|
| 1 | +import { BailianError, ExitCode } from "bailian-cli-core"; |
| 2 | + |
| 3 | +/** |
| 4 | + * Decoder for the obfuscated API key ("o1_…") produced by the Model Studio web |
| 5 | + * console. Ported verbatim from the frontend `encodeTokenPlanKey` counterpart: |
| 6 | + * token = "o1_" + salt(6) + feistel-obfuscated payload + crc32 checksum(6), |
| 7 | + * all over a 65-character alphabet. Pure logic, no dependencies; the CLI only |
| 8 | + * ever needs the decode direction. |
| 9 | + */ |
| 10 | + |
| 11 | +const TOKEN_PREFIX = "o1_"; |
| 12 | +const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_."; |
| 13 | +const ALPHABET_SIZE = ALPHABET.length; |
| 14 | +const ALPHABET_INDEX = new Map(ALPHABET.split("").map((character, index) => [character, index])); |
| 15 | +const KEY_PATTERN = /^[A-Za-z0-9._-]+$/; |
| 16 | +const SALT_LENGTH = 6; |
| 17 | +const CHECKSUM_LENGTH = 6; |
| 18 | +const FEISTEL_ROUNDS = 8; |
| 19 | + |
| 20 | +function invalidCredential(): BailianError { |
| 21 | + return new BailianError( |
| 22 | + "Invalid obfuscated API key.", |
| 23 | + ExitCode.USAGE, |
| 24 | + '--key expects the obfuscated key copied from the web console (starts with "o1_").', |
| 25 | + ); |
| 26 | +} |
| 27 | + |
| 28 | +function toDigits(value: string): number[] { |
| 29 | + const digits: number[] = []; |
| 30 | + for (const character of value) { |
| 31 | + const digit = ALPHABET_INDEX.get(character); |
| 32 | + if (digit === undefined) throw invalidCredential(); |
| 33 | + digits.push(digit); |
| 34 | + } |
| 35 | + return digits; |
| 36 | +} |
| 37 | + |
| 38 | +function fromDigits(digits: number[]): string { |
| 39 | + return digits.map((digit) => ALPHABET[digit]).join(""); |
| 40 | +} |
| 41 | + |
| 42 | +function mixState(state: number, value: number): number { |
| 43 | + return Math.imul((state ^ value) >>> 0, 0x01000193) >>> 0; |
| 44 | +} |
| 45 | + |
| 46 | +function nextState(state: number): number { |
| 47 | + let next = state >>> 0; |
| 48 | + next ^= next << 13; |
| 49 | + next ^= next >>> 17; |
| 50 | + next ^= next << 5; |
| 51 | + return next >>> 0; |
| 52 | +} |
| 53 | + |
| 54 | +function createRoundMask(right: number[], salt: string, round: number, length: number): number[] { |
| 55 | + let state = (0x811c9dc5 ^ Math.imul(round + 1, 0x9e3779b1)) >>> 0; |
| 56 | + |
| 57 | + state = mixState(state, right.length); |
| 58 | + state = mixState(state, length); |
| 59 | + for (const character of salt) { |
| 60 | + state = mixState(state, (ALPHABET_INDEX.get(character) ?? -1) + 1); |
| 61 | + } |
| 62 | + for (const digit of right) { |
| 63 | + state = mixState(state, digit + 1); |
| 64 | + } |
| 65 | + |
| 66 | + state ^= state >>> 16; |
| 67 | + state = Math.imul(state, 0x85ebca6b) >>> 0; |
| 68 | + state ^= state >>> 13; |
| 69 | + state = Math.imul(state, 0xc2b2ae35) >>> 0; |
| 70 | + state ^= state >>> 16; |
| 71 | + state = state >>> 0 || 0x6d2b79f5; |
| 72 | + |
| 73 | + const mask: number[] = []; |
| 74 | + for (let index = 0; index < length; index += 1) { |
| 75 | + state = (state + Math.imul(index + 1, 0x9e3779b1)) >>> 0; |
| 76 | + state = nextState(state); |
| 77 | + mask.push(state % ALPHABET_SIZE); |
| 78 | + } |
| 79 | + return mask; |
| 80 | +} |
| 81 | + |
| 82 | +function deobfuscatePayload(payload: string, salt: string): string { |
| 83 | + const digits = toDigits(payload); |
| 84 | + const midpoint = Math.floor(digits.length / 2); |
| 85 | + let left = digits.slice(0, midpoint); |
| 86 | + let right = digits.slice(midpoint); |
| 87 | + |
| 88 | + for (let round = FEISTEL_ROUNDS - 1; round >= 0; round -= 1) { |
| 89 | + const previousRight = left; |
| 90 | + const mask = createRoundMask(previousRight, salt, round, right.length); |
| 91 | + const previousLeft = right.map( |
| 92 | + (digit, index) => (digit - mask[index] + ALPHABET_SIZE) % ALPHABET_SIZE, |
| 93 | + ); |
| 94 | + left = previousLeft; |
| 95 | + right = previousRight; |
| 96 | + } |
| 97 | + |
| 98 | + return fromDigits([...left, ...right]); |
| 99 | +} |
| 100 | + |
| 101 | +function crc32(value: string): number { |
| 102 | + let checksum = 0xffffffff; |
| 103 | + for (let index = 0; index < value.length; index += 1) { |
| 104 | + checksum ^= value.charCodeAt(index); |
| 105 | + for (let bit = 0; bit < 8; bit += 1) { |
| 106 | + const mask = -(checksum & 1); |
| 107 | + checksum = (checksum >>> 1) ^ (0xedb88320 & mask); |
| 108 | + } |
| 109 | + } |
| 110 | + return (checksum ^ 0xffffffff) >>> 0; |
| 111 | +} |
| 112 | + |
| 113 | +function encodeBase65Number(value: number, length: number): string { |
| 114 | + let remaining = value >>> 0; |
| 115 | + const encoded = Array<string>(length).fill(ALPHABET[0]); |
| 116 | + |
| 117 | + for (let index = length - 1; index >= 0; index -= 1) { |
| 118 | + encoded[index] = ALPHABET[remaining % ALPHABET_SIZE]; |
| 119 | + remaining = Math.floor(remaining / ALPHABET_SIZE); |
| 120 | + } |
| 121 | + if (remaining !== 0) throw invalidCredential(); |
| 122 | + return encoded.join(""); |
| 123 | +} |
| 124 | + |
| 125 | +function validateSalt(salt: string): void { |
| 126 | + if (salt.length !== SALT_LENGTH || !KEY_PATTERN.test(salt)) { |
| 127 | + throw invalidCredential(); |
| 128 | + } |
| 129 | +} |
| 130 | + |
| 131 | +/** Decode an "o1_…" obfuscated token back into the plain API key. */ |
| 132 | +export function decodeTokenPlanKey(token: string): string { |
| 133 | + const minimumLength = TOKEN_PREFIX.length + SALT_LENGTH + CHECKSUM_LENGTH + 1; |
| 134 | + if (token.length < minimumLength || !token.startsWith(TOKEN_PREFIX)) { |
| 135 | + throw invalidCredential(); |
| 136 | + } |
| 137 | + |
| 138 | + const body = token.slice(TOKEN_PREFIX.length); |
| 139 | + if (!KEY_PATTERN.test(body)) throw invalidCredential(); |
| 140 | + |
| 141 | + const salt = body.slice(0, SALT_LENGTH); |
| 142 | + const payload = body.slice(SALT_LENGTH, -CHECKSUM_LENGTH); |
| 143 | + const checksum = body.slice(-CHECKSUM_LENGTH); |
| 144 | + validateSalt(salt); |
| 145 | + if (!payload) throw invalidCredential(); |
| 146 | + |
| 147 | + const apiKey = deobfuscatePayload(payload, salt); |
| 148 | + if (!KEY_PATTERN.test(apiKey)) throw invalidCredential(); |
| 149 | + |
| 150 | + const expectedChecksum = encodeBase65Number(crc32(apiKey), CHECKSUM_LENGTH); |
| 151 | + if (checksum !== expectedChecksum) throw invalidCredential(); |
| 152 | + return apiKey; |
| 153 | +} |
0 commit comments