buroventures-harald-code-core
Version:
Harald Code Core - Core functionality for AI-powered coding assistant
332 lines • 13.2 kB
JavaScript
/**
* @license
* Copyright 2025 Google LLC
* SPDX-License-Identifier: Apache-2.0
*/
import { OAuth2Client, Compute, CodeChallengeMethod, } from 'google-auth-library';
import * as http from 'http';
import url from 'url';
import crypto from 'crypto';
import * as net from 'net';
import open from 'open';
import path from 'node:path';
import { promises as fs } from 'node:fs';
import * as os from 'os';
import { getErrorMessage } from '../utils/errors.js';
import { cacheGoogleAccount, getCachedGoogleAccount, clearCachedGoogleAccount, } from '../utils/user_account.js';
import { AuthType } from '../core/contentGenerator.js';
import readline from 'node:readline';
// OAuth Client ID and Secret for Google authentication
// These should be set via environment variables for security
const OAUTH_CLIENT_ID = process.env.GOOGLE_OAUTH_CLIENT_ID || '';
const OAUTH_CLIENT_SECRET = process.env.GOOGLE_OAUTH_CLIENT_SECRET || '';
// OAuth Scopes for Cloud Code authorization.
const OAUTH_SCOPE = [
'https://www.googleapis.com/auth/cloud-platform',
'https://www.googleapis.com/auth/userinfo.email',
'https://www.googleapis.com/auth/userinfo.profile',
];
const HTTP_REDIRECT = 301;
const SIGN_IN_SUCCESS_URL = 'https://developers.google.com/gemini-code-assist/auth_success_gemini';
const SIGN_IN_FAILURE_URL = 'https://developers.google.com/gemini-code-assist/auth_failure_gemini';
const GEMINI_DIR = '.gemini';
const CREDENTIAL_FILENAME = 'oauth_creds.json';
export async function getOauthClient(authType, config) {
const client = new OAuth2Client({
clientId: OAUTH_CLIENT_ID,
clientSecret: OAUTH_CLIENT_SECRET,
transporterOptions: {
proxy: config.getProxy(),
},
});
if (process.env.GOOGLE_GENAI_USE_GCA &&
process.env.GOOGLE_CLOUD_ACCESS_TOKEN) {
client.setCredentials({
access_token: process.env.GOOGLE_CLOUD_ACCESS_TOKEN,
});
await fetchAndCacheUserInfo(client);
return client;
}
client.on('tokens', async (tokens) => {
await cacheCredentials(tokens);
});
// If there are cached creds on disk, they always take precedence
if (await loadCachedCredentials(client)) {
// Found valid cached credentials.
// Check if we need to retrieve Google Account ID or Email
if (!getCachedGoogleAccount()) {
try {
await fetchAndCacheUserInfo(client);
}
catch {
// Non-fatal, continue with existing auth.
}
}
console.log('Loaded cached credentials.');
return client;
}
// In Google Cloud Shell, we can use Application Default Credentials (ADC)
// provided via its metadata server to authenticate non-interactively using
// the identity of the user logged into Cloud Shell.
if (authType === AuthType.CLOUD_SHELL) {
try {
console.log("Attempting to authenticate via Cloud Shell VM's ADC.");
const computeClient = new Compute({
// We can leave this empty, since the metadata server will provide
// the service account email.
});
await computeClient.getAccessToken();
console.log('Authentication successful.');
// Do not cache creds in this case; note that Compute client will handle its own refresh
return computeClient;
}
catch (e) {
throw new Error(`Could not authenticate using Cloud Shell credentials. Please select a different authentication method or ensure you are in a properly configured environment. Error: ${getErrorMessage(e)}`);
}
}
if (config.isBrowserLaunchSuppressed()) {
let success = false;
const maxRetries = 2;
for (let i = 0; !success && i < maxRetries; i++) {
success = await authWithUserCode(client);
if (!success) {
console.error('\nFailed to authenticate with user code.', i === maxRetries - 1 ? '' : 'Retrying...\n');
}
}
if (!success) {
process.exit(1);
}
}
else {
const webLogin = await authWithWeb(client);
console.log(`\n\nCode Assist login required.\n` +
`Attempting to open authentication page in your browser.\n` +
`Otherwise navigate to:\n\n${webLogin.authUrl}\n\n`);
try {
// Attempt to open the authentication URL in the default browser.
// We do not use the `wait` option here because the main script's execution
// is already paused by `loginCompletePromise`, which awaits the server callback.
const childProcess = await open(webLogin.authUrl);
// IMPORTANT: Attach an error handler to the returned child process.
// Without this, if `open` fails to spawn a process (e.g., `xdg-open` is not found
// in a minimal Docker container), it will emit an unhandled 'error' event,
// causing the entire Node.js process to crash.
childProcess.on('error', (_) => {
console.error('Failed to open browser automatically. Please try running again with NO_BROWSER=true set.');
process.exit(1);
});
}
catch (err) {
console.error('An unexpected error occurred while trying to open the browser:', err, '\nPlease try running again with NO_BROWSER=true set.');
process.exit(1);
}
console.log('Waiting for authentication...');
await webLogin.loginCompletePromise;
}
return client;
}
async function authWithUserCode(client) {
const redirectUri = 'https://codeassist.google.com/authcode';
const codeVerifier = await client.generateCodeVerifierAsync();
const state = crypto.randomBytes(32).toString('hex');
const authUrl = client.generateAuthUrl({
redirect_uri: redirectUri,
access_type: 'offline',
scope: OAUTH_SCOPE,
code_challenge_method: CodeChallengeMethod.S256,
code_challenge: codeVerifier.codeChallenge,
state,
});
console.log('Please visit the following URL to authorize the application:');
console.log('');
console.log(authUrl);
console.log('');
const code = await new Promise((resolve) => {
const rl = readline.createInterface({
input: process.stdin,
output: process.stdout,
});
rl.question('Enter the authorization code: ', (code) => {
rl.close();
resolve(code.trim());
});
});
if (!code) {
console.error('Authorization code is required.');
return false;
}
try {
const { tokens } = await client.getToken({
code,
codeVerifier: codeVerifier.codeVerifier,
redirect_uri: redirectUri,
});
client.setCredentials(tokens);
}
catch (_error) {
return false;
}
return true;
}
async function authWithWeb(client) {
const port = await getAvailablePort();
// The hostname used for the HTTP server binding (e.g., '0.0.0.0' in Docker).
const host = process.env.OAUTH_CALLBACK_HOST || 'localhost';
// The `redirectUri` sent to Google's authorization server MUST use a loopback IP literal
// (i.e., 'localhost' or '127.0.0.1'). This is a strict security policy for credentials of
// type 'Desktop app' or 'Web application' (when using loopback flow) to mitigate
// authorization code interception attacks.
const redirectUri = `http://localhost:${port}/oauth2callback`;
const state = crypto.randomBytes(32).toString('hex');
const authUrl = client.generateAuthUrl({
redirect_uri: redirectUri,
access_type: 'offline',
scope: OAUTH_SCOPE,
state,
});
const loginCompletePromise = new Promise((resolve, reject) => {
const server = http.createServer(async (req, res) => {
try {
if (req.url.indexOf('/oauth2callback') === -1) {
res.writeHead(HTTP_REDIRECT, { Location: SIGN_IN_FAILURE_URL });
res.end();
reject(new Error('Unexpected request: ' + req.url));
}
// acquire the code from the querystring, and close the web server.
const qs = new url.URL(req.url, 'http://localhost:3000').searchParams;
if (qs.get('error')) {
res.writeHead(HTTP_REDIRECT, { Location: SIGN_IN_FAILURE_URL });
res.end();
reject(new Error(`Error during authentication: ${qs.get('error')}`));
}
else if (qs.get('state') !== state) {
res.end('State mismatch. Possible CSRF attack');
reject(new Error('State mismatch. Possible CSRF attack'));
}
else if (qs.get('code')) {
const { tokens } = await client.getToken({
code: qs.get('code'),
redirect_uri: redirectUri,
});
client.setCredentials(tokens);
// Retrieve and cache Google Account ID during authentication
try {
await fetchAndCacheUserInfo(client);
}
catch (error) {
console.error('Failed to retrieve Google Account ID during authentication:', error);
// Don't fail the auth flow if Google Account ID retrieval fails
}
res.writeHead(HTTP_REDIRECT, { Location: SIGN_IN_SUCCESS_URL });
res.end();
resolve();
}
else {
reject(new Error('No code found in request'));
}
}
catch (e) {
reject(e);
}
finally {
server.close();
}
});
server.listen(port, host);
});
return {
authUrl,
loginCompletePromise,
};
}
export function getAvailablePort() {
return new Promise((resolve, reject) => {
let port = 0;
try {
const portStr = process.env.OAUTH_CALLBACK_PORT;
if (portStr) {
port = parseInt(portStr, 10);
if (isNaN(port) || port <= 0 || port > 65535) {
return reject(new Error(`Invalid value for OAUTH_CALLBACK_PORT: "${portStr}"`));
}
return resolve(port);
}
const server = net.createServer();
server.listen(0, () => {
const address = server.address();
port = address.port;
});
server.on('listening', () => {
server.close();
server.unref();
});
server.on('error', (e) => reject(e));
server.on('close', () => resolve(port));
}
catch (e) {
reject(e);
}
});
}
async function loadCachedCredentials(client) {
try {
const keyFile = process.env.GOOGLE_APPLICATION_CREDENTIALS || getCachedCredentialPath();
const creds = await fs.readFile(keyFile, 'utf-8');
client.setCredentials(JSON.parse(creds));
// This will verify locally that the credentials look good.
const { token } = await client.getAccessToken();
if (!token) {
return false;
}
// This will check with the server to see if it hasn't been revoked.
await client.getTokenInfo(token);
return true;
}
catch (_) {
return false;
}
}
async function cacheCredentials(credentials) {
const filePath = getCachedCredentialPath();
await fs.mkdir(path.dirname(filePath), { recursive: true });
const credString = JSON.stringify(credentials, null, 2);
await fs.writeFile(filePath, credString);
}
function getCachedCredentialPath() {
return path.join(os.homedir(), GEMINI_DIR, CREDENTIAL_FILENAME);
}
export async function clearCachedCredentialFile() {
try {
await fs.rm(getCachedCredentialPath(), { force: true });
// Clear the Google Account ID cache when credentials are cleared
await clearCachedGoogleAccount();
}
catch (_) {
/* empty */
}
}
async function fetchAndCacheUserInfo(client) {
try {
const { token } = await client.getAccessToken();
if (!token) {
return;
}
const response = await fetch('https://www.googleapis.com/oauth2/v2/userinfo', {
headers: {
Authorization: `Bearer ${token}`,
},
});
if (!response.ok) {
console.error('Failed to fetch user info:', response.status, response.statusText);
return;
}
const userInfo = await response.json();
if (userInfo.email) {
await cacheGoogleAccount(userInfo.email);
}
}
catch (error) {
console.error('Error retrieving user info:', error);
}
}
//# sourceMappingURL=oauth2.js.map