feat(oauth): ARIA kann Provider selbst registrieren + Custom-Provider in Diagnostic & App
ARIA hat jetzt das META-Tool oauth_register_provider. Wenn Stefan einen Service nutzen will, der nicht in den (auf Spotify reduzierten) Defaults ist, kann sie auth_url/token_url/scopes/client_auth selbst eintragen — ARIA kennt typische OAuth-Endpunkte (Dropbox, Discord, Notion, Slack, Zoom, Trello, LinkedIn, Reddit, Twitch) aus ihrem Training. Sie traegt NUR die URLs ein, client_id/secret bleiben Stefans Job (Diagnostic / App-UI) — bewusste Trennung damit Credentials nicht im Chat-Verlauf landen. DEFAULT_PROVIDERS auf Spotify reduziert — Rest war aktuell ungenutzt und macht den Code unnoetig "groß". ARIA registriert on-demand. Diagnostic-UI: - Custom-Provider zeigen auth_url/token_url/scopes als sichtbare Felder - Defaults verstecken die Felder hinter "Default-URLs ueberschreiben (advanced)" damit man die Spotify-URLs nicht versehentlich loescht - "+ Custom OAuth-Provider hinzufuegen" Button mit Prompts fuer Name/URLs/Scopes - 🗑-Icon bei Custom-Services (Service komplett entfernen) App-UI (neu fuer unterwegs): - Settings → Sektion 🔑 "OAuth-Apps" zwischen Skills und Protokoll - OAuthBrowser-Komponente analog zu Trigger/Skill-Browser: Liste mit Status, Tap → Edit-Modal mit client_id/secret + Advanced-Toggle fuer URLs. "Autorisieren ↗" oeffnet System-Browser via Linking.openURL, redirected zur RVS-Callback-Page, Status-Refresh nach 8s. - "+ Custom"-Button → Full-Screen-Modal fuer Service-Anlage. - brainApi um listOAuthServices/getOAuthApps/saveOAuthApp/ deleteOAuthApp/authorizeOAuth/revokeOAuth erweitert. Workflow ist jetzt: "verbinde mich mit Dropbox" → ARIA registriert Provider → "trag client_id/secret in Settings ein" → Stefan macht das in App oder Diagnostic → "Autorisieren ↗" → fertig. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -307,6 +307,65 @@ META_TOOLS = [
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"type": "function",
|
||||
"function": {
|
||||
"name": "oauth_register_provider",
|
||||
"description": (
|
||||
"Registriert einen NEUEN OAuth2-Provider in oauth_apps.json — "
|
||||
"nutze das wenn Stefan einen Service nutzen will, der noch nicht "
|
||||
"in der Default-Liste (spotify, google, github, strava, microsoft) "
|
||||
"ist. Du kennst typische OAuth-Endpunkte aus deinem Training "
|
||||
"(Dropbox, Twitch, Discord, Slack, Reddit, LinkedIn, Notion, "
|
||||
"Zoom, Trello, ...). Trag NUR die URLs ein — client_id / "
|
||||
"client_secret bleiben Stefans Job (Diagnostic > OAuth-Apps oder "
|
||||
"App > Settings > OAuth-Apps).\n\n"
|
||||
"**Workflow bei neuem Service:**\n"
|
||||
"1. `oauth_register_provider` mit auth_url + token_url + scopes\n"
|
||||
"2. Sag Stefan: \"Service '{name}' ist eingerichtet. Trag in "
|
||||
"Diagnostic/App > OAuth-Apps deine client_id + client_secret aus "
|
||||
"dem {name}-Developer-Dashboard ein. Plus die Callback-URL "
|
||||
"{callback} musst Du dort einmal als Redirect-URI eintragen.\"\n"
|
||||
"3. Warten bis Stefan fertig ist\n"
|
||||
"4. `oauth_authorize` rufen\n\n"
|
||||
"**`client_auth`-Wert:** Die meisten Provider wollen client_id+"
|
||||
"secret im Body (`body`, default). Spotify und manche andere "
|
||||
"wollen Basic-Auth-Header (`basic`). Wenn du unsicher bist, "
|
||||
"nimm `body` — schlaegt der Token-Request dann mit 401 fehl, "
|
||||
"switch auf `basic`.\n\n"
|
||||
"Bei Provider die du wirklich nicht kennst: frag Stefan oder "
|
||||
"such die Docs raus statt zu raten."
|
||||
),
|
||||
"parameters": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"service": {
|
||||
"type": "string",
|
||||
"description": "Service-Name (a-z 0-9 _ -, kurz, z.B. 'dropbox', 'discord')",
|
||||
},
|
||||
"auth_url": {
|
||||
"type": "string",
|
||||
"description": "Authorize-Endpoint, z.B. 'https://www.dropbox.com/oauth2/authorize'",
|
||||
},
|
||||
"token_url": {
|
||||
"type": "string",
|
||||
"description": "Token-Endpoint, z.B. 'https://api.dropboxapi.com/oauth2/token'",
|
||||
},
|
||||
"scopes": {
|
||||
"type": "array",
|
||||
"items": {"type": "string"},
|
||||
"description": "Default-Scopes die der User beim Auth zustimmen muss",
|
||||
},
|
||||
"client_auth": {
|
||||
"type": "string",
|
||||
"enum": ["body", "basic"],
|
||||
"description": "Wie der Provider client_id/secret erwartet (Default 'body')",
|
||||
},
|
||||
},
|
||||
"required": ["service", "auth_url", "token_url"],
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"type": "function",
|
||||
"function": {
|
||||
@@ -927,6 +986,37 @@ class Agent:
|
||||
else:
|
||||
lines.append(f"- {t['name']} ({t['type']}, {state})")
|
||||
return "\n".join(lines)
|
||||
if name == "oauth_register_provider":
|
||||
svc = (arguments.get("service") or "").strip()
|
||||
auth_url = (arguments.get("auth_url") or "").strip()
|
||||
token_url = (arguments.get("token_url") or "").strip()
|
||||
scopes = arguments.get("scopes") if isinstance(arguments.get("scopes"), list) else None
|
||||
client_auth = (arguments.get("client_auth") or "body").strip().lower()
|
||||
if not svc or not auth_url or not token_url:
|
||||
return "FEHLER: service, auth_url, token_url sind Pflicht."
|
||||
try:
|
||||
entry = oauth_mod.register_provider(
|
||||
svc, auth_url, token_url, scopes=scopes, client_auth=client_auth,
|
||||
)
|
||||
except ValueError as exc:
|
||||
return f"FEHLER: {exc}"
|
||||
except Exception as exc:
|
||||
logger.exception("oauth_register_provider fehlgeschlagen")
|
||||
return f"FEHLER: {exc}"
|
||||
cb = oauth_mod._callback_url(svc) if os.environ.get("RVS_HOST") else f"<RVS_HOST nicht gesetzt>/oauth/callback/{svc}"
|
||||
scopes_str = ", ".join(entry.get("scopes") or []) or "(keine)"
|
||||
return (
|
||||
f"OK — Provider '{svc}' registriert.\n"
|
||||
f" auth_url: {entry['auth_url']}\n"
|
||||
f" token_url: {entry['token_url']}\n"
|
||||
f" scopes: {scopes_str}\n"
|
||||
f" client_auth: {entry['client_auth']}\n\n"
|
||||
f"Sage Stefan: Trag in Diagnostic > OAuth-Apps (oder App > "
|
||||
f"Settings > OAuth-Apps) deine client_id + client_secret aus "
|
||||
f"dem {svc}-Developer-Dashboard ein. Plus die Callback-URL "
|
||||
f"`{cb}` musst Du dort einmal als Redirect-URI registrieren.\n"
|
||||
f"Sobald Stefan das gemacht hat, rufe `oauth_authorize` auf."
|
||||
)
|
||||
if name == "oauth_authorize":
|
||||
svc = (arguments.get("service") or "").strip()
|
||||
if not svc:
|
||||
|
||||
+44
-28
@@ -40,7 +40,10 @@ APPS_FILE = CONFIG_DIR / "oauth_apps.json"
|
||||
TOKENS_FILE = CONFIG_DIR / "oauth_tokens.json"
|
||||
|
||||
# Default-Provider-Configs. Werden von oauth_apps.json gemergt (User-Config
|
||||
# uebersteuert). Stefan muss nur client_id + client_secret eintragen.
|
||||
# uebersteuert). Aktuell nur Spotify als out-of-the-box Service — fuer alles
|
||||
# andere benutzt ARIA das `oauth_register_provider` Tool (legt Provider on-
|
||||
# demand mit den jeweiligen Endpunkten an). Stefan muss bei jedem Provider
|
||||
# danach nur client_id + client_secret in Diagnostic / App eintragen.
|
||||
DEFAULT_PROVIDERS: dict[str, dict] = {
|
||||
"spotify": {
|
||||
"auth_url": "https://accounts.spotify.com/authorize",
|
||||
@@ -50,33 +53,6 @@ DEFAULT_PROVIDERS: dict[str, dict] = {
|
||||
"user-library-read"],
|
||||
"client_auth": "basic", # client_id:client_secret als Basic-Auth-Header
|
||||
},
|
||||
"google": {
|
||||
"auth_url": "https://accounts.google.com/o/oauth2/v2/auth",
|
||||
"token_url": "https://oauth2.googleapis.com/token",
|
||||
"scopes": ["openid", "email", "profile"],
|
||||
"client_auth": "body", # client_id+secret im Body
|
||||
"extra_auth_params": {"access_type": "offline", "prompt": "consent"},
|
||||
},
|
||||
"github": {
|
||||
"auth_url": "https://github.com/login/oauth/authorize",
|
||||
"token_url": "https://github.com/login/oauth/access_token",
|
||||
"scopes": ["read:user"],
|
||||
"client_auth": "body",
|
||||
"accept_header": "application/json", # GitHub returns form-urlencoded otherwise
|
||||
},
|
||||
"strava": {
|
||||
"auth_url": "https://www.strava.com/oauth/authorize",
|
||||
"token_url": "https://www.strava.com/oauth/token",
|
||||
"scopes": ["read", "activity:read_all"],
|
||||
"client_auth": "body",
|
||||
"extra_auth_params": {"approval_prompt": "auto"},
|
||||
},
|
||||
"microsoft": {
|
||||
"auth_url": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
|
||||
"token_url": "https://login.microsoftonline.com/common/oauth2/v2.0/token",
|
||||
"scopes": ["User.Read", "offline_access"],
|
||||
"client_auth": "body",
|
||||
},
|
||||
}
|
||||
|
||||
# Pending Auth-Requests: state → {service, scopes, redirect_uri, created_at}
|
||||
@@ -149,6 +125,46 @@ def _provider_credentials(service: str) -> tuple[str, str]:
|
||||
return cid, sec
|
||||
|
||||
|
||||
def register_provider(service: str, auth_url: str, token_url: str,
|
||||
scopes: Optional[list[str]] = None,
|
||||
client_auth: str = "body",
|
||||
extra_auth_params: Optional[dict] = None,
|
||||
accept_header: Optional[str] = None) -> dict:
|
||||
"""Schreibt einen neuen Provider-Eintrag in oauth_apps.json. KEINE
|
||||
Credentials hier — die bleiben Stefans Job (Diagnostic / App-UI). Wird
|
||||
vom Brain-Tool `oauth_register_provider` gerufen.
|
||||
|
||||
Wenn der Service schon existiert: URLs/Scopes werden ueberschrieben,
|
||||
aber vorhandene client_id/client_secret bleiben unberuehrt.
|
||||
"""
|
||||
svc = (service or "").strip()
|
||||
if not svc or not all(c.isalnum() or c in "_-" for c in svc) or len(svc) > 60:
|
||||
raise ValueError(f"Ungueltiger service-Name: {service!r}")
|
||||
if not auth_url.startswith(("http://", "https://")):
|
||||
raise ValueError(f"auth_url muss http(s):// sein: {auth_url!r}")
|
||||
if not token_url.startswith(("http://", "https://")):
|
||||
raise ValueError(f"token_url muss http(s):// sein: {token_url!r}")
|
||||
if client_auth not in ("body", "basic"):
|
||||
raise ValueError(f"client_auth muss 'body' oder 'basic' sein: {client_auth!r}")
|
||||
|
||||
apps = _load_json(APPS_FILE)
|
||||
entry = apps.get(svc) or {}
|
||||
entry["auth_url"] = auth_url.strip()
|
||||
entry["token_url"] = token_url.strip()
|
||||
if scopes is not None:
|
||||
entry["scopes"] = list(scopes)
|
||||
entry["client_auth"] = client_auth
|
||||
if extra_auth_params is not None:
|
||||
entry["extra_auth_params"] = extra_auth_params
|
||||
if accept_header is not None:
|
||||
entry["accept_header"] = accept_header
|
||||
apps[svc] = entry
|
||||
_save_json(APPS_FILE, apps)
|
||||
logger.info("[oauth] Provider '%s' registriert (auth=%s, token=%s, scopes=%d)",
|
||||
svc, auth_url, token_url, len(entry.get("scopes") or []))
|
||||
return entry
|
||||
|
||||
|
||||
def _cleanup_pending() -> None:
|
||||
"""Entfernt abgelaufene Pending-Auths."""
|
||||
now = time.time()
|
||||
|
||||
Reference in New Issue
Block a user