luulam/9router
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Squashed commit of the following:

Browse Source 
commit 6561679f5c396bb07f5f7ba5bc5ec75e81c803a4
Author: OpenClaw Patch <patch@openclaw.local>
Date:   Tue May 19 16:26:01 2026 -0700

    fix: never dedup access_token connections

    Access tokens should always create new entries. User decides
    which to keep (refresh-based OAuth vs no-expiry website token)
    and removes the other manually.

commit d773451657999a2965ca4a094a7f0b7a54066693
Author: OpenClaw Patch <patch@openclaw.local>
Date:   Tue May 19 16:24:30 2026 -0700

    fix: support ChatGPT website token format (account_id, plan_type)

    ChatGPT website access tokens use top-level 'account_id' and
    'plan_type' fields, while OAuth id_tokens use nested claims
    under 'https://api.openai.com/auth'. Now both formats are
    handled, so workspace dedup works for website tokens too.

commit cb895a5f6be59c51267874f11567646fa1f43016
Author: OpenClaw Patch <patch@openclaw.local>
Date:   Tue May 19 16:12:56 2026 -0700

    fix: detect JWT in manual callback URL field

    When user pastes a JWT access token (starts with eyJ) in the
    'paste callback URL' input field, skip URL parsing and send
    it directly to the exchange endpoint as the code. Fixes
    'Failed to construct URL: Invalid URL' error.

commit 29650d4a6732e3cf0958c9963b53209e41c8281e
Author: OpenClaw Patch <patch@openclaw.local>
Date:   Tue May 19 15:37:02 2026 -0700

    feat: auto-detect access token in OAuth exchange

    When the exchange endpoint receives a JWT (starts with eyJ)
    instead of an OAuth authorization code, it detects this and
    creates an access_token connection directly — skipping the
    OAuth token exchange flow.

    This lets users paste a ChatGPT access token where the OAuth
    code would normally go, and have it work automatically.

commit e8e7c5709a783abd0c45246a44de1cc6abdba100
Author: OpenClaw Patch <patch@openclaw.local>
Date:   Tue May 19 15:14:48 2026 -0700

    feat: workspace-aware dedup + ChatGPT access token import

    1. Dedup now checks email AND workspace (chatgptAccountId)
       - Same email in different workspaces = separate connections
       - Backward compatible: non-workspace providers still dedup by email

    2. New authType 'access_token' for ChatGPT website tokens
       - POST /api/oauth/codex/import-token accepts raw access tokens
       - Extracts email, workspace, plan from JWT claims
       - Deduplicates by email+workspace like OAuth
       - No refresh token needed (avoids OAuth relogin issues)
This commit is contained in:
decolua
2026-05-20 14:38:47 +07:00
parent 026a7c9b85
commit 0654d7bb35
5 changed files with 161 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
src/app/api/oauth/[provider]/[action]/route.js
View File

@@ -139,6 +139,48 @@ export async function POST(request, { params }) {
if (action === "exchange") {
const { code, redirectUri, codeVerifier, state, meta } = body;
// Detect if "code" is actually a raw JWT access token (starts with eyJ)
if (code && code.startsWith("eyJ") && code.includes(".")) {
const { extractCodexAccountInfo } = await import("@/lib/oauth/providers");
const info = extractCodexAccountInfo(code);
// Also decode JWT directly for ChatGPT website tokens which use
// top-level account_id/plan_type instead of nested openai auth claims
let directPayload = {};
try {
const b64 = code.split(".")[1].replace(/-/g, "+").replace(/_/g, "/");
const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
directPayload = JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
} catch {}
const accountId = info.chatgptAccountId || directPayload.account_id;
const planType = info.chatgptPlanType || directPayload.plan_type;
const email = info.email || directPayload.email;
const providerSpecificData = { authMethod: "access_token" };
if (accountId) providerSpecificData.chatgptAccountId = accountId;
if (planType) providerSpecificData.chatgptPlanType = planType;
const connection = await createProviderConnection({
provider,
authType: "access_token",
accessToken: code,
email: email || null,
providerSpecificData,
testStatus: "active",
});
return NextResponse.json({
success: true,
connection: {
id: connection.id,
provider: connection.provider,
email: connection.email,
displayName: connection.displayName,
}
});
}
// Cline uses authorization_code without PKCE
const noPkceExchangeProviders = ["cline"];
if (!code || !redirectUri || (!codeVerifier && !noPkceExchangeProviders.includes(provider))) {

96
src/app/api/oauth/codex/import-token/route.js Normal file
View File

@@ -0,0 +1,96 @@
import { NextResponse } from "next/server";
import { createProviderConnection } from "@/models";
import { extractCodexAccountInfo } from "@/lib/oauth/providers";
/**
* POST /api/oauth/codex/import-token
* Import a ChatGPT access token (created from chatgpt.com settings)
* as a provider connection, bypassing OAuth refresh flow.
*
* Body: { accessToken: string, name?: string }
*/
export async function POST(request) {
try {
const { accessToken, name } = await request.json();
if (!accessToken || typeof accessToken !== "string") {
return NextResponse.json(
{ error: "Access token is required" },
{ status: 400 }
);
}
const token = accessToken.trim();
// Extract account info from the JWT (email, workspace, plan)
let email = null;
let providerSpecificData = { authMethod: "access_token" };
// Try decoding as JWT to extract email + workspace
try {
const parts = token.split(".");
if (parts.length === 3) {
const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
const missingPadding = (4 - (base64.length % 4)) % 4;
const padded = base64 + "=".repeat(missingPadding);
const payload = JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
// Extract from OpenAI JWT structure
const auth = payload["https://api.openai.com/auth"] || {};
const profile = payload["https://api.openai.com/profile"] || {};
email = profile.email || payload.email || payload.preferred_username || null;
if (auth.chatgpt_account_id) {
providerSpecificData.chatgptAccountId = auth.chatgpt_account_id;
}
if (auth.chatgpt_plan_type) {
providerSpecificData.chatgptPlanType = auth.chatgpt_plan_type;
}
// Store expiry info from JWT if available
if (payload.exp) {
providerSpecificData.jwtExp = payload.exp;
}
}
} catch {
// Not a JWT or malformed — still allow import as raw token
}
// Also try extractCodexAccountInfo via id_token-style extraction
// (the access token itself may contain the same claims)
if (!email) {
const info = extractCodexAccountInfo(token);
if (info.email) email = info.email;
if (info.chatgptAccountId) providerSpecificData.chatgptAccountId = info.chatgptAccountId;
if (info.chatgptPlanType) providerSpecificData.chatgptPlanType = info.chatgptPlanType;
}
const connectionName = name || email || "ChatGPT Access Token";
// Save to database as access_token authType (no refresh token)
const connection = await createProviderConnection({
provider: "codex",
authType: "access_token",
accessToken: token,
name: connectionName,
email: email,
providerSpecificData,
testStatus: "active",
});
return NextResponse.json({
success: true,
connection: {
id: connection.id,
provider: connection.provider,
email: connection.email,
name: connection.name,
workspace: providerSpecificData.chatgptAccountId || null,
plan: providerSpecificData.chatgptPlanType || null,
},
});
} catch (error) {
console.log("Codex access token import error:", error);
return NextResponse.json({ error: error.message }, { status: 500 });
}
}

12
src/lib/db/repos/connectionsRepo.js
View File

@@ -98,10 +98,18 @@ export async function createProviderConnection(data) {
let existing = null;
if (data.authType === "oauth" && data.email) {
existing = all.find(c => c.authType === "oauth" && c.email === data.email);
const incomingWs = data.providerSpecificData?.chatgptAccountId;
existing = all.find(c => {
if (c.authType !== "oauth" || c.email !== data.email) return false;
// If both sides have a workspace ID, they must match for dedup
const existingWs = c.providerSpecificData?.chatgptAccountId;
if (incomingWs && existingWs) return incomingWs === existingWs;
return true; // fallback: email-only match for non-workspace providers
});
} else if (data.authType === "apikey" && data.name) {
existing = all.find(c => c.authType === "apikey" && c.name === data.name);
}
// access_token: never dedup — user manages duplicates manually
if (existing) {
const merged = { ...existing, ...data, updatedAt: now };
@@ -111,7 +119,7 @@ export async function createProviderConnection(data) {
}
let connectionName = data.name || null;
if (!connectionName && data.authType === "oauth") {
if (!connectionName && (data.authType === "oauth" || data.authType === "access_token")) {
connectionName = data.email || `Account ${all.length + 1}`;
}
let connectionPriority = data.priority;

6
src/lib/oauth/providers.js
View File

@@ -53,15 +53,15 @@ function extractEmailFromAccessToken(accessToken) {
return payload.email || payload.preferred_username || payload.sub || undefined;
}
// Extract codex account info from id_token
// Extract codex account info from id_token or access token
export function extractCodexAccountInfo(idToken) {
const payload = decodeJwtPayload(idToken);
if (!payload) return {};
const chatgpt = payload["https://api.openai.com/auth"] || {};
return {
email: payload.email,
chatgptAccountId: chatgpt.chatgpt_account_id,
chatgptPlanType: chatgpt.chatgpt_plan_type,
chatgptAccountId: chatgpt.chatgpt_account_id || payload.account_id,
chatgptPlanType: chatgpt.chatgpt_plan_type || payload.plan_type,
};
}

11
src/shared/components/OAuthModal.js
View File

@@ -383,7 +383,16 @@ export default function OAuthModal({ isOpen, provider, providerInfo, onSuccess,
const handleManualSubmit = async () => {
try {
setError(null);
const url = new URL(callbackUrl);
const input = callbackUrl.trim();
// Detect raw JWT access token (starts with eyJ) — skip URL parsing
if (input.startsWith("eyJ") && input.includes(".")) {
await exchangeTokens(input, null);
return;
}
const url = new URL(input);
const code = url.searchParams.get("code");
const state = url.searchParams.get("state");
const errorParam = url.searchParams.get("error");