renato97/picoclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): align OpenAI OAuth authorize URL and params

Browse Source
This commit is contained in:
qiaoborui
2026-02-14 12:37:49 +08:00
parent 5872e0f55e
commit 7304ab7d33
2 changed files with 38 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
pkg/auth/oauth.go
View File

@@ -19,18 +19,20 @@ import (
) )
type OAuthProviderConfig struct { type OAuthProviderConfig struct {
Issuer string Issuer string
ClientID string ClientID string
Scopes string Scopes string
Port int Originator string
Port int
} }
func OpenAIOAuthConfig() OAuthProviderConfig { func OpenAIOAuthConfig() OAuthProviderConfig {
return OAuthProviderConfig{ return OAuthProviderConfig{
Issuer: "https://auth.openai.com", Issuer: "https://auth.openai.com",
ClientID: "app_EMoamEEZ73f0CkXaXp7hrann", ClientID: "app_EMoamEEZ73f0CkXaXp7hrann",
Scopes: "openid profile email offline_access", Scopes: "openid profile email offline_access",
Port: 1455, Originator: "codex_cli_rs",
Port: 1455,
} }
} }
@@ -288,15 +290,20 @@ func BuildAuthorizeURL(cfg OAuthProviderConfig, pkce PKCECodes, state, redirectU
func buildAuthorizeURL(cfg OAuthProviderConfig, pkce PKCECodes, state, redirectURI string) string { func buildAuthorizeURL(cfg OAuthProviderConfig, pkce PKCECodes, state, redirectURI string) string {
params := url.Values{ params := url.Values{
"response_type": {"code"}, "response_type": {"code"},
"client_id": {cfg.ClientID}, "client_id": {cfg.ClientID},
"redirect_uri": {redirectURI}, "redirect_uri": {redirectURI},
"scope": {cfg.Scopes}, "scope": {cfg.Scopes},
"code_challenge": {pkce.CodeChallenge}, "code_challenge": {pkce.CodeChallenge},
"code_challenge_method": {"S256"}, "code_challenge_method": {"S256"},
"state": {state}, "id_token_add_organizations": {"true"},
"codex_cli_simplified_flow": {"true"},
"state": {state},
} }
return cfg.Issuer + "/authorize?" + params.Encode() if cfg.Originator != "" {
params.Set("originator", cfg.Originator)
}
return cfg.Issuer + "/oauth/authorize?" + params.Encode()
} }
func exchangeCodeForTokens(cfg OAuthProviderConfig, code, codeVerifier, redirectURI string) (*AuthCredential, error) { func exchangeCodeForTokens(cfg OAuthProviderConfig, code, codeVerifier, redirectURI string) (*AuthCredential, error) {

20
pkg/auth/oauth_test.go
View File

@@ -10,10 +10,11 @@ import (
func TestBuildAuthorizeURL(t *testing.T) { func TestBuildAuthorizeURL(t *testing.T) {
cfg := OAuthProviderConfig{ cfg := OAuthProviderConfig{
Issuer: "https://auth.example.com", Issuer: "https://auth.example.com",
ClientID: "test-client-id", ClientID: "test-client-id",
Scopes: "openid profile", Scopes: "openid profile",
Port: 1455, Originator: "codex_cli_rs",
Port: 1455,
} }
pkce := PKCECodes{ pkce := PKCECodes{
CodeVerifier: "test-verifier", CodeVerifier: "test-verifier",
@@ -22,7 +23,7 @@ func TestBuildAuthorizeURL(t *testing.T) {
u := BuildAuthorizeURL(cfg, pkce, "test-state", "http://localhost:1455/auth/callback") u := BuildAuthorizeURL(cfg, pkce, "test-state", "http://localhost:1455/auth/callback")
if !strings.HasPrefix(u, "https://auth.example.com/authorize?") { if !strings.HasPrefix(u, "https://auth.example.com/oauth/authorize?") {
t.Errorf("URL does not start with expected prefix: %s", u) t.Errorf("URL does not start with expected prefix: %s", u)
} }
if !strings.Contains(u, "client_id=test-client-id") { if !strings.Contains(u, "client_id=test-client-id") {
@@ -40,6 +41,15 @@ func TestBuildAuthorizeURL(t *testing.T) {
if !strings.Contains(u, "response_type=code") { if !strings.Contains(u, "response_type=code") {
t.Error("URL missing response_type") t.Error("URL missing response_type")
} }
if !strings.Contains(u, "id_token_add_organizations=true") {
t.Error("URL missing id_token_add_organizations")
}
if !strings.Contains(u, "codex_cli_simplified_flow=true") {
t.Error("URL missing codex_cli_simplified_flow")
}
if !strings.Contains(u, "originator=codex_cli_rs") {
t.Error("URL missing originator")
}
} }
func TestParseTokenResponse(t *testing.T) { func TestParseTokenResponse(t *testing.T) {