vforclaude2 0.3.87

package/src/lib/oauth/services/openai.js

@@ -0,0 +1,123 @@
+import { OAuthService } from "./oauth.js";
+import { OPENAI_CONFIG } from "../constants/oauth.js";
+import { getServerCredentials } from "../config/index.js";
+import { spinner as createSpinner } from "../utils/ui.js";
+
+/**
+ * OpenAI OAuth Service (Native)
+ * Uses Authorization Code Flow with PKCE (similar to Codex)
+ */
+export class OpenAIService extends OAuthService {
+  constructor() {
+    super(OPENAI_CONFIG);
+  }
+
+  /**
+   * Build OpenAI authorization URL
+   */
+  buildOpenAIAuthUrl(redirectUri, state, codeChallenge) {
+    const params = new URLSearchParams({
+      client_id: OPENAI_CONFIG.clientId,
+      response_type: "code",
+      redirect_uri: redirectUri,
+      scope: OPENAI_CONFIG.scope,
+      state: state,
+      code_challenge: codeChallenge,
+      code_challenge_method: OPENAI_CONFIG.codeChallengeMethod,
+      ...OPENAI_CONFIG.extraParams,
+    });
+
+    return `${OPENAI_CONFIG.authorizeUrl}?${params.toString()}`;
+  }
+
+  /**
+   * Exchange OpenAI authorization code for tokens
+   */
+  async exchangeOpenAICode(code, redirectUri, codeVerifier) {
+    const response = await fetch(OPENAI_CONFIG.tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: OPENAI_CONFIG.clientId,
+        code: code,
+        redirect_uri: redirectUri,
+        code_verifier: codeVerifier,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Token exchange failed: ${error}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Save OpenAI tokens to server
+   */
+  async saveTokens(tokens) {
+    const { server, token, userId } = getServerCredentials();
+
+    const response = await fetch(`${server}/api/cli/providers/openai`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`,
+        "X-User-Id": userId,
+      },
+      body: JSON.stringify({
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        expiresIn: tokens.expires_in,
+        idToken: tokens.id_token,
+        scope: tokens.scope,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.json();
+      throw new Error(error.error || "Failed to save tokens");
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Complete OpenAI OAuth flow
+   */
+  async connect() {
+    const spinner = createSpinner("Starting OpenAI OAuth...").start();
+
+    try {
+      spinner.text = "Starting local server...";
+
+      // Authenticate and get authorization code
+      const { code, codeVerifier, redirectUri } = await this.authenticate(
+        "OpenAI",
+        this.buildOpenAIAuthUrl.bind(this)
+      );
+
+      spinner.start("Exchanging code for tokens...");
+
+      // Exchange code for tokens
+      const tokens = await this.exchangeOpenAICode(code, redirectUri, codeVerifier);
+
+      spinner.text = "Saving tokens to server...";
+
+      // Save tokens to server
+      await this.saveTokens(tokens);
+
+      spinner.succeed("OpenAI connected successfully!");
+      return true;
+    } catch (error) {
+      spinner.fail(`Failed: ${error.message}`);
+      throw error;
+    }
+  }
+}
+

package/src/lib/oauth/services/qwen.js

@@ -0,0 +1,170 @@
+import open from "open";
+import { QWEN_CONFIG } from "../constants/oauth.js";
+import { getServerCredentials } from "../config/index.js";
+import { generatePKCE } from "../utils/pkce.js";
+import { spinner as createSpinner } from "../utils/ui.js";
+
+/**
+ * Qwen OAuth Service
+ * Uses Device Code Flow with PKCE
+ */
+export class QwenService {
+  constructor() {
+    this.config = QWEN_CONFIG;
+  }
+
+  /**
+   * Request device code
+   */
+  async requestDeviceCode(codeChallenge) {
+    const response = await fetch(this.config.deviceCodeUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        client_id: this.config.clientId,
+        scope: this.config.scope,
+        code_challenge: codeChallenge,
+        code_challenge_method: this.config.codeChallengeMethod,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Device code request failed: ${error}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Poll for token
+   */
+  async pollForToken(deviceCode, codeVerifier, interval = 5) {
+    const maxAttempts = 60; // 5 minutes
+    const pollInterval = interval * 1000;
+
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+      await new Promise((r) => setTimeout(r, pollInterval));
+
+      const response = await fetch(this.config.tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json",
+        },
+        body: new URLSearchParams({
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+          client_id: this.config.clientId,
+          device_code: deviceCode,
+          code_verifier: codeVerifier,
+        }),
+      });
+
+      if (response.ok) {
+        return await response.json();
+      }
+
+      const error = await response.json();
+
+      if (error.error === "authorization_pending") {
+        continue;
+      } else if (error.error === "slow_down") {
+        await new Promise((r) => setTimeout(r, 5000));
+        continue;
+      } else if (error.error === "expired_token") {
+        throw new Error("Device code expired");
+      } else if (error.error === "access_denied") {
+        throw new Error("Access denied");
+      } else {
+        throw new Error(error.error_description || error.error);
+      }
+    }
+
+    throw new Error("Authorization timeout");
+  }
+
+  /**
+   * Save Qwen tokens to server
+   */
+  async saveTokens(tokens) {
+    const { server, token, userId } = getServerCredentials();
+
+    const response = await fetch(`${server}/api/cli/providers/qwen`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`,
+        "X-User-Id": userId,
+      },
+      body: JSON.stringify({
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        expiresIn: tokens.expires_in,
+        resourceUrl: tokens.resource_url,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.json();
+      throw new Error(error.error || "Failed to save tokens");
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Complete Qwen OAuth flow
+   */
+  async connect() {
+    const spinner = createSpinner("Starting Qwen OAuth...").start();
+
+    try {
+      spinner.text = "Generating PKCE...";
+
+      // Generate PKCE
+      const { codeVerifier, codeChallenge } = generatePKCE();
+
+      spinner.text = "Requesting device code...";
+
+      // Request device code
+      const deviceData = await this.requestDeviceCode(codeChallenge);
+
+      spinner.stop();
+
+      console.log("\n📋 Please visit the following URL and enter the code:\n");
+      console.log(`   ${deviceData.verification_uri}\n`);
+      console.log(`   Code: ${deviceData.user_code}\n`);
+
+      // Open browser
+      if (deviceData.verification_uri_complete) {
+        await open(deviceData.verification_uri_complete);
+      } else {
+        await open(deviceData.verification_uri);
+      }
+
+      spinner.start("Waiting for authorization...");
+
+      // Poll for token
+      const tokens = await this.pollForToken(
+        deviceData.device_code,
+        codeVerifier,
+        deviceData.interval || 5
+      );
+
+      spinner.text = "Saving tokens to server...";
+
+      // Save tokens to server
+      await this.saveTokens(tokens);
+
+      spinner.succeed("Qwen connected successfully!");
+      return true;
+    } catch (error) {
+      spinner.fail(`Failed: ${error.message}`);
+      throw error;
+    }
+  }
+}
+

package/src/lib/oauth/utils/banner.js

@@ -0,0 +1,63 @@
+import figlet from "figlet";
+import gradient from "gradient-string";
+import chalkAnimation from "chalk-animation";
+
+/**
+ * Display banner
+ */
+export function showBanner() {
+  const banner = figlet.textSync("LLM Proxy", {
+    font: "ANSI Shadow",
+    horizontalLayout: "default",
+    verticalLayout: "default",
+  });
+
+  console.log("\n" + gradient.pastel.multiline(banner));
+  console.log(gradient.cristal("  🚀 OAuth CLI for AI Providers\n"));
+}
+
+/**
+ * Display simple banner (no animation)
+ */
+export function showSimpleBanner() {
+  const banner = figlet.textSync("EP CLI", {
+    font: "Standard",
+    horizontalLayout: "default",
+  });
+  console.log(gradient.pastel.multiline(banner));
+  console.log(gradient.cristal("  OAuth CLI for AI Providers\n"));
+}
+
+/**
+ * Display success animation
+ */
+export async function showSuccess(message) {
+  return new Promise((resolve) => {
+    const animation = chalkAnimation.rainbow(`\n✨ ${message}\n`);
+    setTimeout(() => {
+      animation.stop();
+      resolve();
+    }, 1000);
+  });
+}
+
+/**
+ * Display loading animation
+ */
+export function showLoading(text) {
+  const frames = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+  let i = 0;
+  
+  const interval = setInterval(() => {
+    process.stdout.write(`\r${frames[i]} ${text}`);
+    i = (i + 1) % frames.length;
+  }, 80);
+
+  return {
+    stop: () => {
+      clearInterval(interval);
+      process.stdout.write("\r");
+    },
+  };
+}
+

package/src/lib/oauth/utils/pkce.js

@@ -0,0 +1,38 @@
+import crypto from "crypto";
+
+/**
+ * Generate PKCE code verifier (43-128 characters)
+ */
+export function generateCodeVerifier() {
+  return crypto.randomBytes(32).toString("base64url");
+}
+
+/**
+ * Generate PKCE code challenge from verifier (S256 method)
+ */
+export function generateCodeChallenge(verifier) {
+  return crypto.createHash("sha256").update(verifier).digest("base64url");
+}
+
+/**
+ * Generate random state for CSRF protection
+ */
+export function generateState() {
+  return crypto.randomBytes(32).toString("base64url");
+}
+
+/**
+ * Generate complete PKCE pair
+ */
+export function generatePKCE() {
+  const codeVerifier = generateCodeVerifier();
+  const codeChallenge = generateCodeChallenge(codeVerifier);
+  const state = generateState();
+
+  return {
+    codeVerifier,
+    codeChallenge,
+    state,
+  };
+}
+

package/src/lib/oauth/utils/server.js

@@ -0,0 +1,116 @@
+import http from "http";
+import { URL } from "url";
+
+/**
+ * Start a local HTTP server to receive OAuth callback
+ * @param {Function} onCallback - Called with query params when callback received
+ * @param {number} fixedPort - Optional fixed port number (default: random)
+ * @returns {Promise<{server: http.Server, port: number, close: Function}>}
+ */
+export function startLocalServer(onCallback, fixedPort = null) {
+  return new Promise((resolve, reject) => {
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url, `http://localhost`);
+
+      if (url.pathname === "/callback" || url.pathname === "/auth/callback") {
+        const params = Object.fromEntries(url.searchParams);
+
+        // Send success response to browser with auto-close attempt
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(`<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Authentication Successful</title>
+  <style>
+    body { font-family: system-ui; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #f5f5f5; }
+    .container { text-align: center; padding: 2rem; background: white; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); }
+    .success { color: #22c55e; font-size: 3rem; }
+    h1 { margin: 1rem 0; }
+    p { color: #666; }
+    #countdown { font-weight: bold; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <div class="success">&#10003;</div>
+    <h1>Authentication Successful</h1>
+    <p id="message">Closing in <span id="countdown">3</span> seconds...</p>
+  </div>
+  <script>
+    let count = 3;
+    const countdown = document.getElementById("countdown");
+    const message = document.getElementById("message");
+    const timer = setInterval(() => {
+      count--;
+      countdown.textContent = count;
+      if (count <= 0) {
+        clearInterval(timer);
+        window.close();
+        setTimeout(() => {
+          message.textContent = "Please close this tab manually.";
+        }, 500);
+      }
+    }, 1000);
+  </script>
+</body>
+</html>`);
+
+        // Call callback with params
+        onCallback(params);
+      } else {
+        res.writeHead(404);
+        res.end("Not found");
+      }
+    });
+
+    // Listen on fixed port or find available port
+    const portToUse = fixedPort || 0;
+    server.listen(portToUse, "127.0.0.1", () => {
+      const { port } = server.address();
+      resolve({
+        server,
+        port,
+        close: () => server.close(),
+      });
+    });
+
+    server.on("error", (err) => {
+      if (err.code === "EADDRINUSE" && fixedPort) {
+        reject(new Error(`Port ${fixedPort} is already in use. Please close other applications using this port.`));
+      } else {
+        reject(err);
+      }
+    });
+  });
+}
+
+/**
+ * Wait for callback with timeout
+ * @param {number} timeoutMs - Timeout in milliseconds
+ * @returns {Promise<Object>} - Callback params
+ */
+export function waitForCallback(timeoutMs = 300000) {
+  return new Promise((resolve, reject) => {
+    let resolved = false;
+
+    const timeout = setTimeout(() => {
+      if (!resolved) {
+        resolved = true;
+        reject(new Error("Authentication timeout"));
+      }
+    }, timeoutMs);
+
+    const onCallback = (params) => {
+      if (!resolved) {
+        resolved = true;
+        clearTimeout(timeout);
+        resolve(params);
+      }
+    };
+
+    // Return the callback function
+    resolve.__onCallback = onCallback;
+  });
+}
+

package/src/lib/oauth/utils/ui.js

@@ -0,0 +1,48 @@
+import chalk from "chalk";
+import ora from "ora";
+
+/**
+ * UI Helper Functions
+ */
+
+export function success(message) {
+  console.log(chalk.green(`\n✓ ${message}\n`));
+}
+
+export function error(message) {
+  console.log(chalk.red(`\n✗ ${message}\n`));
+}
+
+export function info(message) {
+  console.log(chalk.blue(`\n${message}\n`));
+}
+
+export function warn(message) {
+  console.log(chalk.yellow(`\n⚠ ${message}\n`));
+}
+
+export function gray(message) {
+  console.log(chalk.gray(message));
+}
+
+export function spinner(text) {
+  return ora(text);
+}
+
+export function printSection(title) {
+  console.log(chalk.blue(`\n${title}\n`));
+}
+
+export function printKeyValue(key, value, isSuccess = false) {
+  const color = isSuccess ? chalk.green : chalk.gray;
+  console.log(color(`  ${key}: ${value}`));
+}
+
+export function printList(items, isSuccess = false) {
+  const symbol = isSuccess ? "✓" : "✗";
+  const color = isSuccess ? chalk.green : chalk.gray;
+  items.forEach((item) => {
+    console.log(color(`  ${symbol} ${item}`));
+  });
+}
+