johannSoCodeyPublic

claudecode: parse Claude Code's credential store

Timestamps are epoch milliseconds; reading them as seconds puts expiry
55,000 years out and the token never looks stale. A missing file means
not logged in and falls through; a file that will not parse names its
path, because that is a broken install rather than an absent one.

Browse Files

Jjonicommitted 4 weeks ago1 parent 806ec13commitfdda42b

Showing 2 changed files with 217 additions and 0 deletions.

+93−0internal/claudecode/claudecode.goaddedView File

++ // Package claudecode reads the OAuth credential Claude Code stores on disk, so
++ // a harness run can borrow a login that already exists.
++ //
++ // This is Claude Code's private storage, not a documented interface: the
++ // schema can change without notice. Everything that knows its shape lives
++ // here, and parses strictly, so a change surfaces as a clear error rather than
++ // as a puzzling 401 somewhere else.
++ package claudecode
++ import (
++ 	"encoding/json"
++ 	"errors"
++ 	"fmt"
++ 	"os"
++ 	"path/filepath"
++ 	"time"
++ )
++ // Filename is the credential store, relative to the home directory.
++ const Filename = ".claude/.credentials.json"
++ // skew is how long before its stated expiry a token starts counting as
++ // expired. A token with seconds left would expire during the request we are
++ // about to send.
++ const skew = 60 * time.Second
++ // ErrNotFound means there is no credentials file: not logged in, rather than
++ // broken. Callers fall through to whatever source is next.
++ var ErrNotFound = errors.New("claudecode: no credentials file")
++ // Credentials is the claudeAiOauth object, with its millisecond timestamps
++ // converted to something Go can compare.
++ type Credentials struct {
++ 	AccessToken      string
++ 	RefreshToken     string
++ 	ExpiresAt        time.Time
++ 	RefreshExpiresAt time.Time
++ 	Scopes           []string
++ 	SubscriptionType string
++ }
++ // stored mirrors the on-disk JSON. Timestamps are epoch milliseconds.
++ type stored struct {
++ 	ClaudeAIOAuth struct {
++ 		AccessToken           string   `json:"accessToken"`
++ 		RefreshToken          string   `json:"refreshToken"`
++ 		ExpiresAt             int64    `json:"expiresAt"`
++ 		RefreshTokenExpiresAt int64    `json:"refreshTokenExpiresAt"`
++ 		Scopes                []string `json:"scopes"`
++ 		SubscriptionType      string   `json:"subscriptionType"`
++ 	} `json:"claudeAiOauth"`
++ }
++ // Load reads and parses the credential store. home is passed in rather than
++ // looked up so tests can point it at a fixture, matching skills.Discover.
++ func Load(home string) (*Credentials, error) {
++ 	path := filepath.Join(home, Filename)
++ 	raw, err := os.ReadFile(path)
++ 	if errors.Is(err, os.ErrNotExist) {
++ 		return nil, ErrNotFound
++ 	}
++ 	if err != nil {
++ 		return nil, fmt.Errorf("claudecode: reading %s: %w", path, err)
++ 	}
++ 	var s stored
++ 	if err := json.Unmarshal(raw, &s); err != nil {
++ 		return nil, fmt.Errorf("claudecode: parsing %s: %w", path, err)
++ 	}
++ 	o := s.ClaudeAIOAuth
++ 	if o.AccessToken == "" {
++ 		return nil, fmt.Errorf("claudecode: %s has no access token", path)
++ 	}
++ 	return &Credentials{
++ 		AccessToken:      o.AccessToken,
++ 		RefreshToken:     o.RefreshToken,
++ 		ExpiresAt:        time.UnixMilli(o.ExpiresAt),
++ 		RefreshExpiresAt: time.UnixMilli(o.RefreshTokenExpiresAt),
++ 		Scopes:           o.Scopes,
++ 		SubscriptionType: o.SubscriptionType,
++ 	}, nil
++ }
++ // Expired reports whether the access token is past its expiry, or close enough
++ // that it would lapse mid-request.
++ func (c *Credentials) Expired(now time.Time) bool {
++ 	return !now.Before(c.ExpiresAt.Add(-skew))
++ }
++ // RefreshExpired reports whether the refresh token is past its expiry. That is
++ // terminal: no amount of refreshing fixes it, only logging in again.
++ func (c *Credentials) RefreshExpired(now time.Time) bool {
++ 	return !now.Before(c.RefreshExpiresAt)
++ }

+124−0internal/claudecode/claudecode_test.goaddedView File

++ package claudecode
++ import (
++ 	"errors"
++ 	"os"
++ 	"path/filepath"
++ 	"strings"
++ 	"testing"
++ 	"time"
++ )
++ // write builds a fake home directory holding one credentials file.
++ func write(t *testing.T, body string) string {
++ 	t.Helper()
++ 	home := t.TempDir()
++ 	dir := filepath.Join(home, ".claude")
++ 	if err := os.MkdirAll(dir, 0o700); err != nil {
++ 		t.Fatal(err)
++ 	}
++ 	if err := os.WriteFile(filepath.Join(dir, ".credentials.json"), []byte(body), 0o600); err != nil {
++ 		t.Fatal(err)
++ 	}
++ 	return home
++ }
++ const sample = `{"claudeAiOauth":{
++   "accessToken":"sk-ant-oat01-access",
++   "refreshToken":"sk-ant-ort01-refresh",
++   "expiresAt":1789668269460,
++   "refreshTokenExpiresAt":1791404074460,
++   "scopes":["user:inference","user:profile"],
++   "subscriptionType":"team"}}`
++ func TestLoadReadsEveryField(t *testing.T) {
++ 	c, err := Load(write(t, sample))
++ 	if err != nil {
++ 		t.Fatalf("Load: %v", err)
++ 	}
++ 	if c.AccessToken != "sk-ant-oat01-access" {
++ 		t.Errorf("AccessToken = %q", c.AccessToken)
++ 	}
++ 	if c.RefreshToken != "sk-ant-ort01-refresh" {
++ 		t.Errorf("RefreshToken = %q", c.RefreshToken)
++ 	}
++ 	if c.SubscriptionType != "team" {
++ 		t.Errorf("SubscriptionType = %q", c.SubscriptionType)
++ 	}
++ 	if len(c.Scopes) != 2 || c.Scopes[0] != "user:inference" {
++ 		t.Errorf("Scopes = %v", c.Scopes)
++ 	}
++ }
++ // The file stores epoch milliseconds. Reading them as seconds puts expiry
++ // 55,000 years out and the token never looks stale.
++ func TestLoadTreatsTimestampsAsMilliseconds(t *testing.T) {
++ 	c, err := Load(write(t, sample))
++ 	if err != nil {
++ 		t.Fatalf("Load: %v", err)
++ 	}
++ 	want := time.UnixMilli(1789668269460)
++ 	if !c.ExpiresAt.Equal(want) {
++ 		t.Errorf("ExpiresAt = %s, want %s", c.ExpiresAt, want)
++ 	}
++ 	if want := time.UnixMilli(1791404074460); !c.RefreshExpiresAt.Equal(want) {
++ 		t.Errorf("RefreshExpiresAt = %s, want %s", c.RefreshExpiresAt, want)
++ 	}
++ }
++ // Not logged in is not a failure. It is a fall-through to the next source.
++ func TestLoadMissingFileIsErrNotFound(t *testing.T) {
++ 	_, err := Load(t.TempDir())
++ 	if !errors.Is(err, ErrNotFound) {
++ 		t.Fatalf("err = %v, want ErrNotFound", err)
++ 	}
++ }
++ // A file that exists but does not parse is a broken install, and saying so
++ // with the path beats falling through to "no credentials".
++ func TestLoadMalformedJSONNamesThePath(t *testing.T) {
++ 	home := write(t, "{not json")
++ 	_, err := Load(home)
++ 	if err == nil || errors.Is(err, ErrNotFound) {
++ 		t.Fatalf("err = %v, want a parse error", err)
++ 	}
++ 	if !strings.Contains(err.Error(), ".credentials.json") {
++ 		t.Errorf("error should name the file, got %q", err)
++ 	}
++ }
++ // An empty access token is a file we cannot use, and it fails at parse time
++ // rather than as a puzzling 401 later.
++ func TestLoadEmptyAccessTokenIsAnError(t *testing.T) {
++ 	_, err := Load(write(t, `{"claudeAiOauth":{"accessToken":""}}`))
++ 	if err == nil || errors.Is(err, ErrNotFound) {
++ 		t.Fatalf("err = %v, want an error about the missing token", err)
++ 	}
++ }
++ func TestExpiredUsesASkewMargin(t *testing.T) {
++ 	base := time.Unix(1_700_000_000, 0)
++ 	c := &Credentials{ExpiresAt: base}
++ 	if c.Expired(base.Add(-5 * time.Minute)) {
++ 		t.Error("a token with five minutes left is not expired")
++ 	}
++ 	// Inside the skew margin: it would expire during the request we are about
++ 	// to send, so it counts as expired now.
++ 	if !c.Expired(base.Add(-30 * time.Second)) {
++ 		t.Error("a token expiring in 30s should count as expired")
++ 	}
++ 	if !c.Expired(base.Add(time.Minute)) {
++ 		t.Error("a token past its expiry is expired")
++ 	}
++ }
++ func TestRefreshExpiredIsTerminal(t *testing.T) {
++ 	base := time.Unix(1_700_000_000, 0)
++ 	c := &Credentials{RefreshExpiresAt: base}
++ 	if c.RefreshExpired(base.Add(-24 * time.Hour)) {
++ 		t.Error("a refresh token with a day left is not expired")
++ 	}
++ 	if !c.RefreshExpired(base.Add(time.Hour)) {
++ 		t.Error("a refresh token past its expiry is expired")
++ 	}
++ }