mirror of
https://github.com/openclaw/openclaw.git
synced 2026-07-26 16:51:17 +00:00
* fix(github-copilot): reject unsupported OAuth enterprise domain before refresh and model routing Legacy github-copilot OAuth credentials can carry a non-github.com enterpriseUrl. The token-refresh path templated it into the endpoint and sent the bearer refresh token there with no allowlist, and the model routing path derived a base URL from the same credential, so an unexpired credential kept routing its access token to that origin without ever reaching a refresh. A persisted credential origin that is not on the Copilot host allowlist is now rejected before any request is issued and before any model URL is produced. Because an off-allowlist origin means the stored access token may itself have been minted by that origin, the credential is refused as a whole rather than coerced to github.com: modifyModels withholds the github-copilot models so the token has no route, and its proxy-ep is never trusted. Login rejects an unsupported host up front, so every path that turns a domain into a bearer-bearing URL validates first. formatAuthDoctorHint guides affected users to re-authenticate, mirroring the qwen-portal hint. Supported hosts are unchanged: github.com and *.ghe.com data-residency tenants still route and refresh as before. The allowlist plus a new isSupportedGithubCopilotDomain predicate move to a dependency-free plugin-sdk leaf so the core OAuth runtime can share them without closing a module cycle; plugin-sdk/provider-auth re-exports normalizeGithubCopilotDomain, so the plugin-owned GitHub Copilot provider keeps its existing import. Fixes #103078. * fix(github-copilot): resolve provider auth base conflict * fix(github-copilot): resolve provider auth base conflict * fix(github-copilot): validate token proxy endpoint * fix(github-copilot): remove stale helper import --------- Co-authored-by: Peter Steinberger <steipete@gmail.com> Co-authored-by: Peter Steinberger <peter@steipete.me>
37 lines
644 B
TypeScript
37 lines
644 B
TypeScript
/**
|
|
* GitHub Copilot OAuth wire and option types.
|
|
*/
|
|
|
|
export type DeviceCodeResponse = {
|
|
device_code: string;
|
|
user_code: string;
|
|
verification_uri: string;
|
|
intervalMs: number;
|
|
expiresAt: number;
|
|
};
|
|
|
|
export type DeviceTokenSuccessResponse = {
|
|
access_token: string;
|
|
token_type?: string;
|
|
scope?: string;
|
|
};
|
|
|
|
export type DeviceTokenErrorResponse = {
|
|
error: string;
|
|
error_description?: string;
|
|
interval?: number;
|
|
};
|
|
|
|
export type CopilotModelListEntry = {
|
|
id?: unknown;
|
|
object?: unknown;
|
|
capabilities?: {
|
|
type?: unknown;
|
|
};
|
|
};
|
|
|
|
export type CopilotRequestOptions = {
|
|
signal?: AbortSignal;
|
|
timeoutMs?: number;
|
|
};
|