feat(qoder): port Kiro-style provider integration with COSY signing
Replaces the Qoder placeholder with a real free-tier provider: - Device-flow OAuth: PKCE + nonce generated locally, user authorizes at qoder.com/device/selectAccounts, poll openapi.qoder.sh until token - COSY signing (RSA-1024 + AES-128-CBC + MD5) for chat / model-list - WAF-bypass body encoding (custom-alphabet base64 + thirds rearrange) - Live model_config catalog from /algo/api/v2/model/list, cached 1h - 11 models registered (auto/ultimate/performance/efficient/lite + 6 frontier *model ids) - Usage fetcher for openapi.qoder.sh/api/v2/quota/usage - Dashboard live-models resolver, provider test, OAuth modal hookup - 24 unit tests covering encoder, PKCE, COSY headers, sigPath stripping
This commit is contained in:
Simon Shi
@@ -144,6 +144,21 @@ export const PROVIDER_MODELS = {
|
||||
{ id: "claude-sonnet-4.5-thinking-agentic", name: "Claude Sonnet 4.5 (Thinking + Agentic)" },
|
||||
{ id: "claude-haiku-4.5-thinking-agentic", name: "Claude Haiku 4.5 (Thinking + Agentic)" },
|
||||
],
|
||||
qd: [ // Qoder AI - tier + frontier models (server-published catalog)
|
||||
// Tier models — pick a quality/cost tradeoff
|
||||
{ id: "auto", name: "Qoder Auto" },
|
||||
{ id: "ultimate", name: "Qoder Ultimate" },
|
||||
{ id: "performance", name: "Qoder Performance" },
|
||||
{ id: "efficient", name: "Qoder Efficient" },
|
||||
{ id: "lite", name: "Qoder Lite" },
|
||||
// Frontier models — pin a specific backing model
|
||||
{ id: "qmodel", name: "Qwen 3.6 Plus (Qoder)" },
|
||||
{ id: "dmodel", name: "DeepSeek V4 Pro (Qoder)" },
|
||||
{ id: "dfmodel", name: "DeepSeek V4 Flash (Qoder)" },
|
||||
{ id: "gm51model", name: "GLM 5.1 (Qoder)" },
|
||||
{ id: "kmodel", name: "Kimi K2.6 (Qoder)" },
|
||||
{ id: "mmodel", name: "MiniMax M2.7 (Qoder)" },
|
||||
],
|
||||
cu: [ // Cursor IDE
|
||||
{ id: "default", name: "Auto (Server Picks)" },
|
||||
{ id: "claude-4.5-opus-high-thinking", name: "Claude 4.5 Opus High Thinking" },
|
||||
@@ -870,6 +885,7 @@ const OAUTH_ALIASES = {
|
||||
kilocode: "kc",
|
||||
cline: "cl",
|
||||
opencode: "oc",
|
||||
qoder: "qd",
|
||||
vertex: "vertex",
|
||||
"vertex-partner": "vertex-partner",
|
||||
};
|
||||
|
||||
@@ -94,13 +94,13 @@ export const PROVIDERS = {
|
||||
authUrl: "https://iflow.cn/oauth"
|
||||
},
|
||||
qoder: {
|
||||
baseUrl: "https://api.qoder.com/v1/chat/completions",
|
||||
// The qoder executor builds the full URL itself (it has to append
|
||||
// ?Encode=1 + sigPath query params and bypass any provider-level URL
|
||||
// rewriting). baseUrl is kept for compatibility with introspection
|
||||
// helpers but the executor ignores it.
|
||||
baseUrl: "https://api3.qoder.sh/algo/api/v2/service/pro/sse/agent_chat_generation",
|
||||
format: "openai",
|
||||
headers: { "User-Agent": "Qoder-Cli" },
|
||||
clientId: process.env.QODER_OAUTH_CLIENT_ID || "10009311001",
|
||||
clientSecret: process.env.QODER_OAUTH_CLIENT_SECRET || "4Z3YjXycVsQvyGF1etiNlIBB4RsqSDtW",
|
||||
tokenUrl: "https://api.qoder.com/oauth/token",
|
||||
authUrl: "https://qoder.com/oauth/authorize"
|
||||
headers: {},
|
||||
},
|
||||
antigravity: {
|
||||
baseUrls: [
|
||||
|
||||
@@ -1,72 +1,404 @@
|
||||
import crypto from "crypto";
|
||||
/**
|
||||
* QoderExecutor — sends OpenAI-format chat requests to Qoder's COSY-signed
|
||||
* inference endpoint at api3.qoder.sh, then unwraps Qoder's `{statusCodeValue,
|
||||
* body}` SSE envelope back into plain OpenAI SSE for the rest of the pipeline.
|
||||
*
|
||||
* Differences vs the previous placeholder:
|
||||
* - URL is api3.qoder.sh/algo/api/v2/service/pro/sse/agent_chat_generation
|
||||
* with `&Encode=1` so we can ship the body through the WAF-bypass
|
||||
* encoder.
|
||||
* - Authentication is COSY (RSA + AES + MD5 + ~17 Cosy-* headers), not
|
||||
* a static HMAC.
|
||||
* - The request shape Qoder expects is non-trivial (chat_context with
|
||||
* mirrored modelConfig, business block with stable IDs, system text
|
||||
* hoisted out of the messages array). All ported from the reference.
|
||||
* - Model identifier is one of the canonical 11 keys (auto / ultimate /
|
||||
* performance / efficient / lite + 6 frontier "*model" ids); the
|
||||
* translator layer feeds us "qoder/<key>" so we strip the prefix.
|
||||
* - Per-model `model_config` is fetched live from /algo/api/v2/model/list
|
||||
* and cached. Sending the wrong block silently downgrades to a
|
||||
* different model upstream, so a missing entry is a hard error.
|
||||
*/
|
||||
|
||||
import { qoderEncodeBody } from "@/lib/qoder/encoding.js";
|
||||
import { buildCosyHeaders } from "@/lib/qoder/cosy.js";
|
||||
import { v4 as uuidv4 } from "uuid";
|
||||
import { createHash } from "crypto";
|
||||
|
||||
import { BaseExecutor } from "./base.js";
|
||||
import { PROVIDERS } from "../config/providers.js";
|
||||
import { proxyAwareFetch } from "../utils/proxyFetch.js";
|
||||
import {
|
||||
QODER_CHAT_URL_ENCODED,
|
||||
QODER_MODEL_MAP,
|
||||
} from "@/lib/qoder/constants.js";
|
||||
import { getQoderModelConfig, resolveQoderModels } from "../services/qoderModels.js";
|
||||
|
||||
/**
|
||||
* QoderExecutor - Executor for Qoder API with HMAC-SHA256 signature
|
||||
* Requires 3 custom headers to avoid 406 error: session-id, x-qoder-timestamp, x-qoder-signature
|
||||
* Hoist role:"system" messages out of the messages array (Qoder rejects
|
||||
* system in messages) and flatten any multipart content arrays.
|
||||
*/
|
||||
function normalizeMessages(messages) {
|
||||
if (!Array.isArray(messages) || messages.length === 0) {
|
||||
return { messages: [], systemText: "" };
|
||||
}
|
||||
const systemParts = [];
|
||||
const out = [];
|
||||
for (const msg of messages) {
|
||||
if (!msg || typeof msg !== "object") continue;
|
||||
const text = extractText(msg.content);
|
||||
if (msg.role === "system") {
|
||||
if (text) systemParts.push(text);
|
||||
continue;
|
||||
}
|
||||
const cloned = { ...msg };
|
||||
cloned.content = text;
|
||||
out.push(cloned);
|
||||
}
|
||||
return { messages: out, systemText: systemParts.join("\n\n") };
|
||||
}
|
||||
|
||||
function extractText(content) {
|
||||
if (typeof content === "string") return content;
|
||||
if (content == null) return "";
|
||||
if (Array.isArray(content)) {
|
||||
const parts = [];
|
||||
for (const item of content) {
|
||||
if (item && typeof item === "object") {
|
||||
if (item.type === "text" && typeof item.text === "string") {
|
||||
parts.push(item.text);
|
||||
} else if (typeof item.text === "string") {
|
||||
parts.push(item.text);
|
||||
}
|
||||
}
|
||||
}
|
||||
return parts.join("\n");
|
||||
}
|
||||
return String(content);
|
||||
}
|
||||
|
||||
function lastUserText(messages) {
|
||||
for (let i = messages.length - 1; i >= 0; i--) {
|
||||
const m = messages[i];
|
||||
if (m?.role === "user" && typeof m.content === "string") {
|
||||
return m.content;
|
||||
}
|
||||
}
|
||||
return "";
|
||||
}
|
||||
|
||||
function stableHash(prefix, ...parts) {
|
||||
const h = createHash("sha256");
|
||||
h.update(prefix);
|
||||
for (const p of parts) {
|
||||
h.update("\0");
|
||||
h.update(String(p ?? ""));
|
||||
}
|
||||
return h.digest("hex").slice(0, 16);
|
||||
}
|
||||
|
||||
function stableChatRecordId(model, messages, tools, maxTokens) {
|
||||
const h = createHash("sha256");
|
||||
h.update("qoder-record\0");
|
||||
h.update(String(model));
|
||||
for (const m of messages) {
|
||||
if (!m || typeof m !== "object") continue;
|
||||
if (m.role) { h.update("\0"); h.update(m.role); }
|
||||
if (typeof m.content === "string" && m.content) {
|
||||
h.update("\0"); h.update(m.content);
|
||||
}
|
||||
}
|
||||
if (tools) {
|
||||
h.update("\0");
|
||||
try { h.update(JSON.stringify(tools)); } catch {}
|
||||
}
|
||||
h.update(`\0mt=${maxTokens}`);
|
||||
return h.digest("hex").slice(0, 16);
|
||||
}
|
||||
|
||||
function truncate(s, n) {
|
||||
return s && s.length > n ? `${s.slice(0, n)}...` : s || "";
|
||||
}
|
||||
|
||||
/**
|
||||
* Map the OpenAI-style request body into the exact shape Qoder expects.
|
||||
*/
|
||||
async function buildQoderRequestBody({ model, body, credentials, log }) {
|
||||
const qoderKey = String(model || "").replace(/^qoder\//, "");
|
||||
if (!QODER_MODEL_MAP[qoderKey]) {
|
||||
throw new Error(`Unsupported qoder model: "${qoderKey}" (received "${model}")`);
|
||||
}
|
||||
|
||||
let modelConfig = await getQoderModelConfig(credentials, qoderKey, { log });
|
||||
if (!modelConfig) {
|
||||
// Try a forced refresh once before giving up — the cache may simply
|
||||
// not be populated yet on first ever call for this credential.
|
||||
const refreshed = await resolveQoderModels(credentials, { forceRefresh: true, log });
|
||||
const retried = refreshed?.rawConfigs.get(qoderKey);
|
||||
if (!retried) {
|
||||
throw new Error(
|
||||
`qoder: model_config for "${qoderKey}" not yet known (run a model list fetch or check upstream connectivity)`,
|
||||
);
|
||||
}
|
||||
modelConfig = { ...retried, key: qoderKey };
|
||||
}
|
||||
|
||||
const { messages, systemText } = normalizeMessages(body.messages || []);
|
||||
const tools = body.tools;
|
||||
const isReasoning = !!modelConfig.is_reasoning;
|
||||
const maxOutputTokens = Number(modelConfig.max_output_tokens) || 0;
|
||||
|
||||
let maxTokens = 32_768;
|
||||
if (maxOutputTokens > 0) maxTokens = maxOutputTokens;
|
||||
if (typeof body.max_tokens === "number" && body.max_tokens > 0 && body.max_tokens < maxTokens) {
|
||||
maxTokens = body.max_tokens;
|
||||
}
|
||||
if (typeof body.max_completion_tokens === "number" && body.max_completion_tokens > 0 && body.max_completion_tokens < maxTokens) {
|
||||
maxTokens = body.max_completion_tokens;
|
||||
}
|
||||
|
||||
const lastUser = lastUserText(messages);
|
||||
const psd = credentials.providerSpecificData || {};
|
||||
const sessionId = stableHash("qoder-session", psd.userId, qoderKey);
|
||||
const recordId = stableChatRecordId(qoderKey, messages, tools, maxTokens);
|
||||
|
||||
return {
|
||||
qoderKey,
|
||||
payload: {
|
||||
request_id: uuidv4(),
|
||||
request_set_id: recordId,
|
||||
chat_record_id: recordId,
|
||||
session_id: sessionId,
|
||||
stream: true,
|
||||
chat_task: "FREE_INPUT",
|
||||
is_reply: true,
|
||||
is_retry: false,
|
||||
source: 1,
|
||||
version: "3",
|
||||
session_type: "qodercli",
|
||||
agent_id: "agent_common",
|
||||
task_id: "common",
|
||||
code_language: "",
|
||||
chat_prompt: "",
|
||||
image_urls: null,
|
||||
aliyun_user_type: "",
|
||||
system: systemText,
|
||||
messages,
|
||||
tools: Array.isArray(tools) ? tools : [],
|
||||
parameters: { max_tokens: maxTokens },
|
||||
chat_context: {
|
||||
chatPrompt: "",
|
||||
imageUrls: null,
|
||||
extra: {
|
||||
context: [],
|
||||
modelConfig: { key: qoderKey, is_reasoning: isReasoning },
|
||||
originalContent: lastUser,
|
||||
},
|
||||
features: [],
|
||||
text: lastUser,
|
||||
},
|
||||
model_config: modelConfig,
|
||||
business: {
|
||||
product: "cli",
|
||||
version: "1.0.0",
|
||||
type: "agent",
|
||||
stage: "start",
|
||||
id: uuidv4(),
|
||||
name: truncate(lastUser, 30),
|
||||
begin_at: Date.now(),
|
||||
},
|
||||
},
|
||||
modelConfig,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Wrap the upstream's `{statusCodeValue, body}` SSE envelope into plain
|
||||
* OpenAI SSE chunks the rest of the chatCore pipeline understands.
|
||||
*
|
||||
* Each upstream line looks like:
|
||||
* data: {"statusCodeValue":200,"body":"{\"choices\":[{\"delta\":{...}}]}"}
|
||||
* The inner body is an OpenAI streaming chunk (or "[DONE]"). We unwrap it
|
||||
* and re-emit as `data: <inner>\n\n`. Errors become `data: [DONE]\n\n` plus
|
||||
* a synthetic OpenAI error chunk.
|
||||
*/
|
||||
function wrapQoderSSE(response, model) {
|
||||
if (!response.ok || !response.body) return response;
|
||||
|
||||
const decoder = new TextDecoder();
|
||||
const encoder = new TextEncoder();
|
||||
let buffer = "";
|
||||
let doneEmitted = false;
|
||||
|
||||
const transform = new TransformStream({
|
||||
transform(chunk, controller) {
|
||||
buffer += decoder.decode(chunk, { stream: true });
|
||||
let nl;
|
||||
while ((nl = buffer.indexOf("\n")) !== -1) {
|
||||
const line = buffer.slice(0, nl);
|
||||
buffer = buffer.slice(nl + 1);
|
||||
const trimmed = line.replace(/\r$/, "").trim();
|
||||
if (!trimmed) continue;
|
||||
if (!trimmed.startsWith("data:")) continue;
|
||||
|
||||
let data = trimmed.slice(5).trimStart();
|
||||
if (data === "[DONE]") {
|
||||
if (!doneEmitted) {
|
||||
controller.enqueue(encoder.encode("data: [DONE]\n\n"));
|
||||
doneEmitted = true;
|
||||
}
|
||||
continue;
|
||||
}
|
||||
|
||||
let envelope;
|
||||
try { envelope = JSON.parse(data); } catch { continue; }
|
||||
const statusVal = typeof envelope.statusCodeValue === "number" ? envelope.statusCodeValue : 200;
|
||||
const inner = typeof envelope.body === "string" ? envelope.body : "";
|
||||
if (statusVal !== 200) {
|
||||
const msg = inner || `upstream status ${statusVal}`;
|
||||
const errChunk = JSON.stringify({
|
||||
id: `qoder-error-${Date.now()}`,
|
||||
object: "chat.completion.chunk",
|
||||
created: Math.floor(Date.now() / 1000),
|
||||
model,
|
||||
choices: [{ index: 0, delta: { content: `\n[qoder error ${statusVal}: ${truncate(msg, 200)}]` }, finish_reason: "stop" }],
|
||||
});
|
||||
controller.enqueue(encoder.encode(`data: ${errChunk}\n\n`));
|
||||
if (!doneEmitted) {
|
||||
controller.enqueue(encoder.encode("data: [DONE]\n\n"));
|
||||
doneEmitted = true;
|
||||
}
|
||||
continue;
|
||||
}
|
||||
if (!inner) continue;
|
||||
if (inner === "[DONE]") {
|
||||
if (!doneEmitted) {
|
||||
controller.enqueue(encoder.encode("data: [DONE]\n\n"));
|
||||
doneEmitted = true;
|
||||
}
|
||||
continue;
|
||||
}
|
||||
// Inner is already an OpenAI-shaped chunk; forward as-is.
|
||||
controller.enqueue(encoder.encode(`data: ${inner}\n\n`));
|
||||
}
|
||||
},
|
||||
flush(controller) {
|
||||
if (!doneEmitted) {
|
||||
controller.enqueue(encoder.encode("data: [DONE]\n\n"));
|
||||
}
|
||||
},
|
||||
});
|
||||
|
||||
const transformed = response.body.pipeThrough(transform);
|
||||
// Build a Response with passable headers; the streaming handler reads
|
||||
// `.body` as a ReadableStream regardless of Content-Type.
|
||||
return new Response(transformed, {
|
||||
status: response.status,
|
||||
statusText: response.statusText,
|
||||
headers: {
|
||||
"Content-Type": "text/event-stream",
|
||||
"Cache-Control": "no-cache",
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export class QoderExecutor extends BaseExecutor {
|
||||
constructor() {
|
||||
super("qoder", PROVIDERS.qoder);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create Qoder signature using HMAC-SHA256
|
||||
* Formula: HMAC-SHA256(key=apiKey, message="UserAgent:sessionID:timestamp")
|
||||
*/
|
||||
createSignature(userAgent, sessionID, timestamp, apiKey) {
|
||||
if (!apiKey) return "";
|
||||
const payload = `${userAgent}:${sessionID}:${timestamp}`;
|
||||
const hmac = crypto.createHmac("sha256", apiKey);
|
||||
hmac.update(payload);
|
||||
return hmac.digest("hex");
|
||||
buildUrl() {
|
||||
return QODER_CHAT_URL_ENCODED;
|
||||
}
|
||||
|
||||
/**
|
||||
* Build headers with Qoder-specific signature
|
||||
*/
|
||||
buildHeaders(credentials, stream = true) {
|
||||
const sessionID = `session-${crypto.randomUUID()}`;
|
||||
const timestamp = Date.now();
|
||||
const userAgent = this.config.headers["User-Agent"] || "Qoder-Cli";
|
||||
const apiKey = credentials.apiKey || credentials.accessToken || "";
|
||||
// Override execute entirely — Qoder needs:
|
||||
// - body built from translated chat completion payload
|
||||
// - body encoded with QoderEncodeBody before signing
|
||||
// - COSY headers built from the *encoded* body bytes
|
||||
// - response stream re-wrapped from {statusCodeValue, body} to OpenAI SSE
|
||||
async execute({ model, body, stream, credentials, signal, log, proxyOptions = null }) {
|
||||
const url = this.buildUrl();
|
||||
|
||||
const signature = this.createSignature(userAgent, sessionID, timestamp, apiKey);
|
||||
const psd = credentials?.providerSpecificData || {};
|
||||
if (!psd.userId) {
|
||||
// No user id → no way to sign. Surface a 401 so the dashboard nudges
|
||||
// the user back to OAuth.
|
||||
const fakeResp = new Response(
|
||||
JSON.stringify({ error: { message: "qoder credential is missing userId; reconnect the account" } }),
|
||||
{ status: 401, headers: { "Content-Type": "application/json" } },
|
||||
);
|
||||
return { response: fakeResp, url, headers: {}, transformedBody: body };
|
||||
}
|
||||
|
||||
let qoderKey;
|
||||
let payload;
|
||||
try {
|
||||
({ qoderKey, payload } = await buildQoderRequestBody({ model, body, credentials, log }));
|
||||
} catch (err) {
|
||||
const fakeResp = new Response(
|
||||
JSON.stringify({ error: { message: err.message } }),
|
||||
{ status: 400, headers: { "Content-Type": "application/json" } },
|
||||
);
|
||||
return { response: fakeResp, url, headers: {}, transformedBody: body };
|
||||
}
|
||||
|
||||
const plainBody = Buffer.from(JSON.stringify(payload), "utf8");
|
||||
const encodedBodyStr = qoderEncodeBody(plainBody);
|
||||
const encodedBodyBuf = Buffer.from(encodedBodyStr, "latin1");
|
||||
|
||||
const cosyHeaders = buildCosyHeaders(
|
||||
encodedBodyBuf,
|
||||
url,
|
||||
{
|
||||
userId: psd.userId,
|
||||
authToken: credentials.accessToken,
|
||||
name: credentials.displayName || "",
|
||||
email: credentials.email || "",
|
||||
machineId: psd.machineId || "",
|
||||
},
|
||||
);
|
||||
|
||||
const modelSource = (payload.model_config && payload.model_config.source) || "system";
|
||||
const headers = {
|
||||
"Content-Type": "application/json",
|
||||
...this.config.headers,
|
||||
"session-id": sessionID,
|
||||
"x-qoder-timestamp": timestamp.toString(),
|
||||
"x-qoder-signature": signature,
|
||||
Accept: "text/event-stream",
|
||||
"Cache-Control": "no-cache",
|
||||
"X-Model-Key": qoderKey,
|
||||
"X-Model-Source": modelSource,
|
||||
// gzip triggers signature validation on Qoder's CDN; force identity.
|
||||
"Accept-Encoding": "identity",
|
||||
...cosyHeaders,
|
||||
};
|
||||
|
||||
if (credentials.apiKey) {
|
||||
headers["Authorization"] = `Bearer ${credentials.apiKey}`;
|
||||
} else if (credentials.accessToken) {
|
||||
headers["Authorization"] = `Bearer ${credentials.accessToken}`;
|
||||
let response;
|
||||
try {
|
||||
response = await proxyAwareFetch(
|
||||
url,
|
||||
{ method: "POST", headers, body: encodedBodyBuf, signal },
|
||||
proxyOptions,
|
||||
);
|
||||
} catch (err) {
|
||||
throw err;
|
||||
}
|
||||
|
||||
if (stream) {
|
||||
headers["Accept"] = "text/event-stream";
|
||||
if (!response.ok) {
|
||||
// Pass error response through unchanged so chatCore can capture it.
|
||||
return { response, url, headers, transformedBody: payload };
|
||||
}
|
||||
|
||||
return headers;
|
||||
const wrapped = wrapQoderSSE(response, `qoder/${qoderKey}`);
|
||||
return { response: wrapped, url, headers, transformedBody: payload };
|
||||
}
|
||||
|
||||
buildUrl(model, stream, urlIndex = 0, credentials = null) {
|
||||
return this.config.baseUrl;
|
||||
// Qoder device tokens don't refresh through OAuth — the upstream returns
|
||||
// 403 for our flow. Surfacing failure via 401-on-chat is enough; the
|
||||
// dashboard tells users to re-login when their token expires (~30 days).
|
||||
async refreshCredentials() {
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Inject stream_options for usage data on streaming requests
|
||||
*/
|
||||
transformRequest(model, body, stream, credentials) {
|
||||
if (stream && body.messages && !body.stream_options) {
|
||||
body.stream_options = { include_usage: true };
|
||||
}
|
||||
return body;
|
||||
needsRefresh() {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -14,6 +14,8 @@ const ALIAS_TO_PROVIDER_ID = {
|
||||
cl: "cline",
|
||||
oc: "opencode",
|
||||
ocg: "opencode-go",
|
||||
qd: "qoder",
|
||||
qoder: "qoder",
|
||||
// TTS providers
|
||||
el: "elevenlabs",
|
||||
// API Key providers
|
||||
|
||||
176
open-sse/services/qoderModels.js
Normal file
176
open-sse/services/qoderModels.js
Normal file
@@ -0,0 +1,176 @@
|
||||
/**
|
||||
* Qoder model catalog fetcher.
|
||||
*
|
||||
* Calls /algo/api/v2/model/list (COSY-signed) on the inference host to get
|
||||
* the live catalog for an authenticated Qoder account, then caches the
|
||||
* per-model `model_config` blocks by key. Chat requests later look up the
|
||||
* exact server-published metadata for the model they want — Qoder's chat
|
||||
* endpoint silently downgrades to a different model when the wrong
|
||||
* model_config is sent.
|
||||
*
|
||||
* On any error the live cache stays empty and chatExecuteCall surfaces the
|
||||
* problem to the user as "model config not yet fetched, retry shortly".
|
||||
*/
|
||||
|
||||
import { createHash } from "crypto";
|
||||
|
||||
import { proxyAwareFetch } from "../utils/proxyFetch.js";
|
||||
import { buildCosyHeaders } from "@/lib/qoder/cosy.js";
|
||||
import {
|
||||
QODER_MODEL_LIST_URL,
|
||||
} from "@/lib/qoder/constants.js";
|
||||
|
||||
const FETCH_TIMEOUT_MS = 15_000;
|
||||
const CACHE_TTL_MS = 60 * 60 * 1000; // 1h, same as the Kiro catalog
|
||||
|
||||
/** @type {Map<string, { expiresAt: number, models: any[], rawConfigs: Map<string, object>, fetched: boolean }>} */
|
||||
const catalogCache = new Map();
|
||||
|
||||
/**
|
||||
* Stable cache key per credential (so different login sessions for the same
|
||||
* account share an entry).
|
||||
*/
|
||||
function cacheKey(credentials) {
|
||||
const psd = credentials?.providerSpecificData || {};
|
||||
const seed = psd.userId || credentials?.refreshToken || credentials?.accessToken || "anonymous";
|
||||
return createHash("sha256").update(`qoder:${seed}`).digest("hex");
|
||||
}
|
||||
|
||||
/**
|
||||
* Strip credential -> COSY creds for buildCosyHeaders.
|
||||
*/
|
||||
function cosyCredsFromConnection(credentials) {
|
||||
const psd = credentials?.providerSpecificData || {};
|
||||
return {
|
||||
userId: psd.userId,
|
||||
authToken: credentials.accessToken,
|
||||
name: credentials.displayName || "",
|
||||
email: credentials.email || "",
|
||||
machineId: psd.machineId || "",
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Fetch the live model list for this credential. Returns:
|
||||
* { models: [{ id, name, contextLength, isVL, isReasoning, ... }, ...],
|
||||
* rawConfigs: Map<modelKey, modelConfigObject> }
|
||||
* or `null` on any error.
|
||||
*/
|
||||
async function fetchQoderCatalogRaw(credentials, signal, proxyOptions = null) {
|
||||
const creds = cosyCredsFromConnection(credentials);
|
||||
if (!creds.userId || !creds.authToken) return null;
|
||||
|
||||
const headers = {
|
||||
Accept: "application/json",
|
||||
"Accept-Encoding": "identity",
|
||||
...buildCosyHeaders(Buffer.alloc(0), QODER_MODEL_LIST_URL, creds),
|
||||
};
|
||||
|
||||
const controller = new AbortController();
|
||||
let timer = null;
|
||||
let abortListener = null;
|
||||
let response;
|
||||
try {
|
||||
timer = setTimeout(() => controller.abort("timeout"), FETCH_TIMEOUT_MS);
|
||||
if (signal && typeof signal.addEventListener === "function") {
|
||||
abortListener = () => controller.abort(signal.reason);
|
||||
signal.addEventListener("abort", abortListener);
|
||||
}
|
||||
response = await proxyAwareFetch(
|
||||
QODER_MODEL_LIST_URL,
|
||||
{
|
||||
method: "GET",
|
||||
headers,
|
||||
signal: controller.signal,
|
||||
},
|
||||
proxyOptions,
|
||||
);
|
||||
} finally {
|
||||
if (timer) clearTimeout(timer);
|
||||
if (signal && abortListener) signal.removeEventListener("abort", abortListener);
|
||||
}
|
||||
|
||||
if (!response.ok) return null;
|
||||
|
||||
const body = await response.json().catch(() => null);
|
||||
if (!body || !Array.isArray(body.chat)) return null;
|
||||
|
||||
const models = [];
|
||||
const rawConfigs = new Map();
|
||||
for (const entry of body.chat) {
|
||||
if (!entry || typeof entry !== "object") continue;
|
||||
const key = entry.key;
|
||||
if (!key) continue;
|
||||
if (entry.enable === false) continue;
|
||||
|
||||
rawConfigs.set(key, entry);
|
||||
|
||||
const display = entry.display_name || key;
|
||||
const ctx = Number(entry.max_input_tokens) || 131_072;
|
||||
models.push({
|
||||
id: key,
|
||||
name: `${display}`,
|
||||
contextLength: ctx,
|
||||
isVL: !!entry.is_vl,
|
||||
isReasoning: !!entry.is_reasoning,
|
||||
maxOutputTokens: Number(entry.max_output_tokens) || 0,
|
||||
description: entry.description || "",
|
||||
});
|
||||
}
|
||||
|
||||
return { models, rawConfigs };
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the cached model_config block for a given model key, fetching the
|
||||
* catalog first if needed. Returns null when the catalog can't be fetched
|
||||
* (so callers can fall back to the static registry).
|
||||
*/
|
||||
export async function getQoderModelConfig(credentials, modelKey, options = {}) {
|
||||
const cached = await resolveQoderModels(credentials, options);
|
||||
if (!cached) return null;
|
||||
const config = cached.rawConfigs.get(modelKey);
|
||||
if (!config) return null;
|
||||
// Defensive copy — chat code may mutate `key` to align with the alias path.
|
||||
return { ...config, key: modelKey };
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve the live model catalog + raw configs for a credential. Caches
|
||||
* results for CACHE_TTL_MS so repeated chat requests don't re-fetch.
|
||||
*/
|
||||
export async function resolveQoderModels(credentials, options = {}) {
|
||||
if (!credentials?.accessToken) return null;
|
||||
const psd = credentials.providerSpecificData || {};
|
||||
if (!psd.userId) return null;
|
||||
|
||||
const key = cacheKey(credentials);
|
||||
const now = Date.now();
|
||||
if (!options.forceRefresh) {
|
||||
const cached = catalogCache.get(key);
|
||||
if (cached && cached.expiresAt > now) {
|
||||
return cached;
|
||||
}
|
||||
}
|
||||
|
||||
const fetched = await fetchQoderCatalogRaw(credentials, options.signal, options.proxyOptions);
|
||||
if (!fetched) return null;
|
||||
|
||||
const entry = {
|
||||
expiresAt: now + CACHE_TTL_MS,
|
||||
models: fetched.models,
|
||||
rawConfigs: fetched.rawConfigs,
|
||||
fetched: true,
|
||||
};
|
||||
catalogCache.set(key, entry);
|
||||
return entry;
|
||||
}
|
||||
|
||||
export function invalidateQoderCatalog(credentials) {
|
||||
if (!credentials) return;
|
||||
catalogCache.delete(cacheKey(credentials));
|
||||
}
|
||||
|
||||
export function clearQoderCatalog() {
|
||||
catalogCache.clear();
|
||||
}
|
||||
@@ -77,6 +77,8 @@ export async function getUsageForProvider(connection, proxyOptions = null) {
|
||||
return await getCodexUsage(accessToken, proxyOptions);
|
||||
case "kiro":
|
||||
return await getKiroUsage(accessToken, providerSpecificData, proxyOptions);
|
||||
case "qoder":
|
||||
return await getQoderUsage(accessToken, proxyOptions);
|
||||
case "qwen":
|
||||
return await getQwenUsage(accessToken, providerSpecificData);
|
||||
case "iflow":
|
||||
@@ -1149,3 +1151,51 @@ async function getMiniMaxUsage(apiKey, provider, proxyOptions = null) {
|
||||
|
||||
return { message: lastErrorMessage ? `MiniMax connected. Unable to fetch usage: ${lastErrorMessage}` : "MiniMax connected. Unable to fetch usage." };
|
||||
}
|
||||
|
||||
async function getQoderUsage(accessToken, proxyOptions = null) {
|
||||
if (!accessToken) {
|
||||
return { message: "Qoder usage unavailable: no access token" };
|
||||
}
|
||||
try {
|
||||
const response = await proxyAwareFetch(
|
||||
"https://openapi.qoder.sh/api/v2/quota/usage",
|
||||
{
|
||||
method: "GET",
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`,
|
||||
Accept: "application/json",
|
||||
},
|
||||
},
|
||||
proxyOptions,
|
||||
);
|
||||
if (!response.ok) {
|
||||
return { message: `Qoder connected. Usage fetch returned ${response.status}.` };
|
||||
}
|
||||
const body = await response.json().catch(() => null);
|
||||
if (!body) {
|
||||
return { message: "Qoder connected. Usage response was not JSON." };
|
||||
}
|
||||
const userQuota = body.userQuota || {};
|
||||
const orgQuota = body.orgResourcePackage || {};
|
||||
const quotas = {
|
||||
user: {
|
||||
total: Number(userQuota.total) || 0,
|
||||
used: Number(userQuota.used) || 0,
|
||||
remaining: Number(userQuota.remaining) || 0,
|
||||
unit: userQuota.unit || "credits",
|
||||
},
|
||||
organization: {
|
||||
total: Number(orgQuota.total) || 0,
|
||||
used: Number(orgQuota.used) || 0,
|
||||
remaining: Number(orgQuota.remaining) || 0,
|
||||
unit: orgQuota.unit || "credits",
|
||||
},
|
||||
totalUsagePercentage: Number(body.totalUsagePercentage) || 0,
|
||||
isQuotaExceeded: !!body.isQuotaExceeded,
|
||||
expiresAt: Number(body.expiresAt) || null,
|
||||
};
|
||||
return { quotas };
|
||||
} catch (error) {
|
||||
return { message: `Qoder connected. Unable to fetch usage: ${error.message}` };
|
||||
}
|
||||
}
|
||||
|
||||
BIN
public/providers/qoder.png
Normal file
BIN
public/providers/qoder.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 7.0 KiB |
@@ -151,7 +151,7 @@ export async function GET(request, { params }) {
|
||||
: undefined;
|
||||
|
||||
// Providers that don't use PKCE for device code
|
||||
const noPkceDeviceProviders = ["github", "kiro", "kimi-coding", "kilocode", "codebuddy"];
|
||||
const noPkceDeviceProviders = ["github", "kiro", "kimi-coding", "kilocode", "codebuddy", "qoder"];
|
||||
let deviceData;
|
||||
if (noPkceDeviceProviders.includes(provider)) {
|
||||
deviceData = await requestDeviceCode(provider, undefined, deviceOptions);
|
||||
@@ -162,7 +162,9 @@ export async function GET(request, { params }) {
|
||||
|
||||
return NextResponse.json({
|
||||
...deviceData,
|
||||
codeVerifier: authData.codeVerifier,
|
||||
// Prefer the verifier the provider's requestDeviceCode generated for
|
||||
// itself (qoder rolls its own PKCE pair); fall back to the generic one.
|
||||
codeVerifier: deviceData.codeVerifier || authData.codeVerifier,
|
||||
});
|
||||
}
|
||||
|
||||
@@ -276,6 +278,14 @@ export async function POST(request, { params }) {
|
||||
} else if (provider === "kiro") {
|
||||
// Kiro needs extraData (clientId, clientSecret) from device code response
|
||||
result = await pollForToken(provider, deviceCode, null, extraData);
|
||||
} else if (provider === "qoder") {
|
||||
// Qoder needs both the PKCE verifier (codeVerifier) and the machineId
|
||||
// captured at device-code time (extraData._qoderMachineId) so
|
||||
// mapTokens can persist it for COSY signing.
|
||||
if (!codeVerifier) {
|
||||
return NextResponse.json({ error: "Missing code verifier" }, { status: 400 });
|
||||
}
|
||||
result = await pollForToken(provider, deviceCode, codeVerifier, extraData);
|
||||
} else {
|
||||
// Qwen and other PKCE providers
|
||||
if (!codeVerifier) {
|
||||
|
||||
@@ -5,6 +5,7 @@ import { GEMINI_CONFIG } from "@/lib/oauth/constants/oauth";
|
||||
import { refreshGoogleToken, updateProviderCredentials } from "@/sse/services/tokenRefresh";
|
||||
import { resolveOllamaLocalHost } from "open-sse/config/providers.js";
|
||||
import { resolveKiroModels } from "open-sse/services/kiroModels.js";
|
||||
import { resolveQoderModels } from "open-sse/services/qoderModels.js";
|
||||
|
||||
const GEMINI_CLI_MODELS_URL = "https://cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels";
|
||||
|
||||
@@ -286,6 +287,41 @@ const PROVIDER_MODELS_CONFIG = {
|
||||
return { models: [], warning };
|
||||
}
|
||||
},
|
||||
qoder: {
|
||||
customResolver: async (connection) => {
|
||||
const credentials = {
|
||||
accessToken: connection.accessToken,
|
||||
refreshToken: connection.refreshToken,
|
||||
email: connection.email,
|
||||
displayName: connection.displayName,
|
||||
providerSpecificData: connection.providerSpecificData || {},
|
||||
};
|
||||
let warning;
|
||||
try {
|
||||
const result = await resolveQoderModels(credentials, { forceRefresh: true });
|
||||
if (result?.models?.length) {
|
||||
return {
|
||||
models: result.models.map((m) => ({
|
||||
// Use the canonical "qoder/<key>" id so the dashboard
|
||||
// surfaces the same identifier the chat router expects.
|
||||
id: `qoder/${m.id}`,
|
||||
name: m.name,
|
||||
contextLength: m.contextLength,
|
||||
isVL: m.isVL,
|
||||
isReasoning: m.isReasoning,
|
||||
maxOutputTokens: m.maxOutputTokens,
|
||||
description: m.description,
|
||||
})),
|
||||
};
|
||||
}
|
||||
warning = "Qoder returned no models; falling back to static catalog.";
|
||||
} catch (error) {
|
||||
warning = `Failed to fetch Qoder models: ${error.message}`;
|
||||
console.log("Failed to fetch Qoder models dynamically, falling back to static:", error.message);
|
||||
}
|
||||
return { models: [], warning };
|
||||
},
|
||||
},
|
||||
"gemini-cli": {
|
||||
customResolver: buildOAuthResolver({
|
||||
refreshFn: (conn) => refreshGoogleToken(conn.refreshToken, GEMINI_CONFIG.clientId, GEMINI_CONFIG.clientSecret),
|
||||
|
||||
@@ -61,6 +61,15 @@ const OAUTH_TEST_CONFIG = {
|
||||
},
|
||||
qwen: { checkExpiry: true, refreshable: true },
|
||||
kiro: { checkExpiry: true, refreshable: true },
|
||||
qoder: {
|
||||
// Test by hitting Qoder's userinfo endpoint with the device token.
|
||||
url: "https://openapi.qoder.sh/api/v1/userinfo",
|
||||
method: "GET",
|
||||
authHeader: "Authorization",
|
||||
authPrefix: "Bearer ",
|
||||
checkExpiry: true,
|
||||
refreshable: false,
|
||||
},
|
||||
"kimi-coding": { checkExpiry: true, refreshable: false },
|
||||
cursor: { tokenExists: true },
|
||||
kilocode: {
|
||||
|
||||
@@ -8,6 +8,7 @@ import {
|
||||
import { getProviderConnections, getCombos, getCustomModels, getModelAliases } from "@/lib/localDb";
|
||||
import { getDisabledModels } from "@/lib/disabledModelsDb";
|
||||
import { resolveKiroModels } from "open-sse/services/kiroModels.js";
|
||||
import { resolveQoderModels } from "open-sse/services/qoderModels.js";
|
||||
|
||||
// Per-provider live model resolvers. Each receives a connection record and
|
||||
// returns { models: [{ id, name? }, ...] } | null on failure.
|
||||
@@ -20,6 +21,19 @@ const LIVE_MODEL_RESOLVERS = {
|
||||
providerSpecificData: conn.providerSpecificData || {}
|
||||
}, { log: console });
|
||||
return result?.models?.length ? { models: result.models } : null;
|
||||
},
|
||||
qoder: async (conn) => {
|
||||
const result = await resolveQoderModels({
|
||||
accessToken: conn.accessToken,
|
||||
refreshToken: conn.refreshToken,
|
||||
email: conn.email,
|
||||
displayName: conn.displayName,
|
||||
providerSpecificData: conn.providerSpecificData || {}
|
||||
});
|
||||
if (!result?.models?.length) return null;
|
||||
return {
|
||||
models: result.models.map((m) => ({ id: m.id, name: m.name })),
|
||||
};
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
@@ -63,15 +63,20 @@ export const QWEN_CONFIG = {
|
||||
codeChallengeMethod: "S256",
|
||||
};
|
||||
|
||||
// Qoder OAuth Configuration (Device Token Flow)
|
||||
// Qoder OAuth Configuration (Device Token Flow with PKCE).
|
||||
// Device tokens are long-lived (~30 days for access, ~360 for refresh).
|
||||
// The upstream refresh endpoint at center.qoder.sh returns 403 for our
|
||||
// flow — we accept that and surface it to the user as "re-login" instead
|
||||
// of attempting to silently rotate.
|
||||
export const QODER_CONFIG = {
|
||||
apiBaseUrl: "https://api2.qoder.sh",
|
||||
deviceTokenUrl: "https://api2.qoder.sh/api/v1/deviceToken/poll",
|
||||
deviceRefreshUrl: "https://api2.qoder.sh/api/v1/deviceToken/refresh",
|
||||
refreshUrl: "https://api2.qoder.sh/api/v3/user/refresh_token",
|
||||
userInfoUrl: "https://api2.qoder.sh/api/v1/userinfo",
|
||||
statusUrl: "https://api2.qoder.sh/api/v3/user/status",
|
||||
loginUrl: "https://qoder.com/login",
|
||||
openApiBaseUrl: "https://openapi.qoder.sh",
|
||||
centerBaseUrl: "https://center.qoder.sh",
|
||||
chatBaseUrl: "https://api3.qoder.sh",
|
||||
deviceTokenUrl: "https://openapi.qoder.sh/api/v1/deviceToken/poll",
|
||||
refreshUrl: "https://center.qoder.sh/algo/api/v3/user/refresh_token",
|
||||
userInfoUrl: "https://openapi.qoder.sh/api/v1/userinfo",
|
||||
quotaUsageUrl: "https://openapi.qoder.sh/api/v2/quota/usage",
|
||||
loginUrl: "https://qoder.com/device/selectAccounts",
|
||||
};
|
||||
|
||||
// iFlow OAuth Configuration (Authorization Code)
|
||||
|
||||
@@ -600,80 +600,93 @@ const PROVIDERS = {
|
||||
|
||||
qoder: {
|
||||
config: QODER_CONFIG,
|
||||
flowType: "authorization_code",
|
||||
buildAuthUrl: (config, redirectUri, state) => {
|
||||
const params = new URLSearchParams({
|
||||
client_id: config.clientId,
|
||||
response_type: "code",
|
||||
redirect_uri: redirectUri,
|
||||
state: state,
|
||||
});
|
||||
return `${config.authorizeUrl}?${params.toString()}`;
|
||||
flowType: "device_code",
|
||||
// Qoder uses a custom device flow: PKCE + nonce + machine_id are generated
|
||||
// locally, the user lands on qoder.com/device/selectAccounts in the
|
||||
// browser, and we poll openapi.qoder.sh until a `dt-...` token appears.
|
||||
requestDeviceCode: async (config) => {
|
||||
const { initiateDeviceFlow } = await import("@/lib/qoder/auth");
|
||||
const flow = initiateDeviceFlow();
|
||||
// Match the device_code shape the rest of the OAuthModal expects
|
||||
// (device_code, user_code, verification_uri[_complete], interval).
|
||||
// The poll endpoint identifies us by nonce+verifier, not by a
|
||||
// server-issued device_code, so we plumb our own values through:
|
||||
// device_code = nonce (modal forwards as deviceCode on poll)
|
||||
// codeVerifier = our PKCE verifier (route forwards as codeVerifier)
|
||||
return {
|
||||
device_code: flow.nonce,
|
||||
user_code: flow.nonce.slice(0, 8).toUpperCase(),
|
||||
verification_uri: config.loginUrl,
|
||||
verification_uri_complete: flow.verificationUriComplete,
|
||||
expires_in: 300,
|
||||
interval: 2,
|
||||
codeVerifier: flow.codeVerifier,
|
||||
_qoderNonce: flow.nonce,
|
||||
_qoderMachineId: flow.machineId,
|
||||
};
|
||||
},
|
||||
exchangeToken: async (config, code, redirectUri) => {
|
||||
const basicAuth = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
|
||||
|
||||
const response = await fetch(config.tokenUrl, {
|
||||
method: "POST",
|
||||
headers: {
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
Accept: "application/json",
|
||||
Authorization: `Basic ${basicAuth}`,
|
||||
pollToken: async (config, deviceCode, codeVerifier, extraData) => {
|
||||
const { pollDeviceToken, fetchUserInfo } = await import("@/lib/qoder/auth");
|
||||
const nonce = deviceCode || extraData?._qoderNonce;
|
||||
const verifier = codeVerifier || extraData?._qoderVerifier;
|
||||
if (!nonce || !verifier) {
|
||||
return {
|
||||
ok: false,
|
||||
data: { error: "invalid_request", error_description: "Missing nonce/verifier" },
|
||||
};
|
||||
}
|
||||
let result;
|
||||
try {
|
||||
result = await pollDeviceToken({ nonce, codeVerifier: verifier });
|
||||
} catch (err) {
|
||||
return {
|
||||
ok: false,
|
||||
data: { error: "poll_failed", error_description: err.message },
|
||||
};
|
||||
}
|
||||
if (result.status === "pending") {
|
||||
return { ok: false, data: { error: "authorization_pending" } };
|
||||
}
|
||||
// Best-effort profile lookup so we have a name/email to display.
|
||||
const userInfo = await fetchUserInfo(result.accessToken);
|
||||
// expireTime is a Unix-ms timestamp from parseExpiry, which already
|
||||
// falls back to "now + 30 days" when the upstream omits expiry. Floor
|
||||
// to a sane minimum (1 day) so a stale or skewed upstream timestamp
|
||||
// doesn't truncate the stored token below something useful.
|
||||
const minSeconds = 24 * 60 * 60;
|
||||
const remainingSeconds = Math.floor((result.expireTime - Date.now()) / 1000);
|
||||
const expiresIn = Math.max(minSeconds, remainingSeconds);
|
||||
return {
|
||||
ok: true,
|
||||
data: {
|
||||
access_token: result.accessToken,
|
||||
refresh_token: result.refreshToken,
|
||||
expires_in: expiresIn,
|
||||
_qoderUserId: result.userId,
|
||||
_qoderMachineId: extraData?._qoderMachineId || "",
|
||||
_qoderName: userInfo.name,
|
||||
_qoderEmail: userInfo.email,
|
||||
_qoderOrganizationId: userInfo.organizationId,
|
||||
},
|
||||
body: new URLSearchParams({
|
||||
grant_type: "authorization_code",
|
||||
code: code,
|
||||
redirect_uri: redirectUri,
|
||||
client_id: config.clientId,
|
||||
client_secret: config.clientSecret,
|
||||
}),
|
||||
});
|
||||
|
||||
if (!response.ok) {
|
||||
const error = await response.text();
|
||||
throw new Error(`Token exchange failed: ${error}`);
|
||||
}
|
||||
|
||||
return await response.json();
|
||||
};
|
||||
},
|
||||
postExchange: async (tokens) => {
|
||||
// Fetch user info (MUST succeed to get API key)
|
||||
const userInfoRes = await fetch(
|
||||
`${QODER_CONFIG.userInfoUrl}?accessToken=${encodeURIComponent(tokens.access_token)}`,
|
||||
{ headers: { Accept: "application/json" } }
|
||||
);
|
||||
|
||||
if (!userInfoRes.ok) {
|
||||
const errorText = await userInfoRes.text();
|
||||
throw new Error(`Failed to fetch user info: ${errorText}`);
|
||||
}
|
||||
|
||||
const result = await userInfoRes.json();
|
||||
if (!result.success) {
|
||||
throw new Error(`User info request failed: ${result.message || "Unknown error"}`);
|
||||
}
|
||||
|
||||
const userInfo = result.data || {};
|
||||
|
||||
if (!userInfo.apiKey || userInfo.apiKey.trim() === "") {
|
||||
throw new Error("Empty API key returned from Qoder");
|
||||
}
|
||||
|
||||
const email = userInfo.email?.trim() || userInfo.phone?.trim();
|
||||
if (!email) {
|
||||
throw new Error("Missing account email/phone in user info");
|
||||
}
|
||||
|
||||
return { userInfo };
|
||||
mapTokens: (tokens) => {
|
||||
const email = (tokens._qoderEmail || "").trim() || null;
|
||||
const displayName = (tokens._qoderName || "").trim() || null;
|
||||
return {
|
||||
accessToken: tokens.access_token,
|
||||
refreshToken: tokens.refresh_token || null,
|
||||
expiresIn: tokens.expires_in,
|
||||
email,
|
||||
displayName,
|
||||
providerSpecificData: {
|
||||
authMethod: "device",
|
||||
userId: tokens._qoderUserId || "",
|
||||
machineId: tokens._qoderMachineId || "",
|
||||
organizationId: tokens._qoderOrganizationId || "",
|
||||
},
|
||||
};
|
||||
},
|
||||
mapTokens: (tokens, extra) => ({
|
||||
accessToken: tokens.access_token,
|
||||
refreshToken: tokens.refresh_token,
|
||||
expiresIn: tokens.expires_in,
|
||||
apiKey: extra?.userInfo?.apiKey,
|
||||
email: extra?.userInfo?.email || extra?.userInfo?.phone,
|
||||
displayName: extra?.userInfo?.nickname || extra?.userInfo?.name,
|
||||
}),
|
||||
},
|
||||
|
||||
qwen: {
|
||||
|
||||
172
src/lib/qoder/auth.js
Normal file
172
src/lib/qoder/auth.js
Normal file
@@ -0,0 +1,172 @@
|
||||
/**
|
||||
* Qoder device flow authentication.
|
||||
*
|
||||
* The flow has three steps:
|
||||
* 1. Generate a PKCE pair locally and a fresh nonce + machine id.
|
||||
* 2. Open https://qoder.com/device/selectAccounts?challenge=...&nonce=...
|
||||
* in the user's browser.
|
||||
* 3. Poll openapi.qoder.sh/api/v1/deviceToken/poll until the user authorizes
|
||||
* and the upstream returns a `dt-...` access token.
|
||||
*
|
||||
* Tokens live ~30 days; refresh is a no-op (the upstream refresh endpoint
|
||||
* returns 403 for our flow). Users re-run login when expired.
|
||||
*/
|
||||
|
||||
import crypto from "crypto";
|
||||
import { v4 as uuidv4 } from "uuid";
|
||||
|
||||
import {
|
||||
QODER_DEVICE_TOKEN_URL,
|
||||
QODER_LOGIN_URL,
|
||||
QODER_USERINFO_URL,
|
||||
} from "./constants.js";
|
||||
|
||||
function base64Url(buf) {
|
||||
return buf
|
||||
.toString("base64")
|
||||
.replace(/=/g, "")
|
||||
.replace(/\+/g, "-")
|
||||
.replace(/\//g, "_");
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate a PKCE verifier + S256 challenge pair.
|
||||
* Uses 32 random bytes (matches qodercli/Veria).
|
||||
*/
|
||||
export function generatePkcePair() {
|
||||
const verifier = base64Url(crypto.randomBytes(32));
|
||||
const challenge = base64Url(crypto.createHash("sha256").update(verifier).digest());
|
||||
return { verifier, challenge };
|
||||
}
|
||||
|
||||
/**
|
||||
* Initiate the device flow. Returns the URL to open in a browser plus the
|
||||
* verifier/nonce/machineId we'll need to poll and to sign future requests.
|
||||
*/
|
||||
export function initiateDeviceFlow() {
|
||||
const { verifier, challenge } = generatePkcePair();
|
||||
const nonce = uuidv4();
|
||||
const machineId = uuidv4();
|
||||
|
||||
const params = new URLSearchParams({
|
||||
challenge,
|
||||
challenge_method: "S256",
|
||||
machine_id: machineId,
|
||||
nonce,
|
||||
});
|
||||
|
||||
return {
|
||||
verificationUriComplete: `${QODER_LOGIN_URL}?${params.toString()}`,
|
||||
codeVerifier: verifier,
|
||||
nonce,
|
||||
machineId,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Single poll attempt. Returns one of:
|
||||
* { status: "pending" } — keep polling
|
||||
* { status: "ok", token, ... } — user authorized, tokens captured
|
||||
* throws Error — terminal failure
|
||||
*
|
||||
* Upstream returns 202/404 while waiting; 200 with a JSON body when done.
|
||||
*/
|
||||
export async function pollDeviceToken({ nonce, codeVerifier }) {
|
||||
if (!nonce || !codeVerifier) {
|
||||
throw new Error("pollDeviceToken: missing nonce or code verifier");
|
||||
}
|
||||
const url = `${QODER_DEVICE_TOKEN_URL}?nonce=${encodeURIComponent(nonce)}&verifier=${encodeURIComponent(codeVerifier)}&challenge_method=S256`;
|
||||
|
||||
const response = await fetch(url, {
|
||||
method: "GET",
|
||||
headers: {
|
||||
Accept: "application/json",
|
||||
"User-Agent": "Go-http-client/2.0",
|
||||
},
|
||||
});
|
||||
|
||||
// Pending — server has registered the device code but the user hasn't
|
||||
// finished the browser flow yet. Both 202 and 404 mean "keep polling".
|
||||
if (response.status === 202 || response.status === 404) {
|
||||
return { status: "pending" };
|
||||
}
|
||||
|
||||
const text = await response.text();
|
||||
|
||||
if (!response.ok) {
|
||||
let message = `Qoder device token poll failed: HTTP ${response.status}`;
|
||||
try {
|
||||
const body = JSON.parse(text);
|
||||
if (body.message) message = `Qoder device token poll failed: ${body.message}`;
|
||||
} catch {}
|
||||
throw new Error(message);
|
||||
}
|
||||
|
||||
let body;
|
||||
try {
|
||||
body = JSON.parse(text);
|
||||
} catch (err) {
|
||||
throw new Error(`Qoder device token poll: invalid JSON response (${err.message})`);
|
||||
}
|
||||
|
||||
// Defensive: 200 + empty token means the upstream changed shape.
|
||||
if (!body.token) {
|
||||
throw new Error("Qoder device token poll returned 200 but no token");
|
||||
}
|
||||
|
||||
const expireMs = parseExpiry(body.expires_at, body.expires_in);
|
||||
|
||||
return {
|
||||
status: "ok",
|
||||
accessToken: body.token,
|
||||
refreshToken: body.refresh_token || "",
|
||||
userId: body.user_id || "",
|
||||
expireTime: expireMs,
|
||||
rawResponse: body,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Fetch profile info for the freshly-issued token. Best-effort — failures
|
||||
* shouldn't block login; returning empty strings is fine.
|
||||
*/
|
||||
export async function fetchUserInfo(accessToken) {
|
||||
try {
|
||||
const response = await fetch(QODER_USERINFO_URL, {
|
||||
method: "GET",
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`,
|
||||
Accept: "application/json",
|
||||
"User-Agent": "Go-http-client/2.0",
|
||||
},
|
||||
});
|
||||
if (!response.ok) return { name: "", email: "" };
|
||||
const body = await response.json();
|
||||
return {
|
||||
name: (body.name || body.username || "").trim(),
|
||||
email: (body.email || "").trim(),
|
||||
organizationId: (body.organization_id || "").trim(),
|
||||
};
|
||||
} catch {
|
||||
return { name: "", email: "" };
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Convert the upstream's expiry hint into a Unix-millisecond timestamp.
|
||||
* Accepts RFC3339 strings, ms-epoch integer strings, or seconds-from-now
|
||||
* (`expires_in`). Falls back to "now + 30 days" when both are missing.
|
||||
*/
|
||||
function parseExpiry(expiresAt, expiresInSeconds) {
|
||||
const trimmed = typeof expiresAt === "string" ? expiresAt.trim() : "";
|
||||
if (trimmed) {
|
||||
const parsed = Date.parse(trimmed);
|
||||
if (!Number.isNaN(parsed)) return parsed;
|
||||
const ms = Number.parseInt(trimmed, 10);
|
||||
if (!Number.isNaN(ms) && ms > 0) return ms;
|
||||
}
|
||||
if (typeof expiresInSeconds === "number" && expiresInSeconds > 0) {
|
||||
return Date.now() + expiresInSeconds * 1000;
|
||||
}
|
||||
return Date.now() + 30 * 24 * 60 * 60 * 1000;
|
||||
}
|
||||
63
src/lib/qoder/constants.js
Normal file
63
src/lib/qoder/constants.js
Normal file
@@ -0,0 +1,63 @@
|
||||
/**
|
||||
* Qoder API constants ported from CLIProxyAPIPlus qoder-provider branch.
|
||||
*
|
||||
* Endpoint set:
|
||||
* openapi.qoder.sh - device flow + userinfo + quota usage
|
||||
* center.qoder.sh - token refresh (best-effort, currently 403 for device tokens)
|
||||
* api3.qoder.sh - inference (chat) + model list, requires COSY signing
|
||||
* qoder.com/device - browser landing page for device authorization
|
||||
*/
|
||||
|
||||
export const QODER_OPENAPI_BASE = "https://openapi.qoder.sh";
|
||||
export const QODER_CENTER_BASE = "https://center.qoder.sh";
|
||||
export const QODER_CHAT_BASE = "https://api3.qoder.sh";
|
||||
|
||||
export const QODER_LOGIN_URL = "https://qoder.com/device/selectAccounts";
|
||||
|
||||
// Device flow endpoints
|
||||
export const QODER_DEVICE_TOKEN_URL = `${QODER_OPENAPI_BASE}/api/v1/deviceToken/poll`;
|
||||
export const QODER_USERINFO_URL = `${QODER_OPENAPI_BASE}/api/v1/userinfo`;
|
||||
export const QODER_QUOTA_USAGE_URL = `${QODER_OPENAPI_BASE}/api/v2/quota/usage`;
|
||||
export const QODER_REFRESH_TOKEN_URL = `${QODER_CENTER_BASE}/algo/api/v3/user/refresh_token`;
|
||||
|
||||
// Inference endpoints (under /algo on api3.qoder.sh, all COSY-signed)
|
||||
export const QODER_CHAT_SIG_PATH = "/api/v2/service/pro/sse/agent_chat_generation";
|
||||
export const QODER_CHAT_URL = `${QODER_CHAT_BASE}/algo${QODER_CHAT_SIG_PATH}?FetchKeys=llm_model_result&AgentId=agent_common`;
|
||||
export const QODER_CHAT_URL_ENCODED = `${QODER_CHAT_URL}&Encode=1`;
|
||||
export const QODER_MODEL_LIST_URL = `${QODER_CHAT_BASE}/algo/api/v2/model/list`;
|
||||
|
||||
// COSY header constants. These are not arbitrary — the upstream signature
|
||||
// validation matches them against the values used at signing time.
|
||||
export const QODER_IDE_VERSION = "1.0.0";
|
||||
export const QODER_CLIENT_TYPE = "5";
|
||||
export const QODER_DATA_POLICY = "disagree";
|
||||
export const QODER_LOGIN_VERSION = "v2";
|
||||
export const QODER_MACHINE_OS = "x86_64_windows";
|
||||
export const QODER_MACHINE_TYPE = "5";
|
||||
|
||||
// Canonical model identifiers. Identity map — keep as a map so callers can
|
||||
// cheaply test "is this a known qoder model?" before sending the request.
|
||||
export const QODER_MODEL_MAP = {
|
||||
// Tier models
|
||||
auto: "auto",
|
||||
ultimate: "ultimate",
|
||||
performance: "performance",
|
||||
efficient: "efficient",
|
||||
lite: "lite",
|
||||
// Frontier models
|
||||
qmodel: "qmodel",
|
||||
dmodel: "dmodel",
|
||||
dfmodel: "dfmodel",
|
||||
gm51model: "gm51model",
|
||||
kmodel: "kmodel",
|
||||
mmodel: "mmodel",
|
||||
};
|
||||
|
||||
// RSA public key for COSY encryption (extracted from Qoder IDE v0.9).
|
||||
// Matches the CLIProxyAPIPlus branch and live qodercli traffic.
|
||||
export const QODER_RSA_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
|
||||
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA8iMH5c02LilrsERw9t6Pv5Nc
|
||||
4k6Pz1EaDicBMpdpxKduSZu5OANqUq8er4GM95omAGIOPOh+Nx0spthYA2BqGz+l
|
||||
6HRkPJ7S236FZz73In/KVuLnwI8JJ2CbuJap8kvheCCZpmAWpb/cPx/3Vr/J6I17
|
||||
XcW+ML9FoCI6AOvOzwIDAQAB
|
||||
-----END PUBLIC KEY-----`;
|
||||
175
src/lib/qoder/cosy.js
Normal file
175
src/lib/qoder/cosy.js
Normal file
@@ -0,0 +1,175 @@
|
||||
/**
|
||||
* Qoder COSY (hybrid RSA+AES+MD5) signing, ported from CLIProxyAPIPlus
|
||||
* qoder-provider branch (internal/auth/qoder/cosy.go).
|
||||
*
|
||||
* Every signed request carries:
|
||||
* - an AES-128-CBC payload of the user info, the AES key wrapped in RSA
|
||||
* - an MD5 signature over `payload || cosyKey || timestamp || body || sigPath`
|
||||
* - the body's MD5 hash + length so the server can validate integrity
|
||||
* - 17 Cosy-* / X-* headers fingerprinting the client (machine id, IDE
|
||||
* version, organization id, etc.)
|
||||
*
|
||||
* The on-the-wire header keys use the same casing as qodercli:
|
||||
* Cosy-Machineid, not Cosy-MachineID.
|
||||
*/
|
||||
|
||||
import crypto from "crypto";
|
||||
import { v4 as uuidv4 } from "uuid";
|
||||
|
||||
import {
|
||||
QODER_CLIENT_TYPE,
|
||||
QODER_DATA_POLICY,
|
||||
QODER_IDE_VERSION,
|
||||
QODER_LOGIN_VERSION,
|
||||
QODER_MACHINE_OS,
|
||||
QODER_MACHINE_TYPE,
|
||||
QODER_RSA_PUBLIC_KEY,
|
||||
} from "./constants.js";
|
||||
|
||||
// AES-128 wants a 16-byte key. Match qodercli/Veria: take the first 16 chars
|
||||
// of a fresh UUID's canonical string (hyphens included). The key is fresh
|
||||
// per request so even though the IV reuses the key bytes, each request still
|
||||
// has a unique IV.
|
||||
function generateAesKey() {
|
||||
return uuidv4().slice(0, 16);
|
||||
}
|
||||
|
||||
function pkcs7Pad(data, blockSize) {
|
||||
const padding = blockSize - (data.length % blockSize);
|
||||
const padded = Buffer.alloc(data.length + padding, padding);
|
||||
data.copy(padded, 0);
|
||||
return padded;
|
||||
}
|
||||
|
||||
function aesEncryptCbcBase64(plaintext, keyStr) {
|
||||
const keyBytes = Buffer.from(keyStr, "utf8");
|
||||
if (keyBytes.length !== 16) {
|
||||
throw new Error(`aes key must be 16 bytes, got ${keyBytes.length}`);
|
||||
}
|
||||
const iv = keyBytes.subarray(0, 16);
|
||||
const cipher = crypto.createCipheriv("aes-128-cbc", keyBytes, iv);
|
||||
cipher.setAutoPadding(false);
|
||||
const padded = pkcs7Pad(Buffer.from(plaintext, "utf8"), 16);
|
||||
const encrypted = Buffer.concat([cipher.update(padded), cipher.final()]);
|
||||
return encrypted.toString("base64");
|
||||
}
|
||||
|
||||
function rsaEncryptBase64(data) {
|
||||
const encrypted = crypto.publicEncrypt(
|
||||
{ key: QODER_RSA_PUBLIC_KEY, padding: crypto.constants.RSA_PKCS1_PADDING },
|
||||
Buffer.from(data, "utf8"),
|
||||
);
|
||||
return encrypted.toString("base64");
|
||||
}
|
||||
|
||||
function encryptUserInfo(userInfo) {
|
||||
const aesKey = generateAesKey();
|
||||
const plaintext = JSON.stringify(userInfo);
|
||||
const infoB64 = aesEncryptCbcBase64(plaintext, aesKey);
|
||||
const cosyKeyB64 = rsaEncryptBase64(aesKey);
|
||||
return { cosyKey: cosyKeyB64, info: infoB64 };
|
||||
}
|
||||
|
||||
function md5Hex(input) {
|
||||
return crypto.createHash("md5").update(input).digest("hex");
|
||||
}
|
||||
|
||||
/**
|
||||
* Strip the leading "/algo" prefix from the request path. Matches qodercli
|
||||
* convention. Empty input returns "".
|
||||
*/
|
||||
function computeSigPath(requestUrl) {
|
||||
let pathname;
|
||||
try {
|
||||
pathname = new URL(requestUrl).pathname || "";
|
||||
} catch {
|
||||
return "";
|
||||
}
|
||||
if (pathname.startsWith("/algo")) {
|
||||
return pathname.slice("/algo".length);
|
||||
}
|
||||
return pathname;
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate a fresh machine UUID. Persisted on the connection record so
|
||||
* every request from the same auth carries the same machineId.
|
||||
*/
|
||||
export function generateMachineId() {
|
||||
return uuidv4();
|
||||
}
|
||||
|
||||
/**
|
||||
* Build the full Cosy-* header set for a single Qoder request.
|
||||
*
|
||||
* @param {Buffer|Uint8Array|string} body The exact bytes that will be sent.
|
||||
* For GET requests pass an empty Buffer / "".
|
||||
* @param {string} requestUrl Full request URL (used for sigPath).
|
||||
* @param {object} creds
|
||||
* @param {string} creds.userId Stable Qoder user id.
|
||||
* @param {string} creds.authToken Device access token (`dt-...`).
|
||||
* @param {string} [creds.name] Display name (optional).
|
||||
* @param {string} [creds.email] Email (optional, can be empty).
|
||||
* @param {string} [creds.machineId] Persisted machine UUID.
|
||||
* @returns {Record<string, string>} Header map ready to merge onto fetch().
|
||||
*/
|
||||
export function buildCosyHeaders(body, requestUrl, creds) {
|
||||
if (!creds?.userId) throw new Error("cosy: user id is empty");
|
||||
if (!creds?.authToken) throw new Error("cosy: auth token is empty");
|
||||
|
||||
const bodyBuf = Buffer.isBuffer(body)
|
||||
? body
|
||||
: typeof body === "string"
|
||||
? Buffer.from(body, "latin1")
|
||||
: Buffer.from(body || []);
|
||||
|
||||
const { cosyKey, info } = encryptUserInfo({
|
||||
uid: creds.userId,
|
||||
security_oauth_token: creds.authToken,
|
||||
name: creds.name || "",
|
||||
aid: "",
|
||||
email: creds.email || "",
|
||||
});
|
||||
|
||||
const timestamp = String(Math.floor(Date.now() / 1000));
|
||||
const requestId = uuidv4();
|
||||
|
||||
const payloadJson = JSON.stringify({
|
||||
version: "v1",
|
||||
requestId,
|
||||
info,
|
||||
cosyVersion: QODER_IDE_VERSION,
|
||||
ideVersion: "",
|
||||
});
|
||||
const payloadB64 = Buffer.from(payloadJson, "utf8").toString("base64");
|
||||
|
||||
const sigPath = computeSigPath(requestUrl);
|
||||
const sigInput = `${payloadB64}\n${cosyKey}\n${timestamp}\n${bodyBuf.toString("latin1")}\n${sigPath}`;
|
||||
const sig = md5Hex(Buffer.from(sigInput, "latin1"));
|
||||
|
||||
const machineId = creds.machineId || generateMachineId();
|
||||
const bodyHash = md5Hex(bodyBuf);
|
||||
const bodyLength = String(bodyBuf.length);
|
||||
|
||||
return {
|
||||
Authorization: `Bearer COSY.${payloadB64}.${sig}`,
|
||||
"Cosy-Key": cosyKey,
|
||||
"Cosy-User": creds.userId,
|
||||
"Cosy-Date": timestamp,
|
||||
"Cosy-Version": QODER_IDE_VERSION,
|
||||
"Cosy-Machineid": machineId,
|
||||
"Cosy-Machinetoken": machineId,
|
||||
"Cosy-Machinetype": QODER_MACHINE_TYPE,
|
||||
"Cosy-Machineos": QODER_MACHINE_OS,
|
||||
"Cosy-Clienttype": QODER_CLIENT_TYPE,
|
||||
"Cosy-Clientip": "127.0.0.1",
|
||||
"Cosy-Bodyhash": bodyHash,
|
||||
"Cosy-Bodylength": bodyLength,
|
||||
"Cosy-Sigpath": sigPath,
|
||||
"Cosy-Data-Policy": QODER_DATA_POLICY,
|
||||
"Cosy-Organization-Id": "",
|
||||
"Cosy-Organization-Tags": "",
|
||||
"Login-Version": QODER_LOGIN_VERSION,
|
||||
"X-Request-Id": uuidv4(),
|
||||
};
|
||||
}
|
||||
55
src/lib/qoder/encoding.js
Normal file
55
src/lib/qoder/encoding.js
Normal file
@@ -0,0 +1,55 @@
|
||||
/**
|
||||
* Qoder body encoding ported from qoder2api's QoderEncoding.java (via the
|
||||
* CLIProxyAPIPlus qoder-provider branch).
|
||||
*
|
||||
* Algorithm:
|
||||
* 1. base64-encode the plaintext bytes (standard alphabet).
|
||||
* 2. Rearrange: split into thirds, reorder as [tail][mid][head].
|
||||
* 3. Substitute each character via a custom alphabet mapping.
|
||||
*
|
||||
* The encoded body must be sent with `&Encode=1` appended to the URL so the
|
||||
* server decodes in reverse. The obfuscation prevents Alibaba Cloud WAF from
|
||||
* pattern-matching the plaintext request body.
|
||||
*/
|
||||
|
||||
const QODER_STD_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
|
||||
const QODER_CUSTOM_ALPHABET = "_doRTgHZBKcGVjlvpC,@aFSx#DPuNJme&i*MzLOEn)sUrthbf%Y^w.(kIQyXqWA!";
|
||||
|
||||
const QODER_S2C = (() => {
|
||||
const table = new Int16Array(128).fill(-1);
|
||||
for (let i = 0; i < 64; i++) {
|
||||
table[QODER_STD_ALPHABET.charCodeAt(i)] = QODER_CUSTOM_ALPHABET.charCodeAt(i);
|
||||
}
|
||||
table["=".charCodeAt(0)] = "$".charCodeAt(0);
|
||||
return table;
|
||||
})();
|
||||
|
||||
/**
|
||||
* Encode plaintext bytes/string using Qoder's WAF-bypass scheme.
|
||||
* @param {Buffer|Uint8Array|string} plaintext
|
||||
* @returns {string} encoded string
|
||||
*/
|
||||
export function qoderEncodeBody(plaintext) {
|
||||
const buf = Buffer.isBuffer(plaintext)
|
||||
? plaintext
|
||||
: typeof plaintext === "string"
|
||||
? Buffer.from(plaintext, "utf8")
|
||||
: Buffer.from(plaintext);
|
||||
|
||||
const std = buf.toString("base64");
|
||||
const n = std.length;
|
||||
const a = Math.floor(n / 3);
|
||||
// [tail][mid][head]
|
||||
const rearranged = std.slice(n - a) + std.slice(a, n - a) + std.slice(0, a);
|
||||
|
||||
const out = Buffer.alloc(n);
|
||||
for (let i = 0; i < n; i++) {
|
||||
const c = rearranged.charCodeAt(i);
|
||||
if (c < 128 && QODER_S2C[c] >= 0) {
|
||||
out[i] = QODER_S2C[c];
|
||||
} else {
|
||||
out[i] = c;
|
||||
}
|
||||
}
|
||||
return out.toString("latin1");
|
||||
}
|
||||
@@ -152,7 +152,7 @@ export default function OAuthModal({ isOpen, provider, providerInfo, onSuccess,
|
||||
setError(null);
|
||||
|
||||
// Device code flow providers
|
||||
const deviceCodeProviders = ["github", "qwen", "kiro", "kimi-coding", "kilocode", "codebuddy"];
|
||||
const deviceCodeProviders = ["github", "qwen", "kiro", "kimi-coding", "kilocode", "codebuddy", "qoder"];
|
||||
if (deviceCodeProviders.includes(provider)) {
|
||||
setIsDeviceCode(true);
|
||||
setStep("waiting");
|
||||
@@ -175,7 +175,9 @@ export default function OAuthModal({ isOpen, provider, providerInfo, onSuccess,
|
||||
const verifyUrl = data.verification_uri_complete || data.verification_uri;
|
||||
if (verifyUrl) window.open(verifyUrl, "_blank", "noopener,noreferrer");
|
||||
|
||||
// Pass extraData for Kiro (contains _clientId, _clientSecret)
|
||||
// Pass extraData for Kiro (contains _clientId, _clientSecret) and
|
||||
// Qoder (contains _qoderMachineId / _qoderNonce — needed so mapTokens
|
||||
// can persist the machine id alongside the token).
|
||||
const extraData = provider === "kiro"
|
||||
? {
|
||||
_clientId: data._clientId,
|
||||
@@ -184,6 +186,12 @@ export default function OAuthModal({ isOpen, provider, providerInfo, onSuccess,
|
||||
_authMethod: data._authMethod,
|
||||
_startUrl: data._startUrl,
|
||||
}
|
||||
: provider === "qoder"
|
||||
? {
|
||||
_qoderNonce: data._qoderNonce,
|
||||
_qoderMachineId: data._qoderMachineId,
|
||||
_qoderVerifier: data.codeVerifier,
|
||||
}
|
||||
: null;
|
||||
startPolling(data.device_code, data.codeVerifier, data.interval || 5, extraData);
|
||||
return;
|
||||
|
||||
@@ -9,7 +9,7 @@ export const FREE_PROVIDERS = {
|
||||
"gemini-cli": { id: "gemini-cli", alias: "gc", name: "Gemini CLI", icon: "terminal", color: "#4285F4", deprecated: true, deprecationNotice: RISK_NOTICE, website: "https://github.com/google-gemini/gemini-cli", notice: { signupUrl: "https://github.com/google-gemini/gemini-cli" } },
|
||||
// gitlab: { id: "gitlab", alias: "gl", name: "GitLab Duo", icon: "code", color: "#FC6D26" },
|
||||
// codebuddy: { id: "codebuddy", alias: "cb", name: "CodeBuddy", icon: "smart_toy", color: "#006EFF" },
|
||||
// qoder: { id: "qoder", alias: "qd", name: "Qoder AI", icon: "water_drop", color: "#EC4899" },
|
||||
qoder: { id: "qoder", alias: "qd", name: "Qoder AI", icon: "water_drop", color: "#EC4899", deprecated: true, deprecationNotice: RISK_NOTICE, website: "https://qoder.com", notice: { signupUrl: "https://qoder.com" } },
|
||||
// iflow: { id: "iflow", alias: "if", name: "iFlow AI", icon: "water_drop", color: "#6366F1", website: "https://iflow.cn", notice: { signupUrl: "https://iflow.cn" } },
|
||||
opencode: { id: "opencode", alias: "oc", name: "OpenCode Free", icon: "terminal", color: "#E87040", textIcon: "OC", noAuth: true, passthroughModels: true, modelsFetcher: { url: "https://opencode.ai/zen/v1/models", type: "opencode-free" } },
|
||||
};
|
||||
|
||||
238
tests/unit/qoder.test.js
Normal file
238
tests/unit/qoder.test.js
Normal file
@@ -0,0 +1,238 @@
|
||||
/**
|
||||
* Unit tests for Qoder encoding + COSY signing primitives.
|
||||
*
|
||||
* These cover the parts that would silently produce wrong-but-plausible
|
||||
* output if logic regressed:
|
||||
* - body encoder boundary cases (empty input, lengths not divisible by 3)
|
||||
* - COSY header production (signature deterministic given fixed inputs,
|
||||
* all required headers present, sigPath correctly stripped)
|
||||
* - device flow URL construction
|
||||
*/
|
||||
|
||||
import { describe, it, expect } from "vitest";
|
||||
import crypto from "crypto";
|
||||
|
||||
import { qoderEncodeBody } from "../../src/lib/qoder/encoding.js";
|
||||
import { buildCosyHeaders } from "../../src/lib/qoder/cosy.js";
|
||||
import { initiateDeviceFlow, generatePkcePair } from "../../src/lib/qoder/auth.js";
|
||||
import { QODER_CHAT_URL_ENCODED, QODER_MODEL_LIST_URL } from "../../src/lib/qoder/constants.js";
|
||||
|
||||
describe("qoderEncodeBody", () => {
|
||||
it("preserves base64 length (input length divisible by 3)", () => {
|
||||
const input = Buffer.from("abcdef", "utf8"); // 6 bytes → 8 base64 chars
|
||||
const encoded = qoderEncodeBody(input);
|
||||
expect(encoded.length).toBe(8);
|
||||
});
|
||||
|
||||
it("preserves base64 length (input length not divisible by 3)", () => {
|
||||
const input = Buffer.from("hello", "utf8"); // 5 bytes → 8 base64 chars (with padding)
|
||||
const encoded = qoderEncodeBody(input);
|
||||
expect(encoded.length).toBe(8);
|
||||
});
|
||||
|
||||
it("handles empty input without throwing", () => {
|
||||
const encoded = qoderEncodeBody(Buffer.alloc(0));
|
||||
expect(encoded).toBe("");
|
||||
});
|
||||
|
||||
it("accepts string and Buffer inputs equivalently", () => {
|
||||
const a = qoderEncodeBody("hello");
|
||||
const b = qoderEncodeBody(Buffer.from("hello", "utf8"));
|
||||
expect(a).toBe(b);
|
||||
});
|
||||
|
||||
it("only emits characters from the custom alphabet", () => {
|
||||
// The custom alphabet is "_doRTgHZBKcGVjlvpC,@aFSx#DPuNJme&i*MzLOEn)sUrthbf%Y^w.(kIQyXqWA!"
|
||||
// plus "$" for the padding char. If the substitution step regresses,
|
||||
// characters outside that set would leak into the output.
|
||||
const allowed = new Set(
|
||||
"_doRTgHZBKcGVjlvpC,@aFSx#DPuNJme&i*MzLOEn)sUrthbf%Y^w.(kIQyXqWA!$",
|
||||
);
|
||||
const encoded = qoderEncodeBody(
|
||||
"hello world this is a longer string for testing 0123456789",
|
||||
);
|
||||
for (const ch of encoded) {
|
||||
expect(allowed.has(ch), `unexpected char in output: ${JSON.stringify(ch)}`).toBe(true);
|
||||
}
|
||||
});
|
||||
|
||||
it("is deterministic for identical input", () => {
|
||||
const a = qoderEncodeBody("abc");
|
||||
const b = qoderEncodeBody("abc");
|
||||
expect(a).toBe(b);
|
||||
});
|
||||
|
||||
it("produces different output for different input", () => {
|
||||
const a = qoderEncodeBody("abc");
|
||||
const b = qoderEncodeBody("xyz");
|
||||
expect(a).not.toBe(b);
|
||||
});
|
||||
});
|
||||
|
||||
describe("generatePkcePair", () => {
|
||||
it("produces base64url-safe verifier and challenge of the right length", () => {
|
||||
const { verifier, challenge } = generatePkcePair();
|
||||
// 32 bytes → 43 base64url chars (no padding)
|
||||
expect(verifier.length).toBe(43);
|
||||
expect(challenge.length).toBe(43);
|
||||
expect(verifier).toMatch(/^[A-Za-z0-9_-]+$/);
|
||||
expect(challenge).toMatch(/^[A-Za-z0-9_-]+$/);
|
||||
});
|
||||
|
||||
it("verifier and challenge are different (challenge is sha256 of verifier)", () => {
|
||||
const { verifier, challenge } = generatePkcePair();
|
||||
expect(verifier).not.toBe(challenge);
|
||||
// S256: challenge should be base64url(sha256(verifier))
|
||||
const expected = crypto
|
||||
.createHash("sha256")
|
||||
.update(verifier)
|
||||
.digest("base64")
|
||||
.replace(/=/g, "")
|
||||
.replace(/\+/g, "-")
|
||||
.replace(/\//g, "_");
|
||||
expect(challenge).toBe(expected);
|
||||
});
|
||||
|
||||
it("returns codeVerifier (not verifier) on the higher-level helper", () => {
|
||||
// Regression: the providers.js qoder entry once read flow.verifier (undefined)
|
||||
// because initiateDeviceFlow returns the field as `codeVerifier`.
|
||||
const flow = initiateDeviceFlow();
|
||||
expect(typeof flow.codeVerifier).toBe("string");
|
||||
expect(flow.codeVerifier.length).toBe(43);
|
||||
expect(flow.verifier).toBeUndefined();
|
||||
});
|
||||
});
|
||||
|
||||
describe("initiateDeviceFlow", () => {
|
||||
it("produces a verification URL pointing at qoder.com/device/selectAccounts", () => {
|
||||
const flow = initiateDeviceFlow();
|
||||
expect(flow.verificationUriComplete).toMatch(
|
||||
/^https:\/\/qoder\.com\/device\/selectAccounts\?/,
|
||||
);
|
||||
expect(flow.verificationUriComplete).toContain("challenge_method=S256");
|
||||
expect(flow.verificationUriComplete).toContain(`nonce=${flow.nonce}`);
|
||||
expect(flow.verificationUriComplete).toContain(`machine_id=${flow.machineId}`);
|
||||
});
|
||||
|
||||
it("returns nonce and machineId as UUIDs", () => {
|
||||
const flow = initiateDeviceFlow();
|
||||
const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
|
||||
expect(flow.nonce).toMatch(uuidRe);
|
||||
expect(flow.machineId).toMatch(uuidRe);
|
||||
});
|
||||
});
|
||||
|
||||
describe("buildCosyHeaders", () => {
|
||||
const creds = {
|
||||
userId: "test-user-id",
|
||||
authToken: "dt-test-token",
|
||||
name: "Test",
|
||||
email: "test@example.com",
|
||||
machineId: "fixed-machine-id",
|
||||
};
|
||||
|
||||
it("produces all required Cosy-* headers", () => {
|
||||
const headers = buildCosyHeaders(Buffer.alloc(0), QODER_MODEL_LIST_URL, creds);
|
||||
const required = [
|
||||
"Authorization",
|
||||
"Cosy-Key",
|
||||
"Cosy-User",
|
||||
"Cosy-Date",
|
||||
"Cosy-Version",
|
||||
"Cosy-Machineid",
|
||||
"Cosy-Machinetoken",
|
||||
"Cosy-Machinetype",
|
||||
"Cosy-Machineos",
|
||||
"Cosy-Clienttype",
|
||||
"Cosy-Clientip",
|
||||
"Cosy-Bodyhash",
|
||||
"Cosy-Bodylength",
|
||||
"Cosy-Sigpath",
|
||||
"Cosy-Data-Policy",
|
||||
"Login-Version",
|
||||
"X-Request-Id",
|
||||
];
|
||||
for (const key of required) {
|
||||
expect(headers[key], `missing header ${key}`).toBeDefined();
|
||||
}
|
||||
});
|
||||
|
||||
it("Authorization is a Bearer COSY token with payload+sig", () => {
|
||||
const headers = buildCosyHeaders(Buffer.alloc(0), QODER_MODEL_LIST_URL, creds);
|
||||
expect(headers.Authorization).toMatch(/^Bearer COSY\.[A-Za-z0-9+/=]+\.[a-f0-9]{32}$/);
|
||||
});
|
||||
|
||||
it("Cosy-Sigpath strips the leading /algo prefix", () => {
|
||||
const headers = buildCosyHeaders(Buffer.alloc(0), QODER_MODEL_LIST_URL, creds);
|
||||
expect(headers["Cosy-Sigpath"]).toBe("/api/v2/model/list");
|
||||
});
|
||||
|
||||
it("Cosy-Sigpath also handles the encoded chat URL", () => {
|
||||
const headers = buildCosyHeaders(Buffer.from("body", "utf8"), QODER_CHAT_URL_ENCODED, creds);
|
||||
expect(headers["Cosy-Sigpath"]).toBe(
|
||||
"/api/v2/service/pro/sse/agent_chat_generation",
|
||||
);
|
||||
});
|
||||
|
||||
it("Cosy-Bodyhash is the MD5 of the request body, Cosy-Bodylength is the length", () => {
|
||||
const body = Buffer.from("hello qoder", "utf8");
|
||||
const headers = buildCosyHeaders(body, QODER_MODEL_LIST_URL, creds);
|
||||
const expectedHash = crypto.createHash("md5").update(body).digest("hex");
|
||||
expect(headers["Cosy-Bodyhash"]).toBe(expectedHash);
|
||||
expect(headers["Cosy-Bodylength"]).toBe(String(body.length));
|
||||
});
|
||||
|
||||
it("empty body produces the canonical empty-MD5 hash", () => {
|
||||
const headers = buildCosyHeaders(Buffer.alloc(0), QODER_MODEL_LIST_URL, creds);
|
||||
expect(headers["Cosy-Bodyhash"]).toBe("d41d8cd98f00b204e9800998ecf8427e");
|
||||
expect(headers["Cosy-Bodylength"]).toBe("0");
|
||||
});
|
||||
|
||||
it("Cosy-Machineid + Cosy-Machinetoken match the supplied machineId", () => {
|
||||
const headers = buildCosyHeaders(Buffer.alloc(0), QODER_MODEL_LIST_URL, creds);
|
||||
expect(headers["Cosy-Machineid"]).toBe("fixed-machine-id");
|
||||
expect(headers["Cosy-Machinetoken"]).toBe("fixed-machine-id");
|
||||
});
|
||||
|
||||
it("auto-generates a machineId when none is supplied", () => {
|
||||
const headers = buildCosyHeaders(Buffer.alloc(0), QODER_MODEL_LIST_URL, {
|
||||
...creds,
|
||||
machineId: "",
|
||||
});
|
||||
expect(headers["Cosy-Machineid"]).toMatch(
|
||||
/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,
|
||||
);
|
||||
});
|
||||
|
||||
it("throws when userId is missing", () => {
|
||||
expect(() =>
|
||||
buildCosyHeaders(Buffer.alloc(0), QODER_MODEL_LIST_URL, { ...creds, userId: "" }),
|
||||
).toThrow(/user id is empty/);
|
||||
});
|
||||
|
||||
it("throws when authToken is missing", () => {
|
||||
expect(() =>
|
||||
buildCosyHeaders(Buffer.alloc(0), QODER_MODEL_LIST_URL, { ...creds, authToken: "" }),
|
||||
).toThrow(/auth token is empty/);
|
||||
});
|
||||
|
||||
it("Cosy-User reflects the supplied userId verbatim", () => {
|
||||
const headers = buildCosyHeaders(Buffer.alloc(0), QODER_MODEL_LIST_URL, creds);
|
||||
expect(headers["Cosy-User"]).toBe("test-user-id");
|
||||
});
|
||||
|
||||
it("two calls with identical inputs differ only in fields that include fresh randomness", () => {
|
||||
// The signature fingerprints a fresh AES key + UUID per call, so the
|
||||
// signature, Cosy-Key, X-Request-Id, and Cosy-Date (1s resolution)
|
||||
// can differ — but Cosy-User, Cosy-Bodyhash, Cosy-Bodylength,
|
||||
// Cosy-Sigpath, and the machineId-derived headers must be stable.
|
||||
const a = buildCosyHeaders(Buffer.from("payload", "utf8"), QODER_CHAT_URL_ENCODED, creds);
|
||||
const b = buildCosyHeaders(Buffer.from("payload", "utf8"), QODER_CHAT_URL_ENCODED, creds);
|
||||
expect(a["Cosy-User"]).toBe(b["Cosy-User"]);
|
||||
expect(a["Cosy-Bodyhash"]).toBe(b["Cosy-Bodyhash"]);
|
||||
expect(a["Cosy-Bodylength"]).toBe(b["Cosy-Bodylength"]);
|
||||
expect(a["Cosy-Sigpath"]).toBe(b["Cosy-Sigpath"]);
|
||||
expect(a["Cosy-Machineid"]).toBe(b["Cosy-Machineid"]);
|
||||
expect(a["X-Request-Id"]).not.toBe(b["X-Request-Id"]);
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user