Something went wrong. Try again.
source dump of claude code forked from oppi.li/claude-code
Something went wrong. Try again.
18 kB · 566 lines
TypeScript
at main
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567// OAuth client for handling authentication flows with Claude servicesimport axios from 'axios'import { type AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, logEvent,} from 'src/services/analytics/index.js'import { ALL_OAUTH_SCOPES, CLAUDE_AI_INFERENCE_SCOPE, CLAUDE_AI_OAUTH_SCOPES, getOauthConfig,} from '../../constants/oauth.js'import { checkAndRefreshOAuthTokenIfNeeded, getClaudeAIOAuthTokens, hasProfileScope, isClaudeAISubscriber, saveApiKey,} from '../../utils/auth.js'import type { AccountInfo } from '../../utils/config.js'import { getGlobalConfig, saveGlobalConfig } from '../../utils/config.js'import { logForDebugging } from '../../utils/debug.js'import { getOauthProfileFromOauthToken } from './getOauthProfile.js'import type { BillingType, OAuthProfileResponse, OAuthTokenExchangeResponse, OAuthTokens, RateLimitTier, SubscriptionType, UserRolesResponse,} from './types.js'
/** * Check if the user has Claude.ai authentication scope * @private Only call this if you're OAuth / auth related code! */export function shouldUseClaudeAIAuth(scopes: string[] | undefined): boolean { return Boolean(scopes?.includes(CLAUDE_AI_INFERENCE_SCOPE))}
export function parseScopes(scopeString?: string): string[] { return scopeString?.split(' ').filter(Boolean) ?? []}
export function buildAuthUrl({ codeChallenge, state, port, isManual, loginWithClaudeAi, inferenceOnly, orgUUID, loginHint, loginMethod,}: { codeChallenge: string state: string port: number isManual: boolean loginWithClaudeAi?: boolean inferenceOnly?: boolean orgUUID?: string loginHint?: string loginMethod?: string}): string { const authUrlBase = loginWithClaudeAi ? getOauthConfig().CLAUDE_AI_AUTHORIZE_URL : getOauthConfig().CONSOLE_AUTHORIZE_URL
const authUrl = new URL(authUrlBase) authUrl.searchParams.append('code', 'true') // this tells the login page to show Claude Max upsell authUrl.searchParams.append('client_id', getOauthConfig().CLIENT_ID) authUrl.searchParams.append('response_type', 'code') authUrl.searchParams.append( 'redirect_uri', isManual ? getOauthConfig().MANUAL_REDIRECT_URL : `http://localhost:${port}/callback`, ) const scopesToUse = inferenceOnly ? [CLAUDE_AI_INFERENCE_SCOPE] // Long-lived inference-only tokens : ALL_OAUTH_SCOPES authUrl.searchParams.append('scope', scopesToUse.join(' ')) authUrl.searchParams.append('code_challenge', codeChallenge) authUrl.searchParams.append('code_challenge_method', 'S256') authUrl.searchParams.append('state', state)
// Add orgUUID as URL param if provided if (orgUUID) { authUrl.searchParams.append('orgUUID', orgUUID) }
// Pre-populate email on the login form (standard OIDC parameter) if (loginHint) { authUrl.searchParams.append('login_hint', loginHint) }
// Request a specific login method (e.g. 'sso', 'magic_link', 'google') if (loginMethod) { authUrl.searchParams.append('login_method', loginMethod) }
return authUrl.toString()}
export async function exchangeCodeForTokens( authorizationCode: string, state: string, codeVerifier: string, port: number, useManualRedirect: boolean = false, expiresIn?: number,): Promise<OAuthTokenExchangeResponse> { const requestBody: Record<string, string | number> = { grant_type: 'authorization_code', code: authorizationCode, redirect_uri: useManualRedirect ? getOauthConfig().MANUAL_REDIRECT_URL : `http://localhost:${port}/callback`, client_id: getOauthConfig().CLIENT_ID, code_verifier: codeVerifier, state, }
if (expiresIn !== undefined) { requestBody.expires_in = expiresIn }
const response = await axios.post(getOauthConfig().TOKEN_URL, requestBody, { headers: { 'Content-Type': 'application/json' }, timeout: 15000, })
if (response.status !== 200) { throw new Error( response.status === 401 ? 'Authentication failed: Invalid authorization code' : `Token exchange failed (${response.status}): ${response.statusText}`, ) } logEvent('tengu_oauth_token_exchange_success', {}) return response.data}
export async function refreshOAuthToken( refreshToken: string, { scopes: requestedScopes }: { scopes?: string[] } = {},): Promise<OAuthTokens> { const requestBody = { grant_type: 'refresh_token', refresh_token: refreshToken, client_id: getOauthConfig().CLIENT_ID, // Request specific scopes, defaulting to the full Claude AI set. The // backend's refresh-token grant allows scope expansion beyond what the // initial authorize granted (see ALLOWED_SCOPE_EXPANSIONS), so this is // safe even for tokens issued before scopes were added to the app's // registered oauth_scope. scope: (requestedScopes?.length ? requestedScopes : CLAUDE_AI_OAUTH_SCOPES ).join(' '), }
try { const response = await axios.post(getOauthConfig().TOKEN_URL, requestBody, { headers: { 'Content-Type': 'application/json' }, timeout: 15000, })
if (response.status !== 200) { throw new Error(`Token refresh failed: ${response.statusText}`) }
const data = response.data as OAuthTokenExchangeResponse const { access_token: accessToken, refresh_token: newRefreshToken = refreshToken, expires_in: expiresIn, } = data
const expiresAt = Date.now() + expiresIn * 1000 const scopes = parseScopes(data.scope)
logEvent('tengu_oauth_token_refresh_success', {})
// Skip the extra /api/oauth/profile round-trip when we already have both // the global-config profile fields AND the secure-storage subscription data. // Routine refreshes satisfy both, so we cut ~7M req/day fleet-wide. // // Checking secure storage (not just config) matters for the // CLAUDE_CODE_OAUTH_REFRESH_TOKEN re-login path: installOAuthTokens runs // performLogout() AFTER we return, wiping secure storage. If we returned // null for subscriptionType here, saveOAuthTokensIfNeeded would persist // null ?? (wiped) ?? null = null, and every future refresh would see the // config guard fields satisfied and skip again, permanently losing the // subscription type for paying users. By passing through existing values, // the re-login path writes cached ?? wiped ?? null = cached; and if secure // storage was already empty we fall through to the fetch. const config = getGlobalConfig() const existing = getClaudeAIOAuthTokens() const haveProfileAlready = config.oauthAccount?.billingType !== undefined && config.oauthAccount?.accountCreatedAt !== undefined && config.oauthAccount?.subscriptionCreatedAt !== undefined && existing?.subscriptionType != null && existing?.rateLimitTier != null
const profileInfo = haveProfileAlready ? null : await fetchProfileInfo(accessToken)
// Update the stored properties if they have changed if (profileInfo && config.oauthAccount) { const updates: Partial<AccountInfo> = {} if (profileInfo.displayName !== undefined) { updates.displayName = profileInfo.displayName } if (typeof profileInfo.hasExtraUsageEnabled === 'boolean') { updates.hasExtraUsageEnabled = profileInfo.hasExtraUsageEnabled } if (profileInfo.billingType !== null) { updates.billingType = profileInfo.billingType } if (profileInfo.accountCreatedAt !== undefined) { updates.accountCreatedAt = profileInfo.accountCreatedAt } if (profileInfo.subscriptionCreatedAt !== undefined) { updates.subscriptionCreatedAt = profileInfo.subscriptionCreatedAt } if (Object.keys(updates).length > 0) { saveGlobalConfig(current => ({ ...current, oauthAccount: current.oauthAccount ? { ...current.oauthAccount, ...updates } : current.oauthAccount, })) } }
return { accessToken, refreshToken: newRefreshToken, expiresAt, scopes, subscriptionType: profileInfo?.subscriptionType ?? existing?.subscriptionType ?? null, rateLimitTier: profileInfo?.rateLimitTier ?? existing?.rateLimitTier ?? null, profile: profileInfo?.rawProfile, tokenAccount: data.account ? { uuid: data.account.uuid, emailAddress: data.account.email_address, organizationUuid: data.organization?.uuid, } : undefined, } } catch (error) { const responseBody = axios.isAxiosError(error) && error.response?.data ? JSON.stringify(error.response.data) : undefined logEvent('tengu_oauth_token_refresh_failure', { error: (error as Error) .message as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, ...(responseBody && { responseBody: responseBody as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, }), }) throw error }}
export async function fetchAndStoreUserRoles( accessToken: string,): Promise<void> { const response = await axios.get(getOauthConfig().ROLES_URL, { headers: { Authorization: `Bearer ${accessToken}` }, })
if (response.status !== 200) { throw new Error(`Failed to fetch user roles: ${response.statusText}`) } const data = response.data as UserRolesResponse const config = getGlobalConfig()
if (!config.oauthAccount) { throw new Error('OAuth account information not found in config') }
saveGlobalConfig(current => ({ ...current, oauthAccount: current.oauthAccount ? { ...current.oauthAccount, organizationRole: data.organization_role, workspaceRole: data.workspace_role, organizationName: data.organization_name, } : current.oauthAccount, }))
logEvent('tengu_oauth_roles_stored', { org_role: data.organization_role as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, })}
export async function createAndStoreApiKey( accessToken: string,): Promise<string | null> { try { const response = await axios.post(getOauthConfig().API_KEY_URL, null, { headers: { Authorization: `Bearer ${accessToken}` }, })
const apiKey = response.data?.raw_key if (apiKey) { await saveApiKey(apiKey) logEvent('tengu_oauth_api_key', { status: 'success' as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, statusCode: response.status, }) return apiKey } return null } catch (error) { logEvent('tengu_oauth_api_key', { status: 'failure' as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, error: (error instanceof Error ? error.message : String( error, )) as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, }) throw error }}
export function isOAuthTokenExpired(expiresAt: number | null): boolean { if (expiresAt === null) { return false }
const bufferTime = 5 * 60 * 1000 const now = Date.now() const expiresWithBuffer = now + bufferTime return expiresWithBuffer >= expiresAt}
export async function fetchProfileInfo(accessToken: string): Promise<{ subscriptionType: SubscriptionType | null displayName?: string rateLimitTier: RateLimitTier | null hasExtraUsageEnabled: boolean | null billingType: BillingType | null accountCreatedAt?: string subscriptionCreatedAt?: string rawProfile?: OAuthProfileResponse}> { const profile = await getOauthProfileFromOauthToken(accessToken) const orgType = profile?.organization?.organization_type
// Reuse the logic from fetchSubscriptionType let subscriptionType: SubscriptionType | null = null switch (orgType) { case 'claude_max': subscriptionType = 'max' break case 'claude_pro': subscriptionType = 'pro' break case 'claude_enterprise': subscriptionType = 'enterprise' break case 'claude_team': subscriptionType = 'team' break default: // Return null for unknown organization types subscriptionType = null break }
const result: { subscriptionType: SubscriptionType | null displayName?: string rateLimitTier: RateLimitTier | null hasExtraUsageEnabled: boolean | null billingType: BillingType | null accountCreatedAt?: string subscriptionCreatedAt?: string } = { subscriptionType, rateLimitTier: profile?.organization?.rate_limit_tier ?? null, hasExtraUsageEnabled: profile?.organization?.has_extra_usage_enabled ?? null, billingType: profile?.organization?.billing_type ?? null, }
if (profile?.account?.display_name) { result.displayName = profile.account.display_name }
if (profile?.account?.created_at) { result.accountCreatedAt = profile.account.created_at }
if (profile?.organization?.subscription_created_at) { result.subscriptionCreatedAt = profile.organization.subscription_created_at }
logEvent('tengu_oauth_profile_fetch_success', {})
return { ...result, rawProfile: profile }}
/** * Gets the organization UUID from the OAuth access token * @returns The organization UUID or null if not authenticated */export async function getOrganizationUUID(): Promise<string | null> { // Check global config first to avoid unnecessary API call const globalConfig = getGlobalConfig() const orgUUID = globalConfig.oauthAccount?.organizationUuid if (orgUUID) { return orgUUID }
// Fall back to fetching from profile (requires user:profile scope) const accessToken = getClaudeAIOAuthTokens()?.accessToken if (accessToken === undefined || !hasProfileScope()) { return null } const profile = await getOauthProfileFromOauthToken(accessToken) const profileOrgUUID = profile?.organization?.uuid if (!profileOrgUUID) { return null } return profileOrgUUID}
/** * Populate the OAuth account info if it has not already been cached in config. * @returns Whether or not the oauth account info was populated. */export async function populateOAuthAccountInfoIfNeeded(): Promise<boolean> { // Check env vars first (synchronous, no network call needed). // SDK callers like Cowork can provide account info directly, which also // eliminates the race condition where early telemetry events lack account info. // NB: If/when adding additional SDK-relevant functionality requiring _other_ OAuth account properties, // please reach out to #proj-cowork so the team can add additional env var fallbacks. const envAccountUuid = process.env.CLAUDE_CODE_ACCOUNT_UUID const envUserEmail = process.env.CLAUDE_CODE_USER_EMAIL const envOrganizationUuid = process.env.CLAUDE_CODE_ORGANIZATION_UUID const hasEnvVars = Boolean( envAccountUuid && envUserEmail && envOrganizationUuid, ) if (envAccountUuid && envUserEmail && envOrganizationUuid) { if (!getGlobalConfig().oauthAccount) { storeOAuthAccountInfo({ accountUuid: envAccountUuid, emailAddress: envUserEmail, organizationUuid: envOrganizationUuid, }) } }
// Wait for any in-flight token refresh to complete first, since // refreshOAuthToken already fetches and stores profile info await checkAndRefreshOAuthTokenIfNeeded()
const config = getGlobalConfig() if ( (config.oauthAccount && config.oauthAccount.billingType !== undefined && config.oauthAccount.accountCreatedAt !== undefined && config.oauthAccount.subscriptionCreatedAt !== undefined) || !isClaudeAISubscriber() || !hasProfileScope() ) { return false }
const tokens = getClaudeAIOAuthTokens() if (tokens?.accessToken) { const profile = await getOauthProfileFromOauthToken(tokens.accessToken) if (profile) { if (hasEnvVars) { logForDebugging( 'OAuth profile fetch succeeded, overriding env var account info', { level: 'info' }, ) } storeOAuthAccountInfo({ accountUuid: profile.account.uuid, emailAddress: profile.account.email, organizationUuid: profile.organization.uuid, displayName: profile.account.display_name || undefined, hasExtraUsageEnabled: profile.organization.has_extra_usage_enabled ?? false, billingType: profile.organization.billing_type ?? undefined, accountCreatedAt: profile.account.created_at, subscriptionCreatedAt: profile.organization.subscription_created_at ?? undefined, }) return true } } return false}
export function storeOAuthAccountInfo({ accountUuid, emailAddress, organizationUuid, displayName, hasExtraUsageEnabled, billingType, accountCreatedAt, subscriptionCreatedAt,}: { accountUuid: string emailAddress: string organizationUuid: string | undefined displayName?: string hasExtraUsageEnabled?: boolean billingType?: BillingType accountCreatedAt?: string subscriptionCreatedAt?: string}): void { const accountInfo: AccountInfo = { accountUuid, emailAddress, organizationUuid, hasExtraUsageEnabled, billingType, accountCreatedAt, subscriptionCreatedAt, } if (displayName) { accountInfo.displayName = displayName } saveGlobalConfig(current => { // For oauthAccount we need to compare content since it's an object if ( current.oauthAccount?.accountUuid === accountInfo.accountUuid && current.oauthAccount?.emailAddress === accountInfo.emailAddress && current.oauthAccount?.organizationUuid === accountInfo.organizationUuid && current.oauthAccount?.displayName === accountInfo.displayName && current.oauthAccount?.hasExtraUsageEnabled === accountInfo.hasExtraUsageEnabled && current.oauthAccount?.billingType === accountInfo.billingType && current.oauthAccount?.accountCreatedAt === accountInfo.accountCreatedAt && current.oauthAccount?.subscriptionCreatedAt === accountInfo.subscriptionCreatedAt ) { return current } return { ...current, oauthAccount: accountInfo } })}