mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André BombeckandClaude Opus 4.7
2f7f487228
The "Connect with ChatGPT" button never actually completed an OAuth
flow. The implementation hit `chatgpt.com/authorize` and
`chatgpt.com/oauth/token`, which are not OAuth endpoints — ChatGPT
silently rendered its normal web app, dropped our params on the
floor, and the user landed on a regular logged-in chat session with
nothing else happening. There was no error and no callback, which is
why the regression survived multiple releases.
The canonical issuer for ChatGPT-OAuth is `auth.openai.com`. The
official `openai/codex` CLI confirms this in
`codex-rs/login/src/auth/manager.rs` and `codex-rs/login/src/server.rs`.
The flow is also slightly more involved than a vanilla PKCE
authorisation:
1. PKCE authorize against `auth.openai.com/oauth/authorize` with the
`openid profile email offline_access api.connectors.read
api.connectors.invoke` scope set, plus `id_token_add_organizations`
and `codex_cli_simplified_flow` flags so the resulting `id_token`
carries the ChatGPT-subscription claims.
2. Token exchange against `auth.openai.com/oauth/token` (form-
urlencoded body, NOT JSON) yields `{ id_token, access_token,
refresh_token }`.
3. **Second token exchange** with grant
`urn:ietf:params:oauth:grant-type:token-exchange`, swapping the
`id_token` for an OpenAI API key (`requested_token=openai-api-key`).
This key bills against the ChatGPT subscription rather than a
separate API plan — exactly what the v1.2/v1.3 design intended.
4. HealthLog stores the API key in `codexAccessTokenEncrypted`
(re-purposing the existing column to avoid a migration) and the
OAuth refresh token in `codexRefreshTokenEncrypted`. When the
key is about to age out we refresh + re-exchange transparently
before the next request.
The downstream provider is now a regular `OpenAIClient` tagged with
`providerType: "codex"` so logs and analytics still distinguish
ChatGPT-subscription billing from plain BYOK. The bespoke
`codex-client.ts` (which hit the chatgpt.com/backend-api/codex/responses
endpoint with the OAuth access token) is still on disk for now so the
prisma columns and the provider tag stay stable, but is unreferenced
by the active path.
The public Codex CLI client ID `app_EMoamEEZ73f0CkXaXp7hrann` is
shipped as a default; operators who registered a private OAuth app
with OpenAI can override via `CODEX_OAUTH_CLIENT_ID`. The
`isCodexOAuthConfigured()` gate is a no-op now because the default
always has a value, so the UI surface no longer silently hides the
"Connect with ChatGPT" button.
Tests cover the new shape end-to-end: PKCE generation, the
authorize-URL parameters, the form-encoded token exchange, the
api-key exchange, the refresh path, and the encrypt/decrypt
round-trip. The provider integration test is updated to expect a
`providerType: "codex"` OpenAIClient instead of the legacy
`CodexClient`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
85 lines
2.3 KiB
JSON
85 lines
2.3 KiB
JSON
{
|
|
"name": "healthlog",
|
|
"version": "1.4.7",
|
|
"private": true,
|
|
"packageManager": "pnpm@10.31.0",
|
|
"scripts": {
|
|
"dev": "next dev",
|
|
"build": "next build",
|
|
"start": "next start",
|
|
"lint": "eslint",
|
|
"db:generate": "prisma generate",
|
|
"db:push": "prisma db push",
|
|
"db:migrate": "prisma migrate dev",
|
|
"db:migrate:deploy": "prisma migrate deploy",
|
|
"db:studio": "prisma studio",
|
|
"format": "prettier --write .",
|
|
"format:check": "prettier --check .",
|
|
"typecheck": "tsc --noEmit",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:integration": "vitest run --config vitest.integration.config.mts",
|
|
"e2e": "playwright test",
|
|
"e2e:ui": "playwright test --ui"
|
|
},
|
|
"dependencies": {
|
|
"@aws-sdk/client-s3": "^3.1045.0",
|
|
"@hookform/resolvers": "^5.2.2",
|
|
"@node-rs/argon2": "^2.0.2",
|
|
"@prisma/adapter-pg": "^7.8.0",
|
|
"@prisma/client": "^7.8.0",
|
|
"@simplewebauthn/browser": "^13.3.0",
|
|
"@simplewebauthn/server": "^13.3.0",
|
|
"@tanstack/react-query": "^5.100.9",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"dotenv": "^17.4.2",
|
|
"jspdf": "^4.2.1",
|
|
"jspdf-autotable": "^5.0.7",
|
|
"lucide-react": "^1.14.0",
|
|
"next": "16.2.4",
|
|
"next-themes": "^0.4.6",
|
|
"pg-boss": "^12.18.2",
|
|
"prisma": "^7.8.0",
|
|
"radix-ui": "^1.4.3",
|
|
"react": "19.2.5",
|
|
"react-dom": "19.2.5",
|
|
"react-hook-form": "^7.75.0",
|
|
"recharts": "^3.8.1",
|
|
"sonner": "^2.0.7",
|
|
"tailwind-merge": "^3.5.0",
|
|
"web-push": "^3.6.7",
|
|
"zod": "^4.4.2",
|
|
"zxcvbn-typescript": "^5.0.1"
|
|
},
|
|
"devDependencies": {
|
|
"@axe-core/playwright": "^4.11.3",
|
|
"@playwright/test": "^1.59.1",
|
|
"@tailwindcss/postcss": "^4",
|
|
"@testcontainers/postgresql": "^11.14.0",
|
|
"@types/node": "^25",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"@types/web-push": "^3.6.4",
|
|
"@vitejs/plugin-react": "^5.1.4",
|
|
"@vitest/coverage-v8": "^4.1.5",
|
|
"eslint": "^9",
|
|
"eslint-config-next": "16.2.4",
|
|
"pdf-parse": "^2.4.5",
|
|
"prettier": "^3.8.3",
|
|
"prettier-plugin-tailwindcss": "^0.8.0",
|
|
"shadcn": "^4.6.0",
|
|
"tailwindcss": "^4",
|
|
"testcontainers": "^11.14.0",
|
|
"tw-animate-css": "^1.4.0",
|
|
"typescript": "^6",
|
|
"vitest": "^4.1.5"
|
|
},
|
|
"pnpm": {
|
|
"onlyBuiltDependencies": [
|
|
"prisma",
|
|
"@prisma/engines"
|
|
]
|
|
}
|
|
}
|