openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-14 11:57:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor: drop top-level network proxy loader config

Browse Source
This commit is contained in:
viyatb-oai
2026-03-06 10:03:52 -08:00
parent aee0f23c6b
commit 2bda01552a
3 changed files with 10 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
codex-rs/core/src/config/mod.rs
View File

@@ -109,7 +109,6 @@ pub use codex_network_proxy::NetworkProxyAuditMetadata;
pub use managed_features::ManagedFeatures;
pub use network_proxy_spec::NetworkProxySpec;
pub use network_proxy_spec::StartedNetworkProxy;
pub use permissions::NetworkToml;
pub use permissions::PermissionsNetworkToml;
pub use permissions::PermissionsToml;
pub use service::ConfigService;

66
codex-rs/core/src/config/permissions.rs
View File

@@ -31,25 +31,6 @@ pub struct PermissionsNetworkToml {
pub allow_local_binding: Option<bool>,
}
#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
#[schemars(deny_unknown_fields)]
pub struct NetworkToml {
pub enabled: Option<bool>,
pub proxy_url: Option<String>,
pub enable_socks5: Option<bool>,
pub socks_url: Option<String>,
pub enable_socks5_udp: Option<bool>,
pub allow_upstream_proxy: Option<bool>,
pub dangerously_allow_non_loopback_proxy: Option<bool>,
pub dangerously_allow_all_unix_sockets: Option<bool>,
#[schemars(with = "Option<NetworkModeSchema>")]
pub mode: Option<NetworkMode>,
pub allowed_domains: Option<Vec<String>>,
pub denied_domains: Option<Vec<String>>,
pub allow_unix_sockets: Option<Vec<String>>,
pub allow_local_binding: Option<bool>,
}
#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, JsonSchema)]
#[serde(rename_all = "lowercase")]
enum NetworkModeSchema {
@@ -57,53 +38,6 @@ enum NetworkModeSchema {
Full,
}
impl NetworkToml {
pub(crate) fn apply_to_network_proxy_config(&self, config: &mut NetworkProxyConfig) {
if let Some(enabled) = self.enabled {
config.network.enabled = enabled;
}
if let Some(proxy_url) = self.proxy_url.as_ref() {
config.network.proxy_url = proxy_url.clone();
}
if let Some(enable_socks5) = self.enable_socks5 {
config.network.enable_socks5 = enable_socks5;
}
if let Some(socks_url) = self.socks_url.as_ref() {
config.network.socks_url = socks_url.clone();
}
if let Some(enable_socks5_udp) = self.enable_socks5_udp {
config.network.enable_socks5_udp = enable_socks5_udp;
}
if let Some(allow_upstream_proxy) = self.allow_upstream_proxy {
config.network.allow_upstream_proxy = allow_upstream_proxy;
}
if let Some(dangerously_allow_non_loopback_proxy) =
self.dangerously_allow_non_loopback_proxy
{
config.network.dangerously_allow_non_loopback_proxy =
dangerously_allow_non_loopback_proxy;
}
if let Some(dangerously_allow_all_unix_sockets) = self.dangerously_allow_all_unix_sockets {
config.network.dangerously_allow_all_unix_sockets = dangerously_allow_all_unix_sockets;
}
if let Some(mode) = self.mode {
config.network.mode = mode;
}
if let Some(allowed_domains) = self.allowed_domains.as_ref() {
config.network.allowed_domains = allowed_domains.clone();
}
if let Some(denied_domains) = self.denied_domains.as_ref() {
config.network.denied_domains = denied_domains.clone();
}
if let Some(allow_unix_sockets) = self.allow_unix_sockets.as_ref() {
config.network.allow_unix_sockets = allow_unix_sockets.clone();
}
if let Some(allow_local_binding) = self.allow_local_binding {
config.network.allow_local_binding = allow_local_binding;
}
}
}
impl PermissionsNetworkToml {
pub(crate) fn apply_to_network_proxy_config(&self, config: &mut NetworkProxyConfig) {
config.network.enabled = true;

59
codex-rs/core/src/network_proxy_loader.rs
View File

@@ -1,4 +1,3 @@
use crate::config::NetworkToml;
use crate::config::PermissionsNetworkToml;
use crate::config::PermissionsToml;
use crate::config::find_codex_home;
@@ -119,9 +118,6 @@ fn network_constraints_from_trusted_layers(
}
let parsed = network_tables_from_toml(&layer.config)?;
if let Some(network) = parsed.network {
apply_network_constraints(network, &mut constraints);
}
if let Some(network) = parsed
.permissions
.and_then(|permissions| permissions.network)
@@ -132,38 +128,6 @@ fn network_constraints_from_trusted_layers(
Ok(constraints)
}
fn apply_network_constraints(network: NetworkToml, constraints: &mut NetworkProxyConstraints) {
if let Some(enabled) = network.enabled {
constraints.enabled = Some(enabled);
}
if let Some(mode) = network.mode {
constraints.mode = Some(mode);
}
if let Some(allow_upstream_proxy) = network.allow_upstream_proxy {
constraints.allow_upstream_proxy = Some(allow_upstream_proxy);
}
if let Some(dangerously_allow_non_loopback_proxy) = network.dangerously_allow_non_loopback_proxy
{
constraints.dangerously_allow_non_loopback_proxy =
Some(dangerously_allow_non_loopback_proxy);
}
if let Some(dangerously_allow_all_unix_sockets) = network.dangerously_allow_all_unix_sockets {
constraints.dangerously_allow_all_unix_sockets = Some(dangerously_allow_all_unix_sockets);
}
if let Some(allowed_domains) = network.allowed_domains {
constraints.allowed_domains = Some(allowed_domains);
}
if let Some(denied_domains) = network.denied_domains {
constraints.denied_domains = Some(denied_domains);
}
if let Some(allow_unix_sockets) = network.allow_unix_sockets {
constraints.allow_unix_sockets = Some(allow_unix_sockets);
}
if let Some(allow_local_binding) = network.allow_local_binding {
constraints.allow_local_binding = Some(allow_local_binding);
}
}
fn apply_permissions_network_constraints(
network: PermissionsNetworkToml,
constraints: &mut NetworkProxyConstraints,
@@ -198,7 +162,6 @@ fn apply_permissions_network_constraints(
#[derive(Debug, Clone, Default, Deserialize)]
struct NetworkTablesToml {
network: Option<NetworkToml>,
permissions: Option<PermissionsToml>,
}
@@ -210,9 +173,6 @@ fn network_tables_from_toml(value: &toml::Value) -> Result<NetworkTablesToml> {
}
fn apply_network_tables(config: &mut NetworkProxyConfig, parsed: NetworkTablesToml) {
if let Some(network) = parsed.network {
network.apply_to_network_proxy_config(config);
}
if let Some(network) = parsed
.permissions
.and_then(|permissions| permissions.network)
@@ -343,7 +303,7 @@ mod tests {
use pretty_assertions::assert_eq;
#[test]
fn higher_precedence_network_table_beats_lower_permissions_network_table() {
fn top_level_network_table_is_ignored() {
let lower_permissions: toml::Value = toml::from_str(
r#"
[permissions.network]
@@ -369,7 +329,7 @@ allowed_domains = ["higher.example.com"]
network_tables_from_toml(&higher_network).expect("higher layer should deserialize"),
);
assert_eq!(config.network.allowed_domains, vec!["higher.example.com"]);
assert_eq!(config.network.allowed_domains, vec!["lower.example.com"]);
}
#[test]
@@ -412,21 +372,22 @@ allowed_domains = ["higher.example.com"]
}
#[test]
fn apply_network_constraints_includes_allow_all_unix_sockets_flag() {
fn apply_permissions_network_constraints_includes_allow_all_unix_sockets_flag() {
let config: toml::Value = toml::from_str(
r#"
[network]
[permissions.network]
dangerously_allow_all_unix_sockets = true
"#,
)
.expect("network table should parse");
.expect("permissions.network table should parse");
let network = network_tables_from_toml(&config)
.expect("network table should deserialize")
.network
.expect("network table should be present");
.expect("permissions.network table should deserialize")
.permissions
.and_then(|permissions| permissions.network)
.expect("permissions.network table should be present");
let mut constraints = NetworkProxyConstraints::default();
apply_network_constraints(network, &mut constraints);
apply_permissions_network_constraints(network, &mut constraints);
assert_eq!(constraints.dangerously_allow_all_unix_sockets, Some(true));
}