Implement S256 challenge in OpenRouter OAuth flow (#5501) * feat: implement S256 challenge in OpenRouter OAuth flow * fix: add error handling for missing OpenRouter authorization code * fix: save verifier to accountStorage Co-authored-by: Copilot <copilot@github.com> * fix: comment on getVerifierKey --------- Co-authored-by: Copilot <copilot@github.com>

97dba399e4791303c5474c8e53563739a9c0066e

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

Parents: 25fb4ceb501bc61b3f9e4e6349b8bdd3630eca51

package-lock.json+7 -0 Viewed

                 "ipaddr.js": "^2.2.0",
                 "is-docker": "^3.0.0",
                 "isomorphic-git": "^1.36.3",
 +                "js-sha256": "^0.11.1",
                 "localforage": "^1.10.0",
                 "lodash": "^4.17.21",
                 "mime-types": "^3.0.2",

             "integrity": "sha512-WZzeDOEtTOBK4Mdsar0IqEU5sMr3vSV2RqkAIzUEV2BHnUfKGyswWFPFwK5EeDo93K3FohSHbLAjj0s1Wzd+dg==",
             "license": "BSD-3-Clause"
         },
 +        "node_modules/js-sha256": {
 +            "version": "0.11.1",
 +            "resolved": "https://registry.npmjs.org/js-sha256/-/js-sha256-0.11.1.tgz",
 +            "integrity": "sha512-o6WSo/LUvY2uC4j7mO50a2ms7E/EAdbP0swigLV+nzHKTTaYnaLIWJ02VdXrsJX0vGedDESQnLsOekr94ryfjg==",
 +            "license": "MIT"
 +        },
         "node_modules/js-yaml": {
             "version": "4.1.1",
             "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",

package.json+1 -0 Viewed

         "ipaddr.js": "^2.2.0",
         "is-docker": "^3.0.0",
         "isomorphic-git": "^1.36.3",
 +        "js-sha256": "^0.11.1",
         "localforage": "^1.10.0",
         "lodash": "^4.17.21",
         "mime-types": "^3.0.2",

public/lib.js+3 -0 Viewed

 import yaml from 'yaml';
 import * as chevrotain from 'chevrotain';
 import { gzipSync, gzip } from 'fflate';
 +import { sha256 } from 'js-sha256';
 /**
  * Expose the libraries to the 'window' object.

     chevrotain,
     gzipSync,
     gzip,
 +    sha256,
 };
 export {

     chevrotain,
     gzipSync,
     gzip,
 +    sha256,
 };

public/script.js+2 -1 Viewed

     tag_import_setting,
     applyCharacterTagsToMessageDivs,
 } from './scripts/tags.js';
 import { checkOpenRouterAuth, initSecrets, readSecretState } from './scripts/secrets.js';
 import { markdownExclusionExt } from './scripts/showdown-exclusion.js';
 import { markdownUnderscoreExt } from './scripts/showdown-underscore.js';
 import { NOTE_MODULE_NAME, initAuthorsNote, metadata_keys, setFloatingPrompt, shouldWIAddPrompt } from './scripts/authors-note.js';

     await initPresetManager();
     await initSystemMessages();
     await getSettings(initLoaderHandle);
 +    await checkOpenRouterAuth();
     initKeyboard();
     initDynamicStyles();
     initTags();

public/scripts/secrets.js+60 -13 Viewed

 import { DOMPurify, moment, sha256 } from '../lib.js';
 import { event_types, eventSource, getRequestHeaders, saveSettings } from '../script.js';
 import { t } from './i18n.js';
 import { chat_completion_sources } from './openai.js';
 import { callGenericPopup, Popup, POPUP_RESULT, POPUP_TYPE } from './popup.js';

 import { SlashCommandScope } from './slash-commands/SlashCommandScope.js';
 import { renderTemplateAsync } from './templates.js';
 import { textgen_types } from './textgen-settings.js';
 import { copyText, isTrueBooleangetCurrentUserHandle } from './utilsuser.js';
 +import { copyText, isTrueBoolean, uuidv4 } from './utils.js';
 +import { accountStorage } from './util/AccountStorage.js';
 export const SECRET_KEYS = {
     HORDE: 'api_key_horde',

             secret_state = await response.json();
             updateSecretDisplay();
             updateInputDataLists();
 -            await checkOpenRouterAuth();
+        }
     } catch {
         console.error('Could not read secrets file');

+}
 /**
 + * Generates a storage key for the PKCE code verifier for a given source.
 + * @param {string} source Source for which to generate the storage key (e.g. 'openrouter')
 + * @returns {string} The storage key for the PKCE code verifier for a given source.
 + */
 +const getVerifierKey = (source) => `${getCurrentUserHandle()}_${source}_code_verifier`;
++
 +/**
 + * Generates a code challenge for PKCE authentication flows.
 + * @param {string} input Input secret string to generate the code challenge from.
 + * @returns {string} S256 code challenge generated from the input string, encoded in base64url format.
 + */
 +const generateChallenge = (input) => {
 +    const encoder = new TextEncoder();
 +    const data = encoder.encode(input);
 +    const hashBytes = sha256.array(data);
 +    return btoa(String.fromCharCode(...hashBytes)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
 +};
++
 +/**
  * Redirects the user to authorize OpenRouter.
  */
 async function authorizeOpenRouter() {

@@ -508,8 +528,15 @@ async function authorizeOpenRouter() {
508	528	}
509	529	}
510	530
	531	+ // Generate a PKCE code verifier and code challenge
	532	+ const codeVerifier = uuidv4() + uuidv4();
	533	+ const codeChallenge = generateChallenge(codeVerifier);
	534	+ accountStorage.setItem(getVerifierKey('openrouter'), codeVerifier);
	535	+ await saveSettings();
	536	+
	537	+ // Redirect to OpenRouter authorization URL with the code challenge and callback URL
511	538	const redirectUrl = new URL('/callback/openrouter', window.location.origin);
512	539	const openRouterUrl = `https://openrouter.ai/auth?callback_url=${encodeURIComponent(redirectUrl.toString())}&code_challenge=${codeChallenge}&code_challenge_method=S256`;
513	540	location.href = openRouterUrl;
514	541	}
515	542

  * Checks if the OpenRouter authorization code is present in the URL, and if so, exchanges it for an API key.
  * @returns {Promise<void>}
  */
 export async function checkOpenRouterAuth() {
     const params = new URLSearchParams(location.search);
     const source = params.get('source');
     if (source === 'openrouter') {
         const query = new URLSearchParams(params.get('query'));
 -        const code = query.get('code');
         try {
 +            const code = query.get('code');
 +            if (!code) {
 +                throw new Error('OpenRouter authorization code not found in URL');
 +            }
++
 +            const codeVerifier = accountStorage.getItem(getVerifierKey('openrouter'));
 +            if (!codeVerifier) {
 +                throw new Error('OpenRouter code verifier not found in accountStorage');
 +            }
++
             const response = await fetch('https://openrouter.ai/api/v1/auth/keys', {
                 method: 'POST',
 -                body: JSON.stringify({ code }),
 +                headers: {
 +                    'Content-Type': 'application/json',
 +                },
 +                body: JSON.stringify({
 +                    code: code,
 +                    code_verifier: codeVerifier,
 +                    code_challenge_method: 'S256',
 +                }),
             });
             if (!response.ok) {

             if (secret_state[SECRET_KEYS.OPENROUTER]) {
                 toastr.success('OpenRouter token saved');
 -                // Remove the code from the URL
 -                const currentUrl = window.location.href;
 -                const urlWithoutSearchParams = currentUrl.split('?')[0];
 -                window.history.pushState({}, '', urlWithoutSearchParams);
             } else {
                 throw new Error('OpenRouter token not saved');
+            }
         } catch (err) {
             toastr.error('Could not verify OpenRouter token. Please try again.');
 -            return;
 +            console.error('OpenRouter OAuth error:', err);
 +        } finally {
 +            // Remove the code from the URL
 +            const currentUrl = window.location.href;
 +            const urlWithoutSearchParams = currentUrl.split('?')[0];
 +            window.history.pushState({}, '', urlWithoutSearchParams);
+        }
+    }
++
 +    // Clean-up any code verifiers that might be left in accountStorage from abandoned auth flows
 +    accountStorage.removeItem(getVerifierKey('openrouter'));
+}
 /**