276 lines
10 KiB
Rust
276 lines
10 KiB
Rust
//! `~/.codex/auth.json` の読み書き。
|
||
//!
|
||
//! Codex CLI と schema を共有するが、yoi は知らないフィールドを
|
||
//! 失わないようファイル全体を `serde_json::Value` で保持し、必要箇所
|
||
//! のみアクセスする。書込は `mode 0o600` を再設定（Codex CLI 同様）、
|
||
//! ファイルロックは取らない（manager 側で guarded reload）。
|
||
|
||
use std::fs::OpenOptions;
|
||
use std::io::Write;
|
||
#[cfg(unix)]
|
||
use std::os::unix::fs::OpenOptionsExt;
|
||
use std::path::Path;
|
||
|
||
use chrono::{DateTime, Utc};
|
||
use serde_json::Value;
|
||
|
||
use super::error::CodexAuthError;
|
||
|
||
/// auth.json から取り出した使い回す情報のスナップショット。
|
||
#[derive(Debug, Clone)]
|
||
pub struct AuthSnapshot {
|
||
pub access_token: String,
|
||
pub refresh_token: String,
|
||
pub account_id: String,
|
||
pub id_token: String,
|
||
pub last_refresh: Option<DateTime<Utc>>,
|
||
/// 書き戻し時に他のフィールドを失わないため、ファイル全体を保持する。
|
||
pub raw: Value,
|
||
}
|
||
|
||
impl AuthSnapshot {
|
||
/// `Value` から必要フィールドを抽出。欠落・型不一致は `MalformedAuthJson`。
|
||
pub fn from_value(raw: Value) -> Result<Self, CodexAuthError> {
|
||
let tokens = raw
|
||
.get("tokens")
|
||
.ok_or_else(|| CodexAuthError::MalformedAuthJson("missing 'tokens'".into()))?;
|
||
|
||
let access_token = tokens
|
||
.get("access_token")
|
||
.and_then(Value::as_str)
|
||
.ok_or_else(|| CodexAuthError::MalformedAuthJson("missing tokens.access_token".into()))?
|
||
.to_string();
|
||
|
||
let refresh_token = tokens
|
||
.get("refresh_token")
|
||
.and_then(Value::as_str)
|
||
.ok_or_else(|| {
|
||
CodexAuthError::MalformedAuthJson("missing tokens.refresh_token".into())
|
||
})?
|
||
.to_string();
|
||
|
||
let id_token = tokens
|
||
.get("id_token")
|
||
.and_then(Value::as_str)
|
||
.ok_or_else(|| CodexAuthError::MalformedAuthJson("missing tokens.id_token".into()))?
|
||
.to_string();
|
||
|
||
// account_id は tokens.account_id を優先、無ければ id_token JWT 由来
|
||
let account_id = tokens
|
||
.get("account_id")
|
||
.and_then(Value::as_str)
|
||
.map(str::to_string)
|
||
.or_else(|| super::jwt::parse_chatgpt_claims(&id_token).and_then(|c| c.account_id))
|
||
.ok_or_else(|| {
|
||
CodexAuthError::MalformedAuthJson(
|
||
"missing account_id in both tokens and id_token claims".into(),
|
||
)
|
||
})?;
|
||
|
||
let last_refresh = raw
|
||
.get("last_refresh")
|
||
.and_then(Value::as_str)
|
||
.and_then(|s| DateTime::parse_from_rfc3339(s).ok())
|
||
.map(|dt| dt.with_timezone(&Utc));
|
||
|
||
Ok(Self {
|
||
access_token,
|
||
refresh_token,
|
||
account_id,
|
||
id_token,
|
||
last_refresh,
|
||
raw,
|
||
})
|
||
}
|
||
}
|
||
|
||
/// auth.json を読む。存在しなければ `NotLoggedIn`。
|
||
pub async fn load(path: &Path) -> Result<AuthSnapshot, CodexAuthError> {
|
||
let bytes = match tokio::fs::read(path).await {
|
||
Ok(b) => b,
|
||
Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
|
||
return Err(CodexAuthError::NotLoggedIn(path.to_path_buf()));
|
||
}
|
||
Err(err) => {
|
||
return Err(CodexAuthError::Io(format!(
|
||
"failed to read {}: {err}",
|
||
path.display()
|
||
)));
|
||
}
|
||
};
|
||
let raw: Value = serde_json::from_slice(&bytes)
|
||
.map_err(|e| CodexAuthError::MalformedAuthJson(format!("json parse: {e}")))?;
|
||
AuthSnapshot::from_value(raw)
|
||
}
|
||
|
||
/// 既存ファイルを再読込し、`tokens.{id_token,access_token,refresh_token}` と
|
||
/// `last_refresh` を更新して書き戻す。Codex CLI の `persist_tokens` 相当。
|
||
///
|
||
/// 並行する Codex CLI / 別 yoi プロセスが先に refresh していた場合の
|
||
/// fields を保護するため、書込前に再 load して merge する。
|
||
pub async fn persist_refreshed(
|
||
path: &Path,
|
||
new_id_token: Option<String>,
|
||
new_access_token: Option<String>,
|
||
new_refresh_token: Option<String>,
|
||
) -> Result<AuthSnapshot, CodexAuthError> {
|
||
let mut current = load(path).await?;
|
||
let raw = &mut current.raw;
|
||
let tokens = raw
|
||
.get_mut("tokens")
|
||
.and_then(Value::as_object_mut)
|
||
.ok_or_else(|| CodexAuthError::MalformedAuthJson("tokens not an object".into()))?;
|
||
if let Some(t) = new_id_token {
|
||
tokens.insert("id_token".into(), Value::String(t));
|
||
}
|
||
if let Some(t) = new_access_token {
|
||
tokens.insert("access_token".into(), Value::String(t));
|
||
}
|
||
if let Some(t) = new_refresh_token {
|
||
tokens.insert("refresh_token".into(), Value::String(t));
|
||
}
|
||
raw.as_object_mut()
|
||
.ok_or_else(|| CodexAuthError::MalformedAuthJson("auth.json not an object".into()))?
|
||
.insert(
|
||
"last_refresh".into(),
|
||
Value::String(Utc::now().to_rfc3339()),
|
||
);
|
||
|
||
write_atomic(path, raw)?;
|
||
AuthSnapshot::from_value(raw.clone())
|
||
}
|
||
|
||
fn write_atomic(path: &Path, value: &Value) -> Result<(), CodexAuthError> {
|
||
if let Some(parent) = path.parent() {
|
||
std::fs::create_dir_all(parent)
|
||
.map_err(|e| CodexAuthError::Io(format!("create_dir_all {}: {e}", parent.display())))?;
|
||
}
|
||
let json = serde_json::to_vec_pretty(value)
|
||
.map_err(|e| CodexAuthError::Io(format!("serialize: {e}")))?;
|
||
let mut options = OpenOptions::new();
|
||
options.truncate(true).write(true).create(true);
|
||
#[cfg(unix)]
|
||
{
|
||
options.mode(0o600);
|
||
}
|
||
let mut file = options
|
||
.open(path)
|
||
.map_err(|e| CodexAuthError::Io(format!("open {}: {e}", path.display())))?;
|
||
file.write_all(&json)
|
||
.map_err(|e| CodexAuthError::Io(format!("write {}: {e}", path.display())))?;
|
||
file.flush()
|
||
.map_err(|e| CodexAuthError::Io(format!("flush {}: {e}", path.display())))?;
|
||
|
||
// 既存ファイルが緩いパーミッションだった場合に備えて 0o600 を強制し直す。
|
||
// OpenOptions の `mode()` は新規作成時しか効かないため。
|
||
#[cfg(unix)]
|
||
{
|
||
use std::os::unix::fs::PermissionsExt;
|
||
std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600))
|
||
.map_err(|e| CodexAuthError::Io(format!("chmod {}: {e}", path.display())))?;
|
||
}
|
||
Ok(())
|
||
}
|
||
|
||
#[cfg(test)]
|
||
mod tests {
|
||
use super::*;
|
||
|
||
fn write_auth_json(dir: &Path, content: &str) -> std::path::PathBuf {
|
||
let path = dir.join("auth.json");
|
||
std::fs::write(&path, content).unwrap();
|
||
path
|
||
}
|
||
|
||
#[tokio::test]
|
||
async fn load_round_trip() {
|
||
let dir = tempfile::tempdir().unwrap();
|
||
let path = write_auth_json(
|
||
dir.path(),
|
||
r#"{
|
||
"auth_mode":"ChatgptAuthTokens",
|
||
"tokens":{
|
||
"id_token":"h.eyJodHRwczovL2FwaS5vcGVuYWkuY29tL2F1dGgiOnsiY2hhdGdwdF9hY2NvdW50X2lkIjoiYWNjLTEifX0.s",
|
||
"access_token":"acc",
|
||
"refresh_token":"ref",
|
||
"account_id":"acc-1"
|
||
},
|
||
"last_refresh":"2026-04-20T00:00:00Z",
|
||
"OPENAI_API_KEY":"sk-extra"
|
||
}"#,
|
||
);
|
||
let snap = load(&path).await.unwrap();
|
||
assert_eq!(snap.access_token, "acc");
|
||
assert_eq!(snap.refresh_token, "ref");
|
||
assert_eq!(snap.account_id, "acc-1");
|
||
assert!(snap.last_refresh.is_some());
|
||
// 未知フィールドが raw に保持されている
|
||
assert_eq!(
|
||
snap.raw.get("OPENAI_API_KEY").and_then(Value::as_str),
|
||
Some("sk-extra")
|
||
);
|
||
}
|
||
|
||
#[tokio::test]
|
||
async fn account_id_falls_back_to_jwt_claim() {
|
||
let dir = tempfile::tempdir().unwrap();
|
||
// tokens.account_id を欠落させ、id_token JWT 内 claim から拾う
|
||
let id_token = "h.eyJodHRwczovL2FwaS5vcGVuYWkuY29tL2F1dGgiOnsiY2hhdGdwdF9hY2NvdW50X2lkIjoiZnJvbS1qd3QifX0.s";
|
||
let path = write_auth_json(
|
||
dir.path(),
|
||
&format!(
|
||
r#"{{ "tokens": {{ "id_token":"{id_token}", "access_token":"a", "refresh_token":"r" }} }}"#
|
||
),
|
||
);
|
||
let snap = load(&path).await.unwrap();
|
||
assert_eq!(snap.account_id, "from-jwt");
|
||
}
|
||
|
||
#[tokio::test]
|
||
async fn missing_file_returns_not_logged_in() {
|
||
let dir = tempfile::tempdir().unwrap();
|
||
let err = load(&dir.path().join("nope.json")).await.unwrap_err();
|
||
assert!(matches!(err, CodexAuthError::NotLoggedIn(_)));
|
||
}
|
||
|
||
#[tokio::test]
|
||
async fn persist_preserves_unknown_fields() {
|
||
let dir = tempfile::tempdir().unwrap();
|
||
let path = write_auth_json(
|
||
dir.path(),
|
||
r#"{
|
||
"tokens":{"id_token":"h.eyJodHRwczovL2FwaS5vcGVuYWkuY29tL2F1dGgiOnsiY2hhdGdwdF9hY2NvdW50X2lkIjoiYSJ9fQ.s","access_token":"old-acc","refresh_token":"old-ref","account_id":"a"},
|
||
"agent_identity":{"workspace_id":"w","agent_runtime_id":"r","agent_private_key":"k","registered_at":"x"}
|
||
}"#,
|
||
);
|
||
let updated =
|
||
persist_refreshed(&path, None, Some("new-acc".into()), Some("new-ref".into()))
|
||
.await
|
||
.unwrap();
|
||
assert_eq!(updated.access_token, "new-acc");
|
||
assert_eq!(updated.refresh_token, "new-ref");
|
||
// 未知フィールド agent_identity が保たれる
|
||
let on_disk: Value = serde_json::from_slice(&std::fs::read(&path).unwrap()).unwrap();
|
||
assert!(on_disk.get("agent_identity").is_some());
|
||
assert!(on_disk.get("last_refresh").is_some());
|
||
}
|
||
|
||
#[cfg(unix)]
|
||
#[tokio::test]
|
||
async fn write_uses_mode_600() {
|
||
use std::os::unix::fs::PermissionsExt;
|
||
let dir = tempfile::tempdir().unwrap();
|
||
let path = write_auth_json(
|
||
dir.path(),
|
||
r#"{"tokens":{"id_token":"h.eyJodHRwczovL2FwaS5vcGVuYWkuY29tL2F1dGgiOnsiY2hhdGdwdF9hY2NvdW50X2lkIjoiYSJ9fQ.s","access_token":"a","refresh_token":"r","account_id":"a"}}"#,
|
||
);
|
||
// 既存ファイルを 644 に変えてから persist → 600 に直るか
|
||
std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o644)).unwrap();
|
||
persist_refreshed(&path, None, Some("a2".into()), None)
|
||
.await
|
||
.unwrap();
|
||
let mode = std::fs::metadata(&path).unwrap().permissions().mode() & 0o777;
|
||
assert_eq!(mode, 0o600);
|
||
}
|
||
}
|