tradestation-client 1.0.0

package/.env.example

@@ -0,0 +1,2 @@
+CLIENT_ID=
+CLIENT_SECRET=

package/.prettierrc

@@ -0,0 +1,4 @@
+{
+  "singleQuote": true,
+  "semi": false
+}

package/authMiddleware.ts

@@ -0,0 +1,235 @@
+import { randomBytes } from 'node:crypto'
+import { readFile, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import type { Middleware } from 'openapi-fetch'
+import fastify from 'fastify'
+import open from 'open'
+
+import { redirectPort, redirectUri } from './config.ts'
+
+type AuthResponse = {
+  access_token: string
+  refresh_token: string
+  id_token: string
+  scope: string
+  expires_in: number
+  token_type: string
+}
+
+type AuthData = AuthResponse & {
+  timestamp: number // Unix timestamp in milliseconds when token was obtained
+}
+
+const authFilePath = join(process.cwd(), 'tradestation-auth.json')
+
+function generateRandomState(): string {
+  return randomBytes(32).toString('base64url')
+}
+
+async function tryLoadAuth(): Promise<AuthData | null> {
+  try {
+    const data = await readFile(authFilePath, 'utf-8')
+    return JSON.parse(data)
+  } catch {
+    return null
+  }
+}
+
+async function saveAuth(authResponse: AuthResponse): Promise<AuthData> {
+  const authData: AuthData = {
+    ...authResponse,
+    timestamp: Date.now(),
+  }
+
+  await writeFile(authFilePath, JSON.stringify(authData, null, 2), 'utf-8')
+  return authData
+}
+
+function isTokenValid(token: AuthData): boolean {
+  const now = Date.now()
+  const expiresAt = token.timestamp + token.expires_in * 1000
+  // Consider token expired 30 seconds before actual expiration to account for clock skew
+  return now < expiresAt - 30000
+}
+
+async function requestAccessToken(
+  code: string,
+  clientId: string,
+  clientSecret: string
+): Promise<AuthData> {
+  const authRes = await fetch('https://signin.tradestation.com/oauth/token', {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+    },
+    body: new URLSearchParams({
+      grant_type: 'authorization_code',
+      code,
+      redirect_uri: redirectUri,
+      client_id: clientId,
+      client_secret: clientSecret,
+    }),
+  })
+
+  const authResponse = (await authRes.json()) as AuthResponse
+
+  if (!authRes.ok) {
+    throw new Error(`Failed to obtain access token: ${authResponse}`)
+  }
+  return saveAuth(authResponse)
+}
+
+async function refreshAccessToken(
+  refreshToken: string,
+  clientId: string,
+  clientSecret: string
+): Promise<AuthData> {
+  const authRes = await fetch('https://signin.tradestation.com/oauth/token', {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+    },
+    body: new URLSearchParams({
+      grant_type: 'refresh_token',
+      client_id: clientId,
+      client_secret: clientSecret,
+      refresh_token: refreshToken,
+    }),
+  })
+
+  if (!authRes.ok) {
+    throw new Error(`Failed to refresh token: ${await authRes.text()}`)
+  }
+
+  const authResponse = (await authRes.json()) as AuthResponse
+
+  // Preserve the original refresh token if a new one wasn't provided
+  // (TradeStation doesn't rotate refresh tokens by default)
+  if (!authResponse.refresh_token) {
+    authResponse.refresh_token = refreshToken
+  }
+
+  return saveAuth(authResponse)
+}
+
+async function authenticateWithOAuth2(
+  clientId: string,
+  clientSecret: string
+): Promise<AuthData> {
+  const app = fastify()
+  const state = generateRandomState()
+
+  const authPromise = new Promise<AuthData>((resolve, reject) => {
+    app.get('/', async (request, reply) => {
+      const { code, state: callbackState } = request.query as {
+        code?: string
+        state?: string
+      }
+
+      if (!code) {
+        reply.code(400)
+        return 'No code provided'
+      }
+
+      if (callbackState !== state) {
+        reply.code(401)
+        reject(new Error('State parameter mismatch - possible CSRF attack'))
+        return 'State validation failed'
+      }
+
+      resolve(await requestAccessToken(code, clientId, clientSecret))
+
+      setTimeout(() => {
+        app.close()
+      }, 100)
+
+      return 'Authorization successful! You can close this tab.'
+    })
+  })
+
+  await app.listen({ port: redirectPort })
+
+  console.log('Opening browser for authentication...')
+
+  await openAuthUrl(state, clientId)
+
+  return authPromise
+}
+
+async function openAuthUrl(state: string, clientId: string) {
+  const authUrl = new URL('https://signin.tradestation.com/authorize')
+  authUrl.searchParams.append('response_type', 'code')
+  authUrl.searchParams.append(
+    'scope',
+    'openid offline_access profile MarketData ReadAccount Trade Matrix'
+  )
+  authUrl.searchParams.append('redirect_uri', redirectUri)
+  authUrl.searchParams.append('client_id', clientId)
+  authUrl.searchParams.append('state', state)
+  authUrl.searchParams.append('audience', 'https://api.tradestation.com')
+
+  await open(authUrl.toString())
+}
+
+export async function authenticate(
+  clientId: string,
+  clientSecret: string
+): Promise<AuthData> {
+  const auth = await tryLoadAuth()
+
+  if (!auth) {
+    return authenticateWithOAuth2(clientId, clientSecret)
+  }
+
+  if (isTokenValid(auth)) {
+    return auth
+  }
+
+  try {
+    return await refreshAccessToken(auth.refresh_token, clientId, clientSecret)
+  } catch (error) {
+    console.error('Token refresh failed, starting OAuth flow:', error)
+  }
+
+  return authenticateWithOAuth2(clientId, clientSecret)
+}
+
+export function createAuthMiddleware(
+  clientId: string,
+  clientSecret: string
+): Middleware {
+  return {
+    async onRequest({ request }) {
+      const auth = await authenticate(clientId, clientSecret)
+
+      request.headers.set('Authorization', `Bearer ${auth.access_token}`)
+      return request
+    },
+    async onResponse({ response, request }) {
+      if (response.status === 401) {
+        console.warn(
+          `Received 401 Unauthorized for request to ${request.url}. Access token may be invalid or expired.`
+        )
+
+        let auth = await tryLoadAuth()
+        if (!auth) {
+          throw new Error('No authentication data available to refresh token.')
+        }
+
+        auth = await refreshAccessToken(
+          auth.refresh_token,
+          clientId,
+          clientSecret
+        )
+
+        response = await fetch(new Request(request), {
+          headers: {
+            Authorization: `Bearer ${auth.access_token}`,
+          },
+        })
+
+        return response
+      }
+    },
+  }
+}

package/cli.ts

@@ -0,0 +1,13 @@
+#! /usr/bin/env node
+import { program } from 'commander'
+import { authenticate } from './authMiddleware.ts'
+
+program
+  .requiredOption('--clientId <clientId>')
+  .requiredOption('--clientSecret <clientSecret>')
+
+program.parse()
+
+const { clientId, clientSecret } = program.opts()
+
+console.log(await authenticate(clientId, clientSecret))