1044 lines
30 KiB
Go
1044 lines
30 KiB
Go
package admin
|
||
|
||
import (
|
||
"context"
|
||
"crypto/sha256"
|
||
"encoding/base64"
|
||
"encoding/hex"
|
||
"encoding/json"
|
||
"errors"
|
||
"fmt"
|
||
"io"
|
||
"strconv"
|
||
"strings"
|
||
"time"
|
||
|
||
"github.com/Wei-Shaw/sub2api/internal/pkg/openai"
|
||
"github.com/Wei-Shaw/sub2api/internal/pkg/response"
|
||
"github.com/Wei-Shaw/sub2api/internal/service"
|
||
"github.com/gin-gonic/gin"
|
||
)
|
||
|
||
const codexImportClockSkewSeconds int64 = 120
|
||
|
||
type CodexSessionImportRequest struct {
|
||
Content string `json:"content"`
|
||
Contents []string `json:"contents"`
|
||
Name string `json:"name"`
|
||
Notes *string `json:"notes"`
|
||
GroupIDs []int64 `json:"group_ids"`
|
||
ProxyID *int64 `json:"proxy_id"`
|
||
Concurrency *int `json:"concurrency"`
|
||
Priority *int `json:"priority"`
|
||
RateMultiplier *float64 `json:"rate_multiplier"`
|
||
LoadFactor *int `json:"load_factor"`
|
||
ExpiresAt *int64 `json:"expires_at"`
|
||
AutoPauseOnExpired *bool `json:"auto_pause_on_expired"`
|
||
CredentialExtras map[string]any `json:"credential_extras"`
|
||
Extra map[string]any `json:"extra"`
|
||
UpdateExisting *bool `json:"update_existing"`
|
||
SkipDefaultGroupBind *bool `json:"skip_default_group_bind"`
|
||
ConfirmMixedChannelRisk *bool `json:"confirm_mixed_channel_risk"`
|
||
}
|
||
|
||
type CodexSessionImportResult struct {
|
||
Total int `json:"total"`
|
||
Created int `json:"created"`
|
||
Updated int `json:"updated"`
|
||
Skipped int `json:"skipped"`
|
||
Failed int `json:"failed"`
|
||
Items []CodexSessionImportItem `json:"items,omitempty"`
|
||
Warnings []CodexSessionImportMessage `json:"warnings,omitempty"`
|
||
Errors []CodexSessionImportMessage `json:"errors,omitempty"`
|
||
}
|
||
|
||
type CodexSessionImportItem struct {
|
||
Index int `json:"index"`
|
||
Name string `json:"name,omitempty"`
|
||
Action string `json:"action"`
|
||
AccountID int64 `json:"account_id,omitempty"`
|
||
Message string `json:"message,omitempty"`
|
||
}
|
||
|
||
type CodexSessionImportMessage struct {
|
||
Index int `json:"index"`
|
||
Name string `json:"name,omitempty"`
|
||
Message string `json:"message"`
|
||
}
|
||
|
||
type codexImportEntry struct {
|
||
Index int
|
||
Value any
|
||
}
|
||
|
||
type codexImportAccount struct {
|
||
Name string
|
||
AccessToken string
|
||
RefreshToken string
|
||
IDToken string
|
||
Email string
|
||
AccountID string
|
||
UserID string
|
||
PlanType string
|
||
Organization string
|
||
Credentials map[string]any
|
||
Extra map[string]any
|
||
TokenExpiresAt *time.Time
|
||
IdentityKeys []string
|
||
WarningTexts []string
|
||
}
|
||
|
||
type codexJWTClaims struct {
|
||
Sub string `json:"sub"`
|
||
Email string `json:"email"`
|
||
Exp int64 `json:"exp"`
|
||
Iat int64 `json:"iat"`
|
||
OpenAIAuth *codexJWTOpenAIClaims `json:"https://api.openai.com/auth,omitempty"`
|
||
}
|
||
|
||
type codexJWTOpenAIClaims struct {
|
||
ChatGPTAccountID string `json:"chatgpt_account_id"`
|
||
ChatGPTUserID string `json:"chatgpt_user_id"`
|
||
ChatGPTPlanType string `json:"chatgpt_plan_type"`
|
||
UserID string `json:"user_id"`
|
||
POID string `json:"poid"`
|
||
Organizations []openai.OrganizationClaim `json:"organizations"`
|
||
}
|
||
|
||
type codexAccountIndex struct {
|
||
accountsByKey map[string]service.Account
|
||
}
|
||
|
||
func (h *AccountHandler) ImportCodexSession(c *gin.Context) {
|
||
var req CodexSessionImportRequest
|
||
if err := c.ShouldBindJSON(&req); err != nil {
|
||
response.BadRequest(c, "Invalid request: "+err.Error())
|
||
return
|
||
}
|
||
if req.Concurrency != nil && *req.Concurrency < 0 {
|
||
response.BadRequest(c, "concurrency must be >= 0")
|
||
return
|
||
}
|
||
if req.Priority != nil && *req.Priority < 0 {
|
||
response.BadRequest(c, "priority must be >= 0")
|
||
return
|
||
}
|
||
if req.RateMultiplier != nil && *req.RateMultiplier < 0 {
|
||
response.BadRequest(c, "rate_multiplier must be >= 0")
|
||
return
|
||
}
|
||
if req.LoadFactor != nil && *req.LoadFactor > 10000 {
|
||
response.BadRequest(c, "load_factor must be <= 10000")
|
||
return
|
||
}
|
||
|
||
entries, err := parseCodexSessionImportEntries(req)
|
||
if err != nil {
|
||
response.BadRequest(c, err.Error())
|
||
return
|
||
}
|
||
if len(entries) == 0 {
|
||
response.BadRequest(c, "请输入 accessToken 或 Codex session JSON")
|
||
return
|
||
}
|
||
|
||
executeAdminIdempotentJSON(c, "admin.accounts.import_codex_session", req, service.DefaultWriteIdempotencyTTL(), func(ctx context.Context) (any, error) {
|
||
return h.importCodexSessions(ctx, req, entries)
|
||
})
|
||
}
|
||
|
||
func (h *AccountHandler) importCodexSessions(ctx context.Context, req CodexSessionImportRequest, entries []codexImportEntry) (CodexSessionImportResult, error) {
|
||
result := CodexSessionImportResult{
|
||
Total: len(entries),
|
||
Items: make([]CodexSessionImportItem, 0, len(entries)),
|
||
}
|
||
|
||
existingAccounts, err := h.listAccountsFiltered(ctx, service.PlatformOpenAI, service.AccountTypeOAuth, "", "", 0, "", "created_at", "desc")
|
||
if err != nil {
|
||
return result, err
|
||
}
|
||
index := buildCodexAccountIndex(existingAccounts)
|
||
|
||
updateExisting := true
|
||
if req.UpdateExisting != nil {
|
||
updateExisting = *req.UpdateExisting
|
||
}
|
||
concurrency := 3
|
||
if req.Concurrency != nil {
|
||
concurrency = *req.Concurrency
|
||
}
|
||
priority := 50
|
||
if req.Priority != nil {
|
||
priority = *req.Priority
|
||
}
|
||
credentialExtras := sanitizeCodexImportCredentialExtras(req.CredentialExtras)
|
||
skipDefaultGroupBind := false
|
||
if req.SkipDefaultGroupBind != nil {
|
||
skipDefaultGroupBind = *req.SkipDefaultGroupBind
|
||
}
|
||
skipMixedChannelCheck := req.ConfirmMixedChannelRisk != nil && *req.ConfirmMixedChannelRisk
|
||
|
||
seenIdentity := map[string]int{}
|
||
for _, entry := range entries {
|
||
item, err := normalizeCodexImportEntry(entry)
|
||
if err != nil {
|
||
result.Failed++
|
||
result.Items = append(result.Items, CodexSessionImportItem{
|
||
Index: entry.Index,
|
||
Action: "failed",
|
||
Message: err.Error(),
|
||
})
|
||
result.Errors = append(result.Errors, CodexSessionImportMessage{
|
||
Index: entry.Index,
|
||
Message: err.Error(),
|
||
})
|
||
continue
|
||
}
|
||
accountName := buildCodexCreateAccountName(req.Name, item, entry.Index, len(entries))
|
||
effectiveExpiresAt, credentialExpiresAt, autoPauseOnExpired, expiryWarnings, expiryErr := resolveCodexImportExpiry(req, item)
|
||
if expiryErr != nil {
|
||
result.Failed++
|
||
result.Items = append(result.Items, CodexSessionImportItem{
|
||
Index: entry.Index,
|
||
Name: accountName,
|
||
Action: "failed",
|
||
Message: expiryErr.Error(),
|
||
})
|
||
result.Errors = append(result.Errors, CodexSessionImportMessage{
|
||
Index: entry.Index,
|
||
Name: accountName,
|
||
Message: expiryErr.Error(),
|
||
})
|
||
continue
|
||
}
|
||
item.WarningTexts = append(item.WarningTexts, expiryWarnings...)
|
||
if credentialExpiresAt != nil {
|
||
item.Credentials["expires_at"] = credentialExpiresAt.Format(time.RFC3339)
|
||
}
|
||
credentials := mergeCodexImportMap(item.Credentials, credentialExtras)
|
||
extra := mergeCodexImportMap(req.Extra, item.Extra)
|
||
for _, warning := range item.WarningTexts {
|
||
result.Warnings = append(result.Warnings, CodexSessionImportMessage{
|
||
Index: entry.Index,
|
||
Name: accountName,
|
||
Message: warning,
|
||
})
|
||
}
|
||
|
||
if duplicateIndex, ok := firstSeenCodexIdentity(seenIdentity, item.IdentityKeys); ok {
|
||
message := fmt.Sprintf("与第 %d 条导入项重复，已跳过", duplicateIndex)
|
||
result.Skipped++
|
||
result.Items = append(result.Items, CodexSessionImportItem{
|
||
Index: entry.Index,
|
||
Name: accountName,
|
||
Action: "skipped",
|
||
Message: message,
|
||
})
|
||
result.Warnings = append(result.Warnings, CodexSessionImportMessage{
|
||
Index: entry.Index,
|
||
Name: accountName,
|
||
Message: message,
|
||
})
|
||
continue
|
||
}
|
||
markCodexIdentitySeen(seenIdentity, item.IdentityKeys, entry.Index)
|
||
|
||
if existing := index.Find(item.IdentityKeys); existing != nil && updateExisting {
|
||
mergedCredentials := mergeCodexImportCredentials(existing.Credentials, credentials, item)
|
||
mergedExtra := mergeCodexImportMap(existing.Extra, extra)
|
||
updateInput := &service.UpdateAccountInput{
|
||
Credentials: mergedCredentials,
|
||
Extra: mergedExtra,
|
||
Concurrency: req.Concurrency,
|
||
Priority: req.Priority,
|
||
RateMultiplier: req.RateMultiplier,
|
||
LoadFactor: req.LoadFactor,
|
||
ExpiresAt: effectiveExpiresAt,
|
||
AutoPauseOnExpired: autoPauseOnExpired,
|
||
}
|
||
if req.ProxyID != nil {
|
||
updateInput.ProxyID = req.ProxyID
|
||
}
|
||
if len(req.GroupIDs) > 0 {
|
||
groupIDs := append([]int64(nil), req.GroupIDs...)
|
||
updateInput.GroupIDs = &groupIDs
|
||
updateInput.SkipMixedChannelCheck = skipMixedChannelCheck
|
||
}
|
||
updated, updateErr := h.adminService.UpdateAccount(ctx, existing.ID, updateInput)
|
||
if updateErr != nil {
|
||
result.Failed++
|
||
result.Items = append(result.Items, CodexSessionImportItem{
|
||
Index: entry.Index,
|
||
Name: accountName,
|
||
Action: "failed",
|
||
Message: updateErr.Error(),
|
||
})
|
||
result.Errors = append(result.Errors, CodexSessionImportMessage{
|
||
Index: entry.Index,
|
||
Name: accountName,
|
||
Message: updateErr.Error(),
|
||
})
|
||
continue
|
||
}
|
||
if h.tokenCacheInvalidator != nil && updated != nil {
|
||
_ = h.tokenCacheInvalidator.InvalidateToken(ctx, updated)
|
||
}
|
||
result.Updated++
|
||
accountID := existing.ID
|
||
if updated != nil {
|
||
accountID = updated.ID
|
||
index.Add(*updated)
|
||
}
|
||
result.Items = append(result.Items, CodexSessionImportItem{
|
||
Index: entry.Index,
|
||
Name: accountName,
|
||
Action: "updated",
|
||
AccountID: accountID,
|
||
})
|
||
continue
|
||
}
|
||
|
||
account, createErr := h.adminService.CreateAccount(ctx, &service.CreateAccountInput{
|
||
Name: accountName,
|
||
Notes: req.Notes,
|
||
Platform: service.PlatformOpenAI,
|
||
Type: service.AccountTypeOAuth,
|
||
Credentials: credentials,
|
||
Extra: extra,
|
||
ProxyID: req.ProxyID,
|
||
Concurrency: concurrency,
|
||
Priority: priority,
|
||
RateMultiplier: req.RateMultiplier,
|
||
LoadFactor: req.LoadFactor,
|
||
GroupIDs: req.GroupIDs,
|
||
ExpiresAt: effectiveExpiresAt,
|
||
AutoPauseOnExpired: autoPauseOnExpired,
|
||
SkipDefaultGroupBind: skipDefaultGroupBind,
|
||
SkipMixedChannelCheck: skipMixedChannelCheck,
|
||
})
|
||
if createErr != nil {
|
||
result.Failed++
|
||
result.Items = append(result.Items, CodexSessionImportItem{
|
||
Index: entry.Index,
|
||
Name: accountName,
|
||
Action: "failed",
|
||
Message: createErr.Error(),
|
||
})
|
||
result.Errors = append(result.Errors, CodexSessionImportMessage{
|
||
Index: entry.Index,
|
||
Name: accountName,
|
||
Message: createErr.Error(),
|
||
})
|
||
continue
|
||
}
|
||
if account != nil {
|
||
index.Add(*account)
|
||
}
|
||
result.Created++
|
||
accountID := int64(0)
|
||
if account != nil {
|
||
accountID = account.ID
|
||
}
|
||
result.Items = append(result.Items, CodexSessionImportItem{
|
||
Index: entry.Index,
|
||
Name: accountName,
|
||
Action: "created",
|
||
AccountID: accountID,
|
||
})
|
||
}
|
||
|
||
return result, nil
|
||
}
|
||
|
||
func parseCodexSessionImportEntries(req CodexSessionImportRequest) ([]codexImportEntry, error) {
|
||
contents := make([]string, 0, 1+len(req.Contents))
|
||
if strings.TrimSpace(req.Content) != "" {
|
||
contents = append(contents, req.Content)
|
||
}
|
||
for _, content := range req.Contents {
|
||
if strings.TrimSpace(content) != "" {
|
||
contents = append(contents, content)
|
||
}
|
||
}
|
||
|
||
var entries []codexImportEntry
|
||
for _, content := range contents {
|
||
values, err := parseCodexSessionImportContent(content)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
for _, value := range values {
|
||
entries = append(entries, codexImportEntry{
|
||
Index: len(entries) + 1,
|
||
Value: value,
|
||
})
|
||
}
|
||
}
|
||
return entries, nil
|
||
}
|
||
|
||
func parseCodexSessionImportContent(content string) ([]any, error) {
|
||
trimmed := strings.TrimSpace(content)
|
||
if trimmed == "" {
|
||
return nil, nil
|
||
}
|
||
|
||
if looksLikeJSON(trimmed) {
|
||
values, err := decodeCodexJSONStream(trimmed)
|
||
if err != nil {
|
||
if strings.Contains(trimmed, "\n") {
|
||
if lineValues, lineErr := parseCodexSessionImportLines(trimmed); lineErr == nil {
|
||
return lineValues, nil
|
||
}
|
||
}
|
||
return nil, fmt.Errorf("JSON 解析失败: %w", err)
|
||
}
|
||
return flattenCodexImportValues(values), nil
|
||
}
|
||
|
||
return parseCodexSessionImportLines(trimmed)
|
||
}
|
||
|
||
func parseCodexSessionImportLines(content string) ([]any, error) {
|
||
values := make([]any, 0)
|
||
for _, line := range strings.Split(content, "\n") {
|
||
line = strings.TrimSpace(line)
|
||
if line == "" {
|
||
continue
|
||
}
|
||
if looksLikeJSON(line) {
|
||
lineValues, err := decodeCodexJSONStream(line)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("第 %d 行 JSON 解析失败: %w", len(values)+1, err)
|
||
}
|
||
values = append(values, flattenCodexImportValues(lineValues)...)
|
||
continue
|
||
}
|
||
values = append(values, line)
|
||
}
|
||
return values, nil
|
||
}
|
||
|
||
func decodeCodexJSONStream(content string) ([]any, error) {
|
||
decoder := json.NewDecoder(strings.NewReader(content))
|
||
decoder.UseNumber()
|
||
values := make([]any, 0, 1)
|
||
for {
|
||
var value any
|
||
err := decoder.Decode(&value)
|
||
if errors.Is(err, io.EOF) {
|
||
break
|
||
}
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
values = append(values, value)
|
||
}
|
||
if len(values) == 0 {
|
||
return nil, errors.New("空 JSON 内容")
|
||
}
|
||
return values, nil
|
||
}
|
||
|
||
func flattenCodexImportValues(values []any) []any {
|
||
out := make([]any, 0, len(values))
|
||
var appendValue func(any)
|
||
appendValue = func(value any) {
|
||
if arr, ok := value.([]any); ok {
|
||
for _, item := range arr {
|
||
appendValue(item)
|
||
}
|
||
return
|
||
}
|
||
out = append(out, value)
|
||
}
|
||
for _, value := range values {
|
||
appendValue(value)
|
||
}
|
||
return out
|
||
}
|
||
|
||
func normalizeCodexImportEntry(entry codexImportEntry) (*codexImportAccount, error) {
|
||
now := time.Now().UTC()
|
||
item := &codexImportAccount{
|
||
Credentials: map[string]any{},
|
||
Extra: map[string]any{
|
||
"import_source": "codex_session",
|
||
"imported_at": now.Format(time.RFC3339),
|
||
},
|
||
}
|
||
|
||
switch raw := entry.Value.(type) {
|
||
case string:
|
||
item.AccessToken = strings.TrimSpace(raw)
|
||
case map[string]any:
|
||
item.AccessToken = firstCodexString(raw,
|
||
[]string{"tokens", "access_token"},
|
||
[]string{"tokens", "accessToken"},
|
||
[]string{"access_token"},
|
||
[]string{"accessToken"},
|
||
[]string{"token"},
|
||
)
|
||
item.RefreshToken = firstCodexString(raw,
|
||
[]string{"tokens", "refresh_token"},
|
||
[]string{"tokens", "refreshToken"},
|
||
[]string{"refresh_token"},
|
||
[]string{"refreshToken"},
|
||
)
|
||
item.IDToken = firstCodexString(raw,
|
||
[]string{"tokens", "id_token"},
|
||
[]string{"tokens", "idToken"},
|
||
[]string{"id_token"},
|
||
[]string{"idToken"},
|
||
)
|
||
item.Email = firstCodexString(raw, []string{"email"}, []string{"user", "email"})
|
||
item.AccountID = firstCodexString(raw,
|
||
[]string{"chatgpt_account_id"},
|
||
[]string{"chatgptAccountId"},
|
||
[]string{"account_id"},
|
||
[]string{"accountId"},
|
||
[]string{"account", "id"},
|
||
[]string{"account", "account_id"},
|
||
[]string{"account", "chatgpt_account_id"},
|
||
)
|
||
item.UserID = firstCodexString(raw,
|
||
[]string{"chatgpt_user_id"},
|
||
[]string{"chatgptUserId"},
|
||
[]string{"user_id"},
|
||
[]string{"userId"},
|
||
[]string{"user", "id"},
|
||
)
|
||
item.PlanType = firstCodexString(raw,
|
||
[]string{"plan_type"},
|
||
[]string{"planType"},
|
||
[]string{"account", "plan_type"},
|
||
[]string{"account", "planType"},
|
||
)
|
||
item.Organization = firstCodexString(raw,
|
||
[]string{"organization_id"},
|
||
[]string{"organizationId"},
|
||
[]string{"org_id"},
|
||
[]string{"orgId"},
|
||
)
|
||
item.Name = firstCodexString(raw, []string{"name"}, []string{"user", "name"})
|
||
authProvider := firstCodexString(raw, []string{"auth_provider"}, []string{"authProvider"})
|
||
if authProvider != "" {
|
||
item.Extra["auth_provider"] = authProvider
|
||
}
|
||
if sessionToken := firstCodexString(raw, []string{"session_token"}, []string{"sessionToken"}); sessionToken != "" {
|
||
item.Extra["session_token_present"] = true
|
||
item.WarningTexts = append(item.WarningTexts, "sessionToken 已忽略，不会作为 OAuth refresh_token 存储")
|
||
}
|
||
if sessionExpiresAt, ok := codexTimeAt(raw, []string{"expires"}); ok {
|
||
item.Extra["session_expires_at"] = sessionExpiresAt.Format(time.RFC3339)
|
||
}
|
||
if tokenExpiresAt, ok := firstCodexTime(raw,
|
||
[]string{"tokens", "expires_at"},
|
||
[]string{"tokens", "expiresAt"},
|
||
[]string{"expires_at"},
|
||
[]string{"expiresAt"},
|
||
); ok {
|
||
if tokenExpiresAt.Unix() <= now.Unix()-codexImportClockSkewSeconds {
|
||
return nil, fmt.Errorf("access_token 已过期: %s", tokenExpiresAt.Format(time.RFC3339))
|
||
}
|
||
item.TokenExpiresAt = &tokenExpiresAt
|
||
item.Credentials["expires_at"] = tokenExpiresAt.Format(time.RFC3339)
|
||
}
|
||
copyCodexExtraString(raw, item.Extra, "user_image", []string{"user", "image"})
|
||
copyCodexExtraString(raw, item.Extra, "user_picture", []string{"user", "picture"})
|
||
copyCodexExtraString(raw, item.Extra, "account_structure", []string{"account", "structure"})
|
||
copyCodexExtraString(raw, item.Extra, "account_residency_region", []string{"account", "residencyRegion"})
|
||
copyCodexExtraString(raw, item.Extra, "compute_residency", []string{"account", "computeResidency"})
|
||
default:
|
||
return nil, fmt.Errorf("第 %d 条格式不支持", entry.Index)
|
||
}
|
||
|
||
if item.AccessToken == "" {
|
||
return nil, errors.New("缺少 accessToken/access_token")
|
||
}
|
||
item.Credentials["access_token"] = item.AccessToken
|
||
if item.RefreshToken != "" {
|
||
item.Credentials["refresh_token"] = item.RefreshToken
|
||
item.Credentials["client_id"] = openai.ClientID
|
||
}
|
||
if item.IDToken != "" {
|
||
item.Credentials["id_token"] = item.IDToken
|
||
_ = enrichCodexImportAccountFromJWT(item, item.IDToken, false, now)
|
||
}
|
||
if err := enrichCodexImportAccountFromJWT(item, item.AccessToken, true, now); err != nil {
|
||
return nil, err
|
||
}
|
||
if _, ok := item.Credentials["expires_at"]; !ok {
|
||
item.WarningTexts = append(item.WarningTexts, "无法从 accessToken 解析过期时间，导入后需自行确认令牌有效性")
|
||
}
|
||
if item.RefreshToken == "" {
|
||
item.WarningTexts = append(item.WarningTexts, "未包含 refresh_token，accessToken 过期后无法自动续期")
|
||
}
|
||
|
||
setCodexCredentialIfNotEmpty(item.Credentials, "email", item.Email)
|
||
setCodexCredentialIfNotEmpty(item.Credentials, "chatgpt_account_id", item.AccountID)
|
||
setCodexCredentialIfNotEmpty(item.Credentials, "chatgpt_user_id", item.UserID)
|
||
setCodexCredentialIfNotEmpty(item.Credentials, "organization_id", item.Organization)
|
||
setCodexCredentialIfNotEmpty(item.Credentials, "plan_type", item.PlanType)
|
||
|
||
fingerprint := codexTokenFingerprint(item.AccessToken)
|
||
item.Extra["access_token_sha256"] = fingerprint
|
||
item.IdentityKeys = buildCodexIdentityKeys(item.AccountID, item.UserID, item.Email, item.AccessToken)
|
||
item.Name = buildCodexImportAccountName(item, entry.Index)
|
||
|
||
return item, nil
|
||
}
|
||
|
||
func enrichCodexImportAccountFromJWT(item *codexImportAccount, token string, validateExpiry bool, now time.Time) error {
|
||
claims, err := decodeCodexJWTClaims(token)
|
||
if err != nil {
|
||
if validateExpiry {
|
||
item.WarningTexts = append(item.WarningTexts, "accessToken 不是可解析 JWT，无法校验过期时间和账号身份")
|
||
}
|
||
return nil
|
||
}
|
||
if validateExpiry && claims.Exp > 0 {
|
||
if now.Unix() > claims.Exp+codexImportClockSkewSeconds {
|
||
return fmt.Errorf("access_token 已过期: %s", time.Unix(claims.Exp, 0).UTC().Format(time.RFC3339))
|
||
}
|
||
expiresAt := time.Unix(claims.Exp, 0).UTC()
|
||
item.TokenExpiresAt = &expiresAt
|
||
item.Credentials["expires_at"] = expiresAt.Format(time.RFC3339)
|
||
}
|
||
if item.Email == "" {
|
||
item.Email = strings.TrimSpace(claims.Email)
|
||
}
|
||
if claims.OpenAIAuth == nil {
|
||
if item.UserID == "" {
|
||
item.UserID = strings.TrimSpace(claims.Sub)
|
||
}
|
||
return nil
|
||
}
|
||
if item.AccountID == "" {
|
||
item.AccountID = strings.TrimSpace(claims.OpenAIAuth.ChatGPTAccountID)
|
||
}
|
||
if item.UserID == "" {
|
||
item.UserID = strings.TrimSpace(claims.OpenAIAuth.ChatGPTUserID)
|
||
}
|
||
if item.UserID == "" {
|
||
item.UserID = strings.TrimSpace(claims.OpenAIAuth.UserID)
|
||
}
|
||
if item.PlanType == "" {
|
||
item.PlanType = strings.TrimSpace(claims.OpenAIAuth.ChatGPTPlanType)
|
||
}
|
||
if item.Organization == "" {
|
||
item.Organization = strings.TrimSpace(claims.OpenAIAuth.POID)
|
||
}
|
||
if item.Organization == "" {
|
||
for _, org := range claims.OpenAIAuth.Organizations {
|
||
if org.IsDefault {
|
||
item.Organization = org.ID
|
||
break
|
||
}
|
||
}
|
||
}
|
||
if item.Organization == "" && len(claims.OpenAIAuth.Organizations) > 0 {
|
||
item.Organization = claims.OpenAIAuth.Organizations[0].ID
|
||
}
|
||
if item.UserID == "" {
|
||
item.UserID = strings.TrimSpace(claims.Sub)
|
||
}
|
||
return nil
|
||
}
|
||
|
||
func decodeCodexJWTClaims(token string) (*codexJWTClaims, error) {
|
||
parts := strings.Split(token, ".")
|
||
if len(parts) != 3 {
|
||
return nil, fmt.Errorf("invalid JWT format")
|
||
}
|
||
payload, err := decodeCodexJWTSegment(parts[1])
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
var claims codexJWTClaims
|
||
if err := json.Unmarshal(payload, &claims); err != nil {
|
||
return nil, err
|
||
}
|
||
return &claims, nil
|
||
}
|
||
|
||
func decodeCodexJWTSegment(segment string) ([]byte, error) {
|
||
if decoded, err := base64.RawURLEncoding.DecodeString(segment); err == nil {
|
||
return decoded, nil
|
||
}
|
||
if decoded, err := base64.RawStdEncoding.DecodeString(segment); err == nil {
|
||
return decoded, nil
|
||
}
|
||
padded := segment
|
||
if rem := len(padded) % 4; rem > 0 {
|
||
padded += strings.Repeat("=", 4-rem)
|
||
}
|
||
if decoded, err := base64.URLEncoding.DecodeString(padded); err == nil {
|
||
return decoded, nil
|
||
}
|
||
return base64.StdEncoding.DecodeString(padded)
|
||
}
|
||
|
||
func buildCodexImportAccountName(item *codexImportAccount, index int) string {
|
||
for _, candidate := range []string{item.Name, item.Email, item.AccountID, item.UserID} {
|
||
candidate = strings.TrimSpace(candidate)
|
||
if candidate != "" {
|
||
return candidate
|
||
}
|
||
}
|
||
return fmt.Sprintf("Codex 导入账号 %d", index)
|
||
}
|
||
|
||
func buildCodexCreateAccountName(base string, item *codexImportAccount, index, total int) string {
|
||
base = strings.TrimSpace(base)
|
||
if base == "" {
|
||
if item == nil {
|
||
return fmt.Sprintf("Codex 导入账号 %d", index)
|
||
}
|
||
return item.Name
|
||
}
|
||
if total > 1 {
|
||
return fmt.Sprintf("%s #%d", base, index)
|
||
}
|
||
return base
|
||
}
|
||
|
||
func resolveCodexImportExpiry(req CodexSessionImportRequest, item *codexImportAccount) (*int64, *time.Time, *bool, []string, error) {
|
||
if item == nil {
|
||
return nil, nil, nil, nil, errors.New("导入项为空")
|
||
}
|
||
|
||
var requestExpiresAt *time.Time
|
||
if req.ExpiresAt != nil && *req.ExpiresAt > 0 {
|
||
t := time.Unix(*req.ExpiresAt, 0).UTC()
|
||
requestExpiresAt = &t
|
||
}
|
||
|
||
var accountExpiresAt *time.Time
|
||
var credentialExpiresAt *time.Time
|
||
warnings := make([]string, 0, 2)
|
||
if item.RefreshToken == "" {
|
||
if item.TokenExpiresAt != nil {
|
||
tokenExpiresAt := item.TokenExpiresAt.UTC()
|
||
accountExpiresAt = &tokenExpiresAt
|
||
credentialExpiresAt = &tokenExpiresAt
|
||
}
|
||
if requestExpiresAt != nil {
|
||
accountExpiresAt = earlierCodexTime(accountExpiresAt, requestExpiresAt)
|
||
credentialExpiresAt = earlierCodexTime(credentialExpiresAt, requestExpiresAt)
|
||
}
|
||
if accountExpiresAt == nil {
|
||
return nil, nil, nil, nil, errors.New("未包含 refresh_token，且无法解析 accessToken 过期时间；请在第一步设置过期时间后再导入")
|
||
}
|
||
if accountExpiresAt.Unix() <= time.Now().UTC().Unix()-codexImportClockSkewSeconds {
|
||
return nil, nil, nil, nil, fmt.Errorf("过期时间已过期: %s", accountExpiresAt.Format(time.RFC3339))
|
||
}
|
||
warnings = append(warnings, "未包含 refresh_token，已按 accessToken/账号过期时间设置自动停止调度")
|
||
if req.AutoPauseOnExpired != nil && !*req.AutoPauseOnExpired {
|
||
warnings = append(warnings, "未包含 refresh_token，已强制开启过期自动暂停")
|
||
}
|
||
autoPause := true
|
||
expiresAtUnix := accountExpiresAt.Unix()
|
||
return &expiresAtUnix, credentialExpiresAt, &autoPause, warnings, nil
|
||
}
|
||
|
||
if requestExpiresAt != nil {
|
||
accountExpiresAt = requestExpiresAt
|
||
}
|
||
if item.TokenExpiresAt != nil {
|
||
tokenExpiresAt := item.TokenExpiresAt.UTC()
|
||
credentialExpiresAt = &tokenExpiresAt
|
||
}
|
||
var expiresAtUnix *int64
|
||
if accountExpiresAt != nil {
|
||
v := accountExpiresAt.Unix()
|
||
expiresAtUnix = &v
|
||
}
|
||
return expiresAtUnix, credentialExpiresAt, req.AutoPauseOnExpired, warnings, nil
|
||
}
|
||
|
||
func earlierCodexTime(current, candidate *time.Time) *time.Time {
|
||
if candidate == nil {
|
||
return current
|
||
}
|
||
if current == nil || candidate.Before(*current) {
|
||
t := candidate.UTC()
|
||
return &t
|
||
}
|
||
t := current.UTC()
|
||
return &t
|
||
}
|
||
|
||
func sanitizeCodexImportCredentialExtras(input map[string]any) map[string]any {
|
||
if len(input) == 0 {
|
||
return nil
|
||
}
|
||
protected := map[string]struct{}{
|
||
"access_token": {},
|
||
"refresh_token": {},
|
||
"id_token": {},
|
||
"expires_at": {},
|
||
"email": {},
|
||
"chatgpt_account_id": {},
|
||
"chatgpt_user_id": {},
|
||
"organization_id": {},
|
||
"plan_type": {},
|
||
"client_id": {},
|
||
}
|
||
out := make(map[string]any, len(input))
|
||
for key, value := range input {
|
||
normalizedKey := strings.TrimSpace(key)
|
||
if normalizedKey == "" {
|
||
continue
|
||
}
|
||
if _, ok := protected[strings.ToLower(normalizedKey)]; ok {
|
||
continue
|
||
}
|
||
out[normalizedKey] = value
|
||
}
|
||
if len(out) == 0 {
|
||
return nil
|
||
}
|
||
return out
|
||
}
|
||
|
||
func buildCodexIdentityKeys(accountID, userID, email, accessToken string) []string {
|
||
keys := make([]string, 0, 4)
|
||
accountID = strings.TrimSpace(accountID)
|
||
userID = strings.TrimSpace(userID)
|
||
if accountID != "" {
|
||
keys = append(keys, "account:"+accountID)
|
||
}
|
||
if userID != "" {
|
||
keys = append(keys, "user:"+userID)
|
||
}
|
||
if accountID == "" && userID == "" {
|
||
if email = strings.ToLower(strings.TrimSpace(email)); email != "" {
|
||
keys = append(keys, "email:"+email)
|
||
}
|
||
}
|
||
if accessToken = strings.TrimSpace(accessToken); accessToken != "" {
|
||
keys = append(keys, "access:"+codexTokenFingerprint(accessToken))
|
||
}
|
||
return keys
|
||
}
|
||
|
||
func buildCodexAccountIndex(accounts []service.Account) *codexAccountIndex {
|
||
index := &codexAccountIndex{accountsByKey: map[string]service.Account{}}
|
||
for _, account := range accounts {
|
||
index.Add(account)
|
||
}
|
||
return index
|
||
}
|
||
|
||
func (i *codexAccountIndex) Add(account service.Account) {
|
||
if i == nil {
|
||
return
|
||
}
|
||
if i.accountsByKey == nil {
|
||
i.accountsByKey = map[string]service.Account{}
|
||
}
|
||
keys := buildCodexIdentityKeys(
|
||
codexCredentialString(account.Credentials, "chatgpt_account_id"),
|
||
codexCredentialString(account.Credentials, "chatgpt_user_id"),
|
||
codexCredentialString(account.Credentials, "email"),
|
||
codexCredentialString(account.Credentials, "access_token"),
|
||
)
|
||
for _, key := range keys {
|
||
i.accountsByKey[key] = account
|
||
}
|
||
}
|
||
|
||
func (i *codexAccountIndex) Find(keys []string) *service.Account {
|
||
if i == nil {
|
||
return nil
|
||
}
|
||
for _, key := range keys {
|
||
if account, ok := i.accountsByKey[key]; ok {
|
||
return &account
|
||
}
|
||
}
|
||
return nil
|
||
}
|
||
|
||
func firstSeenCodexIdentity(seen map[string]int, keys []string) (int, bool) {
|
||
for _, key := range keys {
|
||
if index, ok := seen[key]; ok {
|
||
return index, true
|
||
}
|
||
}
|
||
return 0, false
|
||
}
|
||
|
||
func markCodexIdentitySeen(seen map[string]int, keys []string, index int) {
|
||
for _, key := range keys {
|
||
seen[key] = index
|
||
}
|
||
}
|
||
|
||
func mergeCodexImportMap(existing, incoming map[string]any) map[string]any {
|
||
out := make(map[string]any, len(existing)+len(incoming))
|
||
for k, v := range existing {
|
||
out[k] = v
|
||
}
|
||
for k, v := range incoming {
|
||
out[k] = v
|
||
}
|
||
return out
|
||
}
|
||
|
||
func mergeCodexImportCredentials(existing, incoming map[string]any, item *codexImportAccount) map[string]any {
|
||
out := mergeCodexImportMap(existing, incoming)
|
||
if item == nil {
|
||
return out
|
||
}
|
||
if strings.TrimSpace(item.RefreshToken) == "" {
|
||
delete(out, "refresh_token")
|
||
delete(out, "client_id")
|
||
}
|
||
if strings.TrimSpace(item.IDToken) == "" {
|
||
delete(out, "id_token")
|
||
}
|
||
return out
|
||
}
|
||
|
||
func codexCredentialString(credentials map[string]any, key string) string {
|
||
if credentials == nil {
|
||
return ""
|
||
}
|
||
return codexStringValue(credentials[key])
|
||
}
|
||
|
||
func codexTokenFingerprint(token string) string {
|
||
sum := sha256.Sum256([]byte(strings.TrimSpace(token)))
|
||
return hex.EncodeToString(sum[:])
|
||
}
|
||
|
||
func looksLikeJSON(content string) bool {
|
||
if content == "" {
|
||
return false
|
||
}
|
||
switch content[0] {
|
||
case '{', '[':
|
||
return true
|
||
default:
|
||
return false
|
||
}
|
||
}
|
||
|
||
func firstCodexString(obj map[string]any, paths ...[]string) string {
|
||
for _, path := range paths {
|
||
if value, ok := codexPathValue(obj, path); ok {
|
||
if str := codexStringValue(value); str != "" {
|
||
return str
|
||
}
|
||
}
|
||
}
|
||
return ""
|
||
}
|
||
|
||
func copyCodexExtraString(obj map[string]any, extra map[string]any, key string, path []string) {
|
||
value := firstCodexString(obj, path)
|
||
if value != "" {
|
||
extra[key] = value
|
||
}
|
||
}
|
||
|
||
func firstCodexTime(obj map[string]any, paths ...[]string) (time.Time, bool) {
|
||
for _, path := range paths {
|
||
if value, ok := codexTimeAt(obj, path); ok {
|
||
return value, true
|
||
}
|
||
}
|
||
return time.Time{}, false
|
||
}
|
||
|
||
func codexTimeAt(obj map[string]any, path []string) (time.Time, bool) {
|
||
value, ok := codexPathValue(obj, path)
|
||
if !ok {
|
||
return time.Time{}, false
|
||
}
|
||
return parseCodexTimeValue(value)
|
||
}
|
||
|
||
func codexPathValue(obj map[string]any, path []string) (any, bool) {
|
||
var current any = obj
|
||
for _, key := range path {
|
||
currentObj, ok := current.(map[string]any)
|
||
if !ok {
|
||
return nil, false
|
||
}
|
||
value, ok := currentObj[key]
|
||
if !ok {
|
||
return nil, false
|
||
}
|
||
current = value
|
||
}
|
||
return current, true
|
||
}
|
||
|
||
func codexStringValue(value any) string {
|
||
switch v := value.(type) {
|
||
case string:
|
||
return strings.TrimSpace(v)
|
||
case json.Number:
|
||
return strings.TrimSpace(v.String())
|
||
case float64:
|
||
return strings.TrimSpace(strconv.FormatFloat(v, 'f', -1, 64))
|
||
case float32:
|
||
return strings.TrimSpace(strconv.FormatFloat(float64(v), 'f', -1, 32))
|
||
case int:
|
||
return strconv.Itoa(v)
|
||
case int64:
|
||
return strconv.FormatInt(v, 10)
|
||
case int32:
|
||
return strconv.FormatInt(int64(v), 10)
|
||
default:
|
||
return ""
|
||
}
|
||
}
|
||
|
||
func setCodexCredentialIfNotEmpty(credentials map[string]any, key, value string) {
|
||
value = strings.TrimSpace(value)
|
||
if value != "" {
|
||
credentials[key] = value
|
||
}
|
||
}
|
||
|
||
func parseCodexTimeValue(value any) (time.Time, bool) {
|
||
switch v := value.(type) {
|
||
case string:
|
||
v = strings.TrimSpace(v)
|
||
if v == "" {
|
||
return time.Time{}, false
|
||
}
|
||
if parsed, err := time.Parse(time.RFC3339Nano, v); err == nil {
|
||
return parsed.UTC(), true
|
||
}
|
||
if n, err := strconv.ParseInt(v, 10, 64); err == nil {
|
||
return codexUnixTime(n), true
|
||
}
|
||
case json.Number:
|
||
if n, err := v.Int64(); err == nil {
|
||
return codexUnixTime(n), true
|
||
}
|
||
if f, err := v.Float64(); err == nil {
|
||
return codexUnixTime(int64(f)), true
|
||
}
|
||
case float64:
|
||
return codexUnixTime(int64(v)), true
|
||
case int:
|
||
return codexUnixTime(int64(v)), true
|
||
case int64:
|
||
return codexUnixTime(v), true
|
||
}
|
||
return time.Time{}, false
|
||
}
|
||
|
||
func codexUnixTime(value int64) time.Time {
|
||
if value > 1_000_000_000_000 {
|
||
return time.UnixMilli(value).UTC()
|
||
}
|
||
return time.Unix(value, 0).UTC()
|
||
}
|