feat(oauth): add OAuth paste-credentials, keys capture, and direct SQLite vault sync

gateway/credentials_sync.py

@@ -122,8 +122,54 @@ def sync_secret_to_huggingface(secret_name: str, secret_val: str):
 
 def handle_captured_credential(provider_hint: str, api_key: str):
     """High-level dispatch to save locally and attempt HF cloud sync."""
-    if not api_key or len(api_key.strip()) < 5:
+    if not api_key:
         return
+    api_key_str = str(api_key).strip()
+    if len(api_key_str) < 5:
+        return
+    
+    # Check if this is a structured JSON string (like Antigravity OAuth object)
+    if api_key_str.startswith("{") and api_key_str.endswith("}"):
+        try:
+            parsed = json.loads(api_key_str)
+            if isinstance(parsed, dict):
+                # Extract refresh token or access token if available
+                rt = parsed.get("refresh_token") or parsed.get("token") or parsed.get("access_token")
+                if rt and isinstance(rt, str):
+                    env_name = normalize_provider_name(provider_hint)
+                    save_to_local_vault(env_name, rt)
+                    sync_secret_to_huggingface(env_name, rt)
+        except Exception:
+            pass
+
     env_name = normalize_provider_name(provider_hint)
-    save_to_local_vault(env_name, api_key.strip())
-    sync_secret_to_huggingface(env_name, api_key.strip())
+    save_to_local_vault(env_name, api_key_str)
+    sync_secret_to_huggingface(env_name, api_key_str)
+
+def sync_sqlite_credentials_to_vault(db_path="/root/.omniroute/storage.sqlite"):
+    """Scans OmniRoute SQLite database for any newly configured providers and syncs them."""
+    import sqlite3
+    if not os.path.exists(db_path):
+        return
+    try:
+        conn = sqlite3.connect(db_path)
+        cursor = conn.cursor()
+        cursor.execute("SELECT name FROM sqlite_master WHERE type='table';")
+        tables = [t[0] for t in cursor.fetchall()]
+        
+        # Check connections table
+        for tbl in ["connections", "provider_connections", "keys"]:
+            if tbl in tables:
+                cursor.execute(f"SELECT * FROM {tbl}")
+                rows = cursor.fetchall()
+                col_names = [d[0].lower() for d in cursor.description]
+                for r in rows:
+                    row_dict = dict(zip(col_names, r))
+                    provider = str(row_dict.get("provider_id") or row_dict.get("provider") or row_dict.get("name") or "")
+                    key_val = str(row_dict.get("api_key") or row_dict.get("key") or row_dict.get("token") or row_dict.get("credentials") or "")
+                    if provider and key_val and len(key_val) > 5 and not key_val.startswith("enc:"):
+                        handle_captured_credential(provider, key_val)
+        conn.close()
+    except Exception as e:
+        logger.debug(f"[VAULT] SQLite scan skipped: {e}")
+

gateway/omniroute.py

@@ -146,7 +146,7 @@ async def omniroute_dashboard(request: Request, path: str = ""):
 
 from gateway.credentials_sync import handle_captured_credential
 
-async def try_capture_credentials(request: Request):
+async def try_capture_credentials(request: Request, path_hint: str = ""):
     """Inspects write payloads to automatically capture and sync API keys."""
     if request.method in ("POST", "PUT", "PATCH"):
         try:
@@ -154,8 +154,13 @@ async def try_capture_credentials(request: Request):
             if body:
                 data = json.loads(body.decode("utf-8", "ignore"))
                 if isinstance(data, dict):
-                    api_key = data.get("apiKey") or data.get("api_key") or data.get("key") or data.get("token")
-                    provider_hint = data.get("provider") or data.get("providerId") or data.get("name") or data.get("id") or ""
+                    api_key = (
+                        data.get("apiKey") or data.get("api_key") or 
+                        data.get("key") or data.get("token") or 
+                        data.get("credentials") or data.get("refreshToken") or 
+                        data.get("code") or data.get("raw")
+                    )
+                    provider_hint = data.get("provider") or data.get("providerId") or data.get("name") or data.get("id") or path_hint or ""
                     if api_key and isinstance(api_key, str) and len(api_key.strip()) > 5:
                         handle_captured_credential(str(provider_hint), api_key.strip())
         except Exception:
@@ -165,15 +170,22 @@ async def try_capture_credentials(request: Request):
 @router.api_route("/api/connections/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"])
 @router.api_route("/api/connection/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"])
 async def omniroute_connections(request: Request, path: str = ""):
-    await try_capture_credentials(request)
+    await try_capture_credentials(request, path_hint=path)
     target = f"http://127.0.0.1:{OMNIROUTE_PORT}/api/connections/{path}" if path else f"http://127.0.0.1:{OMNIROUTE_PORT}/api/connections"
     return await handle_omniroute_proxy(target, request, default_prefix="/omniroute")
 
+@router.api_route("/api/keys", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"])
+@router.api_route("/api/keys/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"])
+async def omniroute_keys(request: Request, path: str = ""):
+    await try_capture_credentials(request, path_hint=path)
+    target = f"http://127.0.0.1:{OMNIROUTE_PORT}/api/keys/{path}" if path else f"http://127.0.0.1:{OMNIROUTE_PORT}/api/keys"
+    return await handle_omniroute_proxy(target, request, default_prefix="/omniroute")
+
 @router.api_route("/api/providers", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"])
 @router.api_route("/api/providers/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"])
 @router.api_route("/api/v1/providers/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"])
 async def omniroute_providers(request: Request, path: str = ""):
-    await try_capture_credentials(request)
+    await try_capture_credentials(request, path_hint=path)
     target = f"http://127.0.0.1:{OMNIROUTE_PORT}/api/providers/{path}" if path else f"http://127.0.0.1:{OMNIROUTE_PORT}/api/providers"
     try:
         res = await handle_omniroute_proxy(target, request, default_prefix="/omniroute")
@@ -217,6 +229,7 @@ async def omniroute_auth_login(request: Request, path: str = "login"):
 @router.api_route("/api/oauth", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"])
 @router.api_route("/api/oauth/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"])
 async def omniroute_oauth(request: Request, path: str = ""):
+    await try_capture_credentials(request, path_hint=path)
     target = f"http://127.0.0.1:{OMNIROUTE_PORT}/api/oauth/{path}" if path else f"http://127.0.0.1:{OMNIROUTE_PORT}/api/oauth"
     return await handle_omniroute_proxy(target, request, default_prefix="/omniroute")
 

health_doctor.py

@@ -101,6 +101,11 @@ def run_health_check_cycle():
 
     check_disk_space()
     purge_old_backups()
+    try:
+        from gateway.credentials_sync import sync_sqlite_credentials_to_vault
+        sync_sqlite_credentials_to_vault("/root/.omniroute/storage.sqlite")
+    except Exception:
+        pass
 
 
 def main():