Files
Kigi-CLI/crates/codegen/kigi-shell/src/remote/workspaces_client.rs
T
ZacharyZhang-NY 021b82443d M1/F1: Kimi Code OAuth device-code flow
Replace the xAI OAuth stack with the Kimi device authorization grant:
- kimi_oauth.rs wire layer (device_authorization + token poll + refresh
  against kigi_env::oauth_host(); client_id per PRD; retryable statuses
  429/5xx with backoff; expired_token restarts authorization)
- X-Msh-Device-{Name,Model,Id} headers; device_id minted uuid4-hex at
  ~/.kigi/device_id (0600)
- Storage: system keyring service `kigi`, entry `oauth/kimi-code`
  (macOS/Windows native backends), atomic-file fallback under ~/.kigi;
  official client's keyring/~/.kimi never touched
- Refresh manager: 60s tick, threshold max(300, expires_in*0.5),
  401-tombstone keyed by rejected refresh token with 300s cooldown and
  rotation auto-clear, cross-process lock with sibling-adoption
  triple-check, sleep/wake forced refresh
- Deleted xAI machinery: enterprise OIDC (PKCE/JWKS/teams), devbox login,
  external auth provider, JWT tier gating + subscription paywall stack,
  X-XAI-Token-Auth marker headers, ZDR gates, /user enrichment
- kigi login / TUI /login both drive the device flow; login-host display
  now derives from kigi_env::oauth_host()
- 264 auth unit/wiremock tests; live contract probe of
  auth.kimi.com/api/oauth/device_authorization matches the wire shapes

Gates: check/clippy --all-targets clean, fmt, deny ok, kigi-shell lib
5131 tests green.
2026-07-17 07:37:29 -04:00

177 lines
5.4 KiB
Rust

use std::sync::Arc;
use serde::Deserialize;
use crate::auth::AuthManager;
const KIGI_WEB_URL: &str = "https://grok.com";
#[derive(Debug, Clone, Default, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct Workspace {
#[serde(default)]
pub workspace_id: String,
#[serde(default)]
pub name: String,
#[serde(default)]
pub create_time: Option<String>,
#[serde(default)]
pub kind: Option<String>,
}
#[derive(Debug, Clone, Default)]
pub struct WsQuery {
pub page_size: i64,
pub page_token: Option<String>,
pub query: Option<String>,
pub kind: Option<String>,
}
#[derive(Debug, Clone, Default)]
pub struct ListWorkspacesPage {
pub workspaces: Vec<Workspace>,
pub next_page_token: Option<String>,
}
#[derive(Debug, thiserror::Error)]
pub enum WsError {
#[error("no OAuth credentials for workspaces:read")]
NoOauth,
#[error("network error: {0}")]
Network(#[from] reqwest::Error),
#[error("request failed: {status}")]
Http { status: u16 },
#[error("parse error: {0}")]
Parse(#[from] serde_json::Error),
}
#[derive(Debug, Default, Deserialize)]
#[serde(rename_all = "camelCase")]
struct ListWorkspacesResponseWire {
#[serde(default)]
workspaces: Vec<Workspace>,
#[serde(default)]
next_page_token: Option<String>,
}
pub struct WorkspacesClient {
http: reqwest::Client,
base_url: String,
auth: Arc<AuthManager>,
}
impl WorkspacesClient {
pub fn new(auth: Arc<AuthManager>) -> Self {
let base_url = first_nonempty_env(&[
"KIGI_WORKSPACES_BASE_URL",
"KIGI_CONVERSATIONS_BASE_URL",
"KIGI_CODE_WEB_URL",
])
.unwrap_or_else(|| KIGI_WEB_URL.to_string());
Self {
http: crate::http::shared_client(),
base_url,
auth,
}
}
pub async fn list_workspaces(&self, q: &WsQuery) -> Result<ListWorkspacesPage, WsError> {
let auth = self.auth.auth().await.map_err(|_| WsError::NoOauth)?;
if !auth.is_session_auth() {
return Err(WsError::NoOauth);
}
let url = format!("{}/rest/workspaces", self.base_url);
let mut query: Vec<(&str, String)> = vec![("pageSize", q.page_size.to_string())];
if let Some(token) = q.page_token.as_deref().filter(|s| !s.is_empty()) {
query.push(("pageToken", token.to_owned()));
}
if let Some(search) = q.query.as_deref().filter(|s| !s.is_empty()) {
query.push(("query", search.to_owned()));
}
if let Some(kind) = q.kind.as_deref().filter(|s| !s.is_empty()) {
query.push(("kind", kind.to_owned()));
}
let mut builder = self
.http
.get(&url)
.query(&query)
.header("Authorization", format!("Bearer {}", auth.key))
.header("x-userid", &auth.user_id)
.header("x-grok-client-version", kigi_version::VERSION)
.header(
"x-grok-client-identifier",
crate::http::process_client_identifier(),
)
.header(
crate::http::CLIENT_MODE_HEADER,
crate::http::process_client_mode(),
)
.header(reqwest::header::ACCEPT, "application/json");
if let Some(email) = &auth.email {
builder = builder.header("x-email", email);
}
let builder = kigi_file_utils::trace_context::inject_trace_context_into_request(builder);
let response = builder.send().await?;
let status = response.status();
if !status.is_success() {
return Err(WsError::Http {
status: status.as_u16(),
});
}
let bytes = response.bytes().await?;
let wire: ListWorkspacesResponseWire = serde_json::from_slice(&bytes)?;
Ok(ListWorkspacesPage {
workspaces: wire.workspaces,
next_page_token: wire.next_page_token.filter(|t| !t.is_empty()),
})
}
}
fn first_nonempty_env(keys: &[&str]) -> Option<String> {
keys.iter()
.find_map(|k| std::env::var(k).ok().filter(|s| !s.is_empty()))
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn workspace_parses_camelcase_wire() {
let json = serde_json::json!({
"workspaces": [{
"workspaceId": "ws_9f3a",
"name": "GPU vendor research",
"createTime": "2026-06-18T17:30:00Z",
"kind": "WORKSPACE_KIND_IMAGINE"
}],
"nextPageToken": "tok2"
});
let wire: ListWorkspacesResponseWire = serde_json::from_value(json).unwrap();
assert_eq!(wire.workspaces.len(), 1);
let w = &wire.workspaces[0];
assert_eq!(w.workspace_id, "ws_9f3a");
assert_eq!(w.name, "GPU vendor research");
assert_eq!(w.create_time.as_deref(), Some("2026-06-18T17:30:00Z"));
assert_eq!(w.kind.as_deref(), Some("WORKSPACE_KIND_IMAGINE"));
assert_eq!(wire.next_page_token.as_deref(), Some("tok2"));
}
#[test]
fn missing_fields_default_gracefully() {
let json = serde_json::json!({ "workspaces": [{ "workspaceId": "w1" }] });
let wire: ListWorkspacesResponseWire = serde_json::from_value(json).unwrap();
let w = &wire.workspaces[0];
assert_eq!(w.workspace_id, "w1");
assert!(w.name.is_empty());
assert!(w.create_time.is_none());
assert!(w.kind.is_none());
assert!(wire.next_page_token.is_none());
}
}