257 lines
8.5 KiB
TypeScript
257 lines
8.5 KiB
TypeScript
/**
|
|
* Self-contained MiniMax Device Code OAuth flow.
|
|
*
|
|
* Implements RFC 8628 (Device Authorization Grant) with PKCE for MiniMax API.
|
|
* Zero dependency on openclaw extension modules — survives openclaw upgrades.
|
|
*
|
|
* Protocol:
|
|
* 1. POST /oauth/code → get user_code, verification_uri
|
|
* 2. Open verification_uri in browser
|
|
* 3. Poll POST /oauth/token with user_code until approved
|
|
* 4. Return { access, refresh, expires, resourceUrl }
|
|
*/
|
|
import { createHash, randomBytes, randomUUID } from 'node:crypto';
|
|
import { proxyAwareFetch } from './proxy-fetch';
|
|
|
|
// ── Constants ────────────────────────────────────────────────
|
|
|
|
export type MiniMaxRegion = 'cn' | 'global';
|
|
|
|
const MINIMAX_OAUTH_CONFIG = {
|
|
cn: {
|
|
baseUrl: 'https://api.minimaxi.com',
|
|
clientId: '78257093-7e40-4613-99e0-527b14b39113',
|
|
},
|
|
global: {
|
|
baseUrl: 'https://api.minimax.io',
|
|
clientId: '78257093-7e40-4613-99e0-527b14b39113',
|
|
},
|
|
} as const;
|
|
|
|
const MINIMAX_OAUTH_SCOPE = 'group_id profile model.completion';
|
|
const MINIMAX_OAUTH_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:user_code';
|
|
|
|
function getOAuthEndpoints(region: MiniMaxRegion) {
|
|
const config = MINIMAX_OAUTH_CONFIG[region];
|
|
return {
|
|
codeEndpoint: `${config.baseUrl}/oauth/code`,
|
|
tokenEndpoint: `${config.baseUrl}/oauth/token`,
|
|
clientId: config.clientId,
|
|
baseUrl: config.baseUrl,
|
|
};
|
|
}
|
|
|
|
// ── Types ────────────────────────────────────────────────────
|
|
|
|
export interface MiniMaxOAuthToken {
|
|
access: string;
|
|
refresh: string;
|
|
expires: number;
|
|
resourceUrl?: string;
|
|
notification_message?: string;
|
|
}
|
|
|
|
interface MiniMaxOAuthAuthorization {
|
|
user_code: string;
|
|
verification_uri: string;
|
|
expired_in: number;
|
|
interval?: number;
|
|
state: string;
|
|
}
|
|
|
|
type TokenResult =
|
|
| { status: 'success'; token: MiniMaxOAuthToken }
|
|
| { status: 'pending'; message?: string }
|
|
| { status: 'error'; message: string };
|
|
|
|
export interface MiniMaxOAuthOptions {
|
|
openUrl: (url: string) => Promise<void>;
|
|
note: (message: string, title?: string) => Promise<void>;
|
|
progress: { update: (message: string) => void; stop: (message?: string) => void };
|
|
region?: MiniMaxRegion;
|
|
}
|
|
|
|
// ── PKCE helpers (self-contained, no openclaw dependency) ────
|
|
|
|
function generatePkce(): { verifier: string; challenge: string; state: string } {
|
|
const verifier = randomBytes(32).toString('base64url');
|
|
const challenge = createHash('sha256').update(verifier).digest('base64url');
|
|
const state = randomBytes(16).toString('base64url');
|
|
return { verifier, challenge, state };
|
|
}
|
|
|
|
function toFormUrlEncoded(params: Record<string, string>): string {
|
|
return new URLSearchParams(params).toString();
|
|
}
|
|
|
|
// ── OAuth flow steps ─────────────────────────────────────────
|
|
|
|
async function requestOAuthCode(params: {
|
|
challenge: string;
|
|
state: string;
|
|
region: MiniMaxRegion;
|
|
}): Promise<MiniMaxOAuthAuthorization> {
|
|
const endpoints = getOAuthEndpoints(params.region);
|
|
const response = await proxyAwareFetch(endpoints.codeEndpoint, {
|
|
method: 'POST',
|
|
headers: {
|
|
'Content-Type': 'application/x-www-form-urlencoded',
|
|
Accept: 'application/json',
|
|
'x-request-id': randomUUID(),
|
|
},
|
|
body: toFormUrlEncoded({
|
|
response_type: 'code',
|
|
client_id: endpoints.clientId,
|
|
scope: MINIMAX_OAUTH_SCOPE,
|
|
code_challenge: params.challenge,
|
|
code_challenge_method: 'S256',
|
|
state: params.state,
|
|
}),
|
|
});
|
|
|
|
if (!response.ok) {
|
|
const text = await response.text();
|
|
throw new Error(`MiniMax OAuth authorization failed: ${text || response.statusText}`);
|
|
}
|
|
|
|
const payload = (await response.json()) as MiniMaxOAuthAuthorization & { error?: string };
|
|
if (!payload.user_code || !payload.verification_uri) {
|
|
throw new Error(
|
|
payload.error ??
|
|
'MiniMax OAuth authorization returned an incomplete payload (missing user_code or verification_uri).',
|
|
);
|
|
}
|
|
if (payload.state !== params.state) {
|
|
throw new Error('MiniMax OAuth state mismatch: possible CSRF attack or session corruption.');
|
|
}
|
|
return payload;
|
|
}
|
|
|
|
async function pollOAuthToken(params: {
|
|
userCode: string;
|
|
verifier: string;
|
|
region: MiniMaxRegion;
|
|
}): Promise<TokenResult> {
|
|
const endpoints = getOAuthEndpoints(params.region);
|
|
const response = await proxyAwareFetch(endpoints.tokenEndpoint, {
|
|
method: 'POST',
|
|
headers: {
|
|
'Content-Type': 'application/x-www-form-urlencoded',
|
|
Accept: 'application/json',
|
|
},
|
|
body: toFormUrlEncoded({
|
|
grant_type: MINIMAX_OAUTH_GRANT_TYPE,
|
|
client_id: endpoints.clientId,
|
|
user_code: params.userCode,
|
|
code_verifier: params.verifier,
|
|
}),
|
|
});
|
|
|
|
const text = await response.text();
|
|
let payload:
|
|
| {
|
|
status?: string;
|
|
base_resp?: { status_code?: number; status_msg?: string };
|
|
}
|
|
| undefined;
|
|
if (text) {
|
|
try {
|
|
payload = JSON.parse(text) as typeof payload;
|
|
} catch {
|
|
payload = undefined;
|
|
}
|
|
}
|
|
|
|
if (!response.ok) {
|
|
return {
|
|
status: 'error',
|
|
message:
|
|
(payload?.base_resp?.status_msg ?? text) || 'MiniMax OAuth failed to parse response.',
|
|
};
|
|
}
|
|
|
|
if (!payload) {
|
|
return { status: 'error', message: 'MiniMax OAuth failed to parse response.' };
|
|
}
|
|
|
|
const tokenPayload = payload as {
|
|
status: string;
|
|
access_token?: string | null;
|
|
refresh_token?: string | null;
|
|
expired_in?: number | null;
|
|
token_type?: string;
|
|
resource_url?: string;
|
|
notification_message?: string;
|
|
};
|
|
|
|
if (tokenPayload.status === 'error') {
|
|
return { status: 'error', message: 'An error occurred. Please try again later' };
|
|
}
|
|
|
|
if (tokenPayload.status !== 'success') {
|
|
return { status: 'pending', message: 'current user code is not authorized' };
|
|
}
|
|
|
|
if (!tokenPayload.access_token || !tokenPayload.refresh_token || !tokenPayload.expired_in) {
|
|
return { status: 'error', message: 'MiniMax OAuth returned incomplete token payload.' };
|
|
}
|
|
|
|
return {
|
|
status: 'success',
|
|
token: {
|
|
access: tokenPayload.access_token,
|
|
refresh: tokenPayload.refresh_token,
|
|
expires: tokenPayload.expired_in,
|
|
resourceUrl: tokenPayload.resource_url,
|
|
notification_message: tokenPayload.notification_message,
|
|
},
|
|
};
|
|
}
|
|
|
|
// ── Public API ───────────────────────────────────────────────
|
|
|
|
export async function loginMiniMaxPortalOAuth(params: MiniMaxOAuthOptions): Promise<MiniMaxOAuthToken> {
|
|
const region = params.region ?? 'global';
|
|
const { verifier, challenge, state } = generatePkce();
|
|
const oauth = await requestOAuthCode({ challenge, state, region });
|
|
const verificationUrl = oauth.verification_uri;
|
|
|
|
const noteLines = [
|
|
`Open ${verificationUrl} to approve access.`,
|
|
`If prompted, enter the code ${oauth.user_code}.`,
|
|
`Interval: ${oauth.interval ?? 'default (2000ms)'}, Expires at: ${oauth.expired_in} unix timestamp`,
|
|
];
|
|
await params.note(noteLines.join('\n'), 'MiniMax OAuth');
|
|
|
|
try {
|
|
await params.openUrl(verificationUrl);
|
|
} catch {
|
|
// Fall back to manual copy/paste if browser open fails.
|
|
}
|
|
|
|
let pollIntervalMs = oauth.interval ? oauth.interval : 2000;
|
|
const expireTimeMs = oauth.expired_in;
|
|
|
|
while (Date.now() < expireTimeMs) {
|
|
params.progress.update('Waiting for MiniMax OAuth approval…');
|
|
const result = await pollOAuthToken({
|
|
userCode: oauth.user_code,
|
|
verifier,
|
|
region,
|
|
});
|
|
|
|
if (result.status === 'success') {
|
|
return result.token;
|
|
}
|
|
|
|
if (result.status === 'error') {
|
|
throw new Error(result.message);
|
|
}
|
|
|
|
await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
|
|
pollIntervalMs = Math.max(pollIntervalMs, 2000);
|
|
}
|
|
|
|
throw new Error('MiniMax OAuth timed out before authorization completed.');
|
|
}
|