Login complete. You can close this window and return to csglite.
`) + return + } + _, _ = io.WriteString(w, `Login failed (`+errCode+`). Please try again.
`) } func (s *Server) handleCloudAuthTokenDelete(w http.ResponseWriter, r *http.Request) { diff --git a/internal/server/handlers_cloud_test.go b/internal/server/handlers_cloud_test.go index c367eb7..666bdea 100644 --- a/internal/server/handlers_cloud_test.go +++ b/internal/server/handlers_cloud_test.go @@ -224,6 +224,49 @@ func TestHandleCloudAuthTokenSaveAndDelete(t *testing.T) { } } +func TestHandleCloudAuthCallback(t *testing.T) { + config.Reset() + t.Cleanup(config.Reset) + + home := t.TempDir() + t.Setenv("HOME", home) + t.Setenv("USERPROFILE", home) + + s := newTestServer(t) + + saveReq := httptest.NewRequest(http.MethodGet, "/api/cloud/auth/callback?token=%20test-token%20", nil) + w := httptest.NewRecorder() + s.handleCloudAuthCallback(w, saveReq) + + if w.Code != http.StatusOK { + t.Fatalf("status = %d, want %d", w.Code, http.StatusOK) + } + if ct := w.Header().Get("Content-Type"); !strings.HasPrefix(ct, "text/html") { + t.Fatalf("Content-Type = %q, want text/html", ct) + } + if !strings.Contains(w.Body.String(), "Login complete") { + t.Fatalf("body = %q, want success page", w.Body.String()) + } + if s.cfg.Token != "test-token" { + t.Fatalf("saved token = %q, want %q", s.cfg.Token, "test-token") + } +} + +func TestHandleCloudAuthCallbackMissingToken(t *testing.T) { + s := newTestServer(t) + + req := httptest.NewRequest(http.MethodGet, "/api/cloud/auth/callback", nil) + w := httptest.NewRecorder() + s.handleCloudAuthCallback(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("status = %d, want %d", w.Code, http.StatusOK) + } + if !strings.Contains(w.Body.String(), "Login failed") || !strings.Contains(w.Body.String(), "missing_token") { + t.Fatalf("body = %q, want failure page with missing_token", w.Body.String()) + } +} + func TestHandleCloudAPIKeySaveAndDelete(t *testing.T) { config.Reset() t.Cleanup(config.Reset) diff --git a/internal/server/routes.go b/internal/server/routes.go index 93100a7..a869996 100644 --- a/internal/server/routes.go +++ b/internal/server/routes.go @@ -217,6 +217,12 @@ func (s *Server) externalAPIRoutes() http.Handler { )) } +func (s *Server) authCallbackRoutes() http.Handler { + mux := http.NewServeMux() + mux.HandleFunc("GET /api/cloud/auth/callback", s.handleCloudAuthCallback) + return mux +} + func desktopExternalAPIMiddleware(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { if r.Header.Get("Origin") != "" { diff --git a/internal/server/server.go b/internal/server/server.go index b6b093d..6f32214 100644 --- a/internal/server/server.go +++ b/internal/server/server.go @@ -160,10 +160,11 @@ type Server struct { appManager *apps.Manager sourceSwitches *apps.SourceSwitchManager appShells *aiAppShellManager - cloud *cloud.Service - http *http.Server - externalHTTP *http.Server - logBuf *LogBuffer + cloud *cloud.Service + http *http.Server + externalHTTP *http.Server + authCallbackHTTP *http.Server + logBuf *LogBuffer mu sync.RWMutex engines map[string]*managedEngine @@ -350,6 +351,16 @@ func New(cfg *config.Config, version string) *Server { return s } +// authCallbackAddr returns the loopback address dedicated to receiving the +// "lite" SSO redirect, so the browser can hand the access token back to this +// process on a stable port regardless of the main listener address. +func (s *Server) authCallbackAddr() string { + if s != nil && strings.TrimSpace(s.cfg.AuthCallbackAddr) != "" { + return strings.TrimSpace(s.cfg.AuthCallbackAddr) + } + return config.DefaultAuthCallbackAddr +} + func resolveCloudURL(cfg *config.Config) string { if u := strings.TrimSpace(cfg.AIGatewayURL); u != "" { return u @@ -386,6 +397,19 @@ func (s *Server) Run(ctx context.Context) error { s.cfg.DesktopAPIBoundAddr = externalListener.Addr().String() } + authCallbackListener, err := net.Listen("tcp", s.authCallbackAddr()) + if err != nil { + log.Printf("cloud auth callback listener unavailable on %s: %v", s.authCallbackAddr(), err) + } else { + defer authCallbackListener.Close() + s.authCallbackHTTP = &http.Server{ + Handler: s.authCallbackRoutes(), + ReadHeaderTimeout: 30 * time.Second, + WriteTimeout: 0, + IdleTimeout: 120 * time.Second, + } + } + go s.startEvictor(ctx) go s.refreshCloudModelsOnStartup(ctx) curationCtx, cancelCuration := context.WithCancel(ctx) @@ -405,7 +429,7 @@ func (s *Server) Run(ctx context.Context) error { }() } - errCh := make(chan error, 2) + errCh := make(chan error, 3) if s.cfg.DesktopMode { baseURL := "http://" + boundAddr ready := desktopReady{ @@ -444,6 +468,14 @@ func (s *Server) Run(ctx context.Context) error { } }() } + if s.authCallbackHTTP != nil { + go func() { + log.Printf(" Auth callback: http://%s", s.authCallbackAddr()) + if err := s.authCallbackHTTP.Serve(authCallbackListener); err != nil && !errors.Is(err, http.ErrServerClosed) { + errCh <- err + } + }() + } select { case err := <-errCh: @@ -480,6 +512,11 @@ func (s *Server) shutdownHTTPServers(ctx context.Context) error { if s.externalHTTP != nil { externalErr = s.externalHTTP.Shutdown(ctx) } + if s.authCallbackHTTP != nil { + if err := s.authCallbackHTTP.Shutdown(ctx); err != nil && externalErr == nil { + externalErr = err + } + } internalErr := s.http.Shutdown(ctx) if internalErr != nil { return internalErr diff --git a/internal/server/static/openapi/local-api.json b/internal/server/static/openapi/local-api.json index 511fed5..fc3b696 100644 --- a/internal/server/static/openapi/local-api.json +++ b/internal/server/static/openapi/local-api.json @@ -4027,6 +4027,39 @@ } } }, + "/api/cloud/auth/callback": { + "get": { + "tags": [ + "CloudAuth" + ], + "summary": "Complete the OpenCSG SSO login redirect", + "description": "Browser redirect target for the lite SSO flow. Persists the access token carried in the token query parameter and returns a confirmation page.", + "operationId": "completeCloudAuthCallback", + "parameters": [ + { + "name": "token", + "in": "query", + "required": true, + "description": "OpenCSG access token issued to the lite client.", + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "HTML confirmation showing whether the token was saved.", + "content": { + "text/html": { + "schema": { + "type": "string" + } + } + } + } + } + } + }, "/api/cloud/auth/token": { "post": { "tags": [ diff --git a/openapi/local-api.json b/openapi/local-api.json index 511fed5..fc3b696 100644 --- a/openapi/local-api.json +++ b/openapi/local-api.json @@ -4027,6 +4027,39 @@ } } }, + "/api/cloud/auth/callback": { + "get": { + "tags": [ + "CloudAuth" + ], + "summary": "Complete the OpenCSG SSO login redirect", + "description": "Browser redirect target for the lite SSO flow. Persists the access token carried in the token query parameter and returns a confirmation page.", + "operationId": "completeCloudAuthCallback", + "parameters": [ + { + "name": "token", + "in": "query", + "required": true, + "description": "OpenCSG access token issued to the lite client.", + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "HTML confirmation showing whether the token was saved.", + "content": { + "text/html": { + "schema": { + "type": "string" + } + } + } + } + } + } + }, "/api/cloud/auth/token": { "post": { "tags": [ diff --git a/web/src/i18n.ts b/web/src/i18n.ts index 7f4e54b..5527417 100644 --- a/web/src/i18n.ts +++ b/web/src/i18n.ts @@ -1111,7 +1111,6 @@ const en: Record{t("chat.cloudTokenHint")}
{t("chat.cloudTokenHint")}
{t("chat.cloudTokenHint")}
{t("settings.tokenInputHint")}
-