openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-31 19:28:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Consolidate async header authentication in apply_auth_headers (#57179)

Browse Source 
## What changed

Remove `AuthProvider::resolve_auth_headers` and use `apply_auth_headers` as the async interface for header-only authentication. Migrate providers, callers, and existing tests to the shared interface, passing an empty `HeaderMap` when only authentication headers are needed.

Document that providers may refresh credentials asynchronously and that callers must use the returned header map so providers can remove superseded credentials.

GitOrigin-RevId: 42449de6fddd2be2c50c475c8e92628493197007
This commit is contained in:
cooper-oai
2026-10-26 18:22:11 +00:00
committed by copyberry
parent 3d1001e865
commit b8f6d25ce7
13 changed files with 66 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/codex-api/src/auth.rs
+6 -12
View File
@@ -36,7 +36,7 @@ pub trait AuthProvider: Send + Sync {
///
/// Implementations should be cheap and non-blocking. This method is also
/// used by telemetry and non-HTTP request paths. Providers that require async
/// work must return an error here and override `resolve_auth_headers`.
/// work must return an error here and override `apply_auth_headers`.
/// Callers must not send the request if this returns an error.
fn add_auth_headers(&self, headers: &mut HeaderMap) -> Result<(), AuthError>;
@@ -60,15 +60,6 @@ pub trait AuthProvider: Send + Sync {
})
}
/// Resolves auth headers for an outbound request.
///
/// Unlike [`Self::to_auth_headers`], implementations may perform asynchronous work to refresh
/// credentials before returning. Header-only providers with static credentials can rely on the
/// default implementation.
fn resolve_auth_headers(&self) -> AuthHeadersFuture<'_> {
Box::pin(async { self.to_auth_headers() })
}
/// Refreshes credentials after an explicit HTTP 401. Returns whether the caller
/// may retry with new credentials. Callers must bound retries and pass the headers
/// of the rejected request so concurrent failures can reuse an earlier refresh.
@@ -77,10 +68,13 @@ pub trait AuthProvider: Send + Sync {
}
/// Authenticates a header-only request, including removing credentials it supersedes.
/// WebSocket handshakes must use the returned map rather than overlaying resolved headers.
///
/// Implementations may refresh credentials asynchronously. Providers with static credentials
/// can rely on the default implementation.
/// Callers must use the returned map rather than overlaying resolved headers.
fn apply_auth_headers(&self, mut headers: HeaderMap) -> AuthHeadersFuture<'_> {
Box::pin(async move {
headers.extend(self.resolve_auth_headers().await?);
headers.extend(self.to_auth_headers()?);
Ok(headers)
})
}