ai_usagebar/openai/
creds.rs

1//! Read and write `~/.codex/auth.json` — the OAuth state the OpenAI Codex CLI
2//! maintains. Mirrors codexbar's jq paths.
3
4use std::path::{Path, PathBuf};
5
6use base64::Engine;
7use serde::{Deserialize, Serialize};
8
9use crate::cache::atomic_write;
10use crate::error::{AppError, Result};
11
12#[derive(Debug, Clone, Deserialize, Serialize)]
13pub struct AuthFile {
14    pub tokens: Tokens,
15    #[serde(default, skip_serializing_if = "Option::is_none")]
16    pub last_refresh: Option<String>,
17    #[serde(flatten, default)]
18    pub extra: serde_json::Map<String, serde_json::Value>,
19}
20
21#[derive(Debug, Clone, Deserialize, Serialize)]
22pub struct Tokens {
23    pub access_token: String,
24    pub refresh_token: String,
25    pub id_token: String,
26    #[serde(default)]
27    pub account_id: Option<String>,
28    /// Optional explicit expiry from the OAuth server. When absent, we infer
29    /// from the id_token's `exp` claim.
30    #[serde(default)]
31    pub expires_at: Option<String>,
32    #[serde(flatten, default)]
33    pub extra: serde_json::Map<String, serde_json::Value>,
34}
35
36/// Default location: `~/.codex/auth.json` (Unix/macOS) or
37/// `%USERPROFILE%\.codex\auth.json` (Windows).
38///
39/// Home is resolved through [`crate::cache::home_dir`] so every platform's
40/// convention is honored in one place.
41pub fn default_path() -> Result<PathBuf> {
42    Ok(crate::cache::home_dir()?.join(".codex").join("auth.json"))
43}
44
45pub fn read_from(path: &Path) -> Result<AuthFile> {
46    let raw = std::fs::read_to_string(path).map_err(|e| AppError::io_at(path, e))?;
47    serde_json::from_str(&raw).map_err(|e| {
48        AppError::Credentials(format!(
49            "could not parse {}: {e}. Run `codex login` to re-authenticate.",
50            path.display()
51        ))
52    })
53}
54
55/// Persist updated tokens, preserving any unknown fields. Atomic.
56pub fn write_back(path: &Path, auth: &AuthFile) -> Result<()> {
57    let bytes = serde_json::to_vec_pretty(auth).map_err(AppError::Json)?;
58    atomic_write(path, &bytes)
59}
60
61impl Tokens {
62    /// Compute the Unix-seconds expiry from the embedded id_token. Returns
63    /// 0 (forcing immediate refresh) when the token isn't parseable.
64    pub fn expires_at_secs(&self) -> i64 {
65        parse_jwt_exp(&self.id_token).unwrap_or(0)
66    }
67
68    /// Plan tier from the id_token's nested claim
69    /// `https://api.openai.com/auth.chatgpt_plan_type`.
70    pub fn plan_type_from_id_token(&self) -> Option<String> {
71        let claims = parse_jwt_claims(&self.id_token)?;
72        claims
73            .get("https://api.openai.com/auth")
74            .and_then(|v| v.get("chatgpt_plan_type"))
75            .and_then(|v| v.as_str())
76            .map(|s| s.to_string())
77    }
78}
79
80/// Parse a JWT's `exp` claim. Returns None for malformed tokens.
81fn parse_jwt_exp(token: &str) -> Option<i64> {
82    let claims = parse_jwt_claims(token)?;
83    claims
84        .get("exp")
85        .and_then(|v| v.as_i64())
86        .or_else(|| claims.get("exp").and_then(|v| v.as_f64()).map(|f| f as i64))
87}
88
89fn parse_jwt_claims(token: &str) -> Option<serde_json::Value> {
90    let mut parts = token.split('.');
91    let _header = parts.next()?;
92    let payload = parts.next()?;
93    let decoded = base64::engine::general_purpose::URL_SAFE_NO_PAD
94        .decode(payload)
95        .or_else(|_| base64::engine::general_purpose::URL_SAFE.decode(payload))
96        .ok()?;
97    serde_json::from_slice(&decoded).ok()
98}
99
100#[cfg(test)]
101mod tests {
102    use super::*;
103    use std::io::Write;
104    use tempfile::{NamedTempFile, TempDir};
105
106    fn write_auth(s: &str) -> NamedTempFile {
107        let mut f = NamedTempFile::new().unwrap();
108        f.write_all(s.as_bytes()).unwrap();
109        f.flush().unwrap();
110        f
111    }
112
113    /// Like `write_auth`, but writes to a named file inside a `TempDir` and
114    /// closes the handle, so `write_back`'s atomic rename-over-destination
115    /// succeeds on Windows (which refuses to replace a still-open file).
116    fn write_auth_closed(s: &str) -> (TempDir, std::path::PathBuf) {
117        let dir = TempDir::new().unwrap();
118        let path = dir.path().join("auth.json");
119        std::fs::write(&path, s).unwrap();
120        (dir, path)
121    }
122
123    /// Build a fake JWT with the given claims (no signature verification).
124    fn fake_jwt(claims: serde_json::Value) -> String {
125        let header = base64::engine::general_purpose::URL_SAFE_NO_PAD
126            .encode(br#"{"alg":"none","typ":"JWT"}"#);
127        let payload =
128            base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(claims.to_string().as_bytes());
129        format!("{header}.{payload}.sig")
130    }
131
132    #[test]
133    fn parses_minimal_auth_file() {
134        let jwt = fake_jwt(serde_json::json!({"exp": 1234567890}));
135        let body = format!(
136            r#"{{"tokens":{{"access_token":"AT","refresh_token":"RT",
137                "id_token":"{jwt}","account_id":"acc"}}}}"#
138        );
139        let f = write_auth(&body);
140        let auth = read_from(f.path()).unwrap();
141        assert_eq!(auth.tokens.access_token, "AT");
142        assert_eq!(auth.tokens.account_id.as_deref(), Some("acc"));
143        assert_eq!(auth.tokens.expires_at_secs(), 1234567890);
144    }
145
146    #[test]
147    fn extracts_plan_type_from_id_token() {
148        let jwt = fake_jwt(serde_json::json!({
149            "exp": 1234567890,
150            "https://api.openai.com/auth": {"chatgpt_plan_type": "plus"}
151        }));
152        let body = format!(
153            r#"{{"tokens":{{"access_token":"AT","refresh_token":"RT","id_token":"{jwt}"}}}}"#
154        );
155        let f = write_auth(&body);
156        let auth = read_from(f.path()).unwrap();
157        assert_eq!(
158            auth.tokens.plan_type_from_id_token().as_deref(),
159            Some("plus")
160        );
161    }
162
163    #[test]
164    fn malformed_jwt_returns_zero_exp() {
165        let body = r#"{"tokens":{"access_token":"x","refresh_token":"y","id_token":"not.a.jwt"}}"#;
166        let f = write_auth(body);
167        let auth = read_from(f.path()).unwrap();
168        assert_eq!(auth.tokens.expires_at_secs(), 0);
169        assert!(auth.tokens.plan_type_from_id_token().is_none());
170    }
171
172    #[test]
173    fn malformed_file_returns_credentials_error() {
174        let f = write_auth("not json");
175        let err = read_from(f.path()).unwrap_err();
176        assert!(matches!(err, AppError::Credentials(_)));
177    }
178
179    #[test]
180    fn write_back_preserves_unknown_fields() {
181        let jwt = fake_jwt(serde_json::json!({"exp": 1234567890}));
182        let body = format!(
183            r#"{{"tokens":{{"access_token":"AT","refresh_token":"RT","id_token":"{jwt}"}},
184                "some_other_field":"keep-me"}}"#
185        );
186        let (_dir, path) = write_auth_closed(&body);
187        let mut auth = read_from(&path).unwrap();
188        auth.tokens.access_token = "NEW".into();
189        write_back(&path, &auth).unwrap();
190
191        let v: serde_json::Value =
192            serde_json::from_str(&std::fs::read_to_string(&path).unwrap()).unwrap();
193        assert_eq!(v["some_other_field"], "keep-me");
194        assert_eq!(v["tokens"]["access_token"], "NEW");
195    }
196
197    #[test]
198    fn default_path_ends_with_codex_auth() {
199        let p = default_path().unwrap();
200        // Trailing segments are stable across platforms; only the home prefix
201        // differs (resolved by directories::BaseDirs).
202        assert!(p.ends_with(std::path::Path::new(".codex").join("auth.json")));
203    }
204
205    // On Windows the home prefix is %USERPROFILE%, not $HOME.
206    #[cfg(windows)]
207    #[test]
208    fn default_path_uses_userprofile_on_windows() {
209        let p = default_path().unwrap();
210        let userprofile = std::env::var("USERPROFILE").expect("USERPROFILE set on Windows");
211        // directories::BaseDirs resolves the home via SHGetKnownFolderPath, which
212        // can differ from %USERPROFILE% in casing or path separator. Compare on a
213        // normalized basis (lowercased, backslashes) rather than Path::starts_with,
214        // which compares components case-sensitively even on Windows.
215        let norm = |s: &str| s.to_lowercase().replace('/', "\\");
216        let p_norm = norm(&p.to_string_lossy());
217        let up_norm = norm(&userprofile);
218        assert!(
219            p_norm.starts_with(up_norm.as_str()),
220            "{} should live under {}",
221            p.display(),
222            userprofile
223        );
224    }
225}
ai_usagebar/openai/creds.rs

ai_usagebar/openai/
creds.rs
