8e04fe1734
- zed live model discovery; codebuddy-intl handler; remove duplicate workbuddy - split oauth providers.js into per-provider files (facade re-export) - fold 5 standard refresh providers into config-driven generic - hide trae/windsurf from registry (no tool calling support) - fix login-CSRF + SSRF on trae/windsurf/zed local callback proxies via loopback-origin guard + strict state validation + apiOrigins allowlist - move zed RSA private key transit to POST body; redact proxy logs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
65 lines
2.4 KiB
JavaScript
65 lines
2.4 KiB
JavaScript
import { GITLAB_CONFIG } from "../constants/oauth.js";
|
|
|
|
// GitLab Duo - Authorization Code Flow with PKCE
|
|
// Supports two login modes via loginMode metadata: "oauth" (default) or "pat"
|
|
const gitlab = {
|
|
config: GITLAB_CONFIG,
|
|
flowType: "authorization_code_pkce",
|
|
buildAuthUrl: (config, redirectUri, state, codeChallenge, meta = {}) => {
|
|
const baseUrl = meta.baseUrl || config.defaultBaseUrl;
|
|
const clientId = meta.clientId || "";
|
|
const params = new URLSearchParams({
|
|
client_id: clientId,
|
|
redirect_uri: redirectUri,
|
|
response_type: "code",
|
|
state,
|
|
scope: config.scope,
|
|
code_challenge: codeChallenge,
|
|
code_challenge_method: config.codeChallengeMethod,
|
|
});
|
|
return `${baseUrl}${config.authorizeUrlPath}?${params.toString()}`;
|
|
},
|
|
exchangeToken: async (config, code, redirectUri, codeVerifier, state, meta = {}) => {
|
|
const baseUrl = meta.baseUrl || config.defaultBaseUrl;
|
|
const clientId = meta.clientId || "";
|
|
const clientSecret = meta.clientSecret || "";
|
|
const body = new URLSearchParams({
|
|
client_id: clientId,
|
|
grant_type: "authorization_code",
|
|
code,
|
|
redirect_uri: redirectUri,
|
|
code_verifier: codeVerifier,
|
|
});
|
|
if (clientSecret) body.set("client_secret", clientSecret);
|
|
const response = await fetch(`${baseUrl}${config.tokenUrlPath}`, {
|
|
method: "POST",
|
|
headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
|
|
body: body.toString(),
|
|
});
|
|
if (!response.ok) throw new Error(`GitLab token exchange failed: ${await response.text()}`);
|
|
const tokens = await response.json();
|
|
// Fetch user info
|
|
const userRes = await fetch(`${baseUrl}${config.userInfoUrlPath}`, {
|
|
headers: { Authorization: `Bearer ${tokens.access_token}` },
|
|
});
|
|
const user = userRes.ok ? await userRes.json() : {};
|
|
return { ...tokens, _user: user, _baseUrl: baseUrl, _clientId: clientId };
|
|
},
|
|
mapTokens: (tokens) => ({
|
|
accessToken: tokens.access_token,
|
|
refreshToken: tokens.refresh_token,
|
|
expiresIn: tokens.expires_in,
|
|
scope: tokens.scope,
|
|
providerSpecificData: {
|
|
username: tokens._user?.username || "",
|
|
email: tokens._user?.email || tokens._user?.public_email || "",
|
|
name: tokens._user?.name || "",
|
|
baseUrl: tokens._baseUrl,
|
|
clientId: tokens._clientId,
|
|
authKind: "oauth",
|
|
},
|
|
}),
|
|
};
|
|
|
|
export default gitlab;
|