opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security(auth): allow OAuth credentials to be overridden via env vars

Browse source 
Add PICOCLAW_OPENAI_CLIENT_ID, PICOCLAW_GOOGLE_CLIENT_ID, and
PICOCLAW_GOOGLE_CLIENT_SECRET env var overrides. Hardcoded values
remain as fallback defaults for backward compatibility.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
admin-mf 2026-03-06 00:01:01 -06:00
parent 48b08110de
commit 5a041da9ff
1 changed files with 15 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
pkg/auth/oauth.go
View file

@ -35,7 +35,7 @@ type OAuthProviderConfig struct {
func OpenAIOAuthConfig() OAuthProviderConfig { func OpenAIOAuthConfig() OAuthProviderConfig {
return OAuthProviderConfig{ return OAuthProviderConfig{
Issuer: "https://auth.openai.com", Issuer: "https://auth.openai.com",
ClientID: "app_EMoamEEZ73f0CkXaXp7hrann", ClientID: getEnvOrDefault("PICOCLAW_OPENAI_CLIENT_ID", "app_EMoamEEZ73f0CkXaXp7hrann"),
Scopes: "openid profile email offline_access", Scopes: "openid profile email offline_access",
Originator: "codex_cli_rs", Originator: "codex_cli_rs",
Port: 1455, Port: 1455,
@ -45,11 +45,14 @@ func OpenAIOAuthConfig() OAuthProviderConfig {
// GoogleAntigravityOAuthConfig returns the OAuth configuration for Google Cloud Code Assist (Antigravity). // GoogleAntigravityOAuthConfig returns the OAuth configuration for Google Cloud Code Assist (Antigravity).
// Client credentials are the same ones used by OpenCode/pi-ai for Cloud Code Assist access. // Client credentials are the same ones used by OpenCode/pi-ai for Cloud Code Assist access.
func GoogleAntigravityOAuthConfig() OAuthProviderConfig { func GoogleAntigravityOAuthConfig() OAuthProviderConfig {
// These are the same client credentials used by the OpenCode antigravity plugin. clientID := getEnvOrDefault(
clientID := decodeBase64( "PICOCLAW_GOOGLE_CLIENT_ID",
"MTA3MTAwNjA2MDU5MS10bWhzc2luMmgyMWxjcmUyMzV2dG9sb2poNGc0MDNlcC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbQ==", decodeBase64("MTA3MTAwNjA2MDU5MS10bWhzc2luMmgyMWxjcmUyMzV2dG9sb2poNGc0MDNlcC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbQ=="),
)
clientSecret := getEnvOrDefault(
"PICOCLAW_GOOGLE_CLIENT_SECRET",
decodeBase64("R09DU1BYLUs1OEZXUjQ4NkxkTEoxbUxCOHNYQzR6NnFEQWY="),
) )
clientSecret := decodeBase64("R09DU1BYLUs1OEZXUjQ4NkxkTEoxbUxCOHNYQzR6NnFEQWY=")
return OAuthProviderConfig{ return OAuthProviderConfig{
Issuer: "https://accounts.google.com/o/oauth2/v2", Issuer: "https://accounts.google.com/o/oauth2/v2",
TokenURL: "https://oauth2.googleapis.com/token", TokenURL: "https://oauth2.googleapis.com/token",
@ -60,6 +63,13 @@ func GoogleAntigravityOAuthConfig() OAuthProviderConfig {
} }
} }
func getEnvOrDefault(key, fallback string) string {
if v := os.Getenv(key); v != "" {
return v
}
return fallback
}
func decodeBase64(s string) string { func decodeBase64(s string) string {
data, err := base64.StdEncoding.DecodeString(s) data, err := base64.StdEncoding.DecodeString(s)
if err != nil { if err != nil {