        message: `Proxy request timed out after ${this.requestTimeoutMs}ms`,
+                        retryable: true,
+                    },
+                });
+            }
+            throw new ProxyClientError(error instanceof Error ? error.message : "Could not reach responses-proxy", 502, {
+                error: {
+                    type: "proxy_error",
+                    code: "BOT_PROXY_REQUEST_FAILED",
+                    message: error instanceof Error ? error.message : "Could not reach responses-proxy",
+                    retryable: true,
+                },
+            });
+        }
+        const contentType = response.headers.get("content-type") ?? "";
+        const isJson = contentType.includes("application/json");
+        const body = isJson ? (await response.json()) : undefined;
+        if (!response.ok) {
+            const message = body?.error?.message || `Proxy request failed with status ${response.status}`;
+            throw new ProxyClientError(message, response.status, body);
+        }
+        return body;
+    }
+}

package/dist/telegram-bot/rate-limit.js

@@ -0,0 +1,95 @@
+import { mkdirSync } from "node:fs";
+import path from "node:path";
+import BetterSqlite3 from "better-sqlite3";
+export class SqliteRateLimiter {
+    db;
+    windowMs;
+    maxRequests;
+    constructor(db, windowMs, maxRequests) {
+        this.db = db;
+        this.windowMs = windowMs;
+        this.maxRequests = maxRequests;
+    }
+    static create(dbFile, options) {
+        mkdirSync(path.dirname(dbFile), { recursive: true });
+        const db = new BetterSqlite3(dbFile);
+        ensureRateLimitSchema(db);
+        return new SqliteRateLimiter(db, options.windowMs, options.maxRequests);
+    }
+    consume(userId, nowMs = Date.now()) {
+        this.pruneExpired(nowMs);
+        const row = this.db
+            .prepare(`SELECT user_id, window_started_at, hit_count
+         FROM telegram_bot_rate_limits
+         WHERE user_id = ?`)
+            .get(userId);
+        if (!row || nowMs - row.window_started_at >= this.windowMs) {
+            this.db
+                .prepare(`INSERT INTO telegram_bot_rate_limits (user_id, window_started_at, hit_count)
+           VALUES (?, ?, 1)
+           ON CONFLICT(user_id) DO UPDATE SET
+             window_started_at = excluded.window_started_at,
+             hit_count = excluded.hit_count`)
+                .run(userId, nowMs);
+            return {
+                allowed: true,
+                remaining: Math.max(this.maxRequests - 1, 0),
+                retryAfterMs: 0,
+            };
+        }
+        if (row.hit_count >= this.maxRequests) {
+            return {
+                allowed: false,
+                remaining: 0,
+                retryAfterMs: Math.max(this.windowMs - (nowMs - row.window_started_at), 0),
+            };
+        }
+        const nextCount = row.hit_count + 1;
+        this.db
+            .prepare("UPDATE telegram_bot_rate_limits SET hit_count = ? WHERE user_id = ?")
+            .run(nextCount, userId);
+        return {
+            allowed: true,
+            remaining: Math.max(this.maxRequests - nextCount, 0),
+            retryAfterMs: 0,
+        };
+    }
+    pruneExpired(nowMs) {
+        this.db
+            .prepare("DELETE FROM telegram_bot_rate_limits WHERE (? - window_started_at) >= ?")
+            .run(nowMs, this.windowMs);
+    }
+}
+export function createRateLimitMiddleware(rateLimiter) {
+    return async (ctx, next) => {
+        const userId = ctx.from?.id?.toString();
+        if (!userId) {
+            await next();
+            return;
+        }
+        const result = rateLimiter.consume(userId);
+        if (result.allowed) {
+            await next();
+            return;
+        }
+        const retryAfterSeconds = Math.max(Math.ceil(result.retryAfterMs / 1000), 1);
+        if (ctx.callbackQuery) {
+            await ctx.answerCallbackQuery({
+                text: `⏳ Too many requests. Try again in ${retryAfterSeconds}s.`,
+                show_alert: true,
+            });
+            return;
+        }
+        await ctx.reply(`⏳ Too many requests
+Please try again in ${retryAfterSeconds}s.`);
+    };
+}
+function ensureRateLimitSchema(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS telegram_bot_rate_limits (
+      user_id TEXT PRIMARY KEY,
+      window_started_at INTEGER NOT NULL,
+      hit_count INTEGER NOT NULL
+    );
+  `);
+}

package/dist/telegram-bot/rate-limit.test.js

@@ -0,0 +1,58 @@
+import { afterEach, test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { SqliteRateLimiter } from "./rate-limit.js";
+const tempDirs = [];
+afterEach(() => {
+    while (tempDirs.length > 0) {
+        const directory = tempDirs.pop();
+        if (directory) {
+            rmSync(directory, { recursive: true, force: true });
+        }
+    }
+});
+test("SqliteRateLimiter blocks requests above the per-user threshold", () => {
+    const directory = mkdtempSync(path.join(tmpdir(), "telegram-rate-limit-"));
+    tempDirs.push(directory);
+    const dbFile = path.join(directory, "bot.sqlite");
+    const limiter = SqliteRateLimiter.create(dbFile, {
+        windowMs: 1_000,
+        maxRequests: 2,
+    });
+    assert.equal(limiter.consume("user-1", 1_000).allowed, true);
+    assert.equal(limiter.consume("user-1", 1_100).allowed, true);
+    const denied = limiter.consume("user-1", 1_200);
+    assert.equal(denied.allowed, false);
+    assert.equal(denied.remaining, 0);
+    assert.ok(denied.retryAfterMs > 0);
+});
+test("SqliteRateLimiter resets after the configured window", () => {
+    const directory = mkdtempSync(path.join(tmpdir(), "telegram-rate-limit-"));
+    tempDirs.push(directory);
+    const dbFile = path.join(directory, "bot.sqlite");
+    const limiter = SqliteRateLimiter.create(dbFile, {
+        windowMs: 1_000,
+        maxRequests: 1,
+    });
+    assert.equal(limiter.consume("user-2", 5_000).allowed, true);
+    assert.equal(limiter.consume("user-2", 5_500).allowed, false);
+    assert.equal(limiter.consume("user-2", 6_001).allowed, true);
+});
+test("SqliteRateLimiter persists counters across recreation", () => {
+    const directory = mkdtempSync(path.join(tmpdir(), "telegram-rate-limit-"));
+    tempDirs.push(directory);
+    const dbFile = path.join(directory, "bot.sqlite");
+    const firstLimiter = SqliteRateLimiter.create(dbFile, {
+        windowMs: 1_000,
+        maxRequests: 2,
+    });
+    firstLimiter.consume("user-3", 100);
+    const secondLimiter = SqliteRateLimiter.create(dbFile, {
+        windowMs: 1_000,
+        maxRequests: 2,
+    });
+    assert.equal(secondLimiter.consume("user-3", 200).allowed, true);
+    assert.equal(secondLimiter.consume("user-3", 300).allowed, false);
+});

package/dist/telegram-bot/sessions.js

@@ -0,0 +1,171 @@
+import { randomBytes } from "node:crypto";
+import { mkdirSync } from "node:fs";
+import path from "node:path";
+import BetterSqlite3 from "better-sqlite3";
+export class SqliteSessionStore {
+    db;
+    ttlMs;
+    constructor(db, ttlMs) {
+        this.db = db;
+        this.ttlMs = ttlMs;
+    }
+    static create(dbFile, ttlMs) {
+        mkdirSync(path.dirname(dbFile), { recursive: true });
+        const db = new BetterSqlite3(dbFile);
+        ensureSessionSchema(db);
+        return new SqliteSessionStore(db, ttlMs);
+    }
+    get(sessionScope, nowMs = Date.now()) {
+        this.pruneExpired(nowMs);
+        const row = this.db
+            .prepare(`SELECT session_scope, session_json, expires_at
+         FROM telegram_bot_sessions
+         WHERE session_scope = ?`)
+            .get(sessionScope);
+        if (!row) {
+            return undefined;
+        }
+        if (row.expires_at <= nowMs) {
+            this.clear(sessionScope);
+            return undefined;
+        }
+        return parseSessionJson(row.session_json);
+    }
+    set(sessionScope, session, nowMs = Date.now()) {
+        this.pruneExpired(nowMs);
+        this.db
+            .prepare(`INSERT INTO telegram_bot_sessions (session_scope, session_json, expires_at)
+         VALUES (?, ?, ?)
+         ON CONFLICT(session_scope) DO UPDATE SET
+           session_json = excluded.session_json,
+           expires_at = excluded.expires_at`)
+            .run(sessionScope, JSON.stringify(session), nowMs + this.ttlMs);
+    }
+    clear(sessionScope) {
+        this.db.prepare("DELETE FROM telegram_bot_sessions WHERE session_scope = ?").run(sessionScope);
+    }
+    issueCallbackToken(payload, nowMs = Date.now(), ttlMs = this.ttlMs) {
+        this.pruneExpired(nowMs);
+        const token = randomBytes(9).toString("base64url");
+        this.db
+            .prepare(`INSERT INTO telegram_bot_callback_states (token, payload_json, expires_at)
+         VALUES (?, ?, ?)`)
+            .run(token, JSON.stringify(payload), nowMs + ttlMs);
+        return token;
+    }
+    readCallbackToken(token, nowMs = Date.now()) {
+        this.pruneExpired(nowMs);
+        const row = this.db
+            .prepare(`SELECT token, payload_json, expires_at
+         FROM telegram_bot_callback_states
+         WHERE token = ?`)
+            .get(token);
+        if (!row) {
+            return undefined;
+        }
+        if (row.expires_at <= nowMs) {
+            this.clearCallbackToken(token);
+            return undefined;
+        }
+        return parseCallbackPayloadJson(row.payload_json);
+    }
+    clearCallbackToken(token) {
+        this.db.prepare("DELETE FROM telegram_bot_callback_states WHERE token = ?").run(token);
+    }
+    pruneExpired(nowMs) {
+        this.db.prepare("DELETE FROM telegram_bot_sessions WHERE expires_at <= ?").run(nowMs);
+        this.db.prepare("DELETE FROM telegram_bot_callback_states WHERE expires_at <= ?").run(nowMs);
+    }
+}
+function ensureSessionSchema(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS telegram_bot_sessions (
+      session_scope TEXT PRIMARY KEY,
+      session_json TEXT NOT NULL,
+      expires_at INTEGER NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS telegram_bot_callback_states (
+      token TEXT PRIMARY KEY,
+      payload_json TEXT NOT NULL,
+      expires_at INTEGER NOT NULL
+    );
+  `);
+}
+function parseSessionJson(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === "object" && typeof parsed.kind === "string"
+            ? parsed
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseCallbackPayloadJson(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || typeof parsed.kind !== "string") {
+            return undefined;
+        }
+        if (parsed.kind === "account_action") {
+            if (parsed.action !== "refresh" &&
+                parsed.action !== "disable" &&
+                parsed.action !== "enable" &&
+                parsed.action !== "delete") {
+                return undefined;
+            }
+            return typeof parsed.accountId === "string" && parsed.accountId
+                ? parsed
+                : undefined;
+        }
+        if (parsed.kind === "renewal_plan") {
+            return typeof parsed.planId === "string" &&
+                parsed.planId &&
+                typeof parsed.days === "number" &&
+                Number.isInteger(parsed.days) &&
+                parsed.days > 0
+                ? parsed
+                : undefined;
+        }
+        if (parsed.kind === "renewal_request_action") {
+            if (parsed.action !== "approve" &&
+                parsed.action !== "approve_rotate" &&
+                parsed.action !== "approve_override" &&
+                parsed.action !== "confirm_payment" &&
+                parsed.action !== "close" &&
+                parsed.action !== "view_customer" &&
+                parsed.action !== "show_reject_reasons" &&
+                parsed.action !== "reject_reason" &&
+                parsed.action !== "show_main_actions" &&
+                parsed.action !== "prompt_custom_days" &&
+                parsed.action !== "prompt_custom_reason") {
+                return undefined;
+            }
+            if (typeof parsed.requestId !== "string" || !parsed.requestId) {
+                return undefined;
+            }
+            if (parsed.action === "approve_override") {
+                return typeof parsed.overrideDays === "number" &&
+                    Number.isInteger(parsed.overrideDays) &&
+                    parsed.overrideDays > 0
+                    ? parsed
+                    : undefined;
+            }
+            if (parsed.action === "reject_reason") {
+                return typeof parsed.resolution === "string" && parsed.resolution
+                    ? parsed
+                    : undefined;
+            }
+            return parsed;
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function buildTelegramSessionScope(chatId, userId) {
+    return `${chatId}:${userId}`;
+}

package/dist/telegram-bot/sessions.test.js

@@ -0,0 +1,107 @@
+import { afterEach, test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { buildTelegramSessionScope, SqliteSessionStore } from "./sessions.js";
+const tempDirs = [];
+afterEach(() => {
+    while (tempDirs.length > 0) {
+        const directory = tempDirs.pop();
+        if (directory) {
+            rmSync(directory, { recursive: true, force: true });
+        }
+    }
+});
+test("SqliteSessionStore persists sessions across store recreation", () => {
+    const directory = mkdtempSync(path.join(tmpdir(), "telegram-session-store-"));
+    tempDirs.push(directory);
+    const dbFile = path.join(directory, "bot.sqlite");
+    const firstStore = SqliteSessionStore.create(dbFile, 60_000);
+    const scope = buildTelegramSessionScope("chat-1", "user-1");
+    firstStore.set(scope, {
+        kind: "awaiting_apply_model_input",
+        client: "codex",
+        providerId: "provider-1",
+        providerName: "Provider One",
+        models: ["gpt-5.5"],
+    });
+    const secondStore = SqliteSessionStore.create(dbFile, 60_000);
+    assert.deepEqual(secondStore.get(scope), {
+        kind: "awaiting_apply_model_input",
+        client: "codex",
+        providerId: "provider-1",
+        providerName: "Provider One",
+        models: ["gpt-5.5"],
+    });
+});
+test("SqliteSessionStore expires stale sessions", () => {
+    const directory = mkdtempSync(path.join(tmpdir(), "telegram-session-store-"));
+    tempDirs.push(directory);
+    const dbFile = path.join(directory, "bot.sqlite");
+    const store = SqliteSessionStore.create(dbFile, 100);
+    const scope = buildTelegramSessionScope("chat-2", "user-2");
+    store.set(scope, { kind: "awaiting_oauth_callback" }, 1_000);
+    assert.equal(store.get(scope, 1_050)?.kind, "awaiting_oauth_callback");
+    assert.equal(store.get(scope, 1_101), undefined);
+});
+test("SqliteSessionStore keeps sessions isolated by user within the same chat", () => {
+    const directory = mkdtempSync(path.join(tmpdir(), "telegram-session-store-"));
+    tempDirs.push(directory);
+    const dbFile = path.join(directory, "bot.sqlite");
+    const store = SqliteSessionStore.create(dbFile, 60_000);
+    store.set(buildTelegramSessionScope("chat-shared", "user-a"), { kind: "awaiting_oauth_callback" });
+    store.set(buildTelegramSessionScope("chat-shared", "user-b"), { kind: "awaiting_test_prompt" });
+    assert.equal(store.get(buildTelegramSessionScope("chat-shared", "user-a"))?.kind, "awaiting_oauth_callback");
+    assert.equal(store.get(buildTelegramSessionScope("chat-shared", "user-b"))?.kind, "awaiting_test_prompt");
+});
+test("SqliteSessionStore issues short callback tokens and resolves stored account actions", () => {
+    const directory = mkdtempSync(path.join(tmpdir(), "telegram-session-store-"));
+    tempDirs.push(directory);
+    const dbFile = path.join(directory, "bot.sqlite");
+    const store = SqliteSessionStore.create(dbFile, 60_000);
+    const token = store.issueCallbackToken({
+        kind: "account_action",
+        action: "delete",
+        accountId: "chatgpt-oauth:very.long.email.address@example.com",
+    });
+    assert.ok(token.length < 40);
+    assert.deepEqual(store.readCallbackToken(token), {
+        kind: "account_action",
+        action: "delete",
+        accountId: "chatgpt-oauth:very.long.email.address@example.com",
+    });
+});
+test("SqliteSessionStore resolves renewal confirm payment callback tokens", () => {
+    const directory = mkdtempSync(path.join(tmpdir(), "telegram-session-store-"));
+    tempDirs.push(directory);
+    const dbFile = path.join(directory, "bot.sqlite");
+    const store = SqliteSessionStore.create(dbFile, 60_000);
+    const token = store.issueCallbackToken({
+        kind: "renewal_request_action",
+        action: "confirm_payment",
+        requestId: "renewal-1",
+    });
+    assert.deepEqual(store.readCallbackToken(token), {
+        kind: "renewal_request_action",
+        action: "confirm_payment",
+        requestId: "renewal-1",
+    });
+});
+test("SqliteSessionStore supports longer callback token TTL for renewal review buttons", () => {
+    const directory = mkdtempSync(path.join(tmpdir(), "telegram-session-store-"));
+    tempDirs.push(directory);
+    const dbFile = path.join(directory, "bot.sqlite");
+    const store = SqliteSessionStore.create(dbFile, 60_000);
+    const token = store.issueCallbackToken({
+        kind: "renewal_request_action",
+        action: "approve",
+        requestId: "renewal-late-review",
+    }, 1_000, 3_600_000);
+    assert.deepEqual(store.readCallbackToken(token, 62_000), {
+        kind: "renewal_request_action",
+        action: "approve",
+        requestId: "renewal-late-review",
+    });
+    assert.equal(store.readCallbackToken(token, 3_601_001), undefined);
+});