Authentication successful. Return to your terminal / application to continue.
+ +""" + + +# --------------------------------------------------------------------------- +# Data types +# --------------------------------------------------------------------------- + +@dataclass +class TokenSuccess: + access: str + refresh: str + expires: int # Unix ms timestamp when the token expires + + +@dataclass +class TokenFailure: + reason: str + + +TokenResult = TokenSuccess | TokenFailure + + +@dataclass +class AuthorizationFlow: + verifier: str + state: str + url: str + + +# --------------------------------------------------------------------------- +# JWT helpers +# --------------------------------------------------------------------------- + +def _decode_jwt_payload(token: str) -> Optional[dict]: + """Decode the payload segment of a JWT without verifying the signature.""" + try: + parts = token.split(".") + if len(parts) != 3: + return None + payload_b64 = parts[1] + # Add padding if needed + padding = 4 - len(payload_b64) % 4 + if padding != 4: + payload_b64 += "=" * padding + decoded = base64.urlsafe_b64decode(payload_b64) + return json.loads(decoded) + except Exception: + return None + + +def get_account_id(access_token: str) -> Optional[str]: + """Extract the ChatGPT account ID from an access token JWT.""" + payload = _decode_jwt_payload(access_token) + if not payload: + return None + auth_claims = payload.get(JWT_CLAIM_PATH) + if not isinstance(auth_claims, dict): + return None + account_id = auth_claims.get("chatgpt_account_id") + if isinstance(account_id, str) and account_id: + return account_id + return None + + +# --------------------------------------------------------------------------- +# Authorization URL + PKCE +# --------------------------------------------------------------------------- + +def create_authorization_flow(originator: str = "pi") -> AuthorizationFlow: + """Generate PKCE verifier/challenge, state, and the full authorization URL.""" + verifier, challenge = generate_pkce() + state = secrets.token_hex(16) + + params = { + "response_type": "code", + "client_id": CLIENT_ID, + "redirect_uri": REDIRECT_URI, + "scope": SCOPE, + "code_challenge": challenge, + "code_challenge_method": "S256", + "state": state, + "id_token_add_organizations": "true", + "codex_cli_simplified_flow": "true", + "originator": originator, + } + url = f"{AUTHORIZE_URL}?{urlencode(params)}" + return AuthorizationFlow(verifier=verifier, state=state, url=url) + + +# --------------------------------------------------------------------------- +# Local callback server +# --------------------------------------------------------------------------- + +class _CallbackHandler(BaseHTTPRequestHandler): + """Minimal HTTP handler that captures the OAuth callback code.""" + + def do_GET(self): # noqa: N802 + parsed = urlparse(self.path) + if parsed.path != "/auth/callback": + self.send_response(404) + self.end_headers() + self.wfile.write(b"Not found") + return + + qs = parse_qs(parsed.query) + state_vals = qs.get("state", []) + code_vals = qs.get("code", []) + + expected_state: str = self.server.expected_state # type: ignore[attr-defined] + + if not state_vals or state_vals[0] != expected_state: + self.send_response(400) + self.end_headers() + self.wfile.write(b"State mismatch") + return + + if not code_vals: + self.send_response(400) + self.end_headers() + self.wfile.write(b"Missing authorization code") + return + + self.send_response(200) + self.send_header("Content-Type", "text/html; charset=utf-8") + self.end_headers() + self.wfile.write(SUCCESS_HTML) + + self.server.captured_code = code_vals[0] # type: ignore[attr-defined] + + def log_message(self, format, *args): # noqa: A002 + pass # suppress default stderr logging + + +class OAuthCallbackServer: + """ + Wraps an HTTPServer that listens on port 1455 for the OAuth callback. + Runs in a background daemon thread so it doesn't block the caller. + """ + + def __init__(self, state: str): + self._state = state + self._server: Optional[HTTPServer] = None + self._thread: Optional[threading.Thread] = None + self._started = threading.Event() + self._cancelled = False + + def start(self) -> bool: + """Start the background HTTP server. Returns True if successful.""" + try: + server = HTTPServer(("0.0.0.0", CALLBACK_PORT), _CallbackHandler) + server.expected_state = self._state # type: ignore[attr-defined] + server.captured_code = None # type: ignore[attr-defined] + server.timeout = 0.2 # short poll interval so we can check cancel + self._server = server + + def _serve(): + self._started.set() + while not self._cancelled and server.captured_code is None: + server.handle_request() + server.server_close() + + self._thread = threading.Thread(target=_serve, daemon=True) + self._thread.start() + self._started.wait(timeout=2) + return True + except OSError: + return False + + def get_code_nowait(self) -> Optional[str]: + """Non-blocking peek — returns the captured code or None immediately.""" + if self._server is None: + return None + return self._server.captured_code # type: ignore[attr-defined] + + def wait_for_code(self, timeout_seconds: int = 120) -> Optional[str]: + """ + Block until the callback delivers a code or timeout / cancellation. + Returns the authorization code or None. + """ + if self._server is None: + return None + deadline = time.monotonic() + timeout_seconds + while time.monotonic() < deadline: + if self._cancelled: + return None + code = self._server.captured_code # type: ignore[attr-defined] + if code: + return code + time.sleep(0.1) + return None + + def cancel(self): + self._cancelled = True + + def close(self): + self._cancelled = True + if self._thread: + self._thread.join(timeout=2) + + +# --------------------------------------------------------------------------- +# Token exchange / refresh (sync — called from thread or FastAPI background) +# --------------------------------------------------------------------------- + +def exchange_authorization_code( + code: str, + verifier: str, + redirect_uri: str = REDIRECT_URI, +) -> TokenResult: + """Exchange an authorization code for access + refresh tokens.""" + try: + response = httpx.post( + TOKEN_URL, + headers={"Content-Type": "application/x-www-form-urlencoded"}, + data={ + "grant_type": "authorization_code", + "client_id": CLIENT_ID, + "code": code, + "code_verifier": verifier, + "redirect_uri": redirect_uri, + }, + timeout=30, + ) + if not response.is_success: + return TokenFailure(reason=f"HTTP {response.status_code}: {response.text[:200]}") + + body = response.json() + access = body.get("access_token") + refresh = body.get("refresh_token") + expires_in = body.get("expires_in") + + if not access or not refresh or not isinstance(expires_in, (int, float)): + return TokenFailure(reason=f"Token response missing fields: {list(body.keys())}") + + expires_ms = int(time.time() * 1000) + int(expires_in) * 1000 + return TokenSuccess(access=access, refresh=refresh, expires=expires_ms) + except Exception as exc: + return TokenFailure(reason=str(exc)) + + +def refresh_access_token(refresh_token: str) -> TokenResult: + """Use a refresh token to obtain a new access token.""" + try: + response = httpx.post( + TOKEN_URL, + headers={"Content-Type": "application/x-www-form-urlencoded"}, + data={ + "grant_type": "refresh_token", + "refresh_token": refresh_token, + "client_id": CLIENT_ID, + }, + timeout=30, + ) + if not response.is_success: + return TokenFailure(reason=f"HTTP {response.status_code}: {response.text[:200]}") + + body = response.json() + access = body.get("access_token") + refresh = body.get("refresh_token") + expires_in = body.get("expires_in") + + if not access or not refresh or not isinstance(expires_in, (int, float)): + return TokenFailure(reason=f"Token refresh response missing fields: {list(body.keys())}") + + expires_ms = int(time.time() * 1000) + int(expires_in) * 1000 + return TokenSuccess(access=access, refresh=refresh, expires=expires_ms) + except Exception as exc: + return TokenFailure(reason=str(exc)) + + +# --------------------------------------------------------------------------- +# Parsing helpers (for manual code paste / redirect URL fallback) +# --------------------------------------------------------------------------- + +def parse_authorization_input(raw: str) -> dict: + """ + Accept a variety of user-pasted inputs: + - Full redirect URL: http://localhost:1455/auth/callback?code=X&state=Y + - code#state shorthand + - Raw query string: code=X&state=Y + - Bare code value + Returns a dict with optional 'code' and 'state' keys. + """ + value = raw.strip() + if not value: + return {} + + try: + parsed = urlparse(value) + if parsed.scheme in ("http", "https"): + qs = parse_qs(parsed.query) + return { + k: qs[k][0] + for k in ("code", "state") + if k in qs + } + except Exception: + pass + + if "#" in value: + parts = value.split("#", 1) + return {"code": parts[0], "state": parts[1]} + + if "code=" in value: + qs = parse_qs(value) + return {k: qs[k][0] for k in ("code", "state") if k in qs} + + return {"code": value} diff --git a/servers/fastapi/utils/oauth/pkce.py b/servers/fastapi/utils/oauth/pkce.py new file mode 100644 index 00000000..782bc98a --- /dev/null +++ b/servers/fastapi/utils/oauth/pkce.py @@ -0,0 +1,23 @@ +""" +PKCE utilities using Python's secrets and hashlib. +Python port of pi-mono-main/packages/ai/src/utils/oauth/pkce.ts +""" +import base64 +import hashlib +import secrets + + +def generate_pkce() -> tuple[str, str]: + """ + Generate PKCE code verifier and challenge (S256 method). + + Returns: + (verifier, challenge) — both base64url-encoded, no padding + """ + verifier_bytes = secrets.token_bytes(32) + verifier = base64.urlsafe_b64encode(verifier_bytes).rstrip(b"=").decode() + + digest = hashlib.sha256(verifier.encode()).digest() + challenge = base64.urlsafe_b64encode(digest).rstrip(b"=").decode() + + return verifier, challenge diff --git a/servers/fastapi/utils/set_env.py b/servers/fastapi/utils/set_env.py index e388d391..6f26b34f 100644 --- a/servers/fastapi/utils/set_env.py +++ b/servers/fastapi/utils/set_env.py @@ -103,3 +103,24 @@ def set_dall_e_3_quality_env(value): def set_gpt_image_1_5_quality_env(value): os.environ["GPT_IMAGE_1_5_QUALITY"] = value + + +# Codex OAuth +def set_codex_access_token_env(value: str): + os.environ["CODEX_ACCESS_TOKEN"] = value + + +def set_codex_refresh_token_env(value: str): + os.environ["CODEX_REFRESH_TOKEN"] = value + + +def set_codex_token_expires_env(value: str): + os.environ["CODEX_TOKEN_EXPIRES"] = value + + +def set_codex_account_id_env(value: str): + os.environ["CODEX_ACCOUNT_ID"] = value + + +def set_codex_model_env(value: str): + os.environ["CODEX_MODEL"] = value diff --git a/servers/fastapi/utils/user_config.py b/servers/fastapi/utils/user_config.py index 1dd799bb..f83d3047 100644 --- a/servers/fastapi/utils/user_config.py +++ b/servers/fastapi/utils/user_config.py @@ -28,6 +28,11 @@ from utils.get_env import ( get_pixabay_api_key_env, get_extended_reasoning_env, get_web_grounding_env, + get_codex_access_token_env, + get_codex_refresh_token_env, + get_codex_token_expires_env, + get_codex_account_id_env, + get_codex_model_env, ) from utils.parsers import parse_bool_or_none from utils.set_env import ( @@ -55,6 +60,11 @@ from utils.set_env import ( set_pixabay_api_key_env, set_tool_calls_env, set_web_grounding_env, + set_codex_access_token_env, + set_codex_refresh_token_env, + set_codex_token_expires_env, + set_codex_account_id_env, + set_codex_model_env, ) @@ -118,6 +128,11 @@ def get_user_config(): if existing_config.WEB_GROUNDING is not None else (parse_bool_or_none(get_web_grounding_env()) or False) ), + CODEX_MODEL=existing_config.CODEX_MODEL or get_codex_model_env(), + CODEX_ACCESS_TOKEN=existing_config.CODEX_ACCESS_TOKEN or get_codex_access_token_env(), + CODEX_REFRESH_TOKEN=existing_config.CODEX_REFRESH_TOKEN or get_codex_refresh_token_env(), + CODEX_TOKEN_EXPIRES=existing_config.CODEX_TOKEN_EXPIRES or get_codex_token_expires_env(), + CODEX_ACCOUNT_ID=existing_config.CODEX_ACCOUNT_ID or get_codex_account_id_env(), ) @@ -171,3 +186,43 @@ def update_env_with_user_config(): set_extended_reasoning_env(str(user_config.EXTENDED_REASONING)) if user_config.WEB_GROUNDING is not None: set_web_grounding_env(str(user_config.WEB_GROUNDING)) + if user_config.CODEX_MODEL: + set_codex_model_env(user_config.CODEX_MODEL) + if user_config.CODEX_ACCESS_TOKEN: + set_codex_access_token_env(user_config.CODEX_ACCESS_TOKEN) + if user_config.CODEX_REFRESH_TOKEN: + set_codex_refresh_token_env(user_config.CODEX_REFRESH_TOKEN) + if user_config.CODEX_TOKEN_EXPIRES: + set_codex_token_expires_env(user_config.CODEX_TOKEN_EXPIRES) + if user_config.CODEX_ACCOUNT_ID: + set_codex_account_id_env(user_config.CODEX_ACCOUNT_ID) + + +def save_codex_tokens_to_user_config() -> None: + """ + Write the current in-memory Codex OAuth token env vars back to userConfig.json + so they survive container restarts. Called after a successful token exchange + and on logout (where the env vars have already been cleared to ""). + """ + user_config_path = get_user_config_path_env() + if not user_config_path: + return + + existing: dict = {} + try: + if os.path.exists(user_config_path): + with open(user_config_path, "r") as f: + existing = json.load(f) + except Exception: + pass + + existing["CODEX_ACCESS_TOKEN"] = get_codex_access_token_env() + existing["CODEX_REFRESH_TOKEN"] = get_codex_refresh_token_env() + existing["CODEX_TOKEN_EXPIRES"] = get_codex_token_expires_env() + existing["CODEX_ACCOUNT_ID"] = get_codex_account_id_env() + + try: + with open(user_config_path, "w") as f: + json.dump(existing, f) + except Exception: + pass diff --git a/servers/nextjs/app/api/user-config/route.ts b/servers/nextjs/app/api/user-config/route.ts index 586e9cf1..082b42c6 100644 --- a/servers/nextjs/app/api/user-config/route.ts +++ b/servers/nextjs/app/api/user-config/route.ts @@ -91,6 +91,11 @@ export async function POST(request: Request) { userConfig.USE_CUSTOM_URL === undefined ? existingConfig.USE_CUSTOM_URL : userConfig.USE_CUSTOM_URL, + CODEX_MODEL: userConfig.CODEX_MODEL || existingConfig.CODEX_MODEL, + CODEX_ACCESS_TOKEN: existingConfig.CODEX_ACCESS_TOKEN, + CODEX_REFRESH_TOKEN: existingConfig.CODEX_REFRESH_TOKEN, + CODEX_TOKEN_EXPIRES: existingConfig.CODEX_TOKEN_EXPIRES, + CODEX_ACCOUNT_ID: existingConfig.CODEX_ACCOUNT_ID, }; fs.writeFileSync(userConfigPath, JSON.stringify(mergedConfig)); return NextResponse.json(mergedConfig); diff --git a/servers/nextjs/components/CodexConfig.tsx b/servers/nextjs/components/CodexConfig.tsx new file mode 100644 index 00000000..0dad054a --- /dev/null +++ b/servers/nextjs/components/CodexConfig.tsx @@ -0,0 +1,429 @@ +"use client"; +import { useEffect, useRef, useState } from "react"; +import { + Check, + ChevronsUpDown, + Loader2, + LogIn, + LogOut, + RefreshCw, + UserCheck, +} from "lucide-react"; +import { Button } from "./ui/button"; +import { + Command, + CommandEmpty, + CommandGroup, + CommandInput, + CommandItem, + CommandList, +} from "./ui/command"; +import { Popover, PopoverContent, PopoverTrigger } from "./ui/popover"; +import { cn } from "@/lib/utils"; +import { toast } from "sonner"; + +interface CodexConfigProps { + codexModel: string; + onInputChange: (value: string | boolean, field: string) => void; +} + +type AuthStatus = "checking" | "unauthenticated" | "polling" | "authenticated"; + +interface StatusResponse { + status: string; + account_id?: string; + detail?: string; +} + +interface CodexModel { + id: string; + name: string; +} + +const CHATGPT_MODELS: CodexModel[] = [ + { id: "gpt-5.1", name: "GPT-5.1" }, + { id: "gpt-5.1-codex-max", name: "GPT-5.1 Codex Max" }, + { id: "gpt-5.1-codex-mini", name: "GPT-5.1 Codex Mini" }, + { id: "gpt-5.2", name: "GPT-5.2" }, + { id: "gpt-5.2-codex", name: "GPT-5.2 Codex" }, + { id: "gpt-5.3-codex", name: "GPT-5.3 Codex" }, + { id: "gpt-5.3-codex-spark", name: "GPT-5.3 Codex Spark (Free)" }, +]; + +const DEFAULT_CODEX_MODEL = "gpt-5.3-codex-spark"; + +export default function CodexConfig({ + codexModel, + onInputChange, +}: CodexConfigProps) { + const [authStatus, setAuthStatus] = useState+ Waiting for authentication… +
++ Complete the sign-in in the browser tab that just opened. +
++ Didn't get redirected automatically? +
++ After completing the sign-in, paste the full redirect URL or + authorization code below. +
+ setManualCode(e.target.value)} + /> + ++ Signed in to ChatGPT +
+ {accountId && ( ++ Account: {accountId} +
+ )} ++ + Model availability depends on your ChatGPT subscription tier. +
++ Sign in with your OpenAI account to use ChatGPT models directly via + OAuth — no API key required. +
++ + A browser window will open for you to authenticate with your OpenAI + account. Your credentials are stored locally and never shared. +
+