teamclaude-cloud 1.4.1

package/src/oauth.js

@@ -0,0 +1,347 @@
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { randomBytes, createHash } from 'node:crypto';
+import { exec } from 'node:child_process';
+import { createInterface } from 'node:readline';
+import http from 'node:http';
+
+/**
+ * Import OAuth credentials from a Claude Code credentials file.
+ */
+export async function importCredentials(filePath) {
+  const resolvedPath = filePath.replace(/^~/, homedir());
+  const raw = JSON.parse(await readFile(resolvedPath, 'utf-8'));
+
+  // Claude Code stores credentials nested under "claudeAiOauth"
+  const data = raw.claudeAiOauth || raw;
+  return {
+    accessToken: data.accessToken,
+    refreshToken: data.refreshToken,
+    expiresAt: data.expiresAt,
+    subscriptionType: data.subscriptionType,
+    rateLimitTier: data.rateLimitTier,
+  };
+}
+
+const PROFILE_URL = 'https://api.anthropic.com/api/oauth/profile';
+const DEFAULT_TOKEN_ENDPOINT = 'https://platform.claude.com/v1/oauth/token';
+const DEFAULT_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+// Bound the WHOLE token refresh (all retry attempts combined) so a hung token
+// endpoint can't block the refresh — and every request coalesced onto it /
+// holding an account slot — for long. One shared deadline, not per attempt.
+const TOKEN_REFRESH_TIMEOUT_MS = 30_000;
+
+/**
+ * Refresh an expired OAuth access token using the refresh token.
+ * Retries on 5xx and network errors with exponential backoff.
+ */
+export async function refreshAccessToken(refreshToken, endpoint = DEFAULT_TOKEN_ENDPOINT) {
+  const maxRetries = 2;
+  const baseDelayMs = 500;
+  // One deadline for the entire refresh (shared by every attempt), so the whole
+  // operation is bounded by TOKEN_REFRESH_TIMEOUT_MS rather than that × attempts.
+  const deadline = AbortSignal.timeout(TOKEN_REFRESH_TIMEOUT_MS);
+
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    if (deadline.aborted) break; // total budget spent — don't start another attempt
+    try {
+      if (attempt > 0) {
+        // Deadline-aware retry backoff: don't sleep past the total refresh budget.
+        await delayUntilAborted(baseDelayMs * 2 ** (attempt - 1), deadline);
+        if (deadline.aborted) break;
+      }
+
+      const res = await fetch(endpoint, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'Accept': 'application/json, text/plain, */*',
+          'User-Agent': 'axios/1.13.6',
+        },
+        body: JSON.stringify({
+          grant_type: 'refresh_token',
+          refresh_token: refreshToken,
+          client_id: DEFAULT_CLIENT_ID,
+        }),
+        signal: deadline,
+      });
+
+      if (!res.ok) {
+        if (res.status >= 500 && attempt < maxRetries) {
+          await res.body?.cancel();
+          continue;
+        }
+        const text = await res.text();
+        throw new Error(`Token refresh failed (${res.status}): ${text}`);
+      }
+
+      const data = await res.json();
+      return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token || refreshToken,
+        expiresAt: normalizeExpiresAt(data.expires_at) || (Date.now() + (data.expires_in || 3600) * 1000),
+      };
+    } catch (err) {
+      const isNetworkError = err instanceof Error &&
+        (err.message.includes('fetch failed') ||
+          err.name === 'TimeoutError' || err.name === 'AbortError' ||
+          (err.code === 'ECONNRESET' || err.code === 'ECONNREFUSED' ||
+           err.code === 'ETIMEDOUT' || err.code === 'UND_ERR_CONNECT_TIMEOUT'));
+
+      // Stop retrying once the shared refresh deadline is spent — otherwise the
+      // retry delays would push the total past the intended bound.
+      if (attempt < maxRetries && isNetworkError && !deadline.aborted) {
+        continue;
+      }
+      throw err;
+    }
+  }
+  // Reached only by breaking out when the shared deadline expired.
+  throw new Error(`Token refresh timed out after ${TOKEN_REFRESH_TIMEOUT_MS}ms`);
+}
+
+/** Sleep `ms`, but resolve early if `signal` aborts (cleans up its timer/listener). */
+function delayUntilAborted(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal.aborted) return resolve();
+    const cleanup = () => { clearTimeout(t); signal.removeEventListener('abort', onAbort); };
+    const onAbort = () => { cleanup(); resolve(); };
+    const t = setTimeout(() => { cleanup(); resolve(); }, ms);
+    signal.addEventListener('abort', onAbort, { once: true });
+  });
+}
+
+/**
+ * Normalize an expires_at value to milliseconds.
+ * OAuth endpoints may return seconds; Claude Code credentials use milliseconds.
+ */
+export function normalizeExpiresAt(expiresAt) {
+  if (!expiresAt) return expiresAt;
+  // If the value is plausibly in seconds (< 10^12 ≈ year 2001 in ms, year 33658 in s),
+  // convert to milliseconds
+  return expiresAt < 1e12 ? expiresAt * 1000 : expiresAt;
+}
+
+/**
+ * Check if an OAuth token is expiring within the given threshold.
+ */
+export function isTokenExpiringSoon(expiresAt, thresholdMs = 5 * 60 * 1000) {
+  if (!expiresAt) return false;
+  return Date.now() + thresholdMs >= normalizeExpiresAt(expiresAt);
+}
+
+/**
+ * Fetch account profile for an OAuth token.
+ * Returns { email, name, orgName, orgType, ... } on success,
+ * or { error: 'reason' } on failure.
+ */
+export async function fetchProfile(accessToken) {
+  try {
+    const res = await fetch(PROFILE_URL, {
+      headers: { 'Authorization': `Bearer ${accessToken}` },
+    });
+    if (!res.ok) {
+      let detail = '';
+      try {
+        const body = await res.json();
+        detail = body?.error?.message || JSON.stringify(body).slice(0, 200);
+      } catch {
+        detail = await res.text().catch(() => '');
+      }
+      return { error: `HTTP ${res.status}${detail ? ': ' + detail : ''}` };
+    }
+    const data = await res.json();
+    return {
+      accountUuid: data.account?.uuid,
+      email: data.account?.email,
+      name: data.account?.display_name,
+      orgName: data.organization?.name,
+      orgType: data.organization?.organization_type,
+      hasClaudeMax: data.account?.has_claude_max,
+      hasClaudePro: data.account?.has_claude_pro,
+    };
+  } catch (err) {
+    return { error: err.message || String(err) };
+  }
+}
+
+// OAuth config (extracted from Claude Code)
+const OAUTH_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+const OAUTH_AUTHORIZE = 'https://claude.ai/oauth/authorize';
+const OAUTH_TOKEN = 'https://platform.claude.com/v1/oauth/token';
+const OAUTH_SCOPES = 'org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload';
+
+/**
+ * Perform OAuth login via browser with PKCE flow.
+ * Opens the user's browser, waits for the callback, exchanges the code for tokens.
+ */
+export async function loginOAuth() {
+  // Generate PKCE
+  const codeVerifier = randomBytes(32).toString('base64url');
+  const codeChallenge = createHash('sha256').update(codeVerifier).digest('base64url');
+  const state = randomBytes(32).toString('base64url');
+
+  // Start local callback server on a random port
+  const { port, codePromise, server } = await startCallbackServer(state);
+  const redirectUri = `http://localhost:${port}/callback`;
+
+  // Build authorization URL
+  const authUrl = new URL(OAUTH_AUTHORIZE);
+  authUrl.searchParams.set('code', 'true');
+  authUrl.searchParams.set('client_id', OAUTH_CLIENT_ID);
+  authUrl.searchParams.set('response_type', 'code');
+  authUrl.searchParams.set('redirect_uri', redirectUri);
+  authUrl.searchParams.set('scope', OAUTH_SCOPES);
+  authUrl.searchParams.set('code_challenge', codeChallenge);
+  authUrl.searchParams.set('code_challenge_method', 'S256');
+  authUrl.searchParams.set('state', state);
+
+  // Open browser
+  console.log('Opening browser for authentication...');
+  console.log(`If it doesn't open, visit:\n  ${authUrl.toString()}\n`);
+  openBrowser(authUrl.toString());
+
+  // Wait for either the callback server or manual paste from stdin
+  let code;
+  try {
+    code = await raceWithStdinCode(codePromise, state);
+  } finally {
+    server.close();
+  }
+
+  // Exchange code for tokens
+  console.log('Exchanging authorization code for tokens...');
+  const tokenRes = await fetch(OAUTH_TOKEN, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      code,
+      state,
+      grant_type: 'authorization_code',
+      client_id: OAUTH_CLIENT_ID,
+      redirect_uri: redirectUri,
+      code_verifier: codeVerifier,
+    }),
+  });
+
+  if (!tokenRes.ok) {
+    const text = await tokenRes.text();
+    throw new Error(`Token exchange failed (${tokenRes.status}): ${text}`);
+  }
+
+  const tokens = await tokenRes.json();
+  return {
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token,
+    expiresAt: normalizeExpiresAt(tokens.expires_at) || (Date.now() + (tokens.expires_in || 3600) * 1000),
+  };
+}
+
+/**
+ * Race the callback server promise against manual code entry from stdin.
+ * The user can paste the full callback URL or just the authorization code.
+ */
+function raceWithStdinCode(callbackPromise, expectedState) {
+  if (!process.stdin.isTTY) return callbackPromise;
+
+  return new Promise((resolve, reject) => {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    let settled = false;
+
+    const settle = (fn, val) => {
+      if (settled) return;
+      settled = true;
+      rl.close();
+      fn(val);
+    };
+
+    rl.question('Paste authorization code here (or wait for browser callback): ', answer => {
+      const trimmed = answer.trim();
+      if (!trimmed) return; // empty input, keep waiting for callback
+
+      // Try to parse as a URL with ?code= parameter
+      try {
+        const url = new URL(trimmed);
+        const code = url.searchParams.get('code');
+        const state = url.searchParams.get('state');
+        if (code) {
+          if (expectedState && state && state !== expectedState) {
+            settle(reject, new Error('OAuth state mismatch'));
+          } else {
+            settle(resolve, code);
+          }
+          return;
+        }
+      } catch {}
+
+      // Treat raw input as the authorization code
+      settle(resolve, trimmed);
+    });
+
+    callbackPromise.then(
+      code => settle(resolve, code),
+      err => settle(reject, err),
+    );
+  });
+}
+
+function startCallbackServer(expectedState) {
+  return new Promise((resolve, reject) => {
+    let resolveCode, rejectCode;
+    const codePromise = new Promise((res, rej) => { resolveCode = res; rejectCode = rej; });
+
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url, `http://localhost`);
+
+      if (url.pathname === '/callback') {
+        const code = url.searchParams.get('code');
+        const error = url.searchParams.get('error');
+        const state = url.searchParams.get('state');
+
+        if (error) {
+          res.writeHead(200, { 'Content-Type': 'text/html' });
+          res.end('<html><body><h2>Authentication failed</h2><p>You can close this tab.</p></body></html>');
+          rejectCode(new Error(`OAuth error: ${error} - ${url.searchParams.get('error_description') || ''}`));
+          return;
+        }
+
+        if (expectedState && state !== expectedState) {
+          res.writeHead(200, { 'Content-Type': 'text/html' });
+          res.end('<html><body><h2>Authentication failed</h2><p>State mismatch. You can close this tab.</p></body></html>');
+          rejectCode(new Error('OAuth state mismatch'));
+          return;
+        }
+
+        if (code) {
+          res.writeHead(302, { 'Location': 'https://platform.claude.com/oauth/code/success?app=claude-code' });
+          res.end();
+          resolveCode(code);
+          return;
+        }
+      }
+
+      res.writeHead(404);
+      res.end('Not found');
+    });
+
+    server.listen(0, () => {
+      resolve({ port: server.address().port, codePromise, server });
+    });
+    server.on('error', reject);
+
+    // Timeout after 2 minutes (unref so it doesn't keep the process alive)
+    const timer = setTimeout(() => {
+      rejectCode(new Error('Login timed out after 2 minutes'));
+      server.close();
+    }, 120_000);
+    timer.unref();
+  });
+}
+
+function openBrowser(url) {
+  const platform = process.platform;
+  const cmd = platform === 'darwin' ? 'open'
+    : platform === 'win32' ? 'start'
+    : 'xdg-open';
+  exec(`${cmd} ${JSON.stringify(url)}`, () => {});
+}