/**

* Implements Chutes OAuth PKCE, callback parsing, token exchange, and refresh

* for agent model authentication.

*/

import { createHash, randomBytes } from "node:crypto";

import { normalizeOptionalString } from "@openclaw/normalization-core/string-coerce";

import { resolveExpiresAtMsFromDurationSeconds } from "../infra/parse-finite-number.js";

created_at?: string;

};

/** OAuth client settings for the Chutes authorization-code flow. */

export type ChutesOAuthAppConfig = {

clientId: string;

clientSecret?: string;

clientId?: string;

};

/** Generates a PKCE verifier/challenge pair for Chutes login. */

export function generateChutesPkce(): ChutesPkce {

const verifier = randomBytes(32).toString("hex");

const challenge = createHash("sha256").update(verifier).digest("base64url");

return { verifier, challenge };

}

/** Parses pasted Chutes redirect input and enforces the expected OAuth state. */

export function parseOAuthCallbackInput(

input: string,

expectedState: string,

return typed;

}

/** Exchanges an authorization code for stored Chutes OAuth credentials. */

export async function exchangeChutesCodeForTokens(params: {

app: ChutesOAuthAppConfig;

code: string;

} as unknown as ChutesStoredOAuth;

}

/** Refreshes stored Chutes OAuth credentials, preserving refresh tokens when absent. */

export async function refreshChutesTokens(params: {

credential: ChutesStoredOAuth;

fetchFn?: typeof fetch;

return {

...params.credential,

access,

// RFC 6749 section 6: new refresh token is optional; if present, replace old.

// RFC 6749 section 6 makes new refresh tokens optional; Chutes may omit one

// on refresh, so preserve the old token unless a replacement is returned.

refresh: newRefresh || refreshToken,

expires,

clientId,