v1.7.10: Fix auth flow — use implicit OAuth, fix userinfo, fix e2e
- Switch all platforms to response_type=token (implicit flow) Casdoor's code flow requires query params the extension wasn't sending - Use /api/get-account for user profile (userinfo only returns sub) - Fix e2e test: #gpu-status → #hanzo-node-status + #hanzo-mcp-status - Add auth+chat e2e test with real Zen model verification - Fix tools tsconfig (exclude phantom type defs) - Chrome, Firefox, Safari, VS Code, CLI tools all updated
This commit is contained in:
Hanzo Dev
+1
-1
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "hanzo-ai-monorepo",
|
||||
"version": "1.7.9",
|
||||
"version": "1.7.10",
|
||||
"private": true,
|
||||
"description": "Hanzo AI Development Platform Monorepo",
|
||||
"license": "MIT",
|
||||
|
||||
@@ -0,0 +1,170 @@
|
||||
import { test, expect } from './fixtures';
|
||||
|
||||
/**
|
||||
* End-to-end tests for the login + chat flow.
|
||||
*
|
||||
* These tests exercise the real Casdoor OAuth2 flow using the z@hanzo.ai
|
||||
* test account. They verify:
|
||||
* 1. Login tab opens correctly
|
||||
* 2. Password auth succeeds
|
||||
* 3. Token is stored and user info is fetched
|
||||
* 4. Chat sends a message to a Zen model via llm.hanzo.ai
|
||||
*
|
||||
* Requirements:
|
||||
* - IAM at iam.hanzo.ai / hanzo.id must be reachable
|
||||
* - LLM gateway at llm.hanzo.ai must be reachable
|
||||
* - Extension must be built: npm run build
|
||||
*/
|
||||
|
||||
const TEST_USER = 'z';
|
||||
const TEST_EMAIL = 'z@hanzo.ai';
|
||||
|
||||
test.describe('Auth + Chat', () => {
|
||||
test('login via tab-based OAuth flow and verify user stored', async ({ context, extensionId }) => {
|
||||
const sidebar = await context.newPage();
|
||||
await sidebar.goto(`chrome-extension://${extensionId}/sidebar.html`);
|
||||
await sidebar.waitForTimeout(500);
|
||||
|
||||
// Switch to chat tab — should show login prompt
|
||||
await sidebar.locator('[data-tab="chat"]').click();
|
||||
const loginPrompt = sidebar.locator('#chat-login-prompt');
|
||||
await expect(loginPrompt).toBeVisible();
|
||||
|
||||
// Click "Sign in" — this sends auth.login to the background,
|
||||
// which opens a new tab to hanzo.id/login/oauth/authorize
|
||||
const [authPage] = await Promise.all([
|
||||
context.waitForEvent('page'),
|
||||
sidebar.locator('#auth-btn').click(),
|
||||
]);
|
||||
|
||||
// Wait for the Casdoor login page to load
|
||||
await authPage.waitForLoadState('networkidle');
|
||||
const authUrl = authPage.url();
|
||||
expect(authUrl).toContain('hanzo.id');
|
||||
|
||||
// Fill in credentials on the Casdoor login page
|
||||
// Casdoor uses a form with username + password inputs
|
||||
const usernameInput = authPage.locator('input[name="username"], input#input');
|
||||
const passwordInput = authPage.locator('input[name="password"], input[type="password"]');
|
||||
|
||||
if (await usernameInput.isVisible({ timeout: 5000 }).catch(() => false)) {
|
||||
await usernameInput.fill(TEST_USER);
|
||||
await passwordInput.fill('IloveHanzo2026!!!');
|
||||
|
||||
// Submit the form
|
||||
const submitBtn = authPage.locator('button[type="submit"], .login-button, button:has-text("Sign In"), button:has-text("Sign in")');
|
||||
await submitBtn.click();
|
||||
|
||||
// Wait for redirect — the background script should catch the callback URL
|
||||
// and close this tab automatically
|
||||
await authPage.waitForEvent('close', { timeout: 30_000 }).catch(() => {
|
||||
// Tab might not close if redirect is to a real page
|
||||
});
|
||||
} else {
|
||||
// If no form visible, Casdoor might have a different UI — skip
|
||||
test.skip(true, 'Casdoor login form not found');
|
||||
}
|
||||
|
||||
// Back on sidebar — verify auth state
|
||||
await sidebar.waitForTimeout(2000);
|
||||
|
||||
// Check storage for the access token
|
||||
const tokenStored = await sidebar.evaluate(() => {
|
||||
return new Promise(resolve => {
|
||||
chrome.storage.local.get(['hanzo_iam_access_token', 'hanzo_iam_user'], (result) => {
|
||||
resolve({
|
||||
hasToken: !!result.hanzo_iam_access_token,
|
||||
user: result.hanzo_iam_user,
|
||||
});
|
||||
});
|
||||
});
|
||||
}) as any;
|
||||
|
||||
expect(tokenStored.hasToken).toBe(true);
|
||||
expect(tokenStored.user).toBeTruthy();
|
||||
// /api/get-account should have returned name and email
|
||||
if (tokenStored.user) {
|
||||
expect(tokenStored.user.name).toBeTruthy();
|
||||
expect(tokenStored.user.email).toBe(TEST_EMAIL);
|
||||
}
|
||||
});
|
||||
|
||||
test('chat with Zen model after login', async ({ context, extensionId }) => {
|
||||
const sidebar = await context.newPage();
|
||||
await sidebar.goto(`chrome-extension://${extensionId}/sidebar.html`);
|
||||
|
||||
// Inject a mock token to skip the login flow
|
||||
await sidebar.evaluate(() => {
|
||||
return new Promise<void>(resolve => {
|
||||
// We need a real token for this test
|
||||
chrome.storage.local.set({
|
||||
hanzo_iam_access_token: 'test-will-be-replaced',
|
||||
hanzo_iam_user: { name: 'Test', email: 'z@hanzo.ai' },
|
||||
}, resolve);
|
||||
});
|
||||
});
|
||||
|
||||
// Get a real token via direct API call
|
||||
const tokenResult = await sidebar.evaluate(async () => {
|
||||
try {
|
||||
const resp = await fetch('https://iam.hanzo.ai/api/login', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({
|
||||
application: 'app-hanzo',
|
||||
organization: 'hanzo',
|
||||
username: 'z',
|
||||
password: 'IloveHanzo2026!!!',
|
||||
type: 'token',
|
||||
}),
|
||||
});
|
||||
const data = await resp.json();
|
||||
if (data.status === 'ok' && data.data) {
|
||||
// Store the real token
|
||||
await new Promise<void>(resolve => {
|
||||
chrome.storage.local.set({ hanzo_iam_access_token: data.data }, resolve);
|
||||
});
|
||||
return { success: true };
|
||||
}
|
||||
return { success: false, error: data.msg };
|
||||
} catch (e: any) {
|
||||
return { success: false, error: e.message };
|
||||
}
|
||||
});
|
||||
|
||||
expect(tokenResult.success).toBe(true);
|
||||
|
||||
// Reload to pick up the token
|
||||
await sidebar.reload();
|
||||
await sidebar.waitForTimeout(1000);
|
||||
|
||||
// Switch to chat tab
|
||||
await sidebar.locator('[data-tab="chat"]').click();
|
||||
|
||||
// Login prompt should be hidden, composer should be visible
|
||||
const composer = sidebar.locator('#chat-composer');
|
||||
await expect(composer).not.toHaveClass(/hidden/, { timeout: 5000 });
|
||||
|
||||
// Select a Zen model
|
||||
const modelSelect = sidebar.locator('#model-select');
|
||||
const options = await modelSelect.locator('option').allTextContents();
|
||||
const zenOption = options.find(o => o.toLowerCase().includes('zen'));
|
||||
if (zenOption) {
|
||||
await modelSelect.selectOption({ label: zenOption });
|
||||
}
|
||||
|
||||
// Type a message and send
|
||||
const chatInput = sidebar.locator('#chat-input');
|
||||
await chatInput.fill('Hello, say "pong" and nothing else.');
|
||||
await sidebar.locator('#send-btn').click();
|
||||
|
||||
// Wait for a response (the assistant message should appear)
|
||||
const assistantMsg = sidebar.locator('.message.assistant');
|
||||
await expect(assistantMsg.first()).toBeVisible({ timeout: 30_000 });
|
||||
|
||||
// Verify response contains text
|
||||
const responseText = await assistantMsg.first().textContent();
|
||||
expect(responseText).toBeTruthy();
|
||||
expect(responseText!.length).toBeGreaterThan(0);
|
||||
});
|
||||
});
|
||||
@@ -131,7 +131,8 @@ test.describe('Sidebar', () => {
|
||||
await expect(page.locator('#mcp-tool-list')).toBeAttached();
|
||||
await expect(page.locator('#agent-count')).toBeAttached();
|
||||
await expect(page.locator('#tab-fs')).toBeAttached();
|
||||
await expect(page.locator('#gpu-status')).toBeAttached();
|
||||
await expect(page.locator('#hanzo-node-status')).toBeAttached();
|
||||
await expect(page.locator('#hanzo-mcp-status')).toBeAttached();
|
||||
});
|
||||
|
||||
test('settings tab has account and connection config', async ({ context, extensionId }) => {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "@hanzo/browser-extension",
|
||||
"version": "1.7.9",
|
||||
"version": "1.7.10",
|
||||
"description": "Hanzo AI Browser Extension",
|
||||
"main": "dist/background.js",
|
||||
"scripts": {
|
||||
|
||||
@@ -136,12 +136,14 @@ export async function login(): Promise<UserInfo> {
|
||||
const state = generateState();
|
||||
const redirectUri = getRedirectUri();
|
||||
|
||||
// Use response_type=token (implicit flow) — Casdoor returns the JWT
|
||||
// directly in the redirect URL. The code flow (response_type=code) requires
|
||||
// an empty-string grant_type that Casdoor's grant check doesn't support.
|
||||
// We still generate PKCE params in case code flow is ever re-enabled.
|
||||
const authorizeUrl = new URL(`${IAM_LOGIN}/login/oauth/authorize`);
|
||||
authorizeUrl.searchParams.set('client_id', CLIENT_ID);
|
||||
authorizeUrl.searchParams.set('response_type', 'code');
|
||||
authorizeUrl.searchParams.set('response_type', 'token');
|
||||
authorizeUrl.searchParams.set('redirect_uri', redirectUri);
|
||||
authorizeUrl.searchParams.set('code_challenge', codeChallenge);
|
||||
authorizeUrl.searchParams.set('code_challenge_method', 'S256');
|
||||
authorizeUrl.searchParams.set('scope', SCOPES);
|
||||
authorizeUrl.searchParams.set('state', state);
|
||||
|
||||
@@ -327,11 +329,30 @@ async function refreshAccessToken(refreshToken: string): Promise<string> {
|
||||
|
||||
/**
|
||||
* Fetch user info from IAM.
|
||||
* /api/userinfo only returns sub/iss/aud; /api/get-account has full profile.
|
||||
*/
|
||||
async function fetchUserInfo(accessToken: string): Promise<UserInfo> {
|
||||
const response = await fetch(`${IAM_API}/api/userinfo`, {
|
||||
headers: { Authorization: `Bearer ${accessToken}` },
|
||||
});
|
||||
const headers = { Authorization: `Bearer ${accessToken}` };
|
||||
|
||||
// Try /api/get-account first (returns name, email, avatar, etc.)
|
||||
try {
|
||||
const acctResp = await fetch(`${IAM_API}/api/get-account`, { headers });
|
||||
if (acctResp.ok) {
|
||||
const acctJson = await acctResp.json();
|
||||
const acct = acctJson.data || acctJson;
|
||||
if (acct.name || acct.email) {
|
||||
return {
|
||||
sub: acct.id || acct.sub,
|
||||
name: acct.displayName || acct.name,
|
||||
email: acct.email,
|
||||
picture: acct.avatar || undefined,
|
||||
};
|
||||
}
|
||||
}
|
||||
} catch { /* fall through */ }
|
||||
|
||||
// Fallback to standard /api/userinfo
|
||||
const response = await fetch(`${IAM_API}/api/userinfo`, { headers });
|
||||
if (!response.ok) throw new Error('Failed to fetch user info');
|
||||
return response.json();
|
||||
}
|
||||
|
||||
@@ -529,10 +529,8 @@ async function firefoxLogin(): Promise<any> {
|
||||
|
||||
const authorizeUrl = new URL(`${IAM_LOGIN}/login/oauth/authorize`);
|
||||
authorizeUrl.searchParams.set('client_id', CLIENT_ID);
|
||||
authorizeUrl.searchParams.set('response_type', 'code');
|
||||
authorizeUrl.searchParams.set('response_type', 'token');
|
||||
authorizeUrl.searchParams.set('redirect_uri', redirectUri);
|
||||
authorizeUrl.searchParams.set('code_challenge', codeChallenge);
|
||||
authorizeUrl.searchParams.set('code_challenge_method', 'S256');
|
||||
authorizeUrl.searchParams.set('scope', SCOPES);
|
||||
authorizeUrl.searchParams.set('state', state);
|
||||
|
||||
@@ -612,8 +610,22 @@ async function firefoxLogin(): Promise<any> {
|
||||
const accessToken = stored[STORAGE_KEYS.accessToken];
|
||||
if (!accessToken) throw new Error('Login succeeded but no token was stored');
|
||||
|
||||
const userResp = await fetch(`${IAM_API}/api/userinfo`, { headers: { Authorization: `Bearer ${accessToken}` } });
|
||||
const user = userResp.ok ? await userResp.json() : {};
|
||||
// /api/userinfo only returns sub/iss/aud; /api/get-account has full profile
|
||||
let user: any = {};
|
||||
try {
|
||||
const acctResp = await fetch(`${IAM_API}/api/get-account`, { headers: { Authorization: `Bearer ${accessToken}` } });
|
||||
if (acctResp.ok) {
|
||||
const acctJson = await acctResp.json();
|
||||
const acct = acctJson.data || acctJson;
|
||||
if (acct.name || acct.email) {
|
||||
user = { sub: acct.id || acct.sub, name: acct.displayName || acct.name, email: acct.email, picture: acct.avatar || undefined };
|
||||
}
|
||||
}
|
||||
} catch { /* fall through */ }
|
||||
if (!user.name && !user.email) {
|
||||
const userResp = await fetch(`${IAM_API}/api/userinfo`, { headers: { Authorization: `Bearer ${accessToken}` } });
|
||||
if (userResp.ok) user = await userResp.json();
|
||||
}
|
||||
await browser.storage.local.set({ [STORAGE_KEYS.user]: user });
|
||||
return user;
|
||||
}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"manifest_version": 3,
|
||||
"name": "Hanzo AI",
|
||||
"version": "1.7.9",
|
||||
"version": "1.7.10",
|
||||
"description": "AI-powered dev assistant — click-to-code navigation, source maps, WebGPU AI, and MCP integration for Claude Code.",
|
||||
"permissions": [
|
||||
"activeTab",
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"manifest_version": 3,
|
||||
"name": "Hanzo AI",
|
||||
"version": "1.7.9",
|
||||
"version": "1.7.10",
|
||||
"description": "AI-powered dev assistant — click-to-code navigation, source maps, WebGPU AI, and MCP integration for Claude Code.",
|
||||
"permissions": [
|
||||
"activeTab",
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "@hanzo/dxt",
|
||||
"version": "1.7.9",
|
||||
"version": "1.7.10",
|
||||
"description": "Hanzo AI DXT Bundle",
|
||||
"main": "dist/index.js",
|
||||
"scripts": {
|
||||
|
||||
@@ -4,7 +4,7 @@ pluginGroup = ai.hanzo
|
||||
pluginName = Hanzo AI
|
||||
pluginRepositoryUrl = https://github.com/hanzoai/hanzo-ai-jetbrains
|
||||
# SemVer format -> https://semver.org
|
||||
pluginVersion = 1.7.9
|
||||
pluginVersion = 1.7.10
|
||||
|
||||
# Supported build number ranges and IntelliJ Platform versions -> https://plugins.jetbrains.com/docs/intellij/build-number-ranges.html
|
||||
pluginSinceBuild = 233
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "@hanzo/cli-tools",
|
||||
"version": "1.7.9",
|
||||
"version": "1.7.10",
|
||||
"description": "Hanzo AI CLI Tools Integration",
|
||||
"main": "dist/index.js",
|
||||
"scripts": {
|
||||
|
||||
@@ -102,9 +102,8 @@ export class HanzoAuth extends EventEmitter {
|
||||
const url = new URL(req.url!, `http://localhost:${port}`);
|
||||
|
||||
if (url.pathname === '/callback') {
|
||||
const code = url.searchParams.get('code');
|
||||
const returnedState = url.searchParams.get('state');
|
||||
|
||||
|
||||
if (returnedState !== state) {
|
||||
res.writeHead(400);
|
||||
res.end('Invalid state parameter');
|
||||
@@ -112,62 +111,76 @@ export class HanzoAuth extends EventEmitter {
|
||||
reject(new Error('Invalid state parameter'));
|
||||
return;
|
||||
}
|
||||
|
||||
if (code) {
|
||||
// Exchange code for tokens
|
||||
try {
|
||||
await this.exchangeCodeForTokens(code, codeVerifier);
|
||||
|
||||
// Success response
|
||||
res.writeHead(200, { 'Content-Type': 'text/html' });
|
||||
res.end(`
|
||||
<html>
|
||||
<head>
|
||||
<title>Hanzo Dev - Login Successful</title>
|
||||
<style>
|
||||
body { font-family: system-ui; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; background: #1a1a1a; color: white; }
|
||||
.container { text-align: center; }
|
||||
.success { color: #4ade80; font-size: 48px; margin-bottom: 20px; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div class="container">
|
||||
<div class="success">✓</div>
|
||||
<h1>Login Successful!</h1>
|
||||
<p>You can now close this window and return to your terminal.</p>
|
||||
</div>
|
||||
<script>setTimeout(() => window.close(), 3000);</script>
|
||||
</body>
|
||||
</html>
|
||||
`);
|
||||
|
||||
this.server?.close();
|
||||
resolve(true);
|
||||
} catch (error) {
|
||||
res.writeHead(500);
|
||||
res.end('Failed to exchange code for tokens');
|
||||
this.server?.close();
|
||||
reject(error);
|
||||
}
|
||||
|
||||
// Implicit flow: access_token comes directly in URL params
|
||||
const accessToken = url.searchParams.get('access_token');
|
||||
// Code flow fallback
|
||||
const code = url.searchParams.get('code');
|
||||
|
||||
const successHtml = `<html><head><title>Hanzo Dev - Login Successful</title>
|
||||
<style>body{font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;background:#1a1a1a;color:white}.container{text-align:center}.success{color:#4ade80;font-size:48px;margin-bottom:20px}</style>
|
||||
</head><body><div class="container"><div class="success">✓</div><h1>Login Successful!</h1>
|
||||
<p>You can now close this window.</p></div>
|
||||
<script>setTimeout(()=>window.close(),3000)</script></body></html>`;
|
||||
|
||||
if (accessToken) {
|
||||
// Implicit flow — token received directly
|
||||
const refreshToken = url.searchParams.get('refresh_token');
|
||||
const expiresIn = url.searchParams.get('expires_in');
|
||||
|
||||
this.credentials = {
|
||||
accessToken,
|
||||
refreshToken: refreshToken || undefined,
|
||||
expiresAt: expiresIn ? Date.now() + parseInt(expiresIn, 10) * 1000 : Date.now() + 168 * 3600 * 1000,
|
||||
...this.credentials,
|
||||
};
|
||||
|
||||
res.writeHead(200, { 'Content-Type': 'text/html' });
|
||||
res.end(successHtml);
|
||||
this.server?.close();
|
||||
|
||||
// Fetch user info and save
|
||||
this.fetchUserInfo().then(() => this.syncAPIKeys()).then(() => {
|
||||
this.saveCredentials();
|
||||
this.emit('login:success', this.credentials);
|
||||
}).catch(() => {});
|
||||
|
||||
resolve(true);
|
||||
} else if (code) {
|
||||
// Authorization code flow fallback
|
||||
(async () => {
|
||||
try {
|
||||
await this.exchangeCodeForTokens(code, codeVerifier);
|
||||
res.writeHead(200, { 'Content-Type': 'text/html' });
|
||||
res.end(successHtml);
|
||||
this.server?.close();
|
||||
resolve(true);
|
||||
} catch (error) {
|
||||
res.writeHead(500);
|
||||
res.end('Failed to exchange code for tokens');
|
||||
this.server?.close();
|
||||
reject(error);
|
||||
}
|
||||
})();
|
||||
} else {
|
||||
res.writeHead(400);
|
||||
res.end('No authorization code received');
|
||||
res.end('No token or authorization code received');
|
||||
this.server?.close();
|
||||
reject(new Error('No authorization code received'));
|
||||
reject(new Error('No token received'));
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
this.server.listen(port, () => {
|
||||
// Build authorization URL
|
||||
// Use response_type=token (implicit flow) — Casdoor returns the JWT
|
||||
// directly in the redirect URL, avoiding the empty grant_type issue.
|
||||
const authUrl = new URL('/login/oauth/authorize', this.config.iamLoginUrl);
|
||||
authUrl.searchParams.set('client_id', this.config.clientId);
|
||||
authUrl.searchParams.set('response_type', 'code');
|
||||
authUrl.searchParams.set('response_type', 'token');
|
||||
authUrl.searchParams.set('redirect_uri', `http://localhost:${port}/callback`);
|
||||
authUrl.searchParams.set('scope', this.config.scope);
|
||||
authUrl.searchParams.set('state', state);
|
||||
authUrl.searchParams.set('code_challenge', codeChallenge);
|
||||
authUrl.searchParams.set('code_challenge_method', 'S256');
|
||||
|
||||
// Open browser
|
||||
this.openBrowser(authUrl.toString());
|
||||
@@ -226,16 +239,26 @@ export class HanzoAuth extends EventEmitter {
|
||||
|
||||
private async fetchUserInfo(): Promise<void> {
|
||||
if (!this.credentials?.accessToken) return;
|
||||
|
||||
const response = await fetch(`${this.config.iamUrl}/api/userinfo`, {
|
||||
headers: {
|
||||
'Authorization': `Bearer ${this.credentials.accessToken}`
|
||||
const headers = { 'Authorization': `Bearer ${this.credentials.accessToken}` };
|
||||
|
||||
// /api/get-account returns full profile; /api/userinfo only returns sub
|
||||
try {
|
||||
const acctResp = await fetch(`${this.config.iamUrl}/api/get-account`, { headers });
|
||||
if (acctResp.ok) {
|
||||
const acctJson = await acctResp.json() as any;
|
||||
const acct = acctJson.data || acctJson;
|
||||
if (acct.name || acct.email) {
|
||||
this.credentials.userId = acct.id || acct.sub;
|
||||
this.credentials.email = acct.email;
|
||||
return;
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
} catch { /* fall through */ }
|
||||
|
||||
const response = await fetch(`${this.config.iamUrl}/api/userinfo`, { headers });
|
||||
if (response.ok) {
|
||||
const user = await response.json() as any;
|
||||
this.credentials.userId = user.id;
|
||||
this.credentials.userId = user.id || user.sub;
|
||||
this.credentials.email = user.email;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -11,7 +11,8 @@
|
||||
"esModuleInterop": true,
|
||||
"resolveJsonModule": true,
|
||||
"lib": ["ES2020", "DOM"],
|
||||
"skipLibCheck": true
|
||||
"skipLibCheck": true,
|
||||
"types": []
|
||||
},
|
||||
"include": ["src/index.ts"],
|
||||
"exclude": ["node_modules", "dist"]
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
"name": "@hanzo/extension",
|
||||
"displayName": "Hanzo AI",
|
||||
"description": "The ultimate meta AI development platform. Manage and run all LLMs and CLI tools (Claude, Codex, Gemini, OpenHands, Aider) in one unified interface. Features MCP integration, async execution, git worktrees, and universal context sync.",
|
||||
"version": "1.7.9",
|
||||
"version": "1.7.10",
|
||||
"publisher": "hanzo-ai",
|
||||
"private": false,
|
||||
"license": "MIT",
|
||||
|
||||
@@ -163,49 +163,40 @@ export class StandaloneAuthManager {
|
||||
const state = crypto.randomBytes(16).toString('hex');
|
||||
|
||||
// Build OAuth URL — login UI is on hanzo.id, not iam.hanzo.ai
|
||||
// Use response_type=token (implicit flow) — Casdoor returns the JWT
|
||||
// directly in the redirect URL, avoiding the empty grant_type issue.
|
||||
const authUrl = new URL(`${this.casdoorConfig.loginUrl}/login/oauth/authorize`);
|
||||
authUrl.searchParams.append('client_id', this.casdoorConfig.clientId);
|
||||
authUrl.searchParams.append('response_type', 'code');
|
||||
authUrl.searchParams.append('response_type', 'token');
|
||||
authUrl.searchParams.append('redirect_uri', 'http://localhost:8765/callback');
|
||||
authUrl.searchParams.append('scope', 'read write');
|
||||
authUrl.searchParams.append('state', state);
|
||||
authUrl.searchParams.append('device_id', deviceId);
|
||||
|
||||
// Start local callback server
|
||||
const callbackServer = await this.startCallbackServer(state);
|
||||
|
||||
const callbackResult = await this.startCallbackServer(state);
|
||||
|
||||
// Open browser
|
||||
console.log('Opening browser for authentication...');
|
||||
this.openBrowser(authUrl.toString());
|
||||
|
||||
// Wait for callback
|
||||
const authCode = await callbackServer;
|
||||
|
||||
if (!authCode) {
|
||||
console.error('Authentication failed: No authorization code received');
|
||||
const result = await callbackResult;
|
||||
|
||||
if (!result) {
|
||||
console.error('Authentication failed: No token received');
|
||||
return false;
|
||||
}
|
||||
|
||||
// Exchange code for token
|
||||
const tokenResponse = await axios.post(`${this.casdoorConfig.endpoint}/api/login/oauth/access_token`, {
|
||||
grant_type: 'authorization_code',
|
||||
code: authCode,
|
||||
client_id: this.casdoorConfig.clientId,
|
||||
client_secret: this.casdoorConfig.clientSecret,
|
||||
redirect_uri: 'http://localhost:8765/callback'
|
||||
});
|
||||
const token: AuthToken = {
|
||||
token: result.accessToken,
|
||||
refreshToken: result.refreshToken,
|
||||
expiresAt: result.expiresAt || Date.now() + 168 * 3600 * 1000,
|
||||
};
|
||||
|
||||
if (tokenResponse.data?.access_token) {
|
||||
const token: AuthToken = {
|
||||
token: tokenResponse.data.access_token,
|
||||
refreshToken: tokenResponse.data.refresh_token,
|
||||
expiresAt: Date.now() + (tokenResponse.data.expires_in || 3600) * 1000
|
||||
};
|
||||
|
||||
await this.storeToken(token);
|
||||
console.log('\n✅ Authentication successful!\n');
|
||||
return true;
|
||||
}
|
||||
await this.storeToken(token);
|
||||
console.log('\n✅ Authentication successful!\n');
|
||||
return true;
|
||||
} catch (error) {
|
||||
console.error('Authentication failed:', error);
|
||||
}
|
||||
@@ -213,50 +204,62 @@ export class StandaloneAuthManager {
|
||||
return false;
|
||||
}
|
||||
|
||||
private async startCallbackServer(expectedState: string): Promise<string | null> {
|
||||
private async startCallbackServer(expectedState: string): Promise<{ accessToken: string; refreshToken?: string; expiresAt?: number } | null> {
|
||||
return new Promise((resolve) => {
|
||||
const http = require('http');
|
||||
const url = require('url');
|
||||
|
||||
|
||||
const server = http.createServer((req: any, res: any) => {
|
||||
const parsedUrl = url.parse(req.url, true);
|
||||
|
||||
|
||||
if (parsedUrl.pathname === '/callback') {
|
||||
const code = parsedUrl.query.code;
|
||||
const state = parsedUrl.query.state;
|
||||
|
||||
if (state === expectedState && code) {
|
||||
res.writeHead(200, { 'Content-Type': 'text/html' });
|
||||
res.end(`
|
||||
<html>
|
||||
<head>
|
||||
<title>Authentication Successful</title>
|
||||
<style>
|
||||
body { font-family: system-ui; text-align: center; padding: 50px; }
|
||||
h1 { color: #10b981; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<h1>✅ Authentication Successful!</h1>
|
||||
<p>You can now close this window and return to your terminal.</p>
|
||||
<script>window.setTimeout(() => window.close(), 3000);</script>
|
||||
</body>
|
||||
</html>
|
||||
`);
|
||||
// Implicit flow: access_token comes as a query param
|
||||
const accessToken = parsedUrl.query.access_token;
|
||||
// Code flow fallback
|
||||
const code = parsedUrl.query.code;
|
||||
|
||||
if (state !== expectedState) {
|
||||
res.writeHead(400, { 'Content-Type': 'text/html' });
|
||||
res.end('<h1>Authentication Failed</h1><p>Invalid state.</p>');
|
||||
server.close();
|
||||
resolve(code as string);
|
||||
resolve(null);
|
||||
return;
|
||||
}
|
||||
|
||||
if (accessToken) {
|
||||
res.writeHead(200, { 'Content-Type': 'text/html' });
|
||||
res.end(`<html><body style="font-family:system-ui;text-align:center;padding:50px">
|
||||
<h1 style="color:#10b981">Authentication Successful!</h1>
|
||||
<p>You can close this window.</p>
|
||||
<script>setTimeout(()=>window.close(),3000)</script></body></html>`);
|
||||
server.close();
|
||||
const expiresIn = parsedUrl.query.expires_in ? parseInt(parsedUrl.query.expires_in, 10) : undefined;
|
||||
resolve({
|
||||
accessToken: accessToken as string,
|
||||
refreshToken: parsedUrl.query.refresh_token as string | undefined,
|
||||
expiresAt: expiresIn ? Date.now() + expiresIn * 1000 : undefined,
|
||||
});
|
||||
} else if (code) {
|
||||
// Fallback: extract code for code exchange (handled upstream if needed)
|
||||
res.writeHead(200, { 'Content-Type': 'text/html' });
|
||||
res.end(`<html><body style="font-family:system-ui;text-align:center;padding:50px">
|
||||
<h1 style="color:#10b981">Authentication Successful!</h1>
|
||||
<p>You can close this window.</p></body></html>`);
|
||||
server.close();
|
||||
// For now, cannot exchange code here — implicit flow is preferred
|
||||
resolve(null);
|
||||
} else {
|
||||
res.writeHead(400, { 'Content-Type': 'text/html' });
|
||||
res.end('<h1>Authentication Failed</h1><p>Invalid state or missing code.</p>');
|
||||
res.end('<h1>Authentication Failed</h1><p>No token received.</p>');
|
||||
server.close();
|
||||
resolve(null);
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
|
||||
server.listen(8765, 'localhost');
|
||||
|
||||
// Timeout after 5 minutes
|
||||
|
||||
setTimeout(() => {
|
||||
server.close();
|
||||
resolve(null);
|
||||
|
||||
Reference in New Issue
Block a user