thaipass 0.1.4 → 0.1.6

package/dist/index.d.ts

@@ -24,7 +24,10 @@ interface UpstreamLogger {
 /** The known ids complete in an editor; any other string is left to the catalog. */
 export type AipassModelId = KnownChatModel | (string & Record<never, never>);
 export interface AipassProviderSettings {
-  /** The Cookie header of a browser signed in to AI Pass. */
+  /**
+   * The Cookie header of a browser signed in to AI Pass, or a thaipass token
+   * when this process holds the `THAIPASS_TOKEN_KEY` that sealed it.
+   */
   readonly cookie: string;
   /** Process-wide; defaults to https://de.aipass.net. */
   readonly origin?: string;

package/dist/index.js

@@ -1,6 +1,6 @@
 import { APICallError, NoSuchModelError } from "@ai-sdk/provider";
 import { z } from "zod";
-import { createHash } from "node:crypto";
+import { createDecipheriv, createHash } from "node:crypto";
 import { parseJsonEventStream } from "@ai-sdk/provider-utils";
 //#region ../core/src/aipass/models.ts
 /**
@@ -86,6 +86,185 @@ const configure = (changes) => {
 	Object.assign(current, changes);
 };
 //#endregion
+//#region ../core/src/auth/seal.ts
+/**
+* Login with thaipass, without a database.
+*
+* An app that wants to talk to this gateway has to prove it may drive someone's
+* AI Pass account. The obvious way is to hand it the session cookie, which is
+* what every client does today: the key in a Codex config or a Claude Code
+* environment variable is the whole account, it cannot be revoked, and it has
+* to be copied again by hand each time AI Pass rotates it.
+*
+* A thaipass token is that cookie sealed under a key only the gateway holds.
+* The app carries the sealed bytes and can read nothing in them; the gateway
+* unseals per request and forwards the cookie upstream as before. Nothing is
+* stored anywhere, so a deployment stays as stateless as it is now, and the
+* promise the README makes — that the gateway keeps no credential — still
+* holds: what it keeps is the key that opens one, not the credential.
+*
+* The same envelope carries the authorization code in the middle of a login,
+* with the PKCE challenge and the app's redirect inside it, so a code cannot be
+* replayed as an access token or spent by another app.
+*/
+const ALGORITHM = "aes-256-gcm";
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const KEY_BYTES = 32;
+const TOKEN_PREFIX = "tp_v1_";
+const CODE_PREFIX = "tp_c1_";
+/** The wire shape, with short names because the envelope travels in a header. */
+const payloadSchema = z.object({
+	a: z.string().optional(),
+	c: z.string(),
+	h: z.string().optional(),
+	r: z.string().optional(),
+	s: z.string().optional(),
+	sc: z.string().optional(),
+	x: z.number()
+});
+const SECOND_MS = 1e3;
+/** Bytes that authenticated under our own key are still parsed, not trusted. */
+const openPayload = (plain) => {
+	try {
+		return payloadSchema.parse(JSON.parse(plain));
+	} catch {
+		return null;
+	}
+};
+const NO_KEY$1 = "this deployment issues no thaipass tokens: set THAIPASS_TOKEN_KEY to a 32 byte base64 key";
+const MALFORMED = "the token is not a thaipass token";
+const TAMPERED = "the token does not open: it is for another deployment, or it was altered";
+const EXPIRED = "the token has expired, sign in again";
+const prefixFor = (purpose) => purpose === "code" ? CODE_PREFIX : TOKEN_PREFIX;
+/**
+* The key as bytes, or null when this deployment was never given one. A
+* missing key is not an error: a personal gateway that only ever sees raw
+* cookies needs none, and every path here falls back to that.
+*/
+const tokenKey = () => {
+	const raw = process.env.THAIPASS_TOKEN_KEY?.trim();
+	if (!raw) return null;
+	const key = Buffer.from(raw, "base64");
+	return key.length === KEY_BYTES ? key : null;
+};
+const issuesTokens = () => tokenKey() !== null;
+const isSealed = (value, purpose = "access") => value.startsWith(prefixFor(purpose));
+const unseal = (value, purpose = "access") => {
+	const prefix = prefixFor(purpose);
+	if (!value.startsWith(prefix)) return {
+		ok: false,
+		reason: MALFORMED
+	};
+	const key = tokenKey();
+	if (!key) return {
+		ok: false,
+		reason: NO_KEY$1
+	};
+	const sealed = Buffer.from(value.slice(prefix.length), "base64url");
+	if (sealed.length <= 28) return {
+		ok: false,
+		reason: MALFORMED
+	};
+	const iv = sealed.subarray(0, IV_BYTES);
+	const body = sealed.subarray(IV_BYTES, sealed.length - TAG_BYTES);
+	const tag = sealed.subarray(sealed.length - TAG_BYTES);
+	let plain;
+	try {
+		const decipher = createDecipheriv(ALGORITHM, key, iv);
+		decipher.setAAD(Buffer.from(purpose, "utf-8"));
+		decipher.setAuthTag(tag);
+		plain = decipher.update(body, void 0, "utf-8") + decipher.final("utf-8");
+	} catch {
+		return {
+			ok: false,
+			reason: TAMPERED
+		};
+	}
+	const payload = openPayload(plain);
+	if (payload === null) return {
+		ok: false,
+		reason: TAMPERED
+	};
+	if (payload.x * SECOND_MS <= Date.now()) return {
+		ok: false,
+		reason: EXPIRED
+	};
+	return {
+		claims: {
+			clientId: payload.a,
+			codeChallenge: payload.h,
+			cookie: payload.c,
+			expiresAt: payload.x,
+			redirectUri: payload.r,
+			scope: payload.sc,
+			subject: payload.s
+		},
+		ok: true
+	};
+};
+//#endregion
+//#region ../core/src/aipass/session.ts
+const SESSION_TOKEN = "__Secure-ai_passport_auth.session_token";
+const NO_TOKEN = `the credential carries no ${SESSION_TOKEN}, send the whole Cookie header from a logged-in browser session rather than the token on its own`;
+const withToken = (cookie, grant) => {
+	if (!cookie.includes(SESSION_TOKEN)) return {
+		ok: false,
+		reason: NO_TOKEN
+	};
+	return grant ? {
+		cookie,
+		grant,
+		ok: true
+	} : {
+		cookie,
+		ok: true
+	};
+};
+/**
+* Two credentials reach the same account. A thaipass token is the cookie
+* sealed under this deployment's key, which is what `thaipass login` hands an
+* app; a raw Cookie header is what a personal setup has always sent. Unsealing
+* happens here, once, so every route accepts either without knowing about it.
+*/
+const resolve = (value) => {
+	const credential = value.trim();
+	if (!isSealed(credential)) return withToken(credential);
+	const opened = unseal(credential);
+	if (!opened.ok) return {
+		ok: false,
+		reason: opened.reason
+	};
+	const { claims } = opened;
+	return withToken(claims.cookie, {
+		clientId: claims.clientId,
+		expiresAt: claims.expiresAt,
+		scope: claims.scope,
+		subject: claims.subject
+	});
+};
+/** A credential handed over directly, as the CLI reads it from the environment or a file. */
+const cookieFromValue = (value) => resolve(value);
+const CLIENT_ID_LENGTH = 16;
+const clientIdFromCookie = (cookie) => createHash("sha256").update(cookie).digest("hex").slice(0, CLIENT_ID_LENGTH);
+//#endregion
+//#region src/credential.ts
+/**
+* What `createAipass` will actually send upstream.
+*
+* `thaipass login` hands people a `tp_…` token now, so one will be pasted in
+* here sooner or later. The provider is not a gateway — it talks to AI Pass
+* directly — so a token is only usable in a process that also holds the key
+* that sealed it. When it does, the token opens; when it does not, saying so
+* beats letting AI Pass refuse the request for reasons of its own.
+*/
+const NO_KEY = "that is a thaipass token, and this provider talks to AI Pass directly. Give it the Cookie header, or set THAIPASS_TOKEN_KEY to the key that sealed the token.";
+const resolveCredential = (value) => {
+	const lookup = cookieFromValue(value);
+	if (lookup.ok) return lookup.cookie;
+	throw new Error(isSealed(value) && !issuesTokens() ? NO_KEY : lookup.reason);
+};
+//#endregion
 //#region ../core/src/lib/cache.ts
 const ttlCache = (ttlMs) => {
 	const entries = /* @__PURE__ */ new Map();
@@ -199,8 +378,7 @@ const fetchCatalog = async (clientId, cookie, signal) => {
 * The AI Pass edge answers some requests itself with a 403 before the chat
 * backend runs, scoring what the prompt contains rather than its length. A
 * retry of the same body gets the same verdict, so the proxy reports it as a
-* request error and hands back the edge's own body, since the trigger set is
-* undocumented.
+* request error and hands back the edge's own body.
 */
 const EDGE_REFUSAL_STATUS = 403;
 const EDGE_REFUSAL_HINT = "; the AI Pass edge refused this before the model ran, on what the prompt contains rather than how long it is — resending the same text will be refused again";
@@ -542,8 +720,6 @@ const settleCredits = async (cookie, before) => {
 		usage: toCreditUsage(start, after)
 	};
 };
-const CLIENT_ID_LENGTH = 16;
-const clientIdFromCookie = (cookie) => createHash("sha256").update(cookie).digest("hex").slice(0, CLIENT_ID_LENGTH);
 const thinkingLevelSchema = z.enum([
 	"low",
 	"medium",
@@ -1474,6 +1650,7 @@ const aipassModel = (cookie, modelId) => ({
 //#endregion
 //#region src/index.ts
 const createAipass = (settings) => {
+	const cookie = resolveCredential(settings.cookie);
 	if (settings.origin !== void 0) configure({ origin: settings.origin });
 	if (settings.logger !== void 0) configure({ logger: settings.logger });
 	const languageModel = (modelId = DEFAULT_MODEL) => {
@@ -1481,7 +1658,7 @@ const createAipass = (settings) => {
 			modelId,
 			modelType: "languageModel"
 		});
-		return aipassModel(settings.cookie, modelId);
+		return aipassModel(cookie, modelId);
 	};
 	return Object.assign(languageModel, { languageModel });
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thaipass",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "AI SDK provider for AI Pass, using your own session cookie.",
   "keywords": [
     "ai-sdk",