Files
9router/src/lib/oauth/providers/kimchi.js
T
decoluaandClaude Fable 5 8e04fe1734 feat(oauth): zed/trae/windsurf providers + harden callback proxies
- zed live model discovery; codebuddy-intl handler; remove duplicate workbuddy
- split oauth providers.js into per-provider files (facade re-export)
- fold 5 standard refresh providers into config-driven generic
- hide trae/windsurf from registry (no tool calling support)
- fix login-CSRF + SSRF on trae/windsurf/zed local callback proxies
  via loopback-origin guard + strict state validation + apiOrigins allowlist
- move zed RSA private key transit to POST body; redact proxy logs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-25 17:25:19 +07:00

76 lines
2.0 KiB
JavaScript

import { KIMCHI_CONFIG } from "../constants/oauth.js";
const kimchi = {
config: KIMCHI_CONFIG,
flowType: "browser_token",
buildAuthUrl: (config, redirectUri, state) => {
const baseUrl = (config.webAppUrl || "https://app.kimchi.dev").replace(/\/+$/, "");
const params = new URLSearchParams({
callback: redirectUri,
state,
});
return `${baseUrl}/cli-auth?${params.toString()}`;
},
exchangeToken: async (config, token) => {
const accessToken = String(token || "").trim();
if (!accessToken) {
throw new Error("Missing Kimchi token");
}
const validationUrl = config.validationUrl || "https://api.cast.ai/v1/llm/openai/supported-providers";
const validationRes = await fetch(validationUrl, {
method: "GET",
headers: {
Accept: "application/json",
Authorization: `Bearer ${accessToken}`,
},
});
if (!validationRes.ok) {
throw new Error(`Kimchi token validation failed: ${validationRes.status}`);
}
let userInfo = {};
if (config.userInfoUrl) {
try {
const userRes = await fetch(config.userInfoUrl, {
method: "GET",
headers: {
Accept: "application/json",
Authorization: `Bearer ${accessToken}`,
},
});
if (userRes.ok) {
userInfo = await userRes.json();
}
} catch {
userInfo = {};
}
}
return {
access_token: accessToken,
token_type: "Bearer",
_kimchiUser: userInfo,
};
},
mapTokens: (tokens) => {
const user = tokens._kimchiUser || {};
const userId = user.id ? String(user.id) : "";
const username = user.username || "";
const email = user.email || (userId ? `kimchi-user-${userId}` : null);
return {
accessToken: tokens.access_token,
refreshToken: null,
email,
displayName: user.name || username || null,
providerSpecificData: {
authMethod: "browser_token",
userId,
username,
},
};
},
};
export default kimchi;