swayrouter 1.0.0

package/src/lib/oauth/providers/xai.js

@@ -0,0 +1,95 @@
+import crypto from "crypto";
+import { XAI_CONFIG, XAI_PKCE_VERIFIER_BYTES } from "../constants/xai.js";
+import { validateXaiOAuthEndpoint, decodeXaiIdTokenEmail } from "../providerHelpers.js";
+
+let cachedXaiDiscovery = null;
+
+async function discoverXaiEndpoints() {
+  if (cachedXaiDiscovery) return cachedXaiDiscovery;
+  try {
+    const res = await fetch(XAI_CONFIG.discoveryUrl, { headers: { Accept: "application/json" } });
+    if (res.ok) {
+      const data = await res.json();
+      cachedXaiDiscovery = {
+        authorizeUrl: validateXaiOAuthEndpoint(data.authorization_endpoint, "authorization_endpoint"),
+        tokenUrl: validateXaiOAuthEndpoint(data.token_endpoint, "token_endpoint"),
+      };
+      return cachedXaiDiscovery;
+    }
+  } catch {                                       }
+  cachedXaiDiscovery = { authorizeUrl: XAI_CONFIG.authorizeUrl, tokenUrl: XAI_CONFIG.tokenUrl };
+  return cachedXaiDiscovery;
+}
+
+const xai = {
+  config: XAI_CONFIG,
+  flowType: "authorization_code_pkce",
+  fixedPort: XAI_CONFIG.loopbackPort,
+  callbackPath: XAI_CONFIG.callbackPath,
+  pkceVerifierBytes: XAI_PKCE_VERIFIER_BYTES,
+  prepareConfig: async (config) => {
+    const endpoints = await discoverXaiEndpoints();
+    return {
+      ...config,
+      authorizeUrl: endpoints.authorizeUrl,
+      tokenUrl: endpoints.tokenUrl,
+    };
+  },
+  buildAuthUrl: (config, redirectUri, state, codeChallenge) => {
+
+    const nonce = crypto.randomBytes(16).toString("hex");
+    const params = {
+      response_type: "code",
+      client_id: config.clientId,
+      redirect_uri: redirectUri,
+      scope: config.scope,
+      code_challenge: codeChallenge,
+      code_challenge_method: config.codeChallengeMethod,
+      state,
+      nonce,
+      plan: "generic",
+      referrer: "cli-proxy-api",
+    };
+    const qs = Object.entries(params)
+      .map(([k, v]) => `${k}=${encodeURIComponent(v)}`)
+      .join("&");
+    return `${config.authorizeUrl}?${qs}`;
+  },
+  exchangeToken: async (config, code, redirectUri, codeVerifier) => {
+    const response = await fetch(config.tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        code,
+        redirect_uri: redirectUri,
+        code_verifier: codeVerifier,
+      }),
+    });
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`xAI token exchange failed: ${error}`);
+    }
+    return await response.json();
+  },
+  mapTokens: (tokens) => {
+    const mapped = {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token,
+      expiresIn: tokens.expires_in,
+      scope: tokens.scope,
+    };
+    const email = decodeXaiIdTokenEmail(tokens.id_token);
+    if (email) mapped.email = email;
+    if (tokens.id_token) {
+      mapped.providerSpecificData = { idToken: tokens.id_token };
+    }
+    return mapped;
+  },
+};
+
+export default xai;

package/src/lib/oauth/providers.js

@@ -0,0 +1,16 @@
+export {
+  PROVIDERS,
+  resolveProviderName,
+  getProviderFlowType,
+  providerUsesPkce,
+  providerRequiresDeviceCodeVerifier,
+  getProvider,
+  getProviderNames,
+  generateAuthData,
+  exchangeTokens,
+  requestDeviceCode,
+  pollForToken,
+  backfillCodexEmails,
+  extractCodexAccountInfo,
+  fetchKiroProfileArn,
+} from "./providers/index.js";

package/src/lib/oauth/services/cursor.js

@@ -0,0 +1,132 @@
+import { CURSOR_CONFIG } from "../constants/oauth.js";
+
+export class CursorService {
+  constructor() {
+    this.config = CURSOR_CONFIG;
+  }
+
+  generateChecksum(machineId) {
+    const timestamp = Math.floor(Date.now() / 1000).toString();
+    let key = 165;
+    const encoded = [];
+
+    for (let i = 0; i < timestamp.length; i++) {
+      const charCode = timestamp.charCodeAt(i);
+      encoded.push(charCode ^ key);
+      key = (key + charCode) & 0xff;
+    }
+
+    const base64Encoded = Buffer.from(encoded).toString("base64");
+    return `${base64Encoded},${machineId}`;
+  }
+
+  buildHeaders(accessToken, machineId, ghostMode = false) {
+    const checksum = this.generateChecksum(machineId);
+
+    return {
+      Authorization: `Bearer ${accessToken}`,
+      "Content-Type": "application/connect+proto",
+      "Connect-Protocol-Version": "1",
+      "x-cursor-client-version": this.config.clientVersion,
+      "x-cursor-client-type": this.config.clientType,
+      "x-cursor-client-os": this.detectOS(),
+      "x-cursor-client-arch": this.detectArch(),
+      "x-cursor-client-device-type": "desktop",
+      "x-cursor-checksum": checksum,
+      "x-ghost-mode": ghostMode ? "true" : "false",
+    };
+  }
+
+  detectOS() {
+    if (typeof process !== "undefined") {
+      const platform = process.platform;
+      if (platform === "win32") return "windows";
+      if (platform === "darwin") return "macos";
+      return "linux";
+    }
+    return "linux";
+  }
+
+  detectArch() {
+    if (typeof process !== "undefined") {
+      const arch = process.arch;
+      if (arch === "x64") return "x86_64";
+      if (arch === "arm64") return "aarch64";
+      return arch;
+    }
+    return "x86_64";
+  }
+
+  async validateImportToken(accessToken, machineId) {
+
+    if (!accessToken || typeof accessToken !== "string") {
+      throw new Error("Access token is required");
+    }
+
+    if (!machineId || typeof machineId !== "string") {
+      throw new Error("Machine ID is required");
+    }
+
+    if (accessToken.length < 50) {
+      throw new Error("Invalid token format. Token appears too short.");
+    }
+
+    const uuidRegex = /^[a-f0-9-]{32,}$/i;
+    if (!uuidRegex.test(machineId.replace(/-/g, ""))) {
+      throw new Error("Invalid machine ID format. Expected UUID format.");
+    }
+
+    return {
+      accessToken,
+      machineId,
+      expiresIn: 86400,
+      authMethod: "imported",
+    };
+  }
+
+  extractUserInfo(accessToken) {
+    try {
+
+      const parts = accessToken.split(".");
+      if (parts.length === 3) {
+        let payload = parts[1];
+        while (payload.length % 4) {
+          payload += "=";
+        }
+        const decoded = JSON.parse(
+          Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString()
+        );
+        return {
+          email: decoded.email || decoded.sub,
+          userId: decoded.sub || decoded.user_id,
+        };
+      }
+    } catch {
+
+    }
+
+    return null;
+  }
+
+  getTokenStorageInstructions() {
+    return {
+      title: "How to get your Cursor token",
+      steps: [
+        "1. Open Cursor IDE and make sure you're logged in",
+        "2. Find the state.vscdb file:",
+        `   - Linux: ${this.config.tokenStoragePaths.linux}`,
+        `   - macOS: ${this.config.tokenStoragePaths.macos}`,
+        `   - Windows: ${this.config.tokenStoragePaths.windows}`,
+        "3. Open the database with SQLite browser or CLI:",
+        "   sqlite3 state.vscdb \"SELECT value FROM itemTable WHERE key='cursorAuth/accessToken'\"",
+        "4. Also get the machine ID:",
+        "   sqlite3 state.vscdb \"SELECT value FROM itemTable WHERE key='storage.serviceMachineId'\"",
+        "5. Paste both values in the form below",
+      ],
+      alternativeMethod: [
+        "Or use this one-liner to get both values:",
+        "sqlite3 state.vscdb \"SELECT key, value FROM itemTable WHERE key IN ('cursorAuth/accessToken', 'storage.serviceMachineId')\"",
+      ],
+    };
+  }
+}

package/src/lib/oauth/services/kiro.js

@@ -0,0 +1,351 @@
+import { KIRO_CONFIG, assertValidAwsRegion } from "../constants/oauth.js";
+
+const KIRO_AUTH_SERVICE = "https://prod.us-east-1.auth.desktop.kiro.dev";
+
+export class KiroService {
+
+  async registerClient(region = "us-east-1") {
+    assertValidAwsRegion(region);
+    const endpoint = `https://oidc.${region}.amazonaws.com/client/register`;
+
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        clientName: KIRO_CONFIG.clientName,
+        clientType: KIRO_CONFIG.clientType,
+        scopes: KIRO_CONFIG.scopes,
+        grantTypes: KIRO_CONFIG.grantTypes,
+        issuerUrl: KIRO_CONFIG.issuerUrl,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to register client: ${error}`);
+    }
+
+    const data = await response.json();
+    return {
+      clientId: data.clientId,
+      clientSecret: data.clientSecret,
+      clientSecretExpiresAt: data.clientSecretExpiresAt,
+    };
+  }
+
+  async startDeviceAuthorization(clientId, clientSecret, startUrl, region = "us-east-1") {
+    assertValidAwsRegion(region);
+    const endpoint = `https://oidc.${region}.amazonaws.com/device_authorization`;
+
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        clientId,
+        clientSecret,
+        startUrl,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to start device authorization: ${error}`);
+    }
+
+    const data = await response.json();
+    return {
+      deviceCode: data.deviceCode,
+      userCode: data.userCode,
+      verificationUri: data.verificationUri,
+      verificationUriComplete: data.verificationUriComplete,
+      expiresIn: data.expiresIn,
+      interval: data.interval || 5,
+    };
+  }
+
+  async pollDeviceToken(clientId, clientSecret, deviceCode, region = "us-east-1") {
+    assertValidAwsRegion(region);
+    const endpoint = `https://oidc.${region}.amazonaws.com/token`;
+
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        clientId,
+        clientSecret,
+        deviceCode,
+        grantType: "urn:ietf:params:oauth:grant-type:device_code",
+      }),
+    });
+
+    const data = await response.json();
+
+    if (!response.ok || data.error) {
+      return {
+        success: false,
+        error: data.error,
+        errorDescription: data.error_description,
+        pending: data.error === "authorization_pending" || data.error === "slow_down",
+      };
+    }
+
+    return {
+      success: true,
+      tokens: {
+        accessToken: data.accessToken,
+        refreshToken: data.refreshToken,
+        expiresIn: data.expiresIn,
+        tokenType: data.tokenType,
+      },
+    };
+  }
+
+  buildSocialLoginUrl(provider, codeChallenge, state) {
+    const idp = provider === "google" ? "Google" : "Github";
+
+    const redirectUri = "kiro://kiro.kiroAgent/authenticate-success";
+    return `${KIRO_AUTH_SERVICE}/login?idp=${idp}&redirect_uri=${encodeURIComponent(redirectUri)}&code_challenge=${codeChallenge}&code_challenge_method=S256&state=${state}&prompt=select_account`;
+  }
+
+  async exchangeSocialCode(code, codeVerifier) {
+
+    const redirectUri = "kiro://kiro.kiroAgent/authenticate-success";
+
+    const response = await fetch(`${KIRO_AUTH_SERVICE}/oauth/token`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        code,
+        code_verifier: codeVerifier,
+        redirect_uri: redirectUri,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Token exchange failed: ${error}`);
+    }
+
+    const data = await response.json();
+    return {
+      accessToken: data.accessToken,
+      refreshToken: data.refreshToken,
+      profileArn: data.profileArn,
+      expiresIn: data.expiresIn || 3600,
+    };
+  }
+
+  async refreshToken(refreshToken, providerSpecificData = {}) {
+    const { authMethod, clientId, clientSecret, region } = providerSpecificData;
+
+    if (clientId && clientSecret) {
+      const safeRegion = region || "us-east-1";
+      assertValidAwsRegion(safeRegion);
+      const endpoint = `https://oidc.${safeRegion}.amazonaws.com/token`;
+
+      const response = await fetch(endpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+          clientId,
+          clientSecret,
+          refreshToken,
+          grantType: "refresh_token",
+        }),
+      });
+
+      if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Token refresh failed: ${error}`);
+      }
+
+      const data = await response.json();
+      return {
+        accessToken: data.accessToken,
+        refreshToken: data.refreshToken || refreshToken,
+        profileArn: data.profileArn,
+        expiresIn: data.expiresIn,
+      };
+    }
+
+    const response = await fetch(`${KIRO_AUTH_SERVICE}/refreshToken`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        refreshToken,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Token refresh failed: ${error}`);
+    }
+
+    const data = await response.json();
+    return {
+      accessToken: data.accessToken,
+      refreshToken: data.refreshToken || refreshToken,
+      profileArn: data.profileArn,
+      expiresIn: data.expiresIn || 3600,
+    };
+  }
+
+  async validateImportToken(refreshToken) {
+
+    if (!refreshToken.startsWith("aorAAAAAG")) {
+      throw new Error("Invalid token format. Token should start with aorAAAAAG...");
+    }
+
+    try {
+      const result = await this.refreshToken(refreshToken);
+      return {
+        accessToken: result.accessToken,
+        refreshToken: result.refreshToken || refreshToken,
+        profileArn: result.profileArn,
+        expiresIn: result.expiresIn,
+        authMethod: "imported",
+      };
+    } catch (error) {
+      throw new Error(`Token validation failed: ${error.message}`);
+    }
+  }
+
+  async listAvailableProfiles(accessToken, region = "us-east-1") {
+    assertValidAwsRegion(region);
+    const endpoint = `https://codewhisperer.${region}.amazonaws.com`;
+
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-amz-json-1.0",
+        "x-amz-target": "AmazonCodeWhispererService.ListAvailableProfiles",
+        "Authorization": `Bearer ${accessToken}`,
+        "Accept": "application/json",
+      },
+      body: JSON.stringify({ maxResults: 10 }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to list profiles: ${error}`);
+    }
+
+    const data = await response.json();
+    const profiles = Array.isArray(data?.profiles) ? data.profiles : [];
+    const arnOf = (p) => p?.arn || p?.profileArn || null;
+    const match = profiles.find((p) => arnOf(p)?.split(":")[3] === region) || profiles[0];
+    return arnOf(match);
+  }
+
+  async listAvailableApiKeyModels(apiKey, region = "us-east-1") {
+    assertValidAwsRegion(region);
+    const params = new URLSearchParams({ origin: "AI_EDITOR" });
+    const endpoint = `https://q.${region}.amazonaws.com/ListAvailableModels?${params}`;
+    const response = await fetch(endpoint, {
+      method: "GET",
+      headers: {
+        "Authorization": `Bearer ${apiKey}`,
+        "TokenType": "API_KEY",
+        "Accept": "application/json",
+        "User-Agent": "AWS-SDK-JS/3.0.0 kiro-ide/1.0.0",
+        "X-Amz-User-Agent": "aws-sdk-js/3.0.0 kiro-ide/1.0.0",
+      },
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to list API-key models: ${error}`);
+    }
+
+    const data = await response.json();
+    const models = Array.isArray(data?.models) ? data.models : [];
+    if (models.length === 0) {
+      throw new Error("API key returned no available models");
+    }
+    return models;
+  }
+
+  async validateApiKey(apiKey, region = "us-east-1") {
+    if (!apiKey || typeof apiKey !== "string" || !apiKey.trim()) {
+      throw new Error("API key is required");
+    }
+    const trimmed = apiKey.trim();
+
+    try {
+      await this.listAvailableApiKeyModels(trimmed, region);
+    } catch (error) {
+      throw new Error(`API key validation failed: ${error.message}`);
+    }
+
+    return {
+      accessToken: trimmed,
+      refreshToken: null,
+      profileArn: null,
+      region,
+      authMethod: "api_key",
+    };
+  }
+
+  async listAvailableModels(accessToken, profileArn) {
+    const endpoint = "https://codewhisperer.us-east-1.amazonaws.com";
+    const target = "AmazonCodeWhispererService.ListAvailableModels";
+
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-amz-json-1.0",
+        "x-amz-target": target,
+        "Authorization": `Bearer ${accessToken}`,
+        "Accept": "application/json",
+      },
+      body: JSON.stringify({
+        origin: "AI_EDITOR",
+        profileArn,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to list models: ${error}`);
+    }
+
+    const data = await response.json();
+    return (data.models || []).map(m => ({
+      id: m.modelId,
+      name: m.modelName || m.modelId,
+      description: m.description,
+      rateMultiplier: m.rateMultiplier,
+      rateUnit: m.rateUnit,
+      maxInputTokens: m.tokenLimits?.maxInputTokens || 0,
+    }));
+  }
+
+  extractEmailFromJWT(accessToken) {
+    try {
+      const parts = accessToken.split(".");
+      if (parts.length !== 3) return null;
+
+      let payload = parts[1];
+      while (payload.length % 4) {
+        payload += "=";
+      }
+
+      const decoded = JSON.parse(atob(payload.replace(/-/g, "+").replace(/_/g, "/")));
+      return decoded.email || decoded.preferred_username || decoded.sub;
+    } catch {
+      return null;
+    }
+  }
+}