zevairouter 1.0.154 → 1.0.155

package/src/lib/oauth/services/tempmailClient.js

@@ -1,288 +0,0 @@
-/**
- * Client for self-hosted tempmail (tempmail.zevai.web.id).
- * Inbox-only: create address, poll OTP. No passwords stored server-side.
- *
- * Always hits tempmail **direct** (never HTTP(S)_PROXY). Browser automation may
- * Browser automation may set proxy env, but OTP must be read from our mail API
- * on the host — residential proxies often slow/block the inbox endpoint and
- * leave the job stuck on "polling_otp".
- */
-
-const DEFAULT_BASE_URL = process.env.TEMPMAIL_BASE_URL || "https://tempmail.zevai.web.id";
-const DEFAULT_DOMAIN = process.env.TEMPMAIL_EMAIL_DOMAIN || "zevai.web.id";
-const DEFAULT_UA =
-  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36";
-
-function wait(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-export function getTempmailConfig(overrides = {}) {
-  return {
-    baseUrl: String(overrides.baseUrl || DEFAULT_BASE_URL).replace(/\/+$/, ""),
-    domain: String(overrides.domain || DEFAULT_DOMAIN).replace(/^@/, ""),
-    userAgent: overrides.userAgent || DEFAULT_UA,
-  };
-}
-
-/**
- * Node undici/fetch may honor process.env HTTP(S)_PROXY. Tempmail must not.
- */
-async function directFetch(url, init = {}) {
-  // Prefer undici Agent without proxy env (Node 18+).
-  try {
-    const undici = await import("undici");
-    const dispatcher = new undici.Agent({ connect: { timeout: 20_000 } });
-    return undici.fetch(url, { ...init, dispatcher });
-  } catch {
-    // fall through to global fetch with proxy env stripped
-  }
-  const saved = {
-    HTTP_PROXY: process.env.HTTP_PROXY,
-    HTTPS_PROXY: process.env.HTTPS_PROXY,
-    http_proxy: process.env.http_proxy,
-    https_proxy: process.env.https_proxy,
-    ALL_PROXY: process.env.ALL_PROXY,
-    all_proxy: process.env.all_proxy,
-  };
-  try {
-    delete process.env.HTTP_PROXY;
-    delete process.env.HTTPS_PROXY;
-    delete process.env.http_proxy;
-    delete process.env.https_proxy;
-    delete process.env.ALL_PROXY;
-    delete process.env.all_proxy;
-    return await fetch(url, init);
-  } finally {
-    for (const [k, v] of Object.entries(saved)) {
-      if (v === undefined) delete process.env[k];
-      else process.env[k] = v;
-    }
-  }
-}
-
-async function tempmailFetch(config, path, { method = "GET", body } = {}) {
-  const url = `${config.baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
-  const res = await directFetch(url, {
-    method,
-    headers: {
-      Accept: "application/json",
-      "User-Agent": config.userAgent,
-      ...(body ? { "Content-Type": "application/json" } : {}),
-    },
-    body: body ? JSON.stringify(body) : undefined,
-  });
-  const text = await res.text();
-  let data = null;
-  try {
-    data = text ? JSON.parse(text) : null;
-  } catch {
-    data = { raw: text };
-  }
-  if (!res.ok) {
-    const err = new Error(data?.error || `Tempmail HTTP ${res.status}`);
-    err.status = res.status;
-    err.payload = data;
-    throw err;
-  }
-  return data;
-}
-
-export function generateTempmailLocalPart(prefix = "zevai") {
-  const rand = Math.random().toString(36).slice(2, 8);
-  const ts = Date.now().toString(36).slice(-4);
-  return `${prefix}-${ts}${rand}`.toLowerCase().replace(/[^a-z0-9._+-]/g, "");
-}
-
-export function generateTempmailPassword() {
-  const core = Math.random().toString(36).slice(2, 10);
-  return `Zv!${core}Aa1`;
-}
-
-const FIRST_NAMES = [
-  "James", "John", "Robert", "Michael", "William", "David", "Richard", "Joseph",
-  "Thomas", "Charles", "Christopher", "Daniel", "Matthew", "Anthony", "Mark",
-  "Steven", "Paul", "Andrew", "Joshua", "Kenneth", "Kevin", "Brian", "George",
-  "Timothy", "Ronald", "Edward", "Jason", "Jeffrey", "Ryan", "Jacob",
-  "Mary", "Patricia", "Jennifer", "Linda", "Barbara", "Elizabeth", "Susan",
-  "Jessica", "Sarah", "Karen", "Lisa", "Nancy", "Betty", "Margaret", "Sandra",
-  "Ashley", "Dorothy", "Kimberly", "Emily", "Donna", "Michelle", "Carol",
-  "Amanda", "Melissa", "Deborah", "Stephanie", "Rebecca", "Sharon", "Laura",
-  "Emma", "Olivia", "Ava", "Sophia", "Isabella", "Mia", "Charlotte", "Amelia",
-  "Noah", "Liam", "Oliver", "Elijah", "Lucas", "Mason", "Logan", "Ethan",
-];
-
-const LAST_NAMES = [
-  "Smith", "Johnson", "Williams", "Brown", "Jones", "Garcia", "Miller", "Davis",
-  "Rodriguez", "Martinez", "Hernandez", "Lopez", "Gonzalez", "Wilson", "Anderson",
-  "Thomas", "Taylor", "Moore", "Jackson", "Martin", "Lee", "Perez", "Thompson",
-  "White", "Harris", "Sanchez", "Clark", "Ramirez", "Lewis", "Robinson",
-  "Walker", "Young", "Allen", "King", "Wright", "Scott", "Torres", "Nguyen",
-  "Hill", "Flores", "Green", "Adams", "Nelson", "Baker", "Hall", "Rivera",
-  "Campbell", "Mitchell", "Carter", "Roberts", "Turner", "Phillips", "Parker",
-  "Evans", "Edwards", "Collins", "Stewart", "Morris", "Murphy", "Cook",
-];
-
-function pick(list) {
-  return list[Math.floor(Math.random() * list.length)];
-}
-
-/** Random human-looking first/last name for xAI signup profile. */
-export function generateRandomPersonName() {
-  return {
-    firstName: pick(FIRST_NAMES),
-    lastName: pick(LAST_NAMES),
-  };
-}
-
-export async function registerTempmailAddress(address, { label = null, ...cfg } = {}) {
-  const config = getTempmailConfig(cfg);
-  return tempmailFetch(config, "/api/addresses", {
-    method: "POST",
-    body: { address, label: label || "grok-cli-bulk" },
-  });
-}
-
-export async function createTempmailMailbox({ prefix = "zevai-cb", label = "grok-cli-bulk", ...cfg } = {}) {
-  const config = getTempmailConfig(cfg);
-  const local = generateTempmailLocalPart(prefix);
-  const address = `${local}@${config.domain}`;
-  await registerTempmailAddress(address, { label, ...config });
-  return { address, domain: config.domain };
-}
-
-export async function listTempmailInbox(address, cfg = {}) {
-  const config = getTempmailConfig(cfg);
-  const enc = encodeURIComponent(address);
-  const data = await tempmailFetch(config, `/api/inbox/${enc}`);
-  return Array.isArray(data) ? data : [];
-}
-
-/**
- * Extract xAI-style OTP from subject/body. Formats vary:
- *   "ABC-123 xAI confirmation code"
- *   "Your xAI confirmation code is ABC-123"
- *   "xAI verification code: AB12-CD34"
- */
-export function extractXaiOtpFromMail(mail) {
-  if (!mail || typeof mail !== "object") return null;
-  const blobs = [
-    mail.subject,
-    mail.body,
-    mail.text,
-    mail.snippet,
-    mail.preview,
-    mail.html,
-    typeof mail.raw === "string" ? mail.raw : null,
-  ]
-    .filter(Boolean)
-    .map((s) => String(s));
-
-  const text = blobs.join("\n");
-  if (!text.trim()) return null;
-
-  const patterns = [
-    // Live 2026-07-19: "SpaceXAI confirmation code: 2BP-IVP"
-    /SpaceXAI confirmation code[:\s#-]*([A-Z0-9]{2,5}-[A-Z0-9]{2,5})/i,
-    /([A-Z0-9]{2,5}-[A-Z0-9]{2,5})\s+xAI confirmation code/i,
-    /xAI confirmation code[:\s#-]*([A-Z0-9]{2,5}-[A-Z0-9]{2,5})/i,
-    /confirmation code[:\s#-]*([A-Z0-9]{2,5}-[A-Z0-9]{2,5})/i,
-    /verification code[:\s#-]*([A-Z0-9]{2,5}-[A-Z0-9]{2,5})/i,
-    /security code[:\s#-]*([A-Z0-9]{2,5}-[A-Z0-9]{2,5})/i,
-    /one[-\s]?time(?:\s+code)?[:\s#-]*([A-Z0-9]{2,5}-[A-Z0-9]{2,5})/i,
-    // last resort: dashed code near xAI / SpaceXAI branding
-    /(?:xAI|SpaceXAI)[\s\S]{0,80}?([A-Z0-9]{2,5}-[A-Z0-9]{2,5})/i,
-    /([A-Z0-9]{2,5}-[A-Z0-9]{2,5})[\s\S]{0,40}(?:xAI|SpaceXAI)/i,
-  ];
-
-  for (const re of patterns) {
-    const m = text.match(re);
-    if (m?.[1]) {
-      return m[1].toUpperCase();
-    }
-  }
-  return null;
-}
-
-/**
- * Poll inbox for xAI OTP.
- * @param {string} address
- * @param {object} [opts]
- * @param {number} [opts.timeoutMs=180000]
- * @param {number} [opts.intervalMs=3000]
- * @param {Set} [opts.seenIds]
- * @param {(info: object) => void} [opts.onProgress]  inbox status for UI
- */
-export async function pollTempmailXaiOtp(
-  address,
-  {
-    timeoutMs = 180_000,
-    intervalMs = 3_000,
-    seenIds = null,
-    onProgress = null,
-    ...cfg
-  } = {}
-) {
-  const seen = seenIds || new Set();
-  const start = Date.now();
-  let lastError = null;
-  let attempt = 0;
-
-  while (Date.now() - start < timeoutMs) {
-    attempt += 1;
-    const elapsedSec = Math.round((Date.now() - start) / 1000);
-    try {
-      const mails = await listTempmailInbox(address, cfg);
-      const sorted = [...mails].sort((a, b) => (b.received_at || 0) - (a.received_at || 0));
-      const subjects = sorted.slice(0, 3).map((m) => (m.subject || "(no subject)").slice(0, 60));
-
-      onProgress?.({
-        attempt,
-        elapsedSec,
-        inboxCount: sorted.length,
-        subjects,
-        address,
-      });
-
-      for (const mail of sorted) {
-        const id = mail.id || `${mail.subject}-${mail.received_at}`;
-        if (seen.has(id)) continue;
-        const code = extractXaiOtpFromMail(mail);
-        if (code) {
-          seen.add(id);
-          return {
-            code,
-            subject: mail.subject || "",
-            id: mail.id || null,
-            mail,
-          };
-        }
-      }
-      lastError = null;
-    } catch (error) {
-      lastError = error;
-      onProgress?.({
-        attempt,
-        elapsedSec,
-        inboxCount: -1,
-        error: error.message || String(error),
-        address,
-      });
-    }
-    await wait(intervalMs);
-  }
-
-  if (lastError) {
-    const err = new Error(
-      `No xAI OTP on tempmail after ${Math.round(timeoutMs / 1000)}s (last inbox error: ${lastError.message})`
-    );
-    err.cause = lastError;
-    throw err;
-  }
-  return null;
-}
-
-export {
-  DEFAULT_BASE_URL as TEMPMAIL_DEFAULT_BASE_URL,
-  DEFAULT_DOMAIN as TEMPMAIL_DEFAULT_DOMAIN,
-};

package/src/lib/oauth/services/xai.js

@@ -1,238 +0,0 @@
-import open from "open";
-import { OAuthService } from "./oauth.js";
-import crypto from "crypto";
-import { XAI_CONFIG, XAI_PKCE_VERIFIER_BYTES } from "../constants/xai.js";
-import { startLocalServer } from "../utils/server.js";
-import { generateCodeVerifier, generateCodeChallenge, generateState } from "../utils/pkce.js";
-import { spinner as createSpinner } from "../utils/ui.js";
-
-/**
- * xAI (Grok) OAuth Service
- *
- * Source of truth: router-for-me/CLIProxyAPI internal/auth/xai/xai.go
- *
- * Flow:
- *  1. Discover endpoints from `${XAI_ISSUER}/.well-known/openid-configuration`
- *  2. Bind loopback server on 127.0.0.1:56121, path /callback
- *  3. PKCE S256 with 96-byte verifier
- *  4. Exchange code with form-urlencoded body
- *  5. id_token email decode (no signature verify, mirrors Go)
- */
-
-const BASE64_BLOCK_SIZE = 4;
-
-let cachedDiscovery = null;
-
-export function validateOAuthEndpoint(rawUrl, field) {
-  const value = String(rawUrl || "").trim();
-  if (!value) throw new Error(`xai discovery ${field} is empty`);
-
-  let parsed;
-  try {
-    parsed = new URL(value);
-  } catch (err) {
-    throw new Error(`xai discovery ${field} is invalid: ${err.message}`);
-  }
-
-  if (parsed.protocol !== "https:") {
-    throw new Error(`xai discovery ${field} must use https: ${value}`);
-  }
-
-  const host = parsed.hostname.toLowerCase().trim();
-  if (host !== "x.ai" && !host.endsWith(".x.ai")) {
-    throw new Error(`xai discovery ${field} host ${host} is not on x.ai`);
-  }
-
-  return value;
-}
-
-/**
- * Discover authorization + token endpoints. Cached process-wide.
- */
-export async function discoverEndpoints() {
-  if (cachedDiscovery) return cachedDiscovery;
-
-  try {
-    const res = await fetch(XAI_CONFIG.discoveryUrl, {
-      headers: { Accept: "application/json" },
-    });
-    if (res.ok) {
-      const data = await res.json();
-      cachedDiscovery = {
-        authorizeUrl: validateOAuthEndpoint(data.authorization_endpoint, "authorization_endpoint"),
-        tokenUrl: validateOAuthEndpoint(data.token_endpoint, "token_endpoint"),
-      };
-      return cachedDiscovery;
-    }
-  } catch {
-    // fall through to static fallback
-  }
-
-  cachedDiscovery = {
-    authorizeUrl: XAI_CONFIG.authorizeUrl,
-    tokenUrl: XAI_CONFIG.tokenUrl,
-  };
-  return cachedDiscovery;
-}
-
-/**
- * Decode the `email` claim from an id_token JWT. No signature verification —
- * mirrors CLIProxyAPI Go behavior. Returns undefined if not parseable.
- */
-export function decodeIdTokenEmail(idToken) {
-  if (!idToken || typeof idToken !== "string") return undefined;
-  const parts = idToken.split(".");
-  if (parts.length !== 3) return undefined;
-  try {
-    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-    const padding = (BASE64_BLOCK_SIZE - (base64.length % BASE64_BLOCK_SIZE)) % BASE64_BLOCK_SIZE;
-    const json = Buffer.from(base64 + "=".repeat(padding), "base64").toString("utf8");
-    const payload = JSON.parse(json);
-    return payload.email || payload.preferred_username || payload.sub || undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-export class XaiService extends OAuthService {
-  constructor() {
-    super(XAI_CONFIG);
-  }
-
-  /**
-   * Build xAI authorization URL. Spaces in scope are encoded as %20.
-   */
-  buildXaiAuthUrl(redirectUri, state, codeChallenge, authorizeUrl) {
-    const nonce = crypto.randomBytes(16).toString("hex");
-    const params = {
-      response_type: "code",
-      client_id: XAI_CONFIG.clientId,
-      redirect_uri: redirectUri,
-      scope: XAI_CONFIG.scope,
-      code_challenge: codeChallenge,
-      code_challenge_method: XAI_CONFIG.codeChallengeMethod,
-      state,
-      nonce,
-      plan: "generic",
-      referrer: "cli-proxy-api",
-    };
-    const qs = Object.entries(params)
-      .map(([k, v]) => `${k}=${encodeURIComponent(v)}`)
-      .join("&");
-    return `${authorizeUrl}?${qs}`;
-  }
-
-  /**
-   * Exchange authorization code for tokens.
-   * xAI is a public PKCE client — no client_secret.
-   */
-  async exchangeXaiCode({ tokenUrl, code, redirectUri, codeVerifier }) {
-    const res = await fetch(tokenUrl, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        Accept: "application/json",
-      },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        client_id: XAI_CONFIG.clientId,
-        code,
-        redirect_uri: redirectUri,
-        code_verifier: codeVerifier,
-      }),
-    });
-
-    if (!res.ok) {
-      const err = await res.text();
-      throw new Error(`xAI token exchange failed: ${err}`);
-    }
-    return await res.json();
-  }
-
-  /**
-   * Refresh an access token using a refresh_token.
-   */
-  async refreshAccessToken(refreshToken) {
-    const { tokenUrl } = await discoverEndpoints();
-    const res = await fetch(tokenUrl, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        Accept: "application/json",
-      },
-      body: new URLSearchParams({
-        grant_type: "refresh_token",
-        client_id: XAI_CONFIG.clientId,
-        refresh_token: refreshToken,
-      }),
-    });
-    if (!res.ok) {
-      const err = await res.text();
-      throw new Error(`xAI token refresh failed: ${err}`);
-    }
-    return await res.json();
-  }
-
-  /**
-   * Complete xAI OAuth flow end-to-end (CLI entrypoint).
-   * Returns the raw token response plus extracted email.
-   */
-  async connect() {
-    const spinner = createSpinner("Starting xAI OAuth...").start();
-    try {
-      spinner.text = "Discovering xAI endpoints...";
-      const { authorizeUrl, tokenUrl } = await discoverEndpoints();
-
-      spinner.text = `Starting local server on port ${XAI_CONFIG.loopbackPort}...`;
-      let callbackParams = null;
-      const { port, close } = await startLocalServer((params) => {
-        callbackParams = params;
-      }, XAI_CONFIG.loopbackPort);
-      const redirectUri = `http://127.0.0.1:${port}${XAI_CONFIG.callbackPath}`;
-      spinner.succeed(`Local server started on port ${port}`);
-
-      const codeVerifier = generateCodeVerifier(XAI_PKCE_VERIFIER_BYTES);
-      const codeChallenge = generateCodeChallenge(codeVerifier);
-      const state = generateState();
-      const authUrl = this.buildXaiAuthUrl(redirectUri, state, codeChallenge, authorizeUrl);
-
-      console.log("\nOpening browser for xAI authentication...");
-      console.log(`If browser doesn't open, visit:\n${authUrl}\n`);
-      await open(authUrl);
-
-      spinner.start("Waiting for xAI authorization...");
-      await new Promise((resolve, reject) => {
-        const timeout = setTimeout(() => reject(new Error("Authentication timeout (5 minutes)")), 300000);
-        const iv = setInterval(() => {
-          if (callbackParams) {
-            clearInterval(iv);
-            clearTimeout(timeout);
-            resolve();
-          }
-        }, 100);
-      });
-      close();
-
-      if (callbackParams.error) {
-        throw new Error(callbackParams.error_description || callbackParams.error);
-      }
-      if (!callbackParams.code) throw new Error("No authorization code received");
-      if (callbackParams.state !== state) throw new Error("Invalid state parameter");
-
-      spinner.start("Exchanging code for tokens...");
-      const tokens = await this.exchangeXaiCode({
-        tokenUrl,
-        code: callbackParams.code,
-        redirectUri,
-        codeVerifier,
-      });
-
-      const email = decodeIdTokenEmail(tokens.id_token);
-      spinner.succeed("xAI connected successfully!");
-      return { tokens, email };
-    } catch (error) {
-      spinner.fail(`Failed: ${error.message}`);
-      throw error;
-    }
-  }
-}

package/src/lib/oauth/utils/banner.js

@@ -1,63 +0,0 @@
-import figlet from "figlet";
-import gradient from "gradient-string";
-import chalkAnimation from "chalk-animation";
-
-/**
- * Display banner
- */
-export function showBanner() {
-  const banner = figlet.textSync("LLM Proxy", {
-    font: "ANSI Shadow",
-    horizontalLayout: "default",
-    verticalLayout: "default",
-  });
-
-  console.log("\n" + gradient.pastel.multiline(banner));
-  console.log(gradient.cristal("  🚀 OAuth CLI for AI Providers\n"));
-}
-
-/**
- * Display simple banner (no animation)
- */
-export function showSimpleBanner() {
-  const banner = figlet.textSync("EP CLI", {
-    font: "Standard",
-    horizontalLayout: "default",
-  });
-  console.log(gradient.pastel.multiline(banner));
-  console.log(gradient.cristal("  OAuth CLI for AI Providers\n"));
-}
-
-/**
- * Display success animation
- */
-export async function showSuccess(message) {
-  return new Promise((resolve) => {
-    const animation = chalkAnimation.rainbow(`\n✨ ${message}\n`);
-    setTimeout(() => {
-      animation.stop();
-      resolve();
-    }, 1000);
-  });
-}
-
-/**
- * Display loading animation
- */
-export function showLoading(text) {
-  const frames = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
-  let i = 0;
-  
-  const interval = setInterval(() => {
-    process.stdout.write(`\r${frames[i]} ${text}`);
-    i = (i + 1) % frames.length;
-  }, 80);
-
-  return {
-    stop: () => {
-      clearInterval(interval);
-      process.stdout.write("\r");
-    },
-  };
-}
-

package/src/lib/oauth/utils/pkce.js

@@ -1,39 +0,0 @@
-import crypto from "crypto";
-
-/**
- * Generate PKCE code verifier (43-128 characters)
- *
- * @param {number} [bytes=32] number of random bytes (xAI uses 96)
- */
-export function generateCodeVerifier(bytes = 32) {
-  return crypto.randomBytes(bytes).toString("base64url");
-}
-
-/**
- * Generate PKCE code challenge from verifier (S256 method)
- */
-export function generateCodeChallenge(verifier) {
-  return crypto.createHash("sha256").update(verifier).digest("base64url");
-}
-
-/**
- * Generate random state for CSRF protection
- */
-export function generateState() {
-  return crypto.randomBytes(32).toString("base64url");
-}
-
-/**
- * Generate complete PKCE pair
- */
-export function generatePKCE(bytes = 32) {
-  const codeVerifier = generateCodeVerifier(bytes);
-  const codeChallenge = generateCodeChallenge(codeVerifier);
-  const state = generateState();
-
-  return {
-    codeVerifier,
-    codeChallenge,
-    state,
-  };
-}