1package auth
2
3import (
4 "context"
5 "errors"
6 "fmt"
7 "net/url"
8 "os"
9 "os/exec"
10 "runtime"
11 "strings"
12 "sync"
13 "time"
14)
15
16// Event is delivered on Manager.Events().
17type Event struct {
18 Kind string // "started" | "browser_open" | "success" | "error" | "canceled"
19 Provider string
20 Method string
21 URL string // login URL (for "started"/"browser_open")
22 Message string // on error
23}
24
25// Manager drives a login flow end-to-end. It owns a local web server
26// (for api-key form) plus provider-specific OAuth callback servers.
27type Manager struct {
28 store *Store
29 keyServer *Server // random-port web form server (api-key flow)
30 oauthServer *CallbackServer // fixed-port callback server (oauth flow, only one at a time)
31 mu sync.Mutex
32 events chan Event
33 openBrowser bool
34
35 oauthCtx context.Context
36 oauthCancel context.CancelFunc
37
38 manualOp *OAuthProvider
39 manualStoreProvider string
40 manualEventProvider string
41 manualPKCE PKCE
42 manualState string
43
44 // exchangeCtx/exchangeCancel own the in-flight pasted-code token exchange.
45 // They are registered under mu so CancelOAuth, Close and a newer login can
46 // abort it, and the exchange re-checks them before persisting anything.
47 exchangeCtx context.Context
48 exchangeCancel context.CancelFunc
49}
50
51// NewManager returns a Manager bound to store.
52func NewManager(store *Store) *Manager {
53 return &Manager{
54 store: store,
55 events: make(chan Event, 16),
56 openBrowser: true,
57 }
58}
59
60// Store returns the underlying credential store.
61func (m *Manager) Store() *Store { return m.store }
62
63// Events returns the read-only event channel.
64func (m *Manager) Events() <-chan Event { return m.events }
65
66// Close shuts down any running servers and cancels pending flows.
67func (m *Manager) Close() {
68 m.mu.Lock()
69 defer m.mu.Unlock()
70 if m.keyServer != nil {
71 ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
72 _ = m.keyServer.Shutdown(ctx)
73 cancel()
74 m.keyServer = nil
75 }
76 // stopOAuthLocked also cancels an in-flight pasted-code exchange.
77 m.stopOAuthLocked()
78}
79
80// ---- API key flow ----
81
82// StartAPIKey launches the API-key login flow.
83func (m *Manager) StartAPIKey(provider string) (string, error) {
84 if !isKnownAPIKeyProvider(provider) {
85 return "", errors.New(apiKeyProviderMessage())
86 }
87 if err := m.ensureKeyServer(); err != nil {
88 return "", err
89 }
90 u := m.keyServer.URL() + "/apikey?provider=" + provider
91 go m.maybeOpen(u)
92 m.emit(Event{Kind: "started", Provider: provider, Method: "apikey", URL: u})
93 return u, nil
94}
95
96func (m *Manager) ensureKeyServer() error {
97 m.mu.Lock()
98 defer m.mu.Unlock()
99 if m.keyServer != nil {
100 return nil
101 }
102 s, err := NewServer()
103 if err != nil {
104 return err
105 }
106 m.keyServer = s
107 go m.consumeKeyServerResults()
108 return nil
109}
110
111func (m *Manager) consumeKeyServerResults() {
112 for res := range m.keyServer.Result() {
113 if res.Err != nil {
114 m.emit(Event{Kind: "error", Provider: res.Provider, Method: res.Method, Message: res.Err.Error()})
115 continue
116 }
117 if err := m.store.SetAPIKey(res.Provider, res.APIKey); err != nil {
118 m.emit(Event{Kind: "error", Provider: res.Provider, Method: "apikey", Message: err.Error()})
119 continue
120 }
121 m.emit(Event{Kind: "success", Provider: res.Provider, Method: "apikey"})
122 }
123}
124
125// ---- OAuth flow ----
126
127// StartOAuth launches the subscription OAuth flow for provider.
128// Only one oauth flow may be in progress at a time (because the
129// callback port is fixed per provider and re-used by the official CLIs).
130//
131// Note: "google" is intentionally not supported here. Google does not
132// offer a subscription OAuth that exchanges a Google One AI / Gemini
133// Advanced login for usable Generative Language API credentials, so
134// the only supported google login path is the API-key flow.
135func (m *Manager) StartOAuth(provider string) (string, error) {
136 if provider == "kimi" {
137 return m.StartKimiDeviceOAuth()
138 }
139 if provider == "xai" {
140 return m.StartXAIDeviceOAuth()
141 }
142 if provider == "github-copilot" {
143 return m.StartGitHubCopilotDeviceOAuth()
144 }
145 storeProvider := provider
146 var op OAuthProvider
147 switch provider {
148 case "anthropic":
149 op = AnthropicOAuth
150 case "openai", "openai-codex":
151 op = OpenAIOAuth
152 storeProvider = "openai"
153 case "google":
154 return "", fmt.Errorf("google login is api-key only; use api key login for gemini")
155 case "deepseek":
156 return "", fmt.Errorf("deepseek login is api-key only; use api key login")
157 default:
158 return "", fmt.Errorf("provider must be anthropic, openai, openai-codex, kimi, xai, github-copilot, deepseek, or google")
159 }
160
161 m.mu.Lock()
162 m.stopOAuthLocked()
163 m.mu.Unlock()
164
165 pkce, err := NewPKCE()
166 if err != nil {
167 return "", err
168 }
169 authURL, state, err := op.AuthorizeURL(pkce)
170 if err != nil {
171 return "", err
172 }
173
174 cs, err := NewCallbackServer(op, state)
175 if err != nil {
176 return "", err
177 }
178
179 ctx, cancel := context.WithCancel(context.Background())
180 m.mu.Lock()
181 m.oauthServer = cs
182 m.oauthCtx = ctx
183 m.oauthCancel = cancel
184 // The pasted-code path shares the browser transaction (same PKCE
185 // verifier, state, and redirect URI) so a code copied from either
186 // route is exchanged exactly once.
187 m.manualOp = &op
188 m.manualStoreProvider = storeProvider
189 m.manualEventProvider = provider
190 m.manualPKCE = pkce
191 m.manualState = state
192 m.mu.Unlock()
193
194 go m.awaitOAuth(ctx, op, storeProvider, provider, cs, pkce, state)
195 go m.maybeOpen(authURL)
196 m.emit(Event{Kind: "started", Provider: provider, Method: "oauth", URL: authURL})
197 return authURL, nil
198}
199
200func (m *Manager) awaitOAuth(ctx context.Context, op OAuthProvider, storeProvider, eventProvider string, cs *CallbackServer, pkce PKCE, state string) {
201 defer cs.Shutdown()
202
203 waitCtx, waitCancel := context.WithTimeout(ctx, 10*time.Minute)
204 defer waitCancel()
205 res, err := cs.Result(waitCtx)
206 if err != nil {
207 if ctx.Err() == nil {
208 m.mu.Lock()
209 if m.oauthCtx == ctx {
210 m.clearManualOAuthLocked()
211 }
212 m.mu.Unlock()
213 m.emit(Event{Kind: "error", Provider: eventProvider, Method: "oauth", Message: "timeout waiting for callback"})
214 }
215 return
216 }
217 if ctx.Err() != nil {
218 return
219 }
220 if res.Err != nil {
221 m.mu.Lock()
222 if m.oauthCtx == ctx {
223 m.clearManualOAuthLocked()
224 }
225 m.mu.Unlock()
226 m.emit(Event{Kind: "error", Provider: eventProvider, Method: "oauth", Message: res.Err.Error()})
227 return
228 }
229 // Claim the transaction. If a pasted code, cancellation, or a newer
230 // login already consumed it, this callback result is stale.
231 m.mu.Lock()
232 if m.oauthCtx != ctx || m.manualOp == nil || ctx.Err() != nil {
233 m.mu.Unlock()
234 return
235 }
236 m.clearManualOAuthLocked()
237 m.mu.Unlock()
238
239 // Derived from ctx so canceling the login also aborts the exchange.
240 exCtx, exCancel := context.WithTimeout(ctx, 30*time.Second)
241 defer exCancel()
242 tok, err := op.Exchange(exCtx, res.Code, res.State, pkce)
243 // Persist and report only while this login is still the current one. The
244 // check and the write share the lock, so a cancel or newer login cannot
245 // interleave between them.
246 m.mu.Lock()
247 defer m.mu.Unlock()
248 if ctx.Err() != nil || m.oauthCtx != ctx {
249 return
250 }
251 if err != nil {
252 m.emit(Event{Kind: "error", Provider: eventProvider, Method: "oauth", Message: err.Error()})
253 return
254 }
255 if err := m.store.SetOAuth(storeProvider, *tok); err != nil {
256 m.emit(Event{Kind: "error", Provider: eventProvider, Method: "oauth", Message: err.Error()})
257 return
258 }
259 m.emit(Event{Kind: "success", Provider: eventProvider, Method: "oauth"})
260}
261
262// StartKimiDeviceOAuth starts Kimi Code's device-code subscription login.
263func (m *Manager) StartKimiDeviceOAuth() (string, error) {
264 ctx, cancel := context.WithCancel(context.Background())
265 m.mu.Lock()
266 m.stopOAuthLocked()
267 m.oauthCtx = ctx
268 m.oauthCancel = cancel
269 m.mu.Unlock()
270
271 dev, err := RequestKimiDeviceAuthorization(ctx)
272 if err != nil {
273 return "", err
274 }
275 url := dev.VerificationURIComplete
276 go m.maybeOpen(url)
277 m.emit(Event{Kind: "started", Provider: "kimi", Method: "oauth", URL: url})
278 go func() {
279 tok, err := PollKimiDeviceToken(ctx, dev)
280 if err != nil {
281 if ctx.Err() == nil {
282 m.emit(Event{Kind: "error", Provider: "kimi", Method: "oauth", Message: err.Error()})
283 }
284 return
285 }
286 if err := m.store.SetOAuth("kimi", *tok); err != nil {
287 m.emit(Event{Kind: "error", Provider: "kimi", Method: "oauth", Message: err.Error()})
288 return
289 }
290 m.emit(Event{Kind: "success", Provider: "kimi", Method: "oauth"})
291 }()
292 return url, nil
293}
294
295// StartXAIDeviceOAuth starts xAI's device-code subscription login.
296func (m *Manager) StartXAIDeviceOAuth() (string, error) {
297 ctx, cancel := context.WithCancel(context.Background())
298 m.mu.Lock()
299 m.stopOAuthLocked()
300 m.oauthCtx = ctx
301 m.oauthCancel = cancel
302 m.mu.Unlock()
303
304 dev, err := RequestXAIDeviceAuthorization(ctx)
305 if err != nil {
306 return "", err
307 }
308 loginURL := dev.VerificationURIComplete
309 go m.maybeOpen(loginURL)
310 m.emit(Event{Kind: "started", Provider: "xai", Method: "oauth", URL: loginURL})
311 go func() {
312 tok, err := PollXAIDeviceToken(ctx, dev)
313 if err != nil {
314 if ctx.Err() == nil {
315 m.emit(Event{Kind: "error", Provider: "xai", Method: "oauth", Message: err.Error()})
316 }
317 return
318 }
319 if err := m.store.SetOAuth("xai", *tok); err != nil {
320 m.emit(Event{Kind: "error", Provider: "xai", Method: "oauth", Message: err.Error()})
321 return
322 }
323 m.emit(Event{Kind: "success", Provider: "xai", Method: "oauth"})
324 }()
325 return loginURL, nil
326}
327
328// StartGitHubCopilotDeviceOAuth starts GitHub Copilot's device-code subscription login.
329func (m *Manager) StartGitHubCopilotDeviceOAuth() (string, error) {
330 ctx, cancel := context.WithCancel(context.Background())
331 m.mu.Lock()
332 m.stopOAuthLocked()
333 m.oauthCtx = ctx
334 m.oauthCancel = cancel
335 m.mu.Unlock()
336
337 dev, err := RequestGitHubCopilotDeviceAuthorization(ctx)
338 if err != nil {
339 return "", err
340 }
341 loginURL := dev.VerificationURI
342 if dev.UserCode != "" {
343 loginURL += "?user_code=" + url.QueryEscape(dev.UserCode)
344 }
345 go m.maybeOpen(loginURL)
346 m.emit(Event{Kind: "started", Provider: "github-copilot", Method: "oauth", URL: loginURL})
347 go func() {
348 tok, err := PollGitHubCopilotDeviceToken(ctx, dev)
349 if err != nil {
350 if ctx.Err() == nil {
351 m.emit(Event{Kind: "error", Provider: "github-copilot", Method: "oauth", Message: err.Error()})
352 }
353 return
354 }
355 if err := m.store.SetOAuth("github-copilot", *tok); err != nil {
356 m.emit(Event{Kind: "error", Provider: "github-copilot", Method: "oauth", Message: err.Error()})
357 return
358 }
359 m.emit(Event{Kind: "success", Provider: "github-copilot", Method: "oauth"})
360 }()
361 return loginURL, nil
362}
363
364// StartManualOAuth begins an OAuth flow but does NOT start a local
365// callback server or open a browser. The returned URL is shown to the
366// user so they can complete the authorization on another device; the
367// resulting code is pasted back via CompleteManualOAuth.
368func (m *Manager) StartManualOAuth(provider string) (string, error) {
369 if provider == "kimi" {
370 return m.StartKimiDeviceOAuth()
371 }
372 if provider == "xai" {
373 return m.StartXAIDeviceOAuth()
374 }
375 if provider == "github-copilot" {
376 return m.StartGitHubCopilotDeviceOAuth()
377 }
378 storeProvider := provider
379 var op OAuthProvider
380 switch provider {
381 case "anthropic":
382 op = AnthropicManualOAuth
383 case "openai", "openai-codex":
384 return "", fmt.Errorf("openai login requires the browser callback flow; manual code login is not supported")
385 case "google":
386 return "", fmt.Errorf("google login is api-key only; use api key login for gemini")
387 case "deepseek":
388 return "", fmt.Errorf("deepseek login is api-key only; use api key login")
389 default:
390 return "", fmt.Errorf("provider must be anthropic, openai, openai-codex, kimi, xai, github-copilot, deepseek, or google")
391 }
392
393 m.CancelOAuth()
394 pkce, err := NewPKCE()
395 if err != nil {
396 return "", err
397 }
398 authURL, state, err := op.AuthorizeURL(pkce)
399 if err != nil {
400 return "", err
401 }
402
403 m.mu.Lock()
404 m.manualOp = &op
405 m.manualStoreProvider = storeProvider
406 m.manualEventProvider = provider
407 m.manualPKCE = pkce
408 m.manualState = state
409 m.mu.Unlock()
410
411 m.emit(Event{Kind: "started", Provider: provider, Method: "oauth", URL: authURL})
412 return authURL, nil
413}
414
415// CompleteManualOAuth exchanges the user-pasted authorization code for
416// a token and stores it. Accepts either a raw code or a "code#state"
417// token shown by providers like Anthropic when code=true is set.
418func (m *Manager) CompleteManualOAuth(ctx context.Context, input string) error {
419 code, pastedState := parseManualCodeInput(strings.TrimSpace(input))
420 m.mu.Lock()
421 if m.manualOp == nil {
422 m.mu.Unlock()
423 return fmt.Errorf("no manual oauth flow in progress")
424 }
425 if pastedState != "" && pastedState != m.manualState {
426 m.mu.Unlock()
427 return fmt.Errorf("oauth state mismatch")
428 }
429 if code == "" {
430 m.mu.Unlock()
431 return fmt.Errorf("empty code")
432 }
433 // Claim the transaction and stop the browser callback so only one
434 // result can be produced.
435 op := *m.manualOp
436 storeProvider := m.manualStoreProvider
437 eventProvider := m.manualEventProvider
438 pkce := m.manualPKCE
439 state := m.manualState
440 m.stopOAuthLocked()
441 // The exchange is manager-owned: derived from the caller's context but
442 // cancelable through CancelOAuth, Close, or a newer login.
443 exCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
444 m.exchangeCtx, m.exchangeCancel = exCtx, cancel
445 m.mu.Unlock()
446 defer cancel()
447
448 tok, err := op.Exchange(exCtx, code, state, pkce)
449 m.mu.Lock()
450 defer m.mu.Unlock()
451 if m.exchangeCtx != exCtx || exCtx.Err() != nil && err == nil {
452 // Canceled or superseded: report the cancellation, store nothing,
453 // emit nothing.
454 return ErrOAuthCanceled
455 }
456 if m.exchangeCtx == exCtx {
457 m.exchangeCtx, m.exchangeCancel = nil, nil
458 }
459 if err != nil {
460 if errors.Is(err, context.Canceled) {
461 return ErrOAuthCanceled
462 }
463 m.emit(Event{Kind: "error", Provider: eventProvider, Method: "oauth", Message: err.Error()})
464 return err
465 }
466 if err := m.store.SetOAuth(storeProvider, *tok); err != nil {
467 m.emit(Event{Kind: "error", Provider: eventProvider, Method: "oauth", Message: err.Error()})
468 return err
469 }
470 m.emit(Event{Kind: "success", Provider: eventProvider, Method: "oauth"})
471 return nil
472}
473
474// ErrOAuthCanceled is returned to a pasted-code caller whose login was
475// canceled or replaced while its token exchange was in flight.
476var ErrOAuthCanceled = errors.New("oauth login canceled")
477
478// parseManualCodeInput accepts any of:
479// - a bare authorization code
480// - a "code#state" pair
481// - a full redirect URL like http(s)://host:port/callback?code=X&state=Y
482//
483// and returns the extracted code and (if any) state.
484func parseManualCodeInput(s string) (code, state string) {
485 if strings.HasPrefix(s, "http://") || strings.HasPrefix(s, "https://") {
486 if u, err := url.Parse(s); err == nil {
487 q := u.Query()
488 return q.Get("code"), q.Get("state")
489 }
490 }
491 if idx := strings.IndexByte(s, '#'); idx >= 0 {
492 return s[:idx], s[idx+1:]
493 }
494 return s, ""
495}
496
497// HasBrowser reports whether the current environment probably has a
498// working interactive browser reachable from localhost. Used by the
499// login flow to auto-switch to paste-code mode on headless boxes
500// (containers, SSH without display forwarding, etc.) instead of
501// trying to bind a callback port the user can never reach.
502func HasBrowser() bool {
503 if os.Getenv("ZUT_NO_BROWSER") != "" {
504 return false
505 }
506 if os.Getenv("ZUT_FORCE_BROWSER") != "" {
507 return true
508 }
509 if _, err := os.Stat("/.dockerenv"); err == nil {
510 return false
511 }
512 if b, err := os.ReadFile("/proc/1/cgroup"); err == nil {
513 txt := string(b)
514 if strings.Contains(txt, "docker") || strings.Contains(txt, "kubepods") || strings.Contains(txt, "containerd") {
515 return false
516 }
517 }
518 switch runtime.GOOS {
519 case "darwin", "windows":
520 return true
521 default:
522 if os.Getenv("DISPLAY") == "" && os.Getenv("WAYLAND_DISPLAY") == "" {
523 return false
524 }
525 return true
526 }
527}
528
529// CancelOAuth aborts any in-flight OAuth flow.
530func (m *Manager) CancelOAuth() {
531 m.mu.Lock()
532 defer m.mu.Unlock()
533 m.stopOAuthLocked()
534}
535
536// stopOAuthLocked cancels any in-flight OAuth flow, shuts down its callback
537// server, and discards the shared transaction. m.mu must be held.
538func (m *Manager) stopOAuthLocked() {
539 if m.exchangeCancel != nil {
540 m.exchangeCancel()
541 m.exchangeCancel = nil
542 m.exchangeCtx = nil
543 }
544 if m.oauthCancel != nil {
545 m.oauthCancel()
546 m.oauthCancel = nil
547 }
548 if m.oauthServer != nil {
549 m.oauthServer.Shutdown()
550 m.oauthServer = nil
551 }
552 m.clearManualOAuthLocked()
553}
554
555func (m *Manager) clearManualOAuthLocked() {
556 m.manualOp = nil
557 m.manualStoreProvider = ""
558 m.manualEventProvider = ""
559 m.manualPKCE = PKCE{}
560 m.manualState = ""
561}
562
563// ---- shared ----
564
565func (m *Manager) emit(e Event) {
566 select {
567 case m.events <- e:
568 default:
569 }
570}
571
572// maybeOpen tries to open u in the system browser.
573func (m *Manager) maybeOpen(u string) {
574 if !m.openBrowser {
575 return
576 }
577 var cmd *exec.Cmd
578 switch runtime.GOOS {
579 case "darwin":
580 cmd = exec.Command("open", u)
581 case "windows":
582 cmd = exec.Command("rundll32", "url.dll,FileProtocolHandler", u)
583 default:
584 cmd = exec.Command("xdg-open", u)
585 }
586 _ = cmd.Start()
587 m.emit(Event{Kind: "browser_open", URL: u})
588}
589
590// RefreshIfNeeded returns the currently-usable credential for provider,
591// refreshing an expired OAuth access token if necessary.
592func (m *Manager) RefreshIfNeeded(ctx context.Context, provider string) (string, string, error) {
593 creds, err := m.store.Load()
594 if err != nil {
595 return "", "", err
596 }
597 p := creds.get(provider)
598 if p == nil {
599 return "", "", fmt.Errorf("unknown provider %q", provider)
600 }
601 if p.APIKey != "" {
602 return p.APIKey, "apikey", nil
603 }
604 if p.APIKeyCommand != nil {
605 key, err := ResolveAPIKeyCommand(ctx, *p.APIKeyCommand)
606 if err != nil {
607 return "", "", fmt.Errorf("resolve api key for %s: %w", provider, err)
608 }
609 return key, "apikey", nil
610 }
611 if p.OAuth == nil {
612 return "", "", fmt.Errorf("no credentials for %s", provider)
613 }
614 if !p.OAuth.Expired() {
615 return p.OAuth.AccessToken, "oauth", nil
616 }
617 if p.OAuth.RefreshToken == "" {
618 return "", "", fmt.Errorf("%s access token expired and no refresh token is available; please /login again", provider)
619 }
620 var op OAuthProvider
621 switch provider {
622 case "anthropic":
623 op = AnthropicOAuth
624 case "openai":
625 op = OpenAIOAuth
626 }
627 tok, err := op.Refresh(ctx, p.OAuth.RefreshToken)
628 if err != nil {
629 return "", "", err
630 }
631 if tok.RefreshToken == "" {
632 tok.RefreshToken = p.OAuth.RefreshToken
633 }
634 if err := m.store.SetOAuth(provider, *tok); err != nil {
635 return "", "", err
636 }
637 return tok.AccessToken, "oauth", nil
638}