8487645224
- Fix 'undefined' in auth banner: read access_token_hours_remaining (not hours_remaining) - Fix false-positive warning on fresh tokens: when refresh token present, only warn within 1 hour of expiry (not 24h) since the CLI should auto-rotate but sometimes misses - Emit claude_auth_expired SSE event on 401 so UI shows inline red banner immediately - app.js: handle claude_auth_expired SSE event with persistent top banner + dismiss button Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
80 lines
3.1 KiB
Python
80 lines
3.1 KiB
Python
"""
|
|
CLI auth status for both Claude and Gemini backends.
|
|
|
|
GET /auth/status — returns per-backend auth info and warning flags
|
|
|
|
Claude: warns when OAuth token is < WARN_HOURS from expiry (requires
|
|
user to re-run `claude` to refresh via browser flow).
|
|
Gemini: warns only when oauth_creds.json is missing or has no
|
|
refresh_token (access token rotates automatically every ~1h).
|
|
"""
|
|
import json
|
|
import logging
|
|
from datetime import datetime, timezone
|
|
from pathlib import Path
|
|
from fastapi import APIRouter
|
|
|
|
logger = logging.getLogger(__name__)
|
|
router = APIRouter(prefix="/auth")
|
|
|
|
CLAUDE_CREDS = Path.home() / ".claude" / ".credentials.json"
|
|
GEMINI_CREDS = Path.home() / ".gemini" / "oauth_creds.json"
|
|
GEMINI_ACCTS = Path.home() / ".gemini" / "google_accounts.json"
|
|
WARN_HOURS = 24 # no refresh token — warn a day ahead
|
|
WARN_HOURS_REFRESH = 1 # refresh token present — only warn if CLI hasn't rotated in time
|
|
|
|
|
|
def _claude_status() -> dict:
|
|
try:
|
|
data = json.loads(CLAUDE_CREDS.read_text())
|
|
oauth = data["claudeAiOauth"]
|
|
has_refresh = bool(oauth.get("refreshToken"))
|
|
expires_dt = datetime.fromtimestamp(oauth["expiresAt"] / 1000, tz=timezone.utc)
|
|
now = datetime.now(tz=timezone.utc)
|
|
hours_remaining = (expires_dt - now).total_seconds() / 3600
|
|
# When a refresh token is present the CLI *should* auto-rotate the access
|
|
# token, but sometimes it doesn't. Use a tight 1-hour window so a fresh
|
|
# 8-hour token doesn't immediately trigger a warning, but a stale token
|
|
# that the CLI missed will still surface before it expires.
|
|
expired = hours_remaining <= 0
|
|
threshold = WARN_HOURS_REFRESH if has_refresh else WARN_HOURS
|
|
warning = expired or hours_remaining < threshold
|
|
return {
|
|
"ok": True,
|
|
"has_refresh_token": has_refresh,
|
|
"access_token_expires_at": expires_dt.isoformat(),
|
|
"access_token_hours_remaining": round(hours_remaining, 1),
|
|
"warning": warning,
|
|
"expired": expired,
|
|
}
|
|
except Exception as e:
|
|
logger.warning("claude auth check failed: %s", e)
|
|
return {"ok": False, "error": str(e), "warning": True, "expired": False}
|
|
|
|
|
|
def _gemini_status() -> dict:
|
|
try:
|
|
creds = json.loads(GEMINI_CREDS.read_text())
|
|
if not creds.get("refresh_token"):
|
|
return {"ok": True, "authenticated": False, "warning": True, "account": None}
|
|
account = None
|
|
try:
|
|
accts = json.loads(GEMINI_ACCTS.read_text())
|
|
account = accts.get("active")
|
|
except Exception:
|
|
pass
|
|
return {"ok": True, "authenticated": True, "warning": False, "account": account}
|
|
except FileNotFoundError:
|
|
return {"ok": True, "authenticated": False, "warning": True, "account": None}
|
|
except Exception as e:
|
|
logger.warning("gemini auth check failed: %s", e)
|
|
return {"ok": False, "error": str(e), "warning": True, "authenticated": False}
|
|
|
|
|
|
@router.get("/status")
|
|
async def auth_status() -> dict:
|
|
return {
|
|
"claude": _claude_status(),
|
|
"gemini": _gemini_status(),
|
|
}
|