openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-29 19:08:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Restrict enterprise MCP auth and fail closed on config refresh (#49260)

Browse Source 
## Why

Configuration reloads must honor current managed restrictions without granting new enterprise MCP authority to existing sessions or overwriting newer configuration with stale snapshots.

## What changed

- Allow enterprise managed authentication only for configured MCP servers. Remove plugin `ema_auth` overlays from the schema and disable servers that still use them.
- Refresh ordinary MCP settings while preserving session settings and initially admitted enterprise registrations. Disable enterprise MCP when its registration changes, policy revokes access, or configuration loading or resolution fails; require a new session to restore enterprise authority.
- Publish refreshes only when their captured configuration is still current, with bounded retries in app-server reloads. Preserve updated managed restrictions even when a refresh is rejected.
- Finish processing other thread refreshes before `config/mcpServer/reload` reports a rejection, and document that an error can accompany partially applied changes.

## Testing

Add regression coverage for stale refreshes, bounded retries, managed-policy revocation, persistent enterprise disablement, ordinary MCP transport changes, and rejection of plugin enterprise authentication. Verify that denied enterprise servers receive no requests.

GitOrigin-RevId: 34429cd339c1ec152a2ee8697cb29f0cff5d9e5f
This commit is contained in:
Nick Steele
2026-09-29 13:08:37 +00:00
committed by copyberry
parent 4f16bdc265
commit af0d68a236
46 changed files with 1803 additions and 788 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core-plugins/src/loader.rs
+6 -6
View File
@@ -966,9 +966,9 @@ async fn load_plugin(
}
fn apply_plugin_mcp_server_policy(config: &mut McpServerConfig, policy: &PluginMcpServerConfig) {
config.enabled = policy.enabled;
if let Some(ema) = &policy.ema_auth {
ema.apply(config);
config.enabled = policy.enabled && !policy.has_unsupported_ema_auth;
if policy.has_unsupported_ema_auth {
config.auth = codex_config::McpServerAuth::EmaAuth;
}
if let Some(approval_mode) = policy.default_tools_approval_mode {
config.default_tools_approval_mode = Some(approval_mode);
@@ -1437,9 +1437,9 @@ pub fn apply_configured_plugin_mcp_server_policies(
) {
for (name, server) in servers {
if let Some(policy) = policies.get(name) {
server.enabled &= policy.enabled;
if let Some(ema) = &policy.ema_auth {
ema.apply(server);
server.enabled &= policy.enabled && !policy.has_unsupported_ema_auth;
if policy.has_unsupported_ema_auth {
server.auth = codex_config::McpServerAuth::EmaAuth;
}
let declared_approval_mode = server.default_tools_approval_mode.unwrap_or_default();