mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 04:32:42 +00:00
Marc-André BombeckandClaude Opus 4.7
19eb1d95d6
v1.4.7 corrected the issuer (`auth.openai.com`) and added the RFC-8693 api-key exchange, but the Connect button still failed in production with `unknown_error`. Root cause: OpenAI's Hydra allow-lists only `http://localhost:1455/auth/callback` and `:1457/auth/callback` for the public Codex CLI client ID. Any hosted redirect URI gets silently rejected — the v1.4.7 user landed on the "An error occurred during authentication (unknown_error)" page. The official Codex CLI ships a parallel **device-code flow** for exactly this case (`codex-rs/login/src/device_code_auth.rs`): 1. POST `https://auth.openai.com/api/accounts/deviceauth/usercode` with the client id → `{ device_auth_id, user_code, interval }`. 2. Show the user the code and a link to `https://auth.openai.com/codex/device`. They open it on any device, log in, and type the code. 3. POST `https://auth.openai.com/api/accounts/deviceauth/token` repeatedly until Hydra returns `{ authorization_code, code_challenge, code_verifier }` (otherwise 403 / 404). 4. Standard PKCE token exchange against `/oauth/token` — but with `redirect_uri = https://auth.openai.com/deviceauth/callback`, which IS allow-listed for the public client. Then the same id_token → API-key exchange that v1.4.7 already added. This sidesteps the redirect-URI allow-list entirely; HealthLog's domain never appears in any OAuth round-trip. Implementation: - `src/lib/ai/codex-oauth.ts` adds `requestDeviceCode()` and `pollDeviceCode()`. - `POST /api/auth/codex/device-start` initialises the flow, persists the `device_auth_id` + `user_code` in an encrypted httpOnly cookie (15 min, scoped to the requesting user), and returns the user- facing pieces. - `POST /api/auth/codex/device-poll` does one poll attempt; on `pending` it returns `{ status: "pending" }`, on success it exchanges + persists the api key + refresh token and returns `{ status: "connected" }`. - The Settings → KI section replaces the "redirect to OAuth" button with an inline card showing the user code, the verification URL, and a copy button. The page polls every `intervalSeconds` (5s default) until status flips to "connected" or the user cancels. EN + DE strings under `settings.ai.deviceCode*` cover the new copy. - The legacy authorize / callback routes stay on disk for now — they're harmless when the redirect-URI allow-list is updated for a private client ID, so operators with an OpenAI partner client can still use the original flow via `CODEX_OAUTH_CLIENT_ID`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
85 lines
2.3 KiB
JSON
85 lines
2.3 KiB
JSON
{
|
|
"name": "healthlog",
|
|
"version": "1.4.8",
|
|
"private": true,
|
|
"packageManager": "pnpm@10.31.0",
|
|
"scripts": {
|
|
"dev": "next dev",
|
|
"build": "next build",
|
|
"start": "next start",
|
|
"lint": "eslint",
|
|
"db:generate": "prisma generate",
|
|
"db:push": "prisma db push",
|
|
"db:migrate": "prisma migrate dev",
|
|
"db:migrate:deploy": "prisma migrate deploy",
|
|
"db:studio": "prisma studio",
|
|
"format": "prettier --write .",
|
|
"format:check": "prettier --check .",
|
|
"typecheck": "tsc --noEmit",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:integration": "vitest run --config vitest.integration.config.mts",
|
|
"e2e": "playwright test",
|
|
"e2e:ui": "playwright test --ui"
|
|
},
|
|
"dependencies": {
|
|
"@aws-sdk/client-s3": "^3.1045.0",
|
|
"@hookform/resolvers": "^5.2.2",
|
|
"@node-rs/argon2": "^2.0.2",
|
|
"@prisma/adapter-pg": "^7.8.0",
|
|
"@prisma/client": "^7.8.0",
|
|
"@simplewebauthn/browser": "^13.3.0",
|
|
"@simplewebauthn/server": "^13.3.0",
|
|
"@tanstack/react-query": "^5.100.9",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"dotenv": "^17.4.2",
|
|
"jspdf": "^4.2.1",
|
|
"jspdf-autotable": "^5.0.7",
|
|
"lucide-react": "^1.14.0",
|
|
"next": "16.2.4",
|
|
"next-themes": "^0.4.6",
|
|
"pg-boss": "^12.18.2",
|
|
"prisma": "^7.8.0",
|
|
"radix-ui": "^1.4.3",
|
|
"react": "19.2.5",
|
|
"react-dom": "19.2.5",
|
|
"react-hook-form": "^7.75.0",
|
|
"recharts": "^3.8.1",
|
|
"sonner": "^2.0.7",
|
|
"tailwind-merge": "^3.5.0",
|
|
"web-push": "^3.6.7",
|
|
"zod": "^4.4.2",
|
|
"zxcvbn-typescript": "^5.0.1"
|
|
},
|
|
"devDependencies": {
|
|
"@axe-core/playwright": "^4.11.3",
|
|
"@playwright/test": "^1.59.1",
|
|
"@tailwindcss/postcss": "^4",
|
|
"@testcontainers/postgresql": "^11.14.0",
|
|
"@types/node": "^25",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"@types/web-push": "^3.6.4",
|
|
"@vitejs/plugin-react": "^5.1.4",
|
|
"@vitest/coverage-v8": "^4.1.5",
|
|
"eslint": "^9",
|
|
"eslint-config-next": "16.2.4",
|
|
"pdf-parse": "^2.4.5",
|
|
"prettier": "^3.8.3",
|
|
"prettier-plugin-tailwindcss": "^0.8.0",
|
|
"shadcn": "^4.6.0",
|
|
"tailwindcss": "^4",
|
|
"testcontainers": "^11.14.0",
|
|
"tw-animate-css": "^1.4.0",
|
|
"typescript": "^6",
|
|
"vitest": "^4.1.5"
|
|
},
|
|
"pnpm": {
|
|
"onlyBuiltDependencies": [
|
|
"prisma",
|
|
"@prisma/engines"
|
|
]
|
|
}
|
|
}
|