Squashed commit of the following:

commit 6561679f5c396bb07f5f7ba5bc5ec75e81c803a4 Author: OpenClaw Patch <patch@openclaw.local> Date: Tue May 19 16:26:01 2026 -0700 fix: never dedup access_token connections Access tokens should always create new entries. User decides which to keep (refresh-based OAuth vs no-expiry website token) and removes the other manually. commit d773451657999a2965ca4a094a7f0b7a54066693 Author: OpenClaw Patch <patch@openclaw.local> Date: Tue May 19 16:24:30 2026 -0700 fix: support ChatGPT website token format (account_id, plan_type) ChatGPT website access tokens use top-level 'account_id' and 'plan_type' fields, while OAuth id_tokens use nested claims under 'https://api.openai.com/auth'. Now both formats are handled, so workspace dedup works for website tokens too. commit cb895a5f6be59c51267874f11567646fa1f43016 Author: OpenClaw Patch <patch@openclaw.local> Date: Tue May 19 16:12:56 2026 -0700 fix: detect JWT in manual callback URL field When user pastes a JWT access token (starts with eyJ) in the 'paste callback URL' input field, skip URL parsing and send it directly to the exchange endpoint as the code. Fixes 'Failed to construct URL: Invalid URL' error. commit 29650d4a6732e3cf0958c9963b53209e41c8281e Author: OpenClaw Patch <patch@openclaw.local> Date: Tue May 19 15:37:02 2026 -0700 feat: auto-detect access token in OAuth exchange When the exchange endpoint receives a JWT (starts with eyJ) instead of an OAuth authorization code, it detects this and creates an access_token connection directly — skipping the OAuth token exchange flow. This lets users paste a ChatGPT access token where the OAuth code would normally go, and have it work automatically. commit e8e7c5709a783abd0c45246a44de1cc6abdba100 Author: OpenClaw Patch <patch@openclaw.local> Date: Tue May 19 15:14:48 2026 -0700 feat: workspace-aware dedup + ChatGPT access token import 1. Dedup now checks email AND workspace (chatgptAccountId) - Same email in different workspaces = separate connections - Backward compatible: non-workspace providers still dedup by email 2. New authType 'access_token' for ChatGPT website tokens - POST /api/oauth/codex/import-token accepts raw access tokens - Extracts email, workspace, plan from JWT claims - Deduplicates by email+workspace like OAuth - No refresh token needed (avoids OAuth relogin issues)
2026-09-22 20:00:47 +00:00 · 2026-05-21 11:33:18 +07:00
parent 026a7c9b85
commit 0654d7bb35
5 changed files with 161 additions and 6 deletions
@@ -0,0 +1,96 @@
+import { NextResponse } from "next/server";
+import { createProviderConnection } from "@/models";
+import { extractCodexAccountInfo } from "@/lib/oauth/providers";
+
+/**
+ * POST /api/oauth/codex/import-token
+ * Import a ChatGPT access token (created from chatgpt.com settings)
+ * as a provider connection, bypassing OAuth refresh flow.
+ *
+ * Body: { accessToken: string, name?: string }
+ */
+export async function POST(request) {
+  try {
+    const { accessToken, name } = await request.json();
+
+    if (!accessToken || typeof accessToken !== "string") {
+      return NextResponse.json(
+        { error: "Access token is required" },
+        { status: 400 }
+      );
+    }
+
+    const token = accessToken.trim();
+
+    // Extract account info from the JWT (email, workspace, plan)
+    let email = null;
+    let providerSpecificData = { authMethod: "access_token" };
+
+    // Try decoding as JWT to extract email + workspace
+    try {
+      const parts = token.split(".");
+      if (parts.length === 3) {
+        const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+        const missingPadding = (4 - (base64.length % 4)) % 4;
+        const padded = base64 + "=".repeat(missingPadding);
+        const payload = JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
+
+        // Extract from OpenAI JWT structure
+        const auth = payload["https://api.openai.com/auth"] || {};
+        const profile = payload["https://api.openai.com/profile"] || {};
+        email = profile.email || payload.email || payload.preferred_username || null;
+
+        if (auth.chatgpt_account_id) {
+          providerSpecificData.chatgptAccountId = auth.chatgpt_account_id;
+        }
+        if (auth.chatgpt_plan_type) {
+          providerSpecificData.chatgptPlanType = auth.chatgpt_plan_type;
+        }
+
+        // Store expiry info from JWT if available
+        if (payload.exp) {
+          providerSpecificData.jwtExp = payload.exp;
+        }
+      }
+    } catch {
+      // Not a JWT or malformed — still allow import as raw token
+    }
+
+    // Also try extractCodexAccountInfo via id_token-style extraction
+    // (the access token itself may contain the same claims)
+    if (!email) {
+      const info = extractCodexAccountInfo(token);
+      if (info.email) email = info.email;
+      if (info.chatgptAccountId) providerSpecificData.chatgptAccountId = info.chatgptAccountId;
+      if (info.chatgptPlanType) providerSpecificData.chatgptPlanType = info.chatgptPlanType;
+    }
+
+    const connectionName = name || email || "ChatGPT Access Token";
+
+    // Save to database as access_token authType (no refresh token)
+    const connection = await createProviderConnection({
+      provider: "codex",
+      authType: "access_token",
+      accessToken: token,
+      name: connectionName,
+      email: email,
+      providerSpecificData,
+      testStatus: "active",
+    });
+
+    return NextResponse.json({
+      success: true,
+      connection: {
+        id: connection.id,
+        provider: connection.provider,
+        email: connection.email,
+        name: connection.name,
+        workspace: providerSpecificData.chatgptAccountId || null,
+        plan: providerSpecificData.chatgptPlanType || null,
+      },
+    });
+  } catch (error) {
+    console.log("Codex access token import error:", error);
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+}