eve/dist/src/internal/model-auth/development-broker-server.js

Filesystem-first framework for durable backend AI agents that run anywhere.

import{resolveModelApiKey}from"./api-key.js";import{DEVELOPMENT_MODEL_REJECTED_HEADER}from"./development-broker-protocol.js";import{resolveGatewayModelCredential}from"./gateway-credential.js";import{createHash}from"node:crypto";import{loadDevelopmentEnvironmentFiles}from"#cli/dev/environment.js";import{DEVELOPMENT_WORKFLOW_TRANSPORT_HEADER}from"#internal/workflow/development-world-protocol.js";import{getDefaultCodexTokenBroker}from"#public/models/openai/chatgpt/token-broker.js";import{timingSafeEqualStrings}from"#internal/nitro/dev-client-address.js";async function handleDevelopmentModelCredentialRequest(e,t){let n=new URL(e.url);if(n.pathname!==`/eve/v1/dev/internal/model-credential`)return;let r={"cache-control":`no-store`},i=e.headers.get(DEVELOPMENT_WORKFLOW_TRANSPORT_HEADER);if(i===null||!timingSafeEqualStrings(i,t.secret))return Response.json({error:`Unauthorized`},{status:401,headers:r});if(e.method!==`GET`)return Response.json({error:`Method not allowed`},{status:405,headers:r});let a=n.searchParams.get(`provider`),o=e.headers.get(DEVELOPMENT_MODEL_REJECTED_HEADER);if(![`gateway`,`chatgpt`,`openai`,`anthropic`].includes(a??``)||o!==null&&!/^[a-f0-9]{64}$/u.test(o))return Response.json({error:`Invalid credential request`},{status:400,headers:r});let wasRejected=e=>o===createHash(`sha256`).update(e).digest(`hex`);try{await loadDevelopmentEnvironmentFiles(t.appRoot);let e;if(a===`gateway`)e=await resolveGatewayModelCredential(),wasRejected(e.token)&&e.kind===`oauth`&&(e=await resolveGatewayModelCredential(e.token));else if(a===`chatgpt`){let t=getDefaultCodexTokenBroker(),n=await t.getToken({reason:`request`});wasRejected(n.token)&&(n=await t.getToken({reason:`rejected`})),e={kind:`oauth`,...n}}else e={kind:`api-key`,token:await resolveModelApiKey(a)};return Response.json(e,{headers:r})}catch{return Response.json({error:`The model connection is unavailable. Run /login to reconnect.`},{status:503,headers:r})}}export{handleDevelopmentModelCredentialRequest};