openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-05 20:10:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

exec-server: simplify agent identity auth selection

Browse Source
This commit is contained in:
Michael Zeng
2026-05-15 17:35:51 -07:00
parent 9dd3444b78
commit a1f02c63e0
2 changed files with 39 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/cli/src/main.rs
+31 -40
View File
@@ -74,6 +74,8 @@ use codex_features::FEATURES;
use codex_features::Stage;
use codex_features::is_known_feature_key;
use codex_login::AuthManager;
use codex_login::CodexAuth;
use codex_login::read_codex_access_token_from_env;
use codex_memories_write::clear_memory_roots_contents;
use codex_models_manager::bundled_models_response;
use codex_models_manager::manager::RefreshStrategy;
@@ -1539,40 +1541,29 @@ async fn load_exec_server_remote_auth_provider(
config_profile: Option<String>,
allow_agent_identity_auth: bool,
) -> anyhow::Result<codex_api::SharedAuthProvider> {
if !allow_agent_identity_auth {
return load_chatgpt_exec_server_remote_auth_provider(
root_config_overrides,
config_profile,
)
.await;
let config = load_exec_server_remote_config(root_config_overrides, config_profile).await?;
if allow_agent_identity_auth
&& let Some(agent_identity_jwt) = read_codex_access_token_from_env()
{
let auth =
CodexAuth::from_agent_identity_jwt(&agent_identity_jwt, Some(&config.chatgpt_base_url))
.await?;
return Ok(codex_model_provider::auth_provider_from_auth(&auth));
}
let auth = load_exec_server_remote_auth(
root_config_overrides,
config_profile,
/*allow_agent_identity_auth*/ true,
"remote exec-server registration requires ChatGPT authentication or Agent Identity auth from CODEX_ACCESS_TOKEN",
&config,
if allow_agent_identity_auth {
"remote exec-server registration requires ChatGPT authentication or Agent Identity auth from CODEX_ACCESS_TOKEN"
} else {
"remote exec-server registration requires ChatGPT authentication; run `codex login` first"
},
)
.await?;
validate_agent_identity_enabled_exec_server_remote_auth_mode(auth.auth_mode())?;
Ok(codex_model_provider::auth_provider_from_auth(&auth))
}
async fn load_chatgpt_exec_server_remote_auth_provider(
root_config_overrides: &CliConfigOverrides,
config_profile: Option<String>,
) -> anyhow::Result<codex_api::SharedAuthProvider> {
let auth = load_exec_server_remote_auth(
root_config_overrides,
config_profile,
/*allow_agent_identity_auth*/ false,
"remote exec-server registration requires ChatGPT authentication; run `codex login` first",
)
.await?;
if !auth.is_chatgpt_auth() {
if allow_agent_identity_auth {
validate_agent_identity_enabled_exec_server_remote_auth_mode(auth.auth_mode())?;
} else if !auth.is_chatgpt_auth() {
anyhow::bail!(
"remote exec-server registration requires ChatGPT authentication; API key and Agent Identity auth are not supported"
);
@@ -1581,29 +1572,29 @@ async fn load_chatgpt_exec_server_remote_auth_provider(
Ok(codex_model_provider::auth_provider_from_auth(&auth))
}
async fn load_exec_server_remote_auth(
async fn load_exec_server_remote_config(
root_config_overrides: &CliConfigOverrides,
config_profile: Option<String>,
allow_agent_identity_auth: bool,
missing_auth_error: &'static str,
) -> anyhow::Result<codex_login::CodexAuth> {
) -> anyhow::Result<codex_core::config::Config> {
let cli_kv_overrides = root_config_overrides
.parse_overrides()
.map_err(anyhow::Error::msg)?;
let config = ConfigBuilder::default()
Ok(ConfigBuilder::default()
.cli_overrides(cli_kv_overrides)
.harness_overrides(ConfigOverrides {
config_profile,
..Default::default()
})
.build()
.await?;
let auth_manager = AuthManager::shared_from_config_with_env(
&config,
/*enable_codex_api_key_env*/ false,
/*enable_codex_access_token_env*/ allow_agent_identity_auth,
)
.await;
.await?)
}
async fn load_exec_server_remote_auth(
config: &codex_core::config::Config,
missing_auth_error: &'static str,
) -> anyhow::Result<codex_login::CodexAuth> {
let auth_manager =
AuthManager::shared_from_config(config, /*enable_codex_api_key_env*/ true).await;
let auth = match auth_manager.auth().await {
Some(auth) => auth,
codex-rs/login/src/auth/manager.rs
+8 -69
View File
@@ -733,23 +733,6 @@ async fn load_auth(
enable_codex_api_key_env: bool,
auth_credentials_store_mode: AuthCredentialsStoreMode,
chatgpt_base_url: Option<&str>,
) -> std::io::Result<Option<CodexAuth>> {
load_auth_with_env(
codex_home,
enable_codex_api_key_env,
/*enable_codex_access_token_env*/ true,
auth_credentials_store_mode,
chatgpt_base_url,
)
.await
}
async fn load_auth_with_env(
codex_home: &Path,
enable_codex_api_key_env: bool,
enable_codex_access_token_env: bool,
auth_credentials_store_mode: AuthCredentialsStoreMode,
chatgpt_base_url: Option<&str>,
) -> std::io::Result<Option<CodexAuth>> {
// API key via env var takes precedence over any other auth method.
if enable_codex_api_key_env && let Some(api_key) = read_codex_api_key_from_env() {
@@ -778,9 +761,7 @@ async fn load_auth_with_env(
return Ok(None);
}
if enable_codex_access_token_env
&& let Some(agent_identity) = read_codex_access_token_from_env()
{
if let Some(agent_identity) = read_codex_access_token_from_env() {
return CodexAuth::from_agent_identity_jwt(&agent_identity, chatgpt_base_url)
.await
.map(Some);
@@ -1272,7 +1253,6 @@ pub struct AuthManager {
codex_home: PathBuf,
inner: RwLock<CachedAuth>,
enable_codex_api_key_env: bool,
enable_codex_access_token_env: bool,
auth_credentials_store_mode: AuthCredentialsStoreMode,
forced_chatgpt_workspace_id: RwLock<Option<Vec<String>>>,
chatgpt_base_url: Option<String>,
@@ -1331,27 +1311,9 @@ impl AuthManager {
auth_credentials_store_mode: AuthCredentialsStoreMode,
chatgpt_base_url: Option<String>,
) -> Self {
Self::new_with_env(
codex_home,
enable_codex_api_key_env,
/*enable_codex_access_token_env*/ true,
auth_credentials_store_mode,
chatgpt_base_url,
)
.await
}
async fn new_with_env(
codex_home: PathBuf,
enable_codex_api_key_env: bool,
enable_codex_access_token_env: bool,
auth_credentials_store_mode: AuthCredentialsStoreMode,
chatgpt_base_url: Option<String>,
) -> Self {
let managed_auth = load_auth_with_env(
let managed_auth = load_auth(
&codex_home,
enable_codex_api_key_env,
enable_codex_access_token_env,
auth_credentials_store_mode,
chatgpt_base_url.as_deref(),
)
@@ -1365,7 +1327,6 @@ impl AuthManager {
permanent_refresh_failure: None,
}),
enable_codex_api_key_env,
enable_codex_access_token_env,
auth_credentials_store_mode,
forced_chatgpt_workspace_id: RwLock::new(None),
chatgpt_base_url,
@@ -1385,7 +1346,6 @@ impl AuthManager {
codex_home: PathBuf::from("non-existent"),
inner: RwLock::new(cached),
enable_codex_api_key_env: false,
enable_codex_access_token_env: false,
auth_credentials_store_mode: AuthCredentialsStoreMode::File,
forced_chatgpt_workspace_id: RwLock::new(None),
chatgpt_base_url: None,
@@ -1404,7 +1364,6 @@ impl AuthManager {
codex_home,
inner: RwLock::new(cached),
enable_codex_api_key_env: false,
enable_codex_access_token_env: false,
auth_credentials_store_mode: AuthCredentialsStoreMode::File,
forced_chatgpt_workspace_id: RwLock::new(None),
chatgpt_base_url: None,
@@ -1421,7 +1380,6 @@ impl AuthManager {
permanent_refresh_failure: None,
}),
enable_codex_api_key_env: false,
enable_codex_access_token_env: false,
auth_credentials_store_mode: AuthCredentialsStoreMode::File,
forced_chatgpt_workspace_id: RwLock::new(None),
chatgpt_base_url: None,
@@ -1557,10 +1515,9 @@ impl AuthManager {
}
async fn load_auth_from_storage(&self) -> Option<CodexAuth> {
load_auth_with_env(
load_auth(
&self.codex_home,
self.enable_codex_api_key_env,
self.enable_codex_access_token_env,
self.auth_credentials_store_mode,
self.chatgpt_base_url.as_deref(),
)
@@ -1650,31 +1607,13 @@ impl AuthManager {
config: &impl AuthManagerConfig,
enable_codex_api_key_env: bool,
) -> Arc<Self> {
Self::shared_from_config_with_env(
config,
let auth_manager = Self::shared(
config.codex_home(),
enable_codex_api_key_env,
/*enable_codex_access_token_env*/ true,
config.cli_auth_credentials_store_mode(),
Some(config.chatgpt_base_url()),
)
.await
}
/// Convenience constructor returning an `Arc` wrapper from resolved config,
/// with explicit control over environment-backed auth.
pub async fn shared_from_config_with_env(
config: &impl AuthManagerConfig,
enable_codex_api_key_env: bool,
enable_codex_access_token_env: bool,
) -> Arc<Self> {
let auth_manager = Arc::new(
Self::new_with_env(
config.codex_home(),
enable_codex_api_key_env,
enable_codex_access_token_env,
config.cli_auth_credentials_store_mode(),
Some(config.chatgpt_base_url()),
)
.await,
);
.await;
auth_manager.set_forced_chatgpt_workspace_id(config.forced_chatgpt_workspace_id());
auth_manager
}