5 Commits

Include renames

Author	SHA1	Message	Date
Dark-Alex-17	000559bc9d	style: Applied formatting	2026-07-21 11:24:18 -06:00
Dark-Alex-17	3aede58a11	feat(oauth): enable browser-paste PKCE flow for OpenAI-compatible providers ... Two coordinated changes that make openai-compatible OAuth providers usable with a non-localhost redirect_uri (browser shows the callback URL, user copies it back into the terminal — the same UX Claude uses). Fix: OpenAICompatibleOAuthProvider::fixed_redirect_uri() previously returned Some(uri) for any redirect_uri including public HTTPS URLs, which trapped run_pkce_flow into trying to bind a TCP listener on a public URL. It now returns Some only for loopback URIs (127.0.0.1, localhost, ::1). Non-loopback URIs return None, routing run_pkce_flow to the paste branch. New tri-format paste parser (parse_paste_input): - Full callback URL (starts with http:// or https://): parse code + state from the query string. This is what most modern OAuth providers redirect to and what a naive user copies from the browser bar. - Anthropic-style code#state fragment: preserved for Claude compatibility. - Bare code: accepted with a warning that CSRF state validation is skipped. For providers whose callback page shows only the code with no state. State validation moved from mandatory to conditional — if a paste didn't carry state (bare-code path), we warn and skip the check instead of hard- failing. The listener path (localhost + LAN redirects) still requires state because the server sends it in the query. Adds 9 unit tests covering both changes.	2026-07-21 11:14:55 -06:00
Dark-Alex-17	0fe430102a	feat: implement OAuth 2.0 Device Authorization Grant (RFC 8628) ... Adds a third OAuthFlow variant (device_code) alongside the existing pkce and client_credentials flows. Device flow enables OAuth for headless environments where a browser-based callback listener isn't available — the user visits a verification URL on any device and enters a short user_code. - OAuthFlow::DeviceCode variant + serde 'device_code' string - OAuthConfig fields: device_authorization_url, use_pkce_in_device_flow - OAuthProvider trait: device_authorization_url() / use_pkce_in_device_flow() - OpenAICompatibleOAuthProvider passes both through from config - run_device_code_flow() polls the token endpoint per RFC 8628 §3.4–§3.5: handles authorization_pending, slow_down (+5s backoff), expired_token, access_denied, and unknown errors distinctly - Sandbox-gated QR code display (via qrcode crate) — scanning with a phone is dramatically faster than copy-pasting the URL from a container - Optional PKCE per draft-ietf-oauth-device-flow §5.4 (default off) - run_oauth_flow and prepare_oauth_access_token dispatchers wire DeviceCode in; refresh path shared with PKCE since both flows produce refresh_tokens	2026-07-20 15:21:32 -06:00
Dark-Alex-17	107419966d	style: Cleaned up some comments and imports	2026-07-20 13:46:41 -06:00
Dark-Alex-17	66bbb34d7f	feat: OpenAICompatibleOAuthProvider (config-driven OAuthProvider impl)	2026-07-20 12:55:30 -06:00