feat: [AI-7520] exchange the login_token server-side (no api_key in loopback URL)

saravmajestic · claude · saravmajestic · commit 7e7ac7c6084e · 2026-07-16T13:46:25.000+05:30
The loopback now receives a short-lived `token` (login_token) instead of the raw
key; callback() exchanges it via POST /auth/social/exchange (AltimateApi.
exchangeSocialToken) for the auth_token and saves that. Single code path for both
the Google and email/password connect flows. State validation, loopback bind,
HTML escaping, and the pending-Map/one-time-server logic are unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/packages/opencode/src/altimate/api/client.ts b/packages/opencode/src/altimate/api/client.ts
@@ -196,6 +196,35 @@ export namespace AltimateApi {
     }
   }
 
+  /**
+   * Exchange a short-lived social `login_token` for the user's gateway
+   * `auth_token` via POST {altimateUrl}/auth/social/exchange. The token is
+   * one-time and short-lived, which keeps the raw api_key out of the loopback
+   * callback URL. Throws on a non-ok response or a missing `auth_token`.
+   */
+  export async function exchangeSocialToken(altimateUrl: string, instance: string, token: string): Promise<string> {
+    const url = `${altimateUrl.replace(/\/+$/, "")}/auth/social/exchange`
+    // upstream_fix parity: bound the request so a network stall can't hang the callback.
+    const controller = new AbortController()
+    const timeout = setTimeout(() => controller.abort(), 15_000)
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "x-tenant": instance,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({ token }),
+      signal: controller.signal,
+    }).finally(() => clearTimeout(timeout))
+    if (!res.ok) {
+      const body = await res.text().catch(() => "")
+      throw new Error(`Social token exchange failed (${res.status} ${res.statusText}) ${body}`)
+    }
+    const data = (await res.json()) as { auth_token?: string }
+    if (!data.auth_token) throw new Error("Social token exchange did not return an auth_token")
+    return data.auth_token
+  }
+
   async function request(creds: AltimateCredentials, method: string, endpoint: string, body?: unknown) {
     const url = `${creds.altimateUrl}${endpoint}`
     const res = await fetch(url, {
diff --git a/packages/opencode/src/altimate/plugin/altimate.ts b/packages/opencode/src/altimate/plugin/altimate.ts
@@ -36,7 +36,9 @@ const HTML_ERROR = (msg: string) => `<!doctype html><meta charset="utf-8"><title
 interface CallbackResult {
   api_url: string
   instance: string
-  api_key: string
+  // Short-lived, one-time login_token delivered by the browser. Exchanged for
+  // the gateway auth_token in callback() — the raw api_key never rides in the URL.
+  token: string
 }
 
 interface Pending {
@@ -83,17 +85,17 @@ async function startCallbackServer(): Promise<void> {
       return
     }
 
-    const apiKey = url.searchParams.get("key")
+    const token = url.searchParams.get("token")
     const instance = url.searchParams.get("instance")
     const apiUrl = url.searchParams.get("url") || DEFAULT_API_URL
-    if (!apiKey || !instance) {
+    if (!token || !instance) {
       const msg = "Missing credential in callback"
       entry.reject(new Error(msg))
       html(400, HTML_ERROR(msg))
       return
     }
 
-    entry.resolve({ api_url: apiUrl, instance, api_key: apiKey })
+    entry.resolve({ api_url: apiUrl, instance, token })
     html(200, HTML_SUCCESS)
   })
 
@@ -183,15 +185,18 @@ export async function AltimateAuthPlugin(_input: PluginInput): Promise<Hooks> {
                   if (!AltimateApi.isValidInstanceName(creds.instance)) {
                     throw new Error(`invalid instance name from callback: ${creds.instance}`)
                   }
+                  // Exchange the short-lived, one-time login_token for the gateway
+                  // auth_token server-side — the raw api_key never rides in the URL.
+                  const authToken = await AltimateApi.exchangeSocialToken(creds.api_url, creds.instance, creds.token)
                   // Persist to ~/.altimate/altimate.json — the provider loader
                   // reads this first (it carries the instance/tenant + api_url
                   // the generic auth.json store can't).
                   await AltimateApi.saveCredentials({
                     altimateUrl: creds.api_url,
                     altimateInstanceName: creds.instance,
-                    altimateApiKey: creds.api_key,
+                    altimateApiKey: authToken,
                   })
-                  return { type: "success", key: creds.api_key, provider: "altimate-backend" }
+                  return { type: "success", key: authToken, provider: "altimate-backend" }
                 } catch (err) {
                   // Log the reason (CSRF / timeout / invalid instance / …). Runs in the
                   // server process, so this goes to the log, not the TUI display.
