wyxrouter 0.4.71

package/src/lib/oauth/services/oauth.js

@@ -0,0 +1,157 @@
+import open from "open";
+import { startLocalServer } from "../utils/server.js";
+import { generatePKCE } from "../utils/pkce.js";
+import { spinner as createSpinner } from "../utils/ui.js";
+import { OAUTH_TIMEOUT } from "../constants/oauth.js";
+
+/**
+ * Generic OAuth Authorization Code Flow with PKCE
+ */
+export class OAuthService {
+  constructor(config) {
+    this.config = config;
+  }
+
+  /**
+   * Build authorization URL
+   */
+  buildAuthUrl(redirectUri, state, codeChallenge, extraParams = {}) {
+    const params = new URLSearchParams({
+      client_id: this.config.clientId,
+      response_type: "code",
+      redirect_uri: redirectUri,
+      state: state,
+      code_challenge: codeChallenge,
+      code_challenge_method: this.config.codeChallengeMethod,
+      ...extraParams,
+    });
+
+    return `${this.config.authorizeUrl}?${params.toString()}`;
+  }
+
+  /**
+   * Start local server and wait for callback
+   */
+  async startAuthFlow(authUrl, providerName) {
+    const spinner = createSpinner("Starting local server...").start();
+
+    // Start local server for callback
+    let callbackParams = null;
+    const { port, close } = await startLocalServer((params) => {
+      callbackParams = params;
+    });
+
+    const redirectUri = `http://localhost:${port}/callback`;
+    spinner.succeed(`Local server started on port ${port}`);
+
+    return {
+      redirectUri,
+      port,
+      close,
+      waitForCallback: async () => {
+        spinner.start(`Waiting for ${providerName} authorization...`);
+
+        await new Promise((resolve, reject) => {
+          const timeout = setTimeout(() => {
+            reject(new Error("Authentication timeout (5 minutes)"));
+          }, OAUTH_TIMEOUT);
+
+          const checkInterval = setInterval(() => {
+            if (callbackParams) {
+              clearInterval(checkInterval);
+              clearTimeout(timeout);
+              resolve();
+            }
+          }, 100);
+        });
+
+        spinner.stop();
+        close();
+
+        if (callbackParams.error) {
+          throw new Error(callbackParams.error_description || callbackParams.error);
+        }
+
+        if (!callbackParams.code) {
+          throw new Error("No authorization code received");
+        }
+
+        return callbackParams;
+      },
+    };
+  }
+
+  /**
+   * Exchange authorization code for tokens
+   */
+  async exchangeCode(code, redirectUri, codeVerifier, contentType = "application/x-www-form-urlencoded") {
+    const body =
+      contentType === "application/json"
+        ? JSON.stringify({
+            grant_type: "authorization_code",
+            client_id: this.config.clientId,
+            code: code,
+            redirect_uri: redirectUri,
+            code_verifier: codeVerifier,
+          })
+        : new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: this.config.clientId,
+            code: code,
+            redirect_uri: redirectUri,
+            code_verifier: codeVerifier,
+          });
+
+    const response = await fetch(this.config.tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": contentType,
+        Accept: "application/json",
+      },
+      body: body,
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Token exchange failed: ${error}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Complete OAuth flow
+   */
+  async authenticate(providerName, buildAuthUrlFn) {
+    // Generate PKCE
+    const { codeVerifier, codeChallenge, state } = generatePKCE();
+
+    // Start local server and get redirect URI
+    const { redirectUri, waitForCallback } = await this.startAuthFlow(null, providerName);
+
+    // Build authorization URL
+    const authUrl = buildAuthUrlFn(redirectUri, state, codeChallenge);
+
+    console.log(`\nOpening browser for ${providerName} authentication...`);
+    console.log(`If browser doesn't open, visit:\n${authUrl}\n`);
+
+    // Open browser
+    await open(authUrl);
+
+    // Wait for callback
+    const callbackParams = await waitForCallback();
+
+    // Validate state
+    if (callbackParams.state !== state) {
+      throw new Error("Invalid state parameter");
+    }
+
+    return {
+      code: callbackParams.code,
+      state: callbackParams.state,
+      codeVerifier,
+      redirectUri,
+    };
+  }
+}
+

package/src/lib/oauth/services/openai.js

@@ -0,0 +1,123 @@
+import { OAuthService } from "./oauth.js";
+import { OPENAI_CONFIG } from "../constants/oauth.js";
+import { getServerCredentials } from "../config/index.js";
+import { spinner as createSpinner } from "../utils/ui.js";
+
+/**
+ * OpenAI OAuth Service (Native)
+ * Uses Authorization Code Flow with PKCE (similar to Codex)
+ */
+export class OpenAIService extends OAuthService {
+  constructor() {
+    super(OPENAI_CONFIG);
+  }
+
+  /**
+   * Build OpenAI authorization URL
+   */
+  buildOpenAIAuthUrl(redirectUri, state, codeChallenge) {
+    const params = new URLSearchParams({
+      client_id: OPENAI_CONFIG.clientId,
+      response_type: "code",
+      redirect_uri: redirectUri,
+      scope: OPENAI_CONFIG.scope,
+      state: state,
+      code_challenge: codeChallenge,
+      code_challenge_method: OPENAI_CONFIG.codeChallengeMethod,
+      ...OPENAI_CONFIG.extraParams,
+    });
+
+    return `${OPENAI_CONFIG.authorizeUrl}?${params.toString()}`;
+  }
+
+  /**
+   * Exchange OpenAI authorization code for tokens
+   */
+  async exchangeOpenAICode(code, redirectUri, codeVerifier) {
+    const response = await fetch(OPENAI_CONFIG.tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: OPENAI_CONFIG.clientId,
+        code: code,
+        redirect_uri: redirectUri,
+        code_verifier: codeVerifier,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Token exchange failed: ${error}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Save OpenAI tokens to server
+   */
+  async saveTokens(tokens) {
+    const { server, token, userId } = getServerCredentials();
+
+    const response = await fetch(`${server}/api/cli/providers/openai`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`,
+        "X-User-Id": userId,
+      },
+      body: JSON.stringify({
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        expiresIn: tokens.expires_in,
+        idToken: tokens.id_token,
+        scope: tokens.scope,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.json();
+      throw new Error(error.error || "Failed to save tokens");
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Complete OpenAI OAuth flow
+   */
+  async connect() {
+    const spinner = createSpinner("Starting OpenAI OAuth...").start();
+
+    try {
+      spinner.text = "Starting local server...";
+
+      // Authenticate and get authorization code
+      const { code, codeVerifier, redirectUri } = await this.authenticate(
+        "OpenAI",
+        this.buildOpenAIAuthUrl.bind(this)
+      );
+
+      spinner.start("Exchanging code for tokens...");
+
+      // Exchange code for tokens
+      const tokens = await this.exchangeOpenAICode(code, redirectUri, codeVerifier);
+
+      spinner.text = "Saving tokens to server...";
+
+      // Save tokens to server
+      await this.saveTokens(tokens);
+
+      spinner.succeed("OpenAI connected successfully!");
+      return true;
+    } catch (error) {
+      spinner.fail(`Failed: ${error.message}`);
+      throw error;
+    }
+  }
+}
+

package/src/lib/oauth/services/qoder.js

@@ -0,0 +1,216 @@
+import {
+  QODER_DEVICE_TOKEN_URL,
+  QODER_LOGIN_URL,
+  QODER_USERINFO_URL,
+} from "../../qoder/constants.js";
+import crypto from "crypto";
+import { v4 as uuidv4 } from "uuid";
+
+/**
+ * Qoder OAuth Service
+ * Implements the device-token flow:
+ *   1. Generate PKCE pair + nonce + machine_id locally.
+ *   2. Open https://qoder.com/device/selectAccounts?challenge=...&nonce=...
+ *      in the user's browser.
+ *   3. Poll openapi.qoder.sh/api/v1/deviceToken/poll until the user authorizes
+ *      and the upstream returns a `dt-...` access token.
+ *
+ * Tokens live ~30 days; refresh is a no-op (the upstream refresh endpoint
+ * returns 403 for our flow). Users re-run login when expired.
+ *
+ * Mirrors the structure of KiroService — the COSY signing / WAF-bypass body
+ * encoding / chat protocol live separately in src/lib/qoder/ because they're
+ * used by every signed request, not just OAuth.
+ */
+
+// Timeout for OAuth helper calls. The OAuth modal polls every 2s for up to
+// 5 minutes; an individual request that stalls beyond this is treated as a
+// failed poll attempt and the next poll iteration retries.
+const FETCH_TIMEOUT_MS = 15_000;
+
+function base64Url(buf) {
+  return buf
+    .toString("base64")
+    .replace(/=/g, "")
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_");
+}
+
+/**
+ * Wrap fetch with an AbortController-based timeout. Without this, a stalled
+ * upstream socket hangs on Node's default keepalive timeout (minutes) and
+ * abandoned polls accumulate hung sockets.
+ */
+async function fetchWithTimeout(url, init = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort("timeout"), FETCH_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export class QoderService {
+  /**
+   * Generate a PKCE verifier + S256 challenge pair.
+   * Uses 32 random bytes (matches qodercli/Veria).
+   */
+  generatePkcePair() {
+    const verifier = base64Url(crypto.randomBytes(32));
+    const challenge = base64Url(crypto.createHash("sha256").update(verifier).digest());
+    return { verifier, challenge };
+  }
+
+  /**
+   * Initiate the device flow. Returns the URL to open in a browser plus the
+   * verifier/nonce/machineId we'll need to poll and to sign future requests.
+   */
+  initiateDeviceFlow() {
+    const { verifier, challenge } = this.generatePkcePair();
+    const nonce = uuidv4();
+    const machineId = uuidv4();
+
+    const params = new URLSearchParams({
+      challenge,
+      challenge_method: "S256",
+      machine_id: machineId,
+      nonce,
+    });
+
+    return {
+      verificationUriComplete: `${QODER_LOGIN_URL}?${params.toString()}`,
+      codeVerifier: verifier,
+      nonce,
+      machineId,
+    };
+  }
+
+  /**
+   * Single poll attempt. Returns one of:
+   *   { status: "pending" }       — keep polling
+   *   { status: "ok", token, ... } — user authorized, tokens captured
+   *   throws Error                 — terminal failure
+   *
+   * Upstream returns 202/404 while waiting; 200 with a JSON body when done.
+   */
+  async pollDeviceToken({ nonce, codeVerifier }) {
+    if (!nonce || !codeVerifier) {
+      throw new Error("pollDeviceToken: missing nonce or code verifier");
+    }
+    const url = `${QODER_DEVICE_TOKEN_URL}?nonce=${encodeURIComponent(nonce)}&verifier=${encodeURIComponent(codeVerifier)}&challenge_method=S256`;
+
+    const response = await fetchWithTimeout(url, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        "User-Agent": "Go-http-client/2.0",
+      },
+    });
+
+    // Pending — server has registered the device code but the user hasn't
+    // finished the browser flow yet. Both 202 and 404 mean "keep polling".
+    if (response.status === 202 || response.status === 404) {
+      return { status: "pending" };
+    }
+
+    const text = await response.text();
+
+    if (!response.ok) {
+      let message = `Qoder device token poll failed: HTTP ${response.status}`;
+      try {
+        const body = JSON.parse(text);
+        if (body.message) message = `Qoder device token poll failed: ${body.message}`;
+      } catch {}
+      throw new Error(message);
+    }
+
+    let body;
+    try {
+      body = JSON.parse(text);
+    } catch (err) {
+      throw new Error(`Qoder device token poll: invalid JSON response (${err.message})`);
+    }
+
+    // Defensive: 200 + empty token means the upstream changed shape.
+    if (!body.token) {
+      throw new Error("Qoder device token poll returned 200 but no token");
+    }
+
+    const expireMs = QoderService.parseExpiry(body.expires_at, body.expires_in);
+
+    return {
+      status: "ok",
+      accessToken: body.token,
+      refreshToken: body.refresh_token || "",
+      userId: body.user_id || "",
+      expireTime: expireMs,
+      rawResponse: body,
+    };
+  }
+
+  /**
+   * Fetch profile info for the freshly-issued token. Best-effort — failures
+   * shouldn't block login; returning empty strings is fine.
+   */
+  async fetchUserInfo(accessToken) {
+    try {
+      const response = await fetchWithTimeout(QODER_USERINFO_URL, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          Accept: "application/json",
+          "User-Agent": "Go-http-client/2.0",
+        },
+      });
+      if (!response.ok) return { name: "", email: "" };
+      const body = await response.json();
+      return {
+        name: (body.name || body.username || "").trim(),
+        email: (body.email || "").trim(),
+        organizationId: (body.organization_id || "").trim(),
+      };
+    } catch {
+      return { name: "", email: "" };
+    }
+  }
+
+  /**
+   * Convert the upstream's expiry hint into a Unix-millisecond timestamp.
+   * Accepts:
+   *   - numeric (ms-epoch): returned as-is
+   *   - numeric string of ms-epoch: e.g. "1781594470000"
+   *   - RFC3339 string: e.g. "2026-06-16T07:15:04Z"
+   *   - seconds-from-now via expiresInSeconds (>= 0)
+   * Falls back to "now + 30 days" when both are missing.
+   *
+   * Order matters: try numeric (string or number) before Date.parse, since
+   * Date.parse accepts short numeric strings like "2026" as years and would
+   * otherwise return a misleading year-2026 timestamp instead of falling
+   * through to the integer branch.
+   *
+   * Static so callers (and tests) can use it without instantiating.
+   */
+  static parseExpiry(expiresAt, expiresInSeconds) {
+    if (typeof expiresAt === "number" && Number.isFinite(expiresAt) && expiresAt > 0) {
+      return expiresAt;
+    }
+    const trimmed = typeof expiresAt === "string" ? expiresAt.trim() : "";
+    if (trimmed) {
+      // Pure numeric string → ms-epoch (don't let Date.parse swallow short
+      // numerics as years).
+      if (/^\d+$/.test(trimmed)) {
+        const ms = Number.parseInt(trimmed, 10);
+        if (Number.isFinite(ms) && ms > 0) return ms;
+      }
+      const parsed = Date.parse(trimmed);
+      if (!Number.isNaN(parsed)) return parsed;
+    }
+    // expiresInSeconds === 0 means "already expired"; honor that by returning
+    // the current time rather than fabricating a 30-day default.
+    if (typeof expiresInSeconds === "number" && Number.isFinite(expiresInSeconds) && expiresInSeconds >= 0) {
+      return Date.now() + expiresInSeconds * 1000;
+    }
+    return Date.now() + 30 * 24 * 60 * 60 * 1000;
+  }
+}

package/src/lib/oauth/services/qwen.js

@@ -0,0 +1,170 @@
+import open from "open";
+import { QWEN_CONFIG } from "../constants/oauth.js";
+import { getServerCredentials } from "../config/index.js";
+import { generatePKCE } from "../utils/pkce.js";
+import { spinner as createSpinner } from "../utils/ui.js";
+
+/**
+ * Qwen OAuth Service
+ * Uses Device Code Flow with PKCE
+ */
+export class QwenService {
+  constructor() {
+    this.config = QWEN_CONFIG;
+  }
+
+  /**
+   * Request device code
+   */
+  async requestDeviceCode(codeChallenge) {
+    const response = await fetch(this.config.deviceCodeUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body: new URLSearchParams({
+        client_id: this.config.clientId,
+        scope: this.config.scope,
+        code_challenge: codeChallenge,
+        code_challenge_method: this.config.codeChallengeMethod,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Device code request failed: ${error}`);
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Poll for token
+   */
+  async pollForToken(deviceCode, codeVerifier, interval = 5) {
+    const maxAttempts = 60; // 5 minutes
+    const pollInterval = interval * 1000;
+
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+      await new Promise((r) => setTimeout(r, pollInterval));
+
+      const response = await fetch(this.config.tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json",
+        },
+        body: new URLSearchParams({
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+          client_id: this.config.clientId,
+          device_code: deviceCode,
+          code_verifier: codeVerifier,
+        }),
+      });
+
+      if (response.ok) {
+        return await response.json();
+      }
+
+      const error = await response.json();
+
+      if (error.error === "authorization_pending") {
+        continue;
+      } else if (error.error === "slow_down") {
+        await new Promise((r) => setTimeout(r, 5000));
+        continue;
+      } else if (error.error === "expired_token") {
+        throw new Error("Device code expired");
+      } else if (error.error === "access_denied") {
+        throw new Error("Access denied");
+      } else {
+        throw new Error(error.error_description || error.error);
+      }
+    }
+
+    throw new Error("Authorization timeout");
+  }
+
+  /**
+   * Save Qwen tokens to server
+   */
+  async saveTokens(tokens) {
+    const { server, token, userId } = getServerCredentials();
+
+    const response = await fetch(`${server}/api/cli/providers/qwen`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`,
+        "X-User-Id": userId,
+      },
+      body: JSON.stringify({
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        expiresIn: tokens.expires_in,
+        resourceUrl: tokens.resource_url,
+      }),
+    });
+
+    if (!response.ok) {
+      const error = await response.json();
+      throw new Error(error.error || "Failed to save tokens");
+    }
+
+    return await response.json();
+  }
+
+  /**
+   * Complete Qwen OAuth flow
+   */
+  async connect() {
+    const spinner = createSpinner("Starting Qwen OAuth...").start();
+
+    try {
+      spinner.text = "Generating PKCE...";
+
+      // Generate PKCE
+      const { codeVerifier, codeChallenge } = generatePKCE();
+
+      spinner.text = "Requesting device code...";
+
+      // Request device code
+      const deviceData = await this.requestDeviceCode(codeChallenge);
+
+      spinner.stop();
+
+      console.log("\n📋 Please visit the following URL and enter the code:\n");
+      console.log(`   ${deviceData.verification_uri}\n`);
+      console.log(`   Code: ${deviceData.user_code}\n`);
+
+      // Open browser
+      if (deviceData.verification_uri_complete) {
+        await open(deviceData.verification_uri_complete);
+      } else {
+        await open(deviceData.verification_uri);
+      }
+
+      spinner.start("Waiting for authorization...");
+
+      // Poll for token
+      const tokens = await this.pollForToken(
+        deviceData.device_code,
+        codeVerifier,
+        deviceData.interval || 5
+      );
+
+      spinner.text = "Saving tokens to server...";
+
+      // Save tokens to server
+      await this.saveTokens(tokens);
+
+      spinner.succeed("Qwen connected successfully!");
+      return true;
+    } catch (error) {
+      spinner.fail(`Failed: ${error.message}`);
+      throw error;
+    }
+  }
+}
+