opencode-swap 0.4.0__py3-none-any.whl

opencode_swap/providers/openai.py

@@ -0,0 +1,186 @@
+"""OpenAI provider: reads/writes the ``"openai"`` key of OpenCode's auth.json.
+
+Record shapes verified against OpenCode source
+(packages/opencode/src/auth/index.ts:14-33, the Oauth/Api/WellKnown union):
+
+    oauth:     {type:"oauth", refresh:str, access:str, expires:int,
+                accountId?:str, enterpriseUrl?:str}
+    api:       {type:"api", key:str, metadata?:dict}
+    wellknown: {type:"wellknown", key:str, token:str}
+
+Identity derivation mirrors opencode-balancer's authIdentityKey
+(src/core/pending.ts:116-123): prefer the stable account id, fall back to
+the refresh token itself so two records for the same account are still
+recognized as the same identity even before an accountId claim is known.
+"""
+
+from __future__ import annotations
+
+import math
+import time
+
+from opencode_swap import oauth_refresh, usage
+from opencode_swap.exceptions import SchemaError
+from opencode_swap.models import AccountDesc, AuthRecord, JsonObject, Validity
+from opencode_swap.oauth_jwt import decode_claims, extract_account_id, extract_email
+from opencode_swap.providers.common import credential_values, is_json_number, key_account_hint, published_raw, require_expiry
+
+PROVIDER_ID = "openai"
+
+
+def _require_str(raw: JsonObject, field: str, entry_type: str) -> str:
+    value = raw.get(field)
+    if not isinstance(value, str) or not value:
+        raise SchemaError(f"openai {entry_type} entry missing/invalid field {field!r}")
+    return value
+
+
+def _optional_str(raw: JsonObject, field: str, entry_type: str) -> str | None:
+    if field not in raw:
+        return None
+    value = raw[field]
+    if not isinstance(value, str):
+        raise SchemaError(f"openai {entry_type} entry has invalid field {field!r}")
+    return value
+
+
+def _json_value(value: object) -> bool:
+    if value is None or isinstance(value, (str, bool)):
+        return True
+    if is_json_number(value):
+        return True
+    if isinstance(value, list):
+        return all(_json_value(item) for item in value)
+    if isinstance(value, dict):
+        return all(isinstance(key, str) and _json_value(item) for key, item in value.items())
+    return False
+
+
+def _safe_display(value: object, record: JsonObject) -> str | None:
+    if not isinstance(value, str) or not value:
+        return None
+    if any(ord(char) < 32 or 127 <= ord(char) < 160 for char in value):
+        return None
+    if any(
+        secret and secret in value for secret in (record.get(field) for field in ("refresh", "access", "key", "token")) if isinstance(secret, str)
+    ):
+        return None
+    return value
+
+
+class OpenAiProvider:
+    id = PROVIDER_ID
+    usage_record_types = frozenset({"oauth"})
+
+    def extract(self, auth: JsonObject) -> AuthRecord | None:
+        raw = auth.get(PROVIDER_ID)
+        if raw is None:
+            return None
+        if not isinstance(raw, dict) or "type" not in raw:
+            raise SchemaError("openai entry is not a recognizable auth record")
+        if not _json_value(raw):
+            raise SchemaError("openai entry contains values not representable as JSON")
+
+        entry_type = raw["type"]
+        if entry_type == "oauth":
+            _require_str(raw, "refresh", "oauth")
+            _require_str(raw, "access", "oauth")
+            require_expiry(raw, PROVIDER_ID)
+            _optional_str(raw, "accountId", "oauth")
+            _optional_str(raw, "enterpriseUrl", "oauth")
+        elif entry_type == "api":
+            _require_str(raw, "key", "api")
+            metadata = raw.get("metadata")
+            if "metadata" in raw and (not isinstance(metadata, dict) or not _json_value(metadata)):
+                raise SchemaError("openai api entry has invalid field 'metadata'")
+        elif entry_type == "wellknown":
+            _require_str(raw, "key", "wellknown")
+            _require_str(raw, "token", "wellknown")
+        else:
+            raise SchemaError("unknown openai auth type")
+
+        return AuthRecord(type=entry_type, raw=dict(raw))
+
+    def splice(self, auth: JsonObject, record: AuthRecord) -> JsonObject:
+        new_auth = dict(auth)
+        new_auth[PROVIDER_ID] = published_raw(record.raw)
+        return new_auth
+
+    def identity(self, record: AuthRecord) -> str:
+        if record.type == "oauth":
+            account_id = record.raw.get("accountId")
+            if not isinstance(account_id, str) or not account_id:
+                access = record.raw.get("access")
+                claims = decode_claims(access if isinstance(access, str) else "")
+                account_id = extract_account_id(claims)
+            if account_id:
+                return f"oauth-account\0{account_id}"
+            refresh = record.raw.get("refresh")
+            return f"oauth-refresh\0{refresh if isinstance(refresh, str) else ''}"
+        if record.type == "api":
+            key = record.raw.get("key")
+            return f"api-key\0{key if isinstance(key, str) else ''}"
+        if record.type == "wellknown":
+            key = record.raw.get("key")
+            token = record.raw.get("token")
+            return f"wellknown\0{key if isinstance(key, str) else ''}\0{token if isinstance(token, str) else ''}"
+        raise SchemaError("unknown openai auth type")
+
+    def identity_is_stable(self, record: AuthRecord) -> bool:
+        if record.type != "oauth":
+            return True
+        return self.identity(record).startswith("oauth-account\0")
+
+    def credential_values(self, record: AuthRecord) -> set[str]:
+        return credential_values(record)
+
+    def describe(self, record: AuthRecord) -> AccountDesc:
+        if record.type == "oauth":
+            access = record.raw.get("access")
+            claims = decode_claims(access if isinstance(access, str) else "")
+            account_id = record.raw.get("accountId")
+            expires = record.raw.get("expires")
+            return AccountDesc(
+                type="oauth",
+                email=_safe_display(extract_email(claims), record.raw),
+                account_id=_safe_display(account_id if isinstance(account_id, str) else extract_account_id(claims), record.raw),
+                expires=expires if isinstance(expires, (int, float)) else None,
+            )
+        if record.type == "api":
+            return AccountDesc(type="api", email=None, account_id=key_account_hint(record), expires=None)
+        return AccountDesc(type="wellknown", email=None, account_id=None, expires=None)
+
+    def validate(self, record: AuthRecord) -> Validity:
+        if record.type == "oauth":
+            expires = record.raw.get("expires")
+            if isinstance(expires, bool) or not isinstance(expires, (int, float)) or not math.isfinite(expires):
+                return Validity.INVALID
+            if expires < time.time() * 1000:
+                return Validity.EXPIRED
+            return Validity.OK
+        if record.type in ("api", "wellknown"):
+            return Validity.OK
+        return Validity.INVALID
+
+    def refresh(self, record: AuthRecord) -> AuthRecord | None:
+        if record.type != "oauth":
+            return None
+        refresh_token = record.raw.get("refresh")
+        if not isinstance(refresh_token, str) or not refresh_token:
+            raise SchemaError("openai oauth entry missing/invalid field 'refresh'")
+        tokens = oauth_refresh.refresh_openai_oauth(refresh_token, now_ms=time.time() * 1000)
+        new_raw = dict(record.raw)
+        new_raw["access"] = tokens.access
+        new_raw["refresh"] = tokens.refresh
+        new_raw["expires"] = tokens.expires
+        account_id = tokens.account_id or record.raw.get("accountId")
+        if account_id:
+            new_raw["accountId"] = account_id
+        return AuthRecord(type="oauth", raw=new_raw)
+
+    def fetch_usage(self, record: AuthRecord) -> usage.UsageSnapshot | None:
+        access = record.raw.get("access")
+        if not isinstance(access, str):
+            return None
+        account_id = record.raw.get("accountId")
+        return usage.fetch_openai_oauth_usage(access, account_id if isinstance(account_id, str) else None)

opencode_swap/providers/poe.py

@@ -0,0 +1,64 @@
+"""Poe OAuth/API credentials; OAuth yields a non-rotating API key."""
+
+from __future__ import annotations
+
+import time
+
+from opencode_swap.exceptions import SchemaError
+from opencode_swap.models import AccountDesc, AuthRecord, JsonObject, Validity
+from opencode_swap.providers.common import (
+    credential_values,
+    extract_raw,
+    is_json_number,
+    key_account_hint,
+    published_raw,
+    validate_api,
+    validate_oauth,
+)
+
+
+class PoeProvider:
+    id = "poe"
+    usage_record_types: frozenset[str] = frozenset()  # no known usage endpoint
+
+    def extract(self, auth: JsonObject) -> AuthRecord | None:
+        raw = extract_raw(auth, self.id)
+        if raw is None:
+            return None
+        if raw.get("type") == "api":
+            return validate_api(raw, self.id)
+        if raw.get("type") == "oauth":
+            return validate_oauth(raw, self.id)
+        raise SchemaError("poe auth type is not supported by opencode-swap")
+
+    def splice(self, auth: JsonObject, record: AuthRecord) -> JsonObject:
+        return {**auth, self.id: published_raw(record.raw)}
+
+    def identity(self, record: AuthRecord) -> str:
+        field = "key" if record.type == "api" else "access"
+        token = record.raw.get(field)
+        return f"{record.type}\0{token if isinstance(token, str) else ''}"
+
+    def identity_is_stable(self, record: AuthRecord) -> bool:
+        return True
+
+    def credential_values(self, record: AuthRecord) -> set[str]:
+        return credential_values(record)
+
+    def describe(self, record: AuthRecord) -> AccountDesc:
+        expires = record.raw.get("expires")
+        return AccountDesc(type=record.type, email=None, account_id=key_account_hint(record), expires=expires if is_json_number(expires) else None)
+
+    def validate(self, record: AuthRecord) -> Validity:
+        if record.type == "api":
+            return Validity.OK
+        expires = record.raw.get("expires")
+        if not is_json_number(expires):
+            return Validity.INVALID
+        return Validity.EXPIRED if expires < time.time() * 1000 else Validity.OK
+
+    def refresh(self, record: AuthRecord) -> AuthRecord | None:
+        return None  # no verified standalone refresh flow for this provider yet
+
+    def fetch_usage(self, record: AuthRecord) -> None:
+        return None  # unreachable: usage_record_types is empty

opencode_swap/providers/xai.py

@@ -0,0 +1,72 @@
+"""xAI API/OAuth handling with guarded stable JWT subject identity."""
+
+from __future__ import annotations
+
+import time
+
+from opencode_swap.exceptions import SchemaError
+from opencode_swap.models import AccountDesc, AuthRecord, JsonObject, Validity
+from opencode_swap.oauth_jwt import decode_claims
+from opencode_swap.providers.common import (
+    credential_values,
+    extract_raw,
+    is_json_number,
+    key_account_hint,
+    published_raw,
+    validate_api,
+    validate_oauth,
+)
+
+
+class XaiProvider:
+    id = "xai"
+    usage_record_types: frozenset[str] = frozenset()  # no known usage endpoint
+
+    def extract(self, auth: JsonObject) -> AuthRecord | None:
+        raw = extract_raw(auth, self.id)
+        if raw is None:
+            return None
+        if raw.get("type") == "api":
+            return validate_api(raw, self.id)
+        if raw.get("type") == "oauth":
+            return validate_oauth(raw, self.id)
+        raise SchemaError("xai auth type is not supported by opencode-swap")
+
+    def splice(self, auth: JsonObject, record: AuthRecord) -> JsonObject:
+        return {**auth, self.id: published_raw(record.raw)}
+
+    def identity(self, record: AuthRecord) -> str:
+        if record.type == "api":
+            key = record.raw.get("key")
+            return f"api-key\0{key if isinstance(key, str) else ''}"
+        access = record.raw.get("access")
+        claims = decode_claims(access if isinstance(access, str) else "")
+        subject = claims.get("sub")
+        issuer = claims.get("iss", "")
+        if not isinstance(subject, str) or not subject or not isinstance(issuer, str) or not issuer:
+            raise SchemaError("xai oauth access token has no stable JWT subject; refusing unsafe account switching")
+        return f"oauth-subject\0{issuer}\0{subject}"
+
+    def identity_is_stable(self, record: AuthRecord) -> bool:
+        return True
+
+    def credential_values(self, record: AuthRecord) -> set[str]:
+        return credential_values(record)
+
+    def describe(self, record: AuthRecord) -> AccountDesc:
+        expires = record.raw.get("expires")
+        return AccountDesc(type=record.type, email=None, account_id=key_account_hint(record), expires=expires if is_json_number(expires) else None)
+
+    def validate(self, record: AuthRecord) -> Validity:
+        if record.type == "api":
+            return Validity.OK
+        expires = record.raw.get("expires")
+        if not is_json_number(expires):
+            return Validity.INVALID
+        return Validity.EXPIRED if expires < time.time() * 1000 else Validity.OK
+
+    def refresh(self, record: AuthRecord) -> AuthRecord | None:
+        return None  # no verified standalone refresh flow for this provider yet
+
+    def fetch_usage(self, record: AuthRecord) -> None:
+        return None  # unreachable: usage_record_types is empty

opencode_swap/providers/zai.py

@@ -0,0 +1,31 @@
+"""Z.AI GLM Coding Plan: a canonical API-key record plus a live usage lookup.
+
+Record handling is exactly the generic API path (`ApiProvider`) -- z.ai stores
+`{"type":"api","key":"..."}` like any other static-key provider. The only
+reason this provider exists as its own class is the GLM Coding Plan quota
+endpoint (see `usage.fetch_zai_usage`), which is keyed to the same API key.
+
+Only `zai-coding-plan` is registered, not a bare `zai`: the quota endpoint is
+coding-plan-specific, and a pay-as-you-go `zai` key would only ever report an
+inactive plan.
+"""
+
+from __future__ import annotations
+
+from opencode_swap import usage
+from opencode_swap.models import AuthRecord
+from opencode_swap.providers.api import ApiProvider
+
+
+class ZaiProvider(ApiProvider):
+    id = "zai-coding-plan"
+    usage_record_types = frozenset({"api"})
+
+    def __init__(self) -> None:
+        super().__init__(self.id)
+
+    def fetch_usage(self, record: AuthRecord) -> usage.UsageSnapshot | None:
+        key = record.raw.get("key")
+        if not isinstance(key, str) or not key:
+            return None
+        return usage.fetch_zai_usage(key)

opencode_swap/sealed.py

@@ -0,0 +1,83 @@
+"""AES-256-GCM envelope format for the macOS Keychain backend.
+
+Why this exists: a single OpenAI OAuth record is ~2KB, and hex-encoded for
+``security -i`` that's over the 4095-char stdin line limit (see
+macos_keychain.py) — so the raw credential can never go into a Keychain
+item directly. Instead the Keychain holds a small (32-byte, 64 hex chars)
+per-account data key, and the credential itself is AES-256-GCM ciphertext
+in the existing atomic 0600 file store. This keeps every operation to one
+``security`` spawn regardless of credential size, with no size classes.
+
+pycryptodomex is not a new dependency: pyzipper (already required for
+transfer.py's export/import archives) depends on it, and this module
+formalizes that as a direct dependency.
+
+Blob layout: b"OCS3" | nonce(12) | tag(16) | ciphertext.
+AAD is the caller's key_id (e.g. "openai:work"), so a blob copied or
+renamed onto a different account fails to decrypt instead of silently
+producing garbage under the wrong identity.
+"""
+
+from __future__ import annotations
+
+from Cryptodome.Cipher import AES
+from Cryptodome.Random import get_random_bytes
+
+from opencode_swap.exceptions import SecretStoreError
+
+_MAGIC = b"OCS3"
+_KEY_BYTES = 32
+_NONCE_BYTES = 12
+_TAG_BYTES = 16
+
+# Generic message only: never let a decode/decrypt failure path leak
+# ciphertext, key material, or plaintext content into an error string.
+_CORRUPT_MSG = "stored file credential is corrupt"
+
+
+def new_data_key() -> str:
+    """A fresh 32-byte AES key, hex-encoded (64 chars — printable, tiny)."""
+    random_bytes: bytes = get_random_bytes(_KEY_BYTES)
+    return random_bytes.hex()
+
+
+def seal(key_id: str, data_key_hex: str, plaintext: str) -> bytes:
+    """Encrypt `plaintext` under `data_key_hex`, bound to `key_id` via AAD."""
+    key = _decode_key(data_key_hex)
+    nonce: bytes = get_random_bytes(_NONCE_BYTES)
+    cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)
+    cipher.update(key_id.encode("utf-8"))
+    ciphertext: bytes
+    tag: bytes
+    ciphertext, tag = cipher.encrypt_and_digest(plaintext.encode("utf-8"))
+    return _MAGIC + nonce + tag + ciphertext
+
+
+def unseal(key_id: str, data_key_hex: str, blob: bytes) -> str:
+    """Decrypt a `seal`-produced blob. Raises SecretStoreError on any
+    tampering, wrong key, or wrong key_id (AAD mismatch)."""
+    key = _decode_key(data_key_hex)
+    if len(blob) < len(_MAGIC) + _NONCE_BYTES + _TAG_BYTES or not blob.startswith(_MAGIC):
+        raise SecretStoreError(_CORRUPT_MSG)
+    rest = blob[len(_MAGIC) :]
+    nonce, tag, ciphertext = rest[:_NONCE_BYTES], rest[_NONCE_BYTES : _NONCE_BYTES + _TAG_BYTES], rest[_NONCE_BYTES + _TAG_BYTES :]
+    cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)
+    cipher.update(key_id.encode("utf-8"))
+    try:
+        plaintext: bytes = cipher.decrypt_and_verify(ciphertext, tag)
+    except ValueError as exc:
+        raise SecretStoreError(_CORRUPT_MSG) from exc
+    try:
+        return plaintext.decode("utf-8")
+    except UnicodeDecodeError as exc:
+        raise SecretStoreError(_CORRUPT_MSG) from exc
+
+
+def _decode_key(data_key_hex: str) -> bytes:
+    try:
+        key = bytes.fromhex(data_key_hex)
+    except ValueError as exc:
+        raise SecretStoreError(_CORRUPT_MSG) from exc
+    if len(key) != _KEY_BYTES:
+        raise SecretStoreError(_CORRUPT_MSG)
+    return key