openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-26 18:38:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

core: support dynamic auth tokens for model providers

Browse Source
This commit is contained in:
Michael Bolin
2026-03-30 14:02:34 -07:00
parent d4cf2faae8
commit 056d9e482b
20 changed files with 936 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/config.schema.json
+44
View File
@@ -816,10 +816,54 @@
},
"type": "object"
},
"ModelProviderAuthInfo": {
"additionalProperties": false,
"description": "Configuration for obtaining a provider bearer token from a command.",
"properties": {
"args": {
"default": [],
"description": "Command arguments.",
"items": {
"type": "string"
},
"type": "array"
},
"command": {
"description": "Command to execute. Bare names are resolved via `PATH`; paths are resolved against `cwd`.",
"type": "string"
},
"refresh_interval_ms": {
"default": 300000,
"description": "Maximum age for the cached token before rerunning the command.",
"format": "uint64",
"minimum": 1.0,
"type": "integer"
},
"timeout_ms": {
"default": 5000,
"description": "Maximum time to wait for the token command to exit successfully.",
"format": "uint64",
"minimum": 1.0,
"type": "integer"
}
},
"required": [
"command"
],
"type": "object"
},
"ModelProviderInfo": {
"additionalProperties": false,
"description": "Serializable representation of a provider definition.",
"properties": {
"auth": {
"allOf": [
{
"$ref": "#/definitions/ModelProviderAuthInfo"
}
],
"description": "Command-backed bearer-token configuration for this provider."
},
"base_url": {
"description": "Base URL for the provider's OpenAI-compatible API.",
"type": "string"
codex-rs/core/src/api_bridge.rs
+13 -8
View File
@@ -164,18 +164,23 @@ fn extract_x_error_json_code(headers: Option<&HeaderMap>) -> Option<String> {
.map(str::to_string)
}
pub(crate) fn auth_provider_from_auth(
auth: Option<CodexAuth>,
pub(crate) fn provider_bearer_token(
provider: &ModelProviderInfo,
) -> crate::error::Result<CoreAuthProvider> {
resolved_provider_token: Option<String>,
) -> crate::error::Result<Option<String>> {
if let Some(api_key) = provider.api_key()? {
return Ok(CoreAuthProvider {
token: Some(api_key),
account_id: None,
});
return Ok(Some(api_key));
}
if let Some(token) = provider.experimental_bearer_token.clone() {
Ok(resolved_provider_token.or_else(|| provider.experimental_bearer_token.clone()))
}
pub(crate) fn auth_provider_from_resolved_provider_token(
auth: Option<CodexAuth>,
provider: &ModelProviderInfo,
resolved_provider_token: Option<String>,
) -> crate::error::Result<CoreAuthProvider> {
if let Some(token) = provider_bearer_token(provider, resolved_provider_token)? {
return Ok(CoreAuthProvider {
token: Some(token),
account_id: None,
codex-rs/core/src/auth_env_telemetry.rs
+1
View File
@@ -64,6 +64,7 @@ mod tests {
env_key: Some("sk-should-not-leak".to_string()),
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api: crate::model_provider_info::WireApi::Responses,
query_params: None,
http_headers: None,
codex-rs/core/src/client.rs
+47 -5
View File
@@ -102,6 +102,7 @@ use crate::error::Result;
use crate::flags::CODEX_RS_SSE_FIXTURE;
use crate::model_provider_info::ModelProviderInfo;
use crate::model_provider_info::WireApi;
use crate::provider_auth::ProviderAuthResolver;
use crate::request_auth::RequestUnauthorizedRecovery;
use crate::request_auth::ResolvedRequestAuth;
use crate::request_auth::UnauthorizedRecoveryError;
@@ -138,6 +139,7 @@ struct ModelClientState {
auth_manager: Option<Arc<AuthManager>>,
conversation_id: ThreadId,
provider: ModelProviderInfo,
provider_auth: ProviderAuthResolver,
auth_env_telemetry: AuthEnvTelemetry,
session_source: SessionSource,
model_verbosity: Option<VerbosityConfig>,
@@ -263,6 +265,7 @@ impl ModelClient {
state: Arc::new(ModelClientState {
auth_manager,
conversation_id,
provider_auth: ProviderAuthResolver::new(&provider),
provider,
auth_env_telemetry,
session_source,
@@ -326,6 +329,10 @@ impl ModelClient {
activated
}
pub(crate) async fn resolve_provider_bearer_token(&self) -> Result<Option<String>> {
self.state.provider_auth.resolve_token().await
}
/// Compacts the current conversation history using the Compact endpoint.
///
/// This is a unary call (no streaming) that returns a new list of
@@ -518,7 +525,12 @@ impl ModelClient {
/// This centralizes setup used by both prewarm and normal request paths so they stay in
/// lockstep when auth/provider resolution changes.
async fn current_client_setup(&self) -> Result<ResolvedRequestAuth> {
resolve_request_auth(self.state.auth_manager.as_ref(), &self.state.provider).await
resolve_request_auth(
self.state.auth_manager.as_ref(),
&self.state.provider,
&self.state.provider_auth,
)
.await
}
/// Opens a websocket connection using the same header and telemetry wiring as normal turns.
@@ -997,8 +1009,10 @@ impl ModelClientSession {
return Ok(stream);
}
let mut unauthorized_recovery =
RequestUnauthorizedRecovery::new(self.client.state.auth_manager.as_ref());
let mut unauthorized_recovery = RequestUnauthorizedRecovery::new(
self.client.state.auth_manager.as_ref(),
&self.client.state.provider_auth,
);
let mut pending_retry = PendingUnauthorizedRetry::default();
// Only loop after a successful auth-recovery step. Each retry must rebuild
// the client and request headers before issuing the same streaming request again.
@@ -1085,8 +1099,10 @@ impl ModelClientSession {
warmup: bool,
request_trace: Option<W3cTraceContext>,
) -> Result<WebsocketStreamOutcome> {
let mut unauthorized_recovery =
RequestUnauthorizedRecovery::new(self.client.state.auth_manager.as_ref());
let mut unauthorized_recovery = RequestUnauthorizedRecovery::new(
self.client.state.auth_manager.as_ref(),
&self.client.state.provider_auth,
);
let mut pending_retry = PendingUnauthorizedRetry::default();
// Only loop after a successful auth-recovery step. WebSocket auth is attached
// during connect, so a recovered token requires a fresh connection attempt.
@@ -1148,6 +1164,9 @@ impl ModelClientSession {
session_telemetry,
)
.await?;
if recovery.mode == "provider_exec" {
self.reset_websocket_session();
}
pending_retry = PendingUnauthorizedRetry::from_recovery(recovery);
continue;
}
@@ -1628,6 +1647,29 @@ async fn handle_unauthorized(
Err(CodexErr::Io(other))
}
},
Err(UnauthorizedRecoveryError::Provider { execution, error }) => {
session_telemetry.record_auth_recovery(
execution.mode,
execution.phase,
"recovery_failed_permanent",
debug.request_id.as_deref(),
debug.cf_ray.as_deref(),
debug.auth_error.as_deref(),
debug.auth_error_code.as_deref(),
/*recovery_reason*/ None,
/*auth_state_changed*/ None,
);
emit_feedback_auth_recovery_tags(
execution.mode,
execution.phase,
"recovery_failed_permanent",
debug.request_id.as_deref(),
debug.cf_ray.as_deref(),
debug.auth_error.as_deref(),
debug.auth_error_code.as_deref(),
);
Err(error)
}
}
}
codex-rs/core/src/config/config_tests.rs
+21
View File
@@ -243,6 +243,26 @@ web_search = false
);
}
#[test]
fn rejects_provider_auth_with_env_key() {
let err = toml::from_str::<ConfigToml>(
r#"
[model_providers.corp]
name = "Corp"
env_key = "CORP_TOKEN"
[model_providers.corp.auth]
command = "print-token"
"#,
)
.unwrap_err();
assert!(
err.to_string()
.contains("model_providers.corp: provider auth cannot be combined with env_key")
);
}
#[test]
fn config_toml_deserializes_model_availability_nux() {
let toml = r#"
@@ -4315,6 +4335,7 @@ model_verbosity = "high"
wire_api: crate::WireApi::Responses,
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
query_params: None,
http_headers: None,
env_http_headers: None,
codex-rs/core/src/config/mod.rs
+14 -2
View File
@@ -1837,6 +1837,18 @@ Built-in providers cannot be overridden. Rename your custom provider (for exampl
}
}
fn validate_model_providers(
model_providers: &HashMap<String, ModelProviderInfo>,
) -> Result<(), String> {
validate_reserved_model_provider_ids(model_providers)?;
for (key, provider) in model_providers {
provider
.validate()
.map_err(|message| format!("model_providers.{key}: {message}"))?;
}
Ok(())
}
fn deserialize_model_providers<'de, D>(
deserializer: D,
) -> Result<HashMap<String, ModelProviderInfo>, D::Error>
@@ -1844,7 +1856,7 @@ where
D: serde::Deserializer<'de>,
{
let model_providers = HashMap::<String, ModelProviderInfo>::deserialize(deserializer)?;
validate_reserved_model_provider_ids(&model_providers).map_err(serde::de::Error::custom)?;
validate_model_providers(&model_providers).map_err(serde::de::Error::custom)?;
Ok(model_providers)
}
@@ -1969,7 +1981,7 @@ impl Config {
codex_home: PathBuf,
config_layer_stack: ConfigLayerStack,
) -> std::io::Result<Self> {
validate_reserved_model_provider_ids(&cfg.model_providers)
validate_model_providers(&cfg.model_providers)
.map_err(|message| std::io::Error::new(std::io::ErrorKind::InvalidInput, message))?;
// Ensure that every field of ConfigRequirements is applied to the final
// Config.
codex-rs/core/src/lib.rs
+2
View File
@@ -52,6 +52,7 @@ pub mod models_manager;
mod network_policy_decision;
pub mod network_proxy_loader;
mod original_image_detail;
mod provider_auth;
mod request_auth;
pub use mcp_connection_manager::MCP_SANDBOX_STATE_CAPABILITY;
pub use mcp_connection_manager::MCP_SANDBOX_STATE_METHOD;
@@ -108,6 +109,7 @@ pub use client::X_RESPONSESAPI_INCLUDE_TIMING_METRICS_HEADER;
pub use model_provider_info::DEFAULT_LMSTUDIO_PORT;
pub use model_provider_info::DEFAULT_OLLAMA_PORT;
pub use model_provider_info::LMSTUDIO_OSS_PROVIDER_ID;
pub use model_provider_info::ModelProviderAuthInfo;
pub use model_provider_info::ModelProviderInfo;
pub use model_provider_info::OLLAMA_OSS_PROVIDER_ID;
pub use model_provider_info::OPENAI_PROVIDER_ID;
codex-rs/core/src/model_provider_info.rs
+111
View File
@@ -9,6 +9,7 @@ use crate::auth::AuthMode;
use crate::error::EnvVarError;
use codex_api::Provider as ApiProvider;
use codex_api::provider::RetryConfig as ApiRetryConfig;
use codex_utils_absolute_path::AbsolutePathBuf;
use http::HeaderMap;
use http::header::HeaderName;
use http::header::HeaderValue;
@@ -17,8 +18,11 @@ use serde::Deserialize;
use serde::Serialize;
use std::collections::HashMap;
use std::fmt;
use std::num::NonZeroU64;
use std::time::Duration;
const DEFAULT_PROVIDER_AUTH_TIMEOUT_MS: u64 = 5_000;
const DEFAULT_PROVIDER_AUTH_REFRESH_INTERVAL_MS: u64 = 300_000;
const DEFAULT_STREAM_IDLE_TIMEOUT_MS: u64 = 300_000;
const DEFAULT_STREAM_MAX_RETRIES: u64 = 5;
const DEFAULT_REQUEST_MAX_RETRIES: u64 = 4;
@@ -66,6 +70,74 @@ impl<'de> Deserialize<'de> for WireApi {
}
}
/// Configuration for obtaining a provider bearer token from a command.
#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, JsonSchema)]
#[schemars(deny_unknown_fields)]
pub struct ModelProviderAuthInfo {
/// Command to execute. Bare names are resolved via `PATH`; paths are resolved against `cwd`.
pub command: String,
/// Command arguments.
#[serde(default)]
pub args: Vec<String>,
/// Maximum time to wait for the token command to exit successfully.
#[serde(default = "default_provider_auth_timeout_ms")]
pub timeout_ms: NonZeroU64,
/// Maximum age for the cached token before rerunning the command.
#[serde(default = "default_provider_auth_refresh_interval_ms")]
pub refresh_interval_ms: NonZeroU64,
/// Working directory used when running the token command.
#[serde(default = "default_provider_auth_cwd")]
#[schemars(skip)]
pub cwd: AbsolutePathBuf,
}
impl ModelProviderAuthInfo {
pub(crate) fn timeout(&self) -> Duration {
Duration::from_millis(self.timeout_ms.get())
}
pub(crate) fn refresh_interval(&self) -> Duration {
Duration::from_millis(self.refresh_interval_ms.get())
}
}
fn default_provider_auth_timeout_ms() -> NonZeroU64 {
non_zero_u64(
DEFAULT_PROVIDER_AUTH_TIMEOUT_MS,
"model_providers.<id>.auth.timeout_ms",
)
}
fn default_provider_auth_refresh_interval_ms() -> NonZeroU64 {
non_zero_u64(
DEFAULT_PROVIDER_AUTH_REFRESH_INTERVAL_MS,
"model_providers.<id>.auth.refresh_interval_ms",
)
}
fn non_zero_u64(value: u64, field_name: &str) -> NonZeroU64 {
match NonZeroU64::new(value) {
Some(value) => value,
None => panic!("{field_name} must be non-zero"),
}
}
fn default_provider_auth_cwd() -> AbsolutePathBuf {
let deserializer = serde::de::value::StrDeserializer::<serde::de::value::Error>::new(".");
if let Ok(cwd) = AbsolutePathBuf::deserialize(deserializer) {
return cwd;
}
match AbsolutePathBuf::current_dir() {
Ok(cwd) => cwd,
Err(err) => panic!("provider auth cwd must resolve: {err}"),
}
}
/// Serializable representation of a provider definition.
#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, JsonSchema)]
#[schemars(deny_unknown_fields)]
@@ -86,6 +158,9 @@ pub struct ModelProviderInfo {
/// this may be necessary when using this programmatically.
pub experimental_bearer_token: Option<String>,
/// Command-backed bearer-token configuration for this provider.
pub auth: Option<ModelProviderAuthInfo>,
/// Which wire protocol this provider expects.
#[serde(default)]
pub wire_api: WireApi,
@@ -130,6 +205,36 @@ pub struct ModelProviderInfo {
}
impl ModelProviderInfo {
pub(crate) fn validate(&self) -> std::result::Result<(), String> {
let Some(auth) = self.auth.as_ref() else {
return Ok(());
};
if auth.command.trim().is_empty() {
return Err("provider auth.command must not be empty".to_string());
}
let mut conflicts = Vec::new();
if self.env_key.is_some() {
conflicts.push("env_key");
}
if self.experimental_bearer_token.is_some() {
conflicts.push("experimental_bearer_token");
}
if self.requires_openai_auth {
conflicts.push("requires_openai_auth");
}
if conflicts.is_empty() {
Ok(())
} else {
Err(format!(
"provider auth cannot be combined with {}",
conflicts.join(", ")
))
}
}
fn build_header_map(&self) -> crate::error::Result<HeaderMap> {
let capacity = self.http_headers.as_ref().map_or(0, HashMap::len)
+ self.env_http_headers.as_ref().map_or(0, HashMap::len);
@@ -246,6 +351,7 @@ impl ModelProviderInfo {
env_key: None,
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: Some(
@@ -277,6 +383,10 @@ impl ModelProviderInfo {
pub fn is_openai(&self) -> bool {
self.name == OPENAI_PROVIDER_NAME
}
pub(crate) fn has_command_auth(&self) -> bool {
self.auth.is_some()
}
}
pub const DEFAULT_LMSTUDIO_PORT: u16 = 1234;
@@ -338,6 +448,7 @@ pub fn create_oss_provider_with_base_url(base_url: &str, wire_api: WireApi) -> M
env_key: None,
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api,
query_params: None,
http_headers: None,
codex-rs/core/src/model_provider_info_tests.rs
+32
View File
@@ -1,5 +1,8 @@
use super::*;
use codex_utils_absolute_path::AbsolutePathBuf;
use codex_utils_absolute_path::AbsolutePathBufGuard;
use pretty_assertions::assert_eq;
use tempfile::tempdir;
#[test]
fn test_deserialize_ollama_model_provider_toml() {
@@ -13,6 +16,7 @@ base_url = "http://localhost:11434/v1"
env_key: None,
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
@@ -43,6 +47,7 @@ query_params = { api-version = "2025-04-01-preview" }
env_key: Some("AZURE_OPENAI_API_KEY".into()),
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api: WireApi::Responses,
query_params: Some(maplit::hashmap! {
"api-version".to_string() => "2025-04-01-preview".to_string(),
@@ -76,6 +81,7 @@ env_http_headers = { "X-Example-Env-Header" = "EXAMPLE_ENV_VAR" }
env_key: Some("API_KEY".into()),
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: Some(maplit::hashmap! {
@@ -121,3 +127,29 @@ supports_websockets = true
let provider: ModelProviderInfo = toml::from_str(provider_toml).unwrap();
assert_eq!(provider.websocket_connect_timeout_ms, Some(15_000));
}
#[test]
fn test_deserialize_provider_auth_config_defaults() {
let base_dir = tempdir().unwrap();
let provider_toml = r#"
name = "Corp"
[auth]
command = "./scripts/print-token"
args = ["--format=text"]
"#;
let _guard = AbsolutePathBufGuard::new(base_dir.path());
let provider: ModelProviderInfo = toml::from_str(provider_toml).unwrap();
assert_eq!(
provider.auth,
Some(ModelProviderAuthInfo {
command: "./scripts/print-token".to_string(),
args: vec!["--format=text".to_string()],
timeout_ms: default_provider_auth_timeout_ms(),
refresh_interval_ms: default_provider_auth_refresh_interval_ms(),
cwd: AbsolutePathBuf::resolve_path_against_base(".", base_dir.path()).unwrap(),
})
);
}
codex-rs/core/src/models_manager/manager.rs
+14 -4
View File
@@ -12,6 +12,7 @@ use crate::model_provider_info::ModelProviderInfo;
use crate::models_manager::collaboration_mode_presets::CollaborationModesConfig;
use crate::models_manager::collaboration_mode_presets::builtin_collaboration_mode_presets;
use crate::models_manager::model_info;
use crate::provider_auth::ProviderAuthResolver;
use crate::request_auth::RequestUnauthorizedRecovery;
use crate::request_auth::UnauthorizedRecoveryOutcome;
use crate::request_auth::resolve_request_auth;
@@ -183,6 +184,7 @@ pub struct ModelsManager {
etag: RwLock<Option<String>>,
cache_manager: ModelsCacheManager,
provider: ModelProviderInfo,
provider_auth: ProviderAuthResolver,
}
impl ModelsManager {
@@ -234,6 +236,7 @@ impl ModelsManager {
auth_manager,
etag: RwLock::new(None),
cache_manager,
provider_auth: ProviderAuthResolver::new(&provider),
provider,
}
}
@@ -398,7 +401,9 @@ impl ModelsManager {
return Ok(());
}
if self.auth_manager.auth_mode() != Some(AuthMode::Chatgpt) {
if self.auth_manager.auth_mode() != Some(AuthMode::Chatgpt)
&& !self.provider.has_command_auth()
{
if matches!(
refresh_strategy,
RefreshStrategy::Offline | RefreshStrategy::OnlineIfUncached
@@ -438,13 +443,18 @@ impl ModelsManager {
self.auth_manager.codex_api_key_env_enabled(),
);
let client_version = crate::models_manager::client_version_to_whole();
let mut unauthorized_recovery = RequestUnauthorizedRecovery::new(Some(&self.auth_manager));
let mut unauthorized_recovery =
RequestUnauthorizedRecovery::new(Some(&self.auth_manager), &self.provider_auth);
// Only loop after a successful auth-recovery step so `/models` retries with
// the same freshly resolved auth state as normal request paths.
loop {
let request_auth =
resolve_request_auth(Some(&self.auth_manager), &self.provider).await?;
let request_auth = resolve_request_auth(
Some(&self.auth_manager),
&self.provider,
&self.provider_auth,
)
.await?;
let transport = ReqwestTransport::new(build_reqwest_client());
let request_telemetry: Arc<dyn RequestTelemetry> = Arc::new(ModelsRequestTelemetry {
auth_mode: request_auth
codex-rs/core/src/models_manager/manager_tests.rs
+1
View File
@@ -79,6 +79,7 @@ fn provider_for(base_url: String) -> ModelProviderInfo {
env_key: None,
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
codex-rs/core/src/provider_auth.rs
+174
View File
@@ -0,0 +1,174 @@
use std::fmt;
use std::path::Path;
use std::path::PathBuf;
use std::process::Stdio;
use std::sync::Arc;
use std::time::Instant;
use tokio::process::Command;
use tokio::sync::Mutex;
use crate::error::CodexErr;
use crate::error::Result;
use crate::model_provider_info::ModelProviderAuthInfo;
use crate::model_provider_info::ModelProviderInfo;
#[derive(Clone, Default)]
pub(crate) struct ProviderAuthResolver {
state: Option<Arc<ProviderAuthState>>,
}
impl ProviderAuthResolver {
pub(crate) fn new(provider: &ModelProviderInfo) -> Self {
Self {
state: provider
.auth
.clone()
.map(ProviderAuthState::new)
.map(Arc::new),
}
}
pub(crate) fn is_configured(&self) -> bool {
self.state.is_some()
}
pub(crate) async fn resolve_token(&self) -> Result<Option<String>> {
let Some(state) = self.state.as_ref() else {
return Ok(None);
};
let mut cached = state.cached_token.lock().await;
if let Some(cached_token) = cached.as_ref()
&& cached_token.fetched_at.elapsed() < state.config.refresh_interval()
{
return Ok(Some(cached_token.token.clone()));
}
let token = run_provider_auth_command(&state.config).await?;
*cached = Some(CachedProviderToken {
token: token.clone(),
fetched_at: Instant::now(),
});
Ok(Some(token))
}
pub(crate) async fn refresh_after_unauthorized(&self) -> Result<Option<bool>> {
let Some(state) = self.state.as_ref() else {
return Ok(None);
};
let mut cached = state.cached_token.lock().await;
let previous_token = cached.as_ref().map(|token| token.token.clone());
let token = run_provider_auth_command(&state.config).await?;
let auth_state_changed = previous_token
.as_ref()
.map(|previous_token| previous_token != &token);
*cached = Some(CachedProviderToken {
token,
fetched_at: Instant::now(),
});
Ok(auth_state_changed)
}
}
impl fmt::Debug for ProviderAuthResolver {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
f.debug_struct("ProviderAuthResolver")
.field("configured", &self.is_configured())
.finish()
}
}
struct ProviderAuthState {
config: ModelProviderAuthInfo,
cached_token: Mutex<Option<CachedProviderToken>>,
}
impl ProviderAuthState {
fn new(config: ModelProviderAuthInfo) -> Self {
Self {
config,
cached_token: Mutex::new(None),
}
}
}
struct CachedProviderToken {
token: String,
fetched_at: Instant,
}
async fn run_provider_auth_command(config: &ModelProviderAuthInfo) -> Result<String> {
let program = resolve_provider_auth_program(&config.command, &config.cwd)?;
let mut command = Command::new(&program);
command
.args(&config.args)
.current_dir(config.cwd.as_path())
.stdin(Stdio::null())
.stdout(Stdio::piped())
.stderr(Stdio::piped())
.kill_on_drop(true);
let output = tokio::time::timeout(config.timeout(), command.output())
.await
.map_err(|_| {
CodexErr::InvalidRequest(format!(
"provider auth command `{}` timed out after {} ms",
config.command,
config.timeout_ms.get()
))
})?
.map_err(|err| {
CodexErr::InvalidRequest(format!(
"provider auth command `{}` failed to start: {err}",
config.command
))
})?;
if !output.status.success() {
let status = output.status;
let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
let stderr_suffix = if stderr.is_empty() {
String::new()
} else {
format!(": {stderr}")
};
return Err(CodexErr::InvalidRequest(format!(
"provider auth command `{}` exited with status {status}{stderr_suffix}",
config.command
)));
}
let stdout = String::from_utf8(output.stdout).map_err(|_| {
CodexErr::InvalidRequest(format!(
"provider auth command `{}` wrote non-UTF-8 data to stdout",
config.command
))
})?;
let token = stdout.trim().to_string();
if token.is_empty() {
return Err(CodexErr::InvalidRequest(format!(
"provider auth command `{}` produced an empty token",
config.command
)));
}
Ok(token)
}
fn resolve_provider_auth_program(command: &str, cwd: &Path) -> Result<PathBuf> {
let path = Path::new(command);
if path.is_absolute() || path.components().count() > 1 {
return Ok(
codex_utils_absolute_path::AbsolutePathBuf::resolve_path_against_base(path, cwd)?
.into_path_buf(),
);
}
Ok(PathBuf::from(command))
}
#[cfg(test)]
#[path = "provider_auth_tests.rs"]
mod tests;
codex-rs/core/src/provider_auth_tests.rs
+113
View File
@@ -0,0 +1,113 @@
use super::*;
use pretty_assertions::assert_eq;
use std::num::NonZeroU64;
use tempfile::TempDir;
#[tokio::test]
async fn caches_command_output_until_refreshed() {
let script = ProviderAuthScript::new(&["first-token", "second-token"]).unwrap();
let provider = ModelProviderInfo {
name: "Test".to_string(),
base_url: None,
env_key: None,
env_key_instructions: None,
experimental_bearer_token: None,
auth: Some(script.auth_config()),
wire_api: crate::WireApi::Responses,
query_params: None,
http_headers: None,
env_http_headers: None,
request_max_retries: None,
stream_max_retries: None,
stream_idle_timeout_ms: None,
websocket_connect_timeout_ms: None,
requires_openai_auth: false,
supports_websockets: false,
};
let resolver = ProviderAuthResolver::new(&provider);
let first = resolver.resolve_token().await.unwrap();
let second = resolver.resolve_token().await.unwrap();
let changed = resolver.refresh_after_unauthorized().await.unwrap();
let refreshed = resolver.resolve_token().await.unwrap();
assert_eq!(first.as_deref(), Some("first-token"));
assert_eq!(second.as_deref(), Some("first-token"));
assert_eq!(changed, Some(true));
assert_eq!(refreshed.as_deref(), Some("second-token"));
}
struct ProviderAuthScript {
tempdir: TempDir,
command: String,
args: Vec<String>,
}
impl ProviderAuthScript {
fn new(tokens: &[&str]) -> Result<Self> {
let tempdir = tempfile::tempdir()?;
let token_file = tempdir.path().join("tokens.txt");
std::fs::write(&token_file, format!("{}\n", tokens.join("\n")))?;
#[cfg(unix)]
let (command, args) = {
let script_path = tempdir.path().join("print-token.sh");
std::fs::write(
&script_path,
"#!/bin/sh\nfirst_line=$(sed -n '1p' tokens.txt)\nprintf '%s\\n' \"$first_line\"\ntail -n +2 tokens.txt > tokens.next\nmv tokens.next tokens.txt\n",
)?;
let mut permissions = std::fs::metadata(&script_path)?.permissions();
{
use std::os::unix::fs::PermissionsExt;
permissions.set_mode(0o755);
}
std::fs::set_permissions(&script_path, permissions)?;
("./print-token.sh".to_string(), Vec::new())
};
#[cfg(windows)]
let (command, args) = {
let script_path = tempdir.path().join("print-token.ps1");
std::fs::write(
&script_path,
"$lines = Get-Content -Path tokens.txt\nif ($lines.Count -eq 0) { exit 1 }\nWrite-Output $lines[0]\n$lines | Select-Object -Skip 1 | Set-Content -Path tokens.txt\n",
)?;
(
"powershell".to_string(),
vec![
"-NoProfile".to_string(),
"-ExecutionPolicy".to_string(),
"Bypass".to_string(),
"-File".to_string(),
".\\print-token.ps1".to_string(),
],
)
};
Ok(Self {
tempdir,
command,
args,
})
}
fn auth_config(&self) -> ModelProviderAuthInfo {
ModelProviderAuthInfo {
command: self.command.clone(),
args: self.args.clone(),
timeout_ms: non_zero_u64(/*value*/ 1_000),
refresh_interval_ms: non_zero_u64(/*value*/ 60_000),
cwd: match codex_utils_absolute_path::AbsolutePathBuf::try_from(self.tempdir.path()) {
Ok(cwd) => cwd,
Err(err) => panic!("tempdir should be absolute: {err}"),
},
}
}
}
fn non_zero_u64(value: u64) -> NonZeroU64 {
match NonZeroU64::new(value) {
Some(value) => value,
None => panic!("expected non-zero value: {value}"),
}
}
codex-rs/core/src/realtime_conversation.rs
+9 -6
View File
@@ -1,5 +1,6 @@
use crate::CodexAuth;
use crate::api_bridge::map_api_error;
use crate::api_bridge::provider_bearer_token;
use crate::auth::read_openai_api_key_from_env;
use crate::codex::Session;
use crate::config::RealtimeWsMode;
@@ -453,7 +454,12 @@ async fn prepare_realtime_start(
) -> CodexResult<PreparedRealtimeConversationStart> {
let provider = sess.provider().await;
let auth = sess.services.auth_manager.auth().await;
let realtime_api_key = realtime_api_key(auth.as_ref(), &provider)?;
let provider_token = sess
.services
.model_client
.resolve_provider_bearer_token()
.await?;
let realtime_api_key = realtime_api_key(auth.as_ref(), &provider, provider_token)?;
let mut api_provider = provider.to_api_provider(Some(crate::auth::AuthMode::ApiKey))?;
let config = sess.get_config().await;
if let Some(realtime_ws_base_url) = &config.experimental_realtime_ws_base_url {
@@ -628,15 +634,12 @@ fn realtime_text_from_handoff_request(handoff: &RealtimeHandoffRequested) -> Opt
fn realtime_api_key(
auth: Option<&CodexAuth>,
provider: &crate::ModelProviderInfo,
provider_token: Option<String>,
) -> CodexResult<String> {
if let Some(api_key) = provider.api_key()? {
if let Some(api_key) = provider_bearer_token(provider, provider_token)? {
return Ok(api_key);
}
if let Some(token) = provider.experimental_bearer_token.clone() {
return Ok(token);
}
if let Some(api_key) = auth.and_then(CodexAuth::api_key) {
return Ok(api_key.to_string());
}
codex-rs/core/src/request_auth.rs
+37 -3
View File
@@ -1,7 +1,7 @@
use std::sync::Arc;
use crate::api_bridge::CoreAuthProvider;
use crate::api_bridge::auth_provider_from_auth;
use crate::api_bridge::auth_provider_from_resolved_provider_token;
use crate::auth::AuthManager;
use crate::auth::AuthMode;
use crate::auth::CodexAuth;
@@ -10,6 +10,7 @@ use crate::auth::UnauthorizedRecovery;
use crate::error::CodexErr;
use crate::error::Result;
use crate::model_provider_info::ModelProviderInfo;
use crate::provider_auth::ProviderAuthResolver;
#[derive(Clone)]
pub(crate) struct ResolvedRequestAuth {
@@ -22,14 +23,17 @@ pub(crate) struct ResolvedRequestAuth {
pub(crate) async fn resolve_request_auth(
auth_manager: Option<&Arc<AuthManager>>,
provider: &ModelProviderInfo,
provider_auth: &ProviderAuthResolver,
) -> Result<ResolvedRequestAuth> {
let auth = match auth_manager {
Some(manager) => manager.auth().await,
None => None,
};
let auth_mode = auth.as_ref().map(CodexAuth::auth_mode);
let provider_token = provider_auth.resolve_token().await?;
let api_provider = provider.to_api_provider(auth_mode)?;
let api_auth = auth_provider_from_auth(auth.clone(), provider)?;
let api_auth =
auth_provider_from_resolved_provider_token(auth.clone(), provider, provider_token)?;
Ok(ResolvedRequestAuth {
auth,
auth_mode,
@@ -64,6 +68,10 @@ pub(crate) enum UnauthorizedRecoveryError {
execution: UnauthorizedRecoveryExecution,
error: RefreshTokenError,
},
Provider {
execution: UnauthorizedRecoveryExecution,
error: CodexErr,
},
}
impl UnauthorizedRecoveryError {
@@ -73,6 +81,7 @@ impl UnauthorizedRecoveryError {
RefreshTokenError::Permanent(failed) => CodexErr::RefreshTokenFailed(failed),
RefreshTokenError::Transient(error) => CodexErr::Io(error),
},
Self::Provider { error, .. } => error,
}
}
}
@@ -82,12 +91,19 @@ impl UnauthorizedRecoveryError {
/// The request loops reuse the same instance across retries so this type can enforce the
/// recovery ordering and make sure each one-shot step only runs once.
pub(crate) struct RequestUnauthorizedRecovery {
provider_auth: ProviderAuthResolver,
provider_auth_retry_available: bool,
auth_recovery: Option<UnauthorizedRecovery>,
}
impl RequestUnauthorizedRecovery {
pub(crate) fn new(auth_manager: Option<&Arc<AuthManager>>) -> Self {
pub(crate) fn new(
auth_manager: Option<&Arc<AuthManager>>,
provider_auth: &ProviderAuthResolver,
) -> Self {
Self {
provider_auth: provider_auth.clone(),
provider_auth_retry_available: provider_auth.is_configured(),
auth_recovery: auth_manager.map(AuthManager::unauthorized_recovery),
}
}
@@ -101,6 +117,24 @@ impl RequestUnauthorizedRecovery {
pub(crate) async fn next(
&mut self,
) -> std::result::Result<UnauthorizedRecoveryOutcome, UnauthorizedRecoveryError> {
if self.provider_auth_retry_available {
self.provider_auth_retry_available = false;
let execution = UnauthorizedRecoveryExecution {
mode: "provider_exec",
phase: "refresh",
auth_state_changed: None,
};
return match self.provider_auth.refresh_after_unauthorized().await {
Ok(auth_state_changed) => Ok(UnauthorizedRecoveryOutcome::Recovered(
UnauthorizedRecoveryExecution {
auth_state_changed,
..execution
},
)),
Err(error) => Err(UnauthorizedRecoveryError::Provider { execution, error }),
};
}
if let Some(recovery) = self.auth_recovery.as_mut()
&& recovery.has_next()
{
codex-rs/core/tests/responses_headers.rs
+3
View File
@@ -46,6 +46,7 @@ async fn responses_stream_includes_subagent_header_on_review() {
env_key: None,
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
@@ -158,6 +159,7 @@ async fn responses_stream_includes_subagent_header_on_other() {
env_key: None,
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
@@ -265,6 +267,7 @@ async fn responses_respects_model_info_overrides_from_config() {
env_key: None,
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
codex-rs/core/tests/suite/client.rs
+297
View File
@@ -1,5 +1,6 @@
use codex_core::CodexAuth;
use codex_core::ModelClient;
use codex_core::ModelProviderAuthInfo;
use codex_core::ModelProviderInfo;
use codex_core::NewThread;
use codex_core::Prompt;
@@ -64,6 +65,7 @@ use futures::StreamExt;
use pretty_assertions::assert_eq;
use serde_json::json;
use std::io::Write;
use std::num::NonZeroU64;
use std::sync::Arc;
use tempfile::TempDir;
use uuid::Uuid;
@@ -143,6 +145,81 @@ fn write_auth_json(
fake_jwt
}
struct ProviderAuthCommandFixture {
tempdir: TempDir,
command: String,
args: Vec<String>,
}
impl ProviderAuthCommandFixture {
fn new(tokens: &[&str]) -> std::io::Result<Self> {
let tempdir = tempfile::tempdir()?;
let tokens_file = tempdir.path().join("tokens.txt");
std::fs::write(&tokens_file, format!("{}\n", tokens.join("\n")))?;
#[cfg(unix)]
let (command, args) = {
let script_path = tempdir.path().join("print-token.sh");
std::fs::write(
&script_path,
"#!/bin/sh\nfirst_line=$(sed -n '1p' tokens.txt)\nprintf '%s\\n' \"$first_line\"\ntail -n +2 tokens.txt > tokens.next\nmv tokens.next tokens.txt\n",
)?;
let mut permissions = std::fs::metadata(&script_path)?.permissions();
{
use std::os::unix::fs::PermissionsExt;
permissions.set_mode(0o755);
}
std::fs::set_permissions(&script_path, permissions)?;
("./print-token.sh".to_string(), Vec::new())
};
#[cfg(windows)]
let (command, args) = {
let script_path = tempdir.path().join("print-token.ps1");
std::fs::write(
&script_path,
"$lines = Get-Content -Path tokens.txt\nif ($lines.Count -eq 0) { exit 1 }\nWrite-Output $lines[0]\n$lines | Select-Object -Skip 1 | Set-Content -Path tokens.txt\n",
)?;
(
"powershell".to_string(),
vec![
"-NoProfile".to_string(),
"-ExecutionPolicy".to_string(),
"Bypass".to_string(),
"-File".to_string(),
".\\print-token.ps1".to_string(),
],
)
};
Ok(Self {
tempdir,
command,
args,
})
}
fn auth(&self) -> ModelProviderAuthInfo {
ModelProviderAuthInfo {
command: self.command.clone(),
args: self.args.clone(),
timeout_ms: non_zero_u64(/*value*/ 1_000),
refresh_interval_ms: non_zero_u64(/*value*/ 60_000),
cwd: match codex_utils_absolute_path::AbsolutePathBuf::try_from(self.tempdir.path()) {
Ok(cwd) => cwd,
Err(err) => panic!("tempdir should be absolute: {err}"),
},
}
}
}
fn non_zero_u64(value: u64) -> NonZeroU64 {
match NonZeroU64::new(value) {
Some(value) => value,
None => panic!("expected non-zero value: {value}"),
}
}
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
async fn resume_includes_initial_messages_and_sends_prior_items() {
skip_if_no_network!();
@@ -659,6 +736,223 @@ async fn includes_conversation_id_and_model_headers_in_request() {
assert_eq!(request_authorization, "Bearer Test API Key");
}
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
async fn provider_auth_command_supplies_bearer_token() {
skip_if_no_network!();
let server = MockServer::start().await;
let resp_mock = mount_sse_once(
&server,
sse(vec![ev_response_created("resp1"), ev_completed("resp1")]),
)
.await;
let auth_fixture = ProviderAuthCommandFixture::new(&["command-token"]).unwrap();
let provider = ModelProviderInfo {
name: "corp".into(),
base_url: Some(format!("{}/v1", server.uri())),
env_key: None,
env_key_instructions: None,
experimental_bearer_token: None,
auth: Some(auth_fixture.auth()),
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
env_http_headers: None,
request_max_retries: Some(0),
stream_max_retries: Some(0),
stream_idle_timeout_ms: Some(5_000),
websocket_connect_timeout_ms: None,
requires_openai_auth: false,
supports_websockets: false,
};
let codex_home = TempDir::new().unwrap();
let mut config = load_default_config_for_test(&codex_home).await;
config.model_provider_id = provider.name.clone();
config.model_provider = provider.clone();
let effort = config.model_reasoning_effort;
let summary = config.model_reasoning_summary;
let model = codex_core::test_support::get_model_offline(config.model.as_deref());
config.model = Some(model.clone());
let config = Arc::new(config);
let model_info =
codex_core::test_support::construct_model_info_offline(model.as_str(), &config);
let conversation_id = ThreadId::new();
let session_telemetry = SessionTelemetry::new(
conversation_id,
model.as_str(),
model_info.slug.as_str(),
/*account_id*/ None,
Some("test@test.com".to_string()),
/*auth_mode*/ None,
"test_originator".to_string(),
/*log_user_prompts*/ false,
"test".to_string(),
SessionSource::Exec,
);
let client = ModelClient::new(
/*auth_manager*/ None,
conversation_id,
provider,
SessionSource::Exec,
config.model_verbosity,
/*enable_request_compression*/ false,
/*include_timing_metrics*/ false,
/*beta_features_header*/ None,
);
let mut client_session = client.new_session();
let mut prompt = Prompt::default();
prompt.input.push(ResponseItem::Message {
id: None,
role: "user".to_string(),
content: vec![ContentItem::InputText {
text: "hello".to_string(),
}],
end_turn: None,
phase: None,
});
let mut stream = client_session
.stream(
&prompt,
&model_info,
&session_telemetry,
effort,
summary.unwrap_or(ReasoningSummary::Auto),
/*service_tier*/ None,
/*turn_metadata_header*/ None,
)
.await
.expect("responses stream to start");
while let Some(event) = stream.next().await {
if let Ok(ResponseEvent::Completed { .. }) = event {
break;
}
}
let request = resp_mock.single_request();
let request_authorization = request
.header("authorization")
.expect("authorization header");
assert_eq!(request_authorization, "Bearer command-token");
}
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
async fn provider_auth_command_refreshes_after_401() {
skip_if_no_network!();
let server = MockServer::start().await;
let auth_fixture = ProviderAuthCommandFixture::new(&["first-token", "second-token"]).unwrap();
Mock::given(method("POST"))
.and(path("/v1/responses"))
.and(header_regex("Authorization", "Bearer first-token"))
.respond_with(ResponseTemplate::new(401).set_body_string("unauthorized"))
.expect(1)
.mount(&server)
.await;
Mock::given(method("POST"))
.and(path("/v1/responses"))
.and(header_regex("Authorization", "Bearer second-token"))
.respond_with(
ResponseTemplate::new(200)
.insert_header("content-type", "text/event-stream")
.set_body_raw(
sse(vec![ev_response_created("resp1"), ev_completed("resp1")]),
"text/event-stream",
),
)
.expect(1)
.mount(&server)
.await;
let provider = ModelProviderInfo {
name: "corp".into(),
base_url: Some(format!("{}/v1", server.uri())),
env_key: None,
env_key_instructions: None,
experimental_bearer_token: None,
auth: Some(auth_fixture.auth()),
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
env_http_headers: None,
request_max_retries: Some(0),
stream_max_retries: Some(0),
stream_idle_timeout_ms: Some(5_000),
websocket_connect_timeout_ms: None,
requires_openai_auth: false,
supports_websockets: false,
};
let codex_home = TempDir::new().unwrap();
let mut config = load_default_config_for_test(&codex_home).await;
config.model_provider_id = provider.name.clone();
config.model_provider = provider.clone();
let effort = config.model_reasoning_effort;
let summary = config.model_reasoning_summary;
let model = codex_core::test_support::get_model_offline(config.model.as_deref());
config.model = Some(model.clone());
let config = Arc::new(config);
let model_info =
codex_core::test_support::construct_model_info_offline(model.as_str(), &config);
let conversation_id = ThreadId::new();
let session_telemetry = SessionTelemetry::new(
conversation_id,
model.as_str(),
model_info.slug.as_str(),
/*account_id*/ None,
Some("test@test.com".to_string()),
/*auth_mode*/ None,
"test_originator".to_string(),
/*log_user_prompts*/ false,
"test".to_string(),
SessionSource::Exec,
);
let client = ModelClient::new(
/*auth_manager*/ None,
conversation_id,
provider,
SessionSource::Exec,
config.model_verbosity,
/*enable_request_compression*/ false,
/*include_timing_metrics*/ false,
/*beta_features_header*/ None,
);
let mut client_session = client.new_session();
let mut prompt = Prompt::default();
prompt.input.push(ResponseItem::Message {
id: None,
role: "user".to_string(),
content: vec![ContentItem::InputText {
text: "hello".to_string(),
}],
end_turn: None,
phase: None,
});
let mut stream = client_session
.stream(
&prompt,
&model_info,
&session_telemetry,
effort,
summary.unwrap_or(ReasoningSummary::Auto),
/*service_tier*/ None,
/*turn_metadata_header*/ None,
)
.await
.expect("responses stream to start");
while let Some(event) = stream.next().await {
if let Ok(ResponseEvent::Completed { .. }) = event {
break;
}
}
}
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
async fn includes_base_instructions_override_in_request() {
skip_if_no_network!();
@@ -1796,6 +2090,7 @@ async fn azure_responses_request_includes_store_and_reasoning_ids() {
env_key: None,
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
@@ -2396,6 +2691,7 @@ async fn azure_overrides_assign_properties_used_for_responses_url() {
// Reuse the existing environment variable to avoid using unsafe code
env_key: Some(existing_env_var_with_random_value.to_string()),
experimental_bearer_token: None,
auth: None,
query_params: Some(std::collections::HashMap::from([(
"api-version".to_string(),
"2025-04-01-preview".to_string(),
@@ -2486,6 +2782,7 @@ async fn env_var_overrides_loaded_auth() {
)])),
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api: WireApi::Responses,
http_headers: Some(std::collections::HashMap::from([(
"Custom-Header".to_string(),
codex-rs/core/tests/suite/client_websockets.rs
+1
View File
@@ -1674,6 +1674,7 @@ fn websocket_provider_with_connect_timeout(
env_key: None,
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
codex-rs/core/tests/suite/stream_error_allows_next_turn.rs
+1
View File
@@ -69,6 +69,7 @@ async fn continue_after_stream_error() {
env_key: Some("PATH".into()),
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,
codex-rs/core/tests/suite/stream_no_completed.rs
+1
View File
@@ -53,6 +53,7 @@ async fn retries_on_early_close() {
env_key: Some("PATH".into()),
env_key_instructions: None,
experimental_bearer_token: None,
auth: None,
wire_api: WireApi::Responses,
query_params: None,
http_headers: None,