feat: implement real project ID fetching for Antigravity (#170)
* feat: implement Project ID service to fetch and cache real Project IDs from Google Cloud Code API * fix: implement caching and cleanup for Project ID retrieval * feat: add project ID invalidation and refresh logic after token updates * refactor: remove unnecessary format changes * feat: add on-demand project ID retrieval for antigravity requests
This commit is contained in:
zx07
315
open-sse/services/projectId.js
Normal file
315
open-sse/services/projectId.js
Normal file
@@ -0,0 +1,315 @@
|
||||
/**
|
||||
* Project ID Service - Fetch and cache real Project IDs from Google Cloud Code API
|
||||
*
|
||||
* Reference: CLIProxyAPI internal/auth/antigravity/auth.go (FetchProjectID + OnboardUser)
|
||||
*
|
||||
* Instead of generating random project IDs (e.g. "useful-spark-a1b2c"),
|
||||
* this service fetches the real Project ID bound to the authenticated user's account.
|
||||
* This significantly reduces the risk of being flagged by Google's anti-abuse systems.
|
||||
*/
|
||||
|
||||
import {ANTIGRAVITY_HEADERS, CLIENT_METADATA, CLOUD_CODE_API, getPlatformUserAgent} from "../config/constants.js";
|
||||
|
||||
// ─── Cache ────────────────────────────────────────────────────────────────────
|
||||
// connectionId -> { projectId: string, fetchedAt: number }
|
||||
const projectIdCache = new Map();
|
||||
|
||||
/** How long a cached project ID is considered fresh (1 hour). */
|
||||
const CACHE_TTL_MS = 60 * 60 * 1000;
|
||||
|
||||
// ─── Pending-fetch deduplication ─────────────────────────────────────────────
|
||||
// connectionId -> { promise: Promise<string|null>, controller: AbortController, startedAt: number }
|
||||
const pendingFetches = new Map();
|
||||
|
||||
/** Abort and evict a pending fetch that has been running longer than this (2 min). */
|
||||
const PENDING_TTL_MS = 2 * 60 * 1000;
|
||||
|
||||
// ─── Periodic cleanup ────────────────────────────────────────────────────────
|
||||
/** How often the background sweep runs (10 min). */
|
||||
const CLEANUP_INTERVAL_MS = 10 * 60 * 1000;
|
||||
|
||||
let _cleanupTimer = null;
|
||||
|
||||
/** Run one sweep immediately: evict stale cache entries and abort orphaned pending fetches. */
|
||||
export function cleanupNow() {
|
||||
const now = Date.now();
|
||||
|
||||
for (const [id, entry] of projectIdCache) {
|
||||
if (!entry || now - entry.fetchedAt >= CACHE_TTL_MS) {
|
||||
projectIdCache.delete(id);
|
||||
}
|
||||
}
|
||||
|
||||
for (const [id, item] of pendingFetches) {
|
||||
if (!item || typeof item.startedAt !== "number") {
|
||||
pendingFetches.delete(id);
|
||||
continue;
|
||||
}
|
||||
if (now - item.startedAt > PENDING_TTL_MS) {
|
||||
try { item.controller.abort(); } catch (_) { /* ignore */ }
|
||||
pendingFetches.delete(id);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/** Start the periodic background cleanup (idempotent). Called automatically on module load. */
|
||||
export function startCacheCleanup() {
|
||||
if (_cleanupTimer) return;
|
||||
_cleanupTimer = setInterval(() => {
|
||||
try { cleanupNow(); } catch (e) {
|
||||
console.warn("[ProjectId] cleanup sweep error:", e?.message ?? e);
|
||||
}
|
||||
}, CLEANUP_INTERVAL_MS);
|
||||
// Unref so the timer doesn't prevent Node from exiting when it is otherwise idle
|
||||
_cleanupTimer?.unref?.();
|
||||
}
|
||||
|
||||
/** Stop the periodic background cleanup (e.g. during graceful shutdown). */
|
||||
export function stopCacheCleanup() {
|
||||
if (!_cleanupTimer) return;
|
||||
clearInterval(_cleanupTimer);
|
||||
_cleanupTimer = null;
|
||||
}
|
||||
|
||||
// Start automatically when the module is first imported
|
||||
startCacheCleanup();
|
||||
|
||||
// ─── Public API ───────────────────────────────────────────────────────────────
|
||||
|
||||
/**
|
||||
* Get the Project ID for a connection, with caching.
|
||||
* Returns null on failure (callers should fall back to random generation).
|
||||
*
|
||||
* @param {string} connectionId - The connection identifier for cache keying
|
||||
* @param {string} accessToken - Valid OAuth access token
|
||||
* @returns {Promise<string|null>} Real project ID or null
|
||||
*/
|
||||
export async function getProjectIdForConnection(connectionId, accessToken) {
|
||||
if (!connectionId || !accessToken) return null;
|
||||
|
||||
// Return cached value if still fresh
|
||||
const cached = projectIdCache.get(connectionId);
|
||||
if (cached && Date.now() - cached.fetchedAt < CACHE_TTL_MS) {
|
||||
return cached.projectId;
|
||||
}
|
||||
|
||||
// Deduplicate concurrent fetches for the same connection
|
||||
if (pendingFetches.has(connectionId)) {
|
||||
return pendingFetches.get(connectionId).promise;
|
||||
}
|
||||
|
||||
// Each fetch gets its own AbortController so it can be canceled via removeConnection()
|
||||
const controller = new AbortController();
|
||||
|
||||
const promise = (async () => {
|
||||
try {
|
||||
const projectId = await fetchProjectId(accessToken, controller.signal);
|
||||
if (projectId) {
|
||||
projectIdCache.set(connectionId, {projectId, fetchedAt: Date.now()});
|
||||
return projectId;
|
||||
}
|
||||
console.warn("[ProjectId] could not fetch projectId for connection", connectionId.slice(0, 8));
|
||||
return null;
|
||||
} catch (error) {
|
||||
console.warn(`[ProjectId] Error fetching project ID: ${error.message}`);
|
||||
return null;
|
||||
} finally {
|
||||
pendingFetches.delete(connectionId);
|
||||
}
|
||||
})();
|
||||
|
||||
pendingFetches.set(connectionId, {promise, controller, startedAt: Date.now()});
|
||||
return promise;
|
||||
}
|
||||
|
||||
/**
|
||||
* Invalidate the cached project ID for a connection.
|
||||
* Call this when a connection's credentials are fully revoked or refreshed.
|
||||
*/
|
||||
export function invalidateProjectId(connectionId) {
|
||||
projectIdCache.delete(connectionId);
|
||||
}
|
||||
|
||||
/**
|
||||
* Fully remove a connection: abort any in-flight fetch and delete its cached project ID.
|
||||
* Wire this into your connection close / disconnect lifecycle events to prevent memory leaks.
|
||||
*
|
||||
* @param {string} connectionId
|
||||
*/
|
||||
export function removeConnection(connectionId) {
|
||||
if (!connectionId) return;
|
||||
projectIdCache.delete(connectionId);
|
||||
const pending = pendingFetches.get(connectionId);
|
||||
if (pending) {
|
||||
try { pending.controller.abort(); } catch (_) { /* ignore */ }
|
||||
pendingFetches.delete(connectionId);
|
||||
}
|
||||
}
|
||||
|
||||
// ─── Internal helpers ─────────────────────────────────────────────────────────
|
||||
|
||||
/**
|
||||
* Fetch project ID via loadCodeAssist endpoint.
|
||||
* Falls back to onboardUser when loadCodeAssist returns no project.
|
||||
*
|
||||
* @param {string} accessToken
|
||||
* @param {AbortSignal} signal
|
||||
* @returns {Promise<string|null>}
|
||||
*/
|
||||
async function fetchProjectId(accessToken, signal) {
|
||||
const response = await fetch(CLOUD_CODE_API.loadCodeAssist, {
|
||||
method: "POST",
|
||||
headers: {
|
||||
"Authorization": `Bearer ${accessToken}`,
|
||||
"Content-Type": "application/json",
|
||||
"User-Agent": getPlatformUserAgent(),
|
||||
...ANTIGRAVITY_HEADERS
|
||||
},
|
||||
body: JSON.stringify({metadata: CLIENT_METADATA, mode: 1}),
|
||||
signal
|
||||
});
|
||||
|
||||
if (!response.ok) {
|
||||
const errorText = await response.text().catch(() => "");
|
||||
throw new Error(`loadCodeAssist failed: HTTP ${response.status} ${errorText.slice(0, 200)}`);
|
||||
}
|
||||
|
||||
const data = await response.json();
|
||||
const projectId = extractProjectId(data);
|
||||
if (projectId) return projectId;
|
||||
|
||||
// Determine the tier to use for onboarding
|
||||
let tierID = "legacy-tier";
|
||||
if (Array.isArray(data.allowedTiers)) {
|
||||
for (const tier of data.allowedTiers) {
|
||||
if (tier && typeof tier === "object" && tier.isDefault === true) {
|
||||
if (tier.id && typeof tier.id === "string" && tier.id.trim()) {
|
||||
tierID = tier.id.trim();
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return onboardUser(accessToken, tierID, signal);
|
||||
}
|
||||
|
||||
/**
|
||||
* Fetch project ID via onboardUser endpoint (polls until done).
|
||||
*
|
||||
* @param {string} accessToken
|
||||
* @param {string} tierID
|
||||
* @param {AbortSignal} externalSignal – propagated from the connection's AbortController
|
||||
* @returns {Promise<string|null>}
|
||||
*/
|
||||
async function onboardUser(accessToken, tierID, externalSignal) {
|
||||
console.log(`[ProjectId] Onboarding user with tier: ${tierID}`);
|
||||
|
||||
const reqBody = {tierId: tierID, metadata: CLIENT_METADATA, mode: 1};
|
||||
const MAX_ATTEMPTS = 5;
|
||||
|
||||
for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
|
||||
// Bail out immediately if the connection was removed
|
||||
if (externalSignal?.aborted) return null;
|
||||
|
||||
// Per-attempt timeout controller; forwards external abort as well
|
||||
const localCtrl = new AbortController();
|
||||
const timeoutId = setTimeout(() => localCtrl.abort(), 30_000);
|
||||
const forwardAbort = () => localCtrl.abort();
|
||||
externalSignal?.addEventListener("abort", forwardAbort);
|
||||
|
||||
try {
|
||||
const response = await fetch(CLOUD_CODE_API.onboardUser, {
|
||||
method: "POST",
|
||||
headers: {
|
||||
"Authorization": `Bearer ${accessToken}`,
|
||||
"Content-Type": "application/json",
|
||||
"User-Agent": getPlatformUserAgent(),
|
||||
...ANTIGRAVITY_HEADERS
|
||||
},
|
||||
body: JSON.stringify(reqBody),
|
||||
signal: localCtrl.signal
|
||||
});
|
||||
|
||||
clearTimeout(timeoutId);
|
||||
|
||||
if (!response.ok) {
|
||||
const errorText = await response.text().catch(() => "");
|
||||
throw new Error(`onboardUser HTTP ${response.status}: ${errorText.slice(0, 200)}`);
|
||||
}
|
||||
|
||||
const data = await response.json();
|
||||
|
||||
if (data.done === true) {
|
||||
const projectId = extractProjectIdFromOnboard(data);
|
||||
if (projectId) {
|
||||
console.log(`[ProjectId] Successfully onboarded, project ID: ${projectId}`);
|
||||
return projectId;
|
||||
}
|
||||
throw new Error("onboardUser done but no project_id in response");
|
||||
}
|
||||
|
||||
// Server not done yet – wait and retry
|
||||
console.log(`[ProjectId] Onboard attempt ${attempt}/${MAX_ATTEMPTS}: not done yet, waiting...`);
|
||||
await new Promise(resolve => setTimeout(resolve, 2000));
|
||||
|
||||
} catch (error) {
|
||||
clearTimeout(timeoutId);
|
||||
if (error.name === "AbortError") {
|
||||
console.warn(`[ProjectId] onboardUser attempt ${attempt} aborted (timeout or connection removed)`);
|
||||
if (externalSignal?.aborted) return null; // connection gone – stop retrying
|
||||
continue;
|
||||
}
|
||||
if (attempt === MAX_ATTEMPTS) {
|
||||
console.warn(`[ProjectId] onboardUser failed after ${MAX_ATTEMPTS} attempts: ${error.message}`);
|
||||
return null;
|
||||
}
|
||||
throw error;
|
||||
} finally {
|
||||
clearTimeout(timeoutId);
|
||||
externalSignal?.removeEventListener("abort", forwardAbort);
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Extract project ID from loadCodeAssist response.
|
||||
*/
|
||||
function extractProjectId(data) {
|
||||
if (!data) return null;
|
||||
|
||||
if (typeof data.cloudaicompanionProject === "string") {
|
||||
const id = data.cloudaicompanionProject.trim();
|
||||
if (id) return id;
|
||||
}
|
||||
|
||||
if (data.cloudaicompanionProject && typeof data.cloudaicompanionProject === "object") {
|
||||
const id = data.cloudaicompanionProject.id;
|
||||
if (typeof id === "string" && id.trim()) return id.trim();
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Extract project ID from onboardUser response.
|
||||
*/
|
||||
function extractProjectIdFromOnboard(data) {
|
||||
if (!data?.response) return null;
|
||||
|
||||
const project = data.response.cloudaicompanionProject;
|
||||
|
||||
if (typeof project === "string") {
|
||||
const id = project.trim();
|
||||
if (id) return id;
|
||||
}
|
||||
|
||||
if (project && typeof project === "object") {
|
||||
const id = project.id;
|
||||
if (typeof id === "string" && id.trim()) return id.trim();
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
@@ -8,7 +8,7 @@ export const TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1000;
|
||||
*/
|
||||
export async function refreshAccessToken(provider, refreshToken, credentials, log) {
|
||||
const config = PROVIDERS[provider];
|
||||
|
||||
|
||||
if (!config || !config.refreshUrl) {
|
||||
log?.warn?.("TOKEN_REFRESH", `No refresh URL configured for provider: ${provider}`);
|
||||
return null;
|
||||
@@ -44,7 +44,7 @@ export async function refreshAccessToken(provider, refreshToken, credentials, lo
|
||||
}
|
||||
|
||||
const tokens = await response.json();
|
||||
|
||||
|
||||
log?.info?.("TOKEN_REFRESH", `Successfully refreshed token for ${provider}`, {
|
||||
hasNewAccessToken: !!tokens.access_token,
|
||||
hasNewRefreshToken: !!tokens.refresh_token,
|
||||
@@ -91,7 +91,7 @@ export async function refreshClaudeOAuthToken(refreshToken, log) {
|
||||
}
|
||||
|
||||
const tokens = await response.json();
|
||||
|
||||
|
||||
log?.info?.("TOKEN_REFRESH", "Successfully refreshed Claude OAuth token", {
|
||||
hasNewAccessToken: !!tokens.access_token,
|
||||
hasNewRefreshToken: !!tokens.refresh_token,
|
||||
@@ -133,7 +133,7 @@ export async function refreshGoogleToken(refreshToken, clientId, clientSecret, l
|
||||
}
|
||||
|
||||
const tokens = await response.json();
|
||||
|
||||
|
||||
log?.info?.("TOKEN_REFRESH", "Successfully refreshed Google token", {
|
||||
hasNewAccessToken: !!tokens.access_token,
|
||||
hasNewRefreshToken: !!tokens.refresh_token,
|
||||
@@ -152,7 +152,7 @@ export async function refreshGoogleToken(refreshToken, clientId, clientSecret, l
|
||||
*/
|
||||
export async function refreshQwenToken(refreshToken, log) {
|
||||
const endpoint = OAUTH_ENDPOINTS.qwen.token;
|
||||
|
||||
|
||||
try {
|
||||
const response = await fetch(endpoint, {
|
||||
method: "POST",
|
||||
@@ -169,7 +169,7 @@ export async function refreshQwenToken(refreshToken, log) {
|
||||
|
||||
if (response.status === 200) {
|
||||
const tokens = await response.json();
|
||||
|
||||
|
||||
log?.info?.("TOKEN_REFRESH", "Successfully refreshed Qwen token", {
|
||||
hasNewAccessToken: !!tokens.access_token,
|
||||
hasNewRefreshToken: !!tokens.refresh_token,
|
||||
@@ -226,7 +226,7 @@ export async function refreshCodexToken(refreshToken, log) {
|
||||
}
|
||||
|
||||
const tokens = await response.json();
|
||||
|
||||
|
||||
log?.info?.("TOKEN_REFRESH", "Successfully refreshed Codex token", {
|
||||
hasNewAccessToken: !!tokens.access_token,
|
||||
hasNewRefreshToken: !!tokens.refresh_token,
|
||||
@@ -249,7 +249,7 @@ export async function refreshKiroToken(refreshToken, providerSpecificData, log)
|
||||
const clientId = providerSpecificData?.clientId;
|
||||
const clientSecret = providerSpecificData?.clientSecret;
|
||||
const region = providerSpecificData?.region;
|
||||
|
||||
|
||||
// AWS SSO OIDC (Builder ID or IDC)
|
||||
// If clientId and clientSecret exist, assume AWS SSO OIDC (default to builder-id if authMethod not specified)
|
||||
if (clientId && clientSecret) {
|
||||
@@ -257,7 +257,7 @@ export async function refreshKiroToken(refreshToken, providerSpecificData, log)
|
||||
const endpoint = isIDC && region
|
||||
? `https://oidc.${region}.amazonaws.com/token`
|
||||
: "https://oidc.us-east-1.amazonaws.com/token";
|
||||
|
||||
|
||||
const response = await fetch(endpoint, {
|
||||
method: "POST",
|
||||
headers: {
|
||||
@@ -282,7 +282,7 @@ export async function refreshKiroToken(refreshToken, providerSpecificData, log)
|
||||
}
|
||||
|
||||
const tokens = await response.json();
|
||||
|
||||
|
||||
log?.info?.("TOKEN_REFRESH", "Successfully refreshed Kiro AWS token", {
|
||||
hasNewAccessToken: !!tokens.accessToken,
|
||||
expiresIn: tokens.expiresIn,
|
||||
@@ -294,7 +294,7 @@ export async function refreshKiroToken(refreshToken, providerSpecificData, log)
|
||||
expiresIn: tokens.expiresIn,
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
// Social Auth (Google/GitHub) - use Kiro's refresh endpoint
|
||||
const response = await fetch(PROVIDERS.kiro.tokenUrl, {
|
||||
method: "POST",
|
||||
@@ -317,7 +317,7 @@ export async function refreshKiroToken(refreshToken, providerSpecificData, log)
|
||||
}
|
||||
|
||||
const tokens = await response.json();
|
||||
|
||||
|
||||
log?.info?.("TOKEN_REFRESH", "Successfully refreshed Kiro social token", {
|
||||
hasNewAccessToken: !!tokens.accessToken,
|
||||
expiresIn: tokens.expiresIn,
|
||||
@@ -335,7 +335,7 @@ export async function refreshKiroToken(refreshToken, providerSpecificData, log)
|
||||
*/
|
||||
export async function refreshIflowToken(refreshToken, log) {
|
||||
const basicAuth = btoa(`${PROVIDERS.iflow.clientId}:${PROVIDERS.iflow.clientSecret}`);
|
||||
|
||||
|
||||
const response = await fetch(OAUTH_ENDPOINTS.iflow.token, {
|
||||
method: "POST",
|
||||
headers: {
|
||||
@@ -361,7 +361,7 @@ export async function refreshIflowToken(refreshToken, log) {
|
||||
}
|
||||
|
||||
const tokens = await response.json();
|
||||
|
||||
|
||||
log?.info?.("TOKEN_REFRESH", "Successfully refreshed iFlow token", {
|
||||
hasNewAccessToken: !!tokens.access_token,
|
||||
hasNewRefreshToken: !!tokens.refresh_token,
|
||||
@@ -403,7 +403,7 @@ export async function refreshGitHubToken(refreshToken, log) {
|
||||
}
|
||||
|
||||
const tokens = await response.json();
|
||||
|
||||
|
||||
log?.info?.("TOKEN_REFRESH", "Successfully refreshed GitHub token", {
|
||||
hasNewAccessToken: !!tokens.access_token,
|
||||
hasNewRefreshToken: !!tokens.refresh_token,
|
||||
@@ -442,7 +442,7 @@ export async function refreshCopilotToken(githubAccessToken, log) {
|
||||
}
|
||||
|
||||
const data = await response.json();
|
||||
|
||||
|
||||
log?.info?.("TOKEN_REFRESH", "Successfully refreshed Copilot token", {
|
||||
hasToken: !!data.token,
|
||||
expiresAt: data.expires_at
|
||||
@@ -479,29 +479,29 @@ export async function getAccessToken(provider, credentials, log) {
|
||||
PROVIDERS[provider].clientSecret,
|
||||
log
|
||||
);
|
||||
|
||||
|
||||
case "claude":
|
||||
return await refreshClaudeOAuthToken(credentials.refreshToken, log);
|
||||
|
||||
|
||||
case "codex":
|
||||
return await refreshCodexToken(credentials.refreshToken, log);
|
||||
|
||||
|
||||
case "qwen":
|
||||
return await refreshQwenToken(credentials.refreshToken, log);
|
||||
|
||||
|
||||
case "iflow":
|
||||
return await refreshIflowToken(credentials.refreshToken, log);
|
||||
|
||||
|
||||
case "github":
|
||||
return await refreshGitHubToken(credentials.refreshToken, log);
|
||||
|
||||
|
||||
case "kiro":
|
||||
return await refreshKiroToken(
|
||||
credentials.refreshToken,
|
||||
credentials.providerSpecificData,
|
||||
log
|
||||
);
|
||||
|
||||
|
||||
default:
|
||||
log?.warn?.("TOKEN_REFRESH", `Unsupported provider for token refresh: ${provider}`);
|
||||
return null;
|
||||
@@ -561,13 +561,13 @@ export function formatProviderCredentials(provider, credentials, log) {
|
||||
accessToken: credentials.accessToken,
|
||||
projectId: credentials.projectId
|
||||
};
|
||||
|
||||
|
||||
case "claude":
|
||||
return {
|
||||
apiKey: credentials.apiKey,
|
||||
accessToken: credentials.accessToken
|
||||
};
|
||||
|
||||
|
||||
case "codex":
|
||||
case "qwen":
|
||||
case "iflow":
|
||||
@@ -577,14 +577,15 @@ export function formatProviderCredentials(provider, credentials, log) {
|
||||
apiKey: credentials.apiKey,
|
||||
accessToken: credentials.accessToken
|
||||
};
|
||||
|
||||
|
||||
case "antigravity":
|
||||
case "gemini-cli":
|
||||
return {
|
||||
accessToken: credentials.accessToken,
|
||||
refreshToken: credentials.refreshToken
|
||||
refreshToken: credentials.refreshToken,
|
||||
projectId: credentials.projectId
|
||||
};
|
||||
|
||||
|
||||
default:
|
||||
return {
|
||||
apiKey: credentials.apiKey,
|
||||
@@ -599,21 +600,21 @@ export function formatProviderCredentials(provider, credentials, log) {
|
||||
*/
|
||||
export async function getAllAccessTokens(userInfo, log) {
|
||||
const results = {};
|
||||
|
||||
|
||||
if (userInfo.connections && Array.isArray(userInfo.connections)) {
|
||||
for (const connection of userInfo.connections) {
|
||||
if (connection.isActive && connection.provider) {
|
||||
const token = await getAccessToken(connection.provider, {
|
||||
refreshToken: connection.refreshToken
|
||||
}, log);
|
||||
|
||||
|
||||
if (token) {
|
||||
results[connection.provider] = token;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
return results;
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user