Add oauth support for openai WIP

Author: ericdallo

deps.edn

@@ -10,6 +10,7 @@
         com.cognitect/transit-clj {:mvn/version "1.0.333"}
         hato/hato {:mvn/version "1.0.0"}
         ring/ring-codec {:mvn/version "1.3.0"}
+        ring/ring-jetty-adapter {:mvn/version "1.15.2"}
         camel-snake-kebab/camel-snake-kebab {:mvn/version "0.4.3"}
         org.slf4j/slf4j-simple {:mvn/version "2.0.17"}
         com.googlecode.java-diff-utils/diffutils {:mvn/version "1.3.0"}

src/eca/llm_api.clj

@@ -121,7 +121,8 @@
           :web-search web-search
           :extra-payload extra-payload
           :api-url api-url
-          :api-key api-key}
+          :api-key api-key
+          :auth-type provider-auth-type}
          callbacks)
 
         (= "anthropic" provider)

src/eca/llm_providers/anthropic.clj

@@ -380,7 +380,7 @@
   (if (string/starts-with? input "sk-")
     (do
       (config/update-global-config! {:providers {"anthropic" {:key input}}})
-      (swap! db* dissoc :auth provider)
+      (swap! db* update :auth dissoc provider)
       (send-msg! (format "API key and models saved to %s" (.getCanonicalPath (config/global-config-file))))
       (f.login/login-done! ctx))
     (send-msg! (format "Invalid API key '%s'" input))))

src/eca/llm_providers/azure.clj

@@ -30,6 +30,6 @@
                                                                  {}
                                                                  (string/split input #","))
                                                         :key api-key}}}))
-  (swap! db* dissoc :auth provider)
+  (swap! db* update :auth dissoc provider)
   (send-msg! (format "API key, url and models saved to %s" (.getCanonicalPath (config/global-config-file))))
   (f.login/login-done! ctx))

src/eca/llm_providers/deepseek.clj

@@ -24,6 +24,6 @@
                                                                     {}
                                                                     (string/split input #","))
                                                            :key api-key}}}))
-  (swap! db* dissoc :auth provider)
+  (swap! db* update :auth dissoc provider)
   (send-msg! (format "API key and models saved to %s" (.getCanonicalPath (config/global-config-file))))
   (f.login/login-done! ctx))

src/eca/llm_providers/openai.clj

@@ -7,21 +7,40 @@
    [eca.features.login :as f.login]
    [eca.llm-util :as llm-util]
    [eca.logger :as logger]
-   [hato.client :as http]))
+   [eca.oauth :as oauth]
+   [eca.shared :refer [assoc-some multi-str]]
+   [hato.client :as http]
+   [ring.util.codec :as ring.util]))
 
 (set! *warn-on-reflection* true)
 
 (def ^:private logger-tag "[OPENAI]")
 
 (def ^:private responses-path "/v1/responses")
+(def ^:private codex-url "https://chatgpt.com/backend-api/codex/responses")
 
-(defn ^:private base-completion-request! [{:keys [rid body api-url url-relative-path api-key on-error on-response]}]
-  (let [url (str api-url (or url-relative-path responses-path))]
+(defn ^:private jtw-token->account-id [api-key]
+  (let [[_ base64] (string/split api-key #"\.")
+        payload (some-> base64
+                        llm-util/<-base64
+                        json/parse-string)]
+    (get-in payload ["https://api.openai.com/auth" "chatgpt_account_id"])))
+
+(defn ^:private base-completion-request! [{:keys [rid body api-url auth-type url-relative-path api-key on-error on-response]}]
+  (let [oauth? (= :auth/oauth auth-type)
+        url (if oauth?
+              codex-url
+              (str api-url (or url-relative-path responses-path)))]
     (llm-util/log-request logger-tag rid url body)
     (http/post
      url
-     {:headers {"Authorization" (str "Bearer " api-key)
-                "Content-Type" "application/json"}
+     {:headers (assoc-some
+                {"Authorization" (str "Bearer " api-key)
+                 "Content-Type" "application/json"}
+                "chatgpt-account-id" (jtw-token->account-id api-key)
+                "OpenAI-Beta" (when oauth? "responses=experimental"),
+                "Originator" (when oauth? "codex_cli_rs")
+                "Session-ID" (when oauth? (str (random-uuid))))
       :body (json/generate-string body)
       :throw-exceptions? false
       :async? true
@@ -81,7 +100,7 @@
         messages))
 
 (defn completion! [{:keys [model user-messages instructions reason? supports-image? api-key api-url url-relative-path
-                           max-output-tokens past-messages tools web-search extra-payload]}
+                           max-output-tokens past-messages tools web-search extra-payload auth-type]}
                    {:keys [on-message-received on-error on-prepare-tool-call on-tools-called on-reason on-usage-updated]}]
   (let [input (concat (normalize-messages past-messages supports-image?)
                       (normalize-messages user-messages supports-image?))
@@ -91,7 +110,9 @@
                      :input input
                      :prompt_cache_key (str (System/getProperty "user.name") "@ECA")
                      :parallel_tool_calls true
-                     :instructions instructions
+                     :instructions (if (= :auth/oauth auth-type)
+                                     (str "You are Codex." instructions)
+                                     instructions)
                      :tools tools
                      :include (when reason?
                                 ["reasoning.encrypted_content"])
@@ -190,6 +211,7 @@
                     :api-url api-url
                     :url-relative-path url-relative-path
                     :api-key api-key
+                    :auth-type auth-type
                     :on-error on-error
                     :on-response handle-response})
                   (doseq [tool-call tool-calls]
@@ -209,18 +231,90 @@
       :api-url api-url
       :url-relative-path url-relative-path
       :api-key api-key
+      :auth-type auth-type
       :on-error on-error
       :on-response on-response-fn})))
 
+(def ^:private client-id "app_EMoamEEZ73f0CkXaXp7hrann")
+
+(defn ^:private oauth-url [server-url]
+  (let [url "https://auth.openai.com/oauth/authorize"
+        {:keys [challenge verifier]} (llm-util/generate-pkce)]
+    {:verifier verifier
+     :url (str url "?" (ring.util/form-encode {:client_id client-id
+                                               :response_type "code"
+                                               :redirect_uri server-url
+                                               :scope "openid profile email offline_access"
+                                               :id_token_add_organizations "true"
+                                               :prompt "login"
+                                               :codex_cli_simplified_flow "true"
+                                               :code_challenge challenge
+                                               :code_challenge_method "S256"
+                                               :state verifier}))}))
+
+(defn ^:private oauth-authorize [server-url code verifier]
+  (let [{:keys [status body]} (http/post
+                               "https://auth.openai.com/oauth/token"
+                               {:headers {"Content-Type" "application/json"}
+                                :body (json/generate-string
+                                       {:grant_type "authorization_code"
+                                        :client_id client-id
+                                        :code code
+                                        :code_verifier verifier
+                                        :redirect_uri server-url})
+                                :as :json})]
+    (if (= 200 status)
+      {:refresh-token (:refresh_token body)
+       :access-token (:access_token body)
+       :expires-at (+ (quot (System/currentTimeMillis) 1000) (:expires_in body))}
+      (throw (ex-info (format "OpenAI token exchange failed: %s" (pr-str body))
+                      {:status status
+                       :body body})))))
+
 (defmethod f.login/login-step ["openai" :login/start] [{:keys [db* chat-id provider send-msg!]}]
   (swap! db* assoc-in [:chats chat-id :login-provider] provider)
-  (swap! db* assoc-in [:auth provider] {:step :login/waiting-api-key})
-  (send-msg! "Paste your API Key"))
+  (swap! db* assoc-in [:auth provider] {:step :login/waiting-login-method})
+  (send-msg! (multi-str "Now, inform the login method:"
+                        ""
+                        ;; "pro: GPT Pro (subscription)"
+                        "manual: Manually enter API Key")))
+
+(defmethod f.login/login-step ["openai" :login/waiting-login-method] [{:keys [db* input provider send-msg!] :as ctx}]
+  (case input
+    "pro"
+    (let [local-server-port 1455 ;; openai requires this port
+          server-url (str "http://localhost:" local-server-port "/auth/callback")
+          {:keys [verifier url]} (oauth-url server-url)]
+      (throw (ex-info "Unsupported login" {}))
+      (oauth/start-oauth-server!
+       {:port local-server-port
+        :on-success (fn [{:keys [code]}]
+                      (let [{:keys [access-token refresh-token expires-at]} (oauth-authorize server-url code verifier)]
+                        (swap! db* update-in [:auth provider] merge {:step :login/done
+                                                                     :type :auth/oauth
+                                                                     :refresh-token refresh-token
+                                                                     :api-key access-token
+                                                                     :expires-at expires-at})
+                        (send-msg! "")
+                        (f.login/login-done! ctx))
+                      (future
+                        (Thread/sleep 2000) ;; wait to render success page
+                        (oauth/stop-oauth-server!)))
+        :on-error (fn [error]
+                    (send-msg! (str "Error authenticating via oauth: " error))
+                    (oauth/stop-oauth-server!))})
+      (send-msg! (format "Open your browser at `%s` and authenticate at OpenAI.\n\nThen ECA will finish the login automatically." url)))
+    "manual"
+    (do
+      (swap! db* assoc-in [:auth provider] {:step :login/waiting-api-key
+                                            :mode :manual})
+      (send-msg! "Paste your API Key"))
+    (send-msg! (format "Unknown login method '%s'. Inform one of the options: pro, manual" input))))
 
 (defmethod f.login/login-step ["openai" :login/waiting-api-key] [{:keys [input db* provider send-msg!] :as ctx}]
   (if (string/starts-with? input "sk-")
     (do (config/update-global-config! {:providers {"openai" {:key input}}})
-        (swap! db* dissoc :auth provider)
+        (swap! db* update :auth dissoc provider)
         (send-msg! (str "API key saved in " (.getCanonicalPath (config/global-config-file))))
 
         (f.login/login-done! ctx :update-cache? false))

src/eca/llm_providers/openrouter.clj

@@ -24,6 +24,6 @@
                                                                       {}
                                                                       (string/split input #","))
                                                              :key api-key}}}))
-  (swap! db* dissoc :auth provider)
+  (swap! db* update :auth dissoc provider)
   (send-msg! (format "API key and models saved to %s" (.getCanonicalPath (config/global-config-file))))
   (f.login/login-done! ctx))

src/eca/llm_providers/z_ai.clj

@@ -24,6 +24,6 @@
                                                                 {}
                                                                 (string/split input #","))
                                                        :key api-key}}}))
-  (swap! db* dissoc :auth provider)
+  (swap! db* update :auth dissoc provider)
   (send-msg! (format "API key and models saved to %s" (.getCanonicalPath (config/global-config-file))))
   (f.login/login-done! ctx))

src/eca/llm_util.clj

@@ -72,6 +72,9 @@
     (.nextBytes (SecureRandom.) seed)
     seed))
 
+(defn <-base64 ^String [^String s]
+  (String. (.decode (Base64/getDecoder) s)))
+
 (defn ^:private ->base64 [^bytes bs]
   (.encodeToString (Base64/getEncoder) bs))
 

src/eca/oauth.clj

@@ -0,0 +1,73 @@
+(ns eca.oauth
+  (:require
+   [eca.logger :as logger]
+   [ring.adapter.jetty :as jetty]
+   [ring.middleware.keyword-params :refer [wrap-keyword-params]]
+   [ring.middleware.params :refer [wrap-params]]
+   [ring.util.response :as response])
+  (:import
+   [org.eclipse.jetty.server Server]))
+
+(set! *warn-on-reflection* true)
+
+(def ^:private logger-tag "[OAUTH]")
+
+(defonce ^:private oauth-server* (atom nil))
+
+(defn ^:private oauth-handler [request on-success on-error]
+  (let [{:keys [code error state]} (:params request)]
+    (if code
+      (do
+        (on-success {:code code
+                     :state state})
+        (-> (response/response (str "<html>"
+                                    "<head>"
+                                    "<meta charset=\"UTF-8\">"
+                                    "<title>My Web Page</title>"
+                                    "</head>"
+                                    "<body>"
+                                    "<h2>✅ Authentication Successful!</h2>"
+                                    "<p>You can close this window and return to ECA.</p>"
+                                    "<script>window.close();</script>"
+                                    "</body></html>"))
+            (response/content-type "text/html")))
+      (do
+        (on-error error)
+        (-> (response/response (str "<html>"
+                                    "<head>"
+                                    "<meta charset=\"UTF-8\">"
+                                    "<title>My Web Page</title>"
+                                    "</head>"
+                                    "<body>"
+                                    "<h2>❌ Authentication Failed</h2>"
+                                    "<p>Error: " (or error "Unknown error") "</p>"
+                                    "<p>You can close this window and return to ECA.</p>"
+                                    "</body></html>"))
+            (response/content-type "text/html"))))))
+
+(defn start-oauth-server!
+  "Start local server on port to handle OAuth redirect"
+  [{:keys [on-error on-success port]}]
+  (when-not @oauth-server*
+    (let [handler (-> oauth-handler
+                      wrap-keyword-params
+                      wrap-params)
+          server (jetty/run-jetty
+                  (fn [request]
+                    (if (= "/auth/callback" (:uri request))
+                      (handler request on-success on-error)
+                      (-> (response/response "404 Not Found")
+                          (response/status 404))))
+                  {:port port
+                   :join? false})]
+      (reset! oauth-server* server)
+      (logger/info logger-tag (str "OAuth server started on http://localhost:" port))
+      server)))
+
+(defn stop-oauth-server!
+  "Stop the local OAuth server"
+  []
+  (when-let [^Server server @oauth-server*]
+    (.stop server)
+    (reset! oauth-server* nil)
+    (logger/info logger-tag "OAuth server stopped")))