src/services/openaiAuth/client.ts

import { randomBytes } from 'crypto'
import { generateCodeChallenge } from '../oauth/crypto.js'
import type {
  OpenAIJwtClaims,
  OpenAIOAuthTokenResponse,
  OpenAIOAuthTokens,
} from './types.js'

export const OPENAI_AUTH_ISSUER = 'https://auth.openai.com'
export const OPENAI_CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann'
export const OPENAI_CODEX_API_ENDPOINT =
  'https://chatgpt.com/backend-api/codex/responses'
export const OPENAI_CODEX_OAUTH_PORT = 1455
export const OPENAI_CODEX_REDIRECT_PATH = '/auth/callback'
export const OPENAI_CODEX_TOKEN_USER_AGENT = 'codex-cli/0.91.0'

const DEFAULT_TOKEN_LIFETIME_MS = 3600 * 1000
const OPENAI_TOKEN_ERROR_BODY_LIMIT = 500

const OPENAI_TOKEN_REQUEST_HEADERS = {
  Accept: 'application/json',
  'Content-Type': 'application/x-www-form-urlencoded',
  'User-Agent': OPENAI_CODEX_TOKEN_USER_AGENT,
} as const

export function generateOpenAIState(): string {
  return randomBytes(32).toString('hex')
}

export function generateOpenAICodeVerifier(): string {
  return randomBytes(64).toString('hex')
}

export function buildOpenAIAuthorizeUrl(input: {
  redirectUri: string
  codeVerifier: string
  state: string
}): string {
  const params = new URLSearchParams({
    response_type: 'code',
    client_id: OPENAI_CODEX_CLIENT_ID,
    redirect_uri: input.redirectUri,
    scope: 'openid profile email offline_access',
    code_challenge: generateCodeChallenge(input.codeVerifier),
    code_challenge_method: 'S256',
    id_token_add_organizations: 'true',
    codex_cli_simplified_flow: 'true',
    state: input.state,
  })

  return `${OPENAI_AUTH_ISSUER}/oauth/authorize?${params.toString()}`
}

export async function exchangeOpenAICodeForTokens(input: {
  code: string
  redirectUri: string
  codeVerifier: string
}): Promise<OpenAIOAuthTokenResponse> {
  const response = await fetch(`${OPENAI_AUTH_ISSUER}/oauth/token`, {
    method: 'POST',
    headers: OPENAI_TOKEN_REQUEST_HEADERS,
    body: new URLSearchParams({
      grant_type: 'authorization_code',
      code: input.code,
      redirect_uri: input.redirectUri,
      client_id: OPENAI_CODEX_CLIENT_ID,
      code_verifier: input.codeVerifier,
    }).toString(),
  })

  if (!response.ok) {
    throw await buildOpenAITokenHttpError('exchange', response)
  }

  return (await response.json()) as OpenAIOAuthTokenResponse
}

export async function refreshOpenAITokens(
  refreshToken: string,
): Promise<OpenAIOAuthTokenResponse> {
  const response = await fetch(`${OPENAI_AUTH_ISSUER}/oauth/token`, {
    method: 'POST',
    headers: OPENAI_TOKEN_REQUEST_HEADERS,
    body: new URLSearchParams({
      grant_type: 'refresh_token',
      refresh_token: refreshToken,
      client_id: OPENAI_CODEX_CLIENT_ID,
      scope: 'openid profile email',
    }).toString(),
  })

  if (!response.ok) {
    throw await buildOpenAITokenHttpError('refresh', response)
  }

  return (await response.json()) as OpenAIOAuthTokenResponse
}

async function buildOpenAITokenHttpError(
  operation: 'exchange' | 'refresh',
  response: Response,
): Promise<Error> {
  const body = await response.text().catch(() => '')
  const sanitizedBody = sanitizeOpenAITokenErrorBody(body)
  const bodySuffix = sanitizedBody ? `: ${sanitizedBody}` : ''
  return new Error(
    `OpenAI token ${operation} failed: ${response.status}${bodySuffix}`,
  )
}

function sanitizeOpenAITokenErrorBody(body: string): string {
  return body
    .replace(
      /"((?:access_token|refresh_token|id_token|code|code_verifier))"\s*:\s*"[^"]*"/gi,
      '"$1":"[redacted]"',
    )
    .replace(
      /\b(access_token|refresh_token|id_token|code|code_verifier)=([^&\s]+)/gi,
      '$1=[redacted]',
    )
    .slice(0, OPENAI_TOKEN_ERROR_BODY_LIMIT)
}

export function parseOpenAIJwtClaims(
  token?: string,
): OpenAIJwtClaims | undefined {
  if (!token) return undefined
  const parts = token.split('.')
  if (parts.length !== 3) return undefined

  try {
    return JSON.parse(Buffer.from(parts[1]!, 'base64url').toString())
  } catch {
    return undefined
  }
}

export function extractOpenAIAccountId(
  claims?: OpenAIJwtClaims,
): string | undefined {
  if (!claims) return undefined

  return (
    claims.chatgpt_account_id ||
    claims['https://api.openai.com/auth']?.chatgpt_account_id ||
    claims.organizations?.[0]?.id
  )
}

export function normalizeOpenAITokens(
  response: OpenAIOAuthTokenResponse,
): OpenAIOAuthTokens {
  const claims =
    parseOpenAIJwtClaims(response.id_token) ??
    parseOpenAIJwtClaims(response.access_token)

  if (!response.refresh_token) {
    throw new Error('OpenAI OAuth response did not include a refresh token')
  }

  return {
    accessToken: response.access_token,
    refreshToken: response.refresh_token,
    expiresAt: Date.now() + (response.expires_in ?? 3600) * 1000,
    idToken: response.id_token,
    accountId: extractOpenAIAccountId(claims),
    email: claims?.email,
    clientId: OPENAI_CODEX_CLIENT_ID,
  }
}

export function isOpenAITokenExpired(expiresAt: number): boolean {
  return expiresAt - Date.now() <= 5 * 60 * 1000
}

export function withRefreshedAccessToken(
  existing: OpenAIOAuthTokens,
  refreshed: OpenAIOAuthTokenResponse,
): OpenAIOAuthTokens {
  const claims =
    parseOpenAIJwtClaims(refreshed.id_token) ??
    parseOpenAIJwtClaims(refreshed.access_token)

  return {
    accessToken: refreshed.access_token,
    refreshToken: refreshed.refresh_token ?? existing.refreshToken,
    expiresAt: Date.now() + (refreshed.expires_in ?? 3600) * 1000,
    idToken: refreshed.id_token ?? existing.idToken,
    accountId: extractOpenAIAccountId(claims) ?? existing.accountId,
    email: claims?.email ?? existing.email,
    clientId: existing.clientId ?? OPENAI_CODEX_CLIENT_ID,
  }
}