LemonAi.Auth.OpenAICodexOAuth (lemon_ai v0.1.0)

@type login_opt() ::
  {:on_auth, (String.t(), String.t() | nil -> any())}
  | {:on_progress, (String.t() -> any())}
  | {:on_prompt, (map() -> String.t() | charlist())}
  | {:originator, String.t()}
  | {:redirect_uri, String.t()}
  | {:state, String.t()}
  | {:callback_timeout_ms, pos_integer()}
  | {:listen_for_callback, boolean()}
  | {:local_callback_listener, module()}
  | {:persist_secret, (String.t(), String.t() -> any())}

oauth_secret()

@type oauth_secret() :: %{required(String.t()) => String.t() | integer() | nil}

Functions

authorize_url(opts \\ [])

@spec authorize_url(keyword()) :: {:ok, map()}

Build an OAuth authorization URL + PKCE verifier/state.

build_authorize_url(opts \\ [])

@spec build_authorize_url(keyword()) :: {:ok, map()}

Build an OAuth authorization URL + PKCE verifier/state.

decode_secret(secret_value)

@spec decode_secret(String.t()) :: {:ok, oauth_secret()} | :not_oauth

Decode OAuth secret payload.

encode_secret(secret)

@spec encode_secret(oauth_secret()) :: String.t()

Encode OAuth secret payload for storage by the caller.

exchange_code_for_secret(code, code_verifier, opts \\ [])

@spec exchange_code_for_secret(String.t(), String.t(), keyword()) ::
  {:ok, oauth_secret()} | {:error, term()}

Exchange authorization code + PKCE verifier for an OAuth secret payload.

login_device_flow(opts \\ [])

@spec login_device_flow([login_opt()]) :: {:ok, oauth_secret()} | {:error, term()}

Run OpenAI Codex OAuth flow.

When the redirect URI is local (http://localhost:1455/auth/callback by default), A local listener can capture the browser callback automatically and fall back to manual paste only if that listener cannot complete the flow.

parse_authorization_input(input)

@spec parse_authorization_input(String.t()) ::
  {:ok, %{code: String.t(), state: String.t() | nil}} | {:error, term()}

Parse manual pasted OAuth input. Accepts:

full callback URL
query string containing code=
code#state
plain code

resolve_access_token()

@spec resolve_access_token() :: String.t() | nil

Resolve a Codex access token from process environment values.

Resolution order:

OPENAI_CODEX_API_KEY
CHATGPT_TOKEN

resolve_api_key_from_secret(secret_name, secret_value, opts \\ [])

Resolve a usable Codex access token from an OAuth secret.

Returns :ignore for non-Codex-OAuth payloads.