openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-28 18:58:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Consolidate async header authentication in apply_auth_headers (#57179)

Browse Source 
## What changed

Remove `AuthProvider::resolve_auth_headers` and use `apply_auth_headers` as the async interface for header-only authentication. Migrate providers, callers, and existing tests to the shared interface, passing an empty `HeaderMap` when only authentication headers are needed.

Document that providers may refresh credentials asynchronously and that callers must use the returned header map so providers can remove superseded credentials.

GitOrigin-RevId: 42449de6fddd2be2c50c475c8e92628493197007
This commit is contained in:
cooper-oai
2026-10-26 18:22:11 +00:00
committed by copyberry
parent 3d1001e865
commit b8f6d25ce7
13 changed files with 66 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/runtime-agent-instance/src/auth.rs
+1 -1
View File
@@ -120,7 +120,7 @@ impl AuthProvider for RuntimeRequestAuth {
Box::pin(async move {
Ok(replace_auth_headers(
headers,
self.resolve_auth_headers().await?,
self.auth.auth_headers(self.mode)?,
))
})
}
codex-rs/runtime-agent-instance/src/manager_tests.rs
+6 -6
View File
@@ -134,7 +134,7 @@ async fn concurrent_requests_share_registration_and_replacement_preserves_in_fli
first
.clone()
.into_auth_provider(RuntimeAuthMode::DualHeader)
.resolve_auth_headers()
.apply_auth_headers(HeaderMap::new())
.await
.unwrap()["authorization"],
"Bearer key-a"
@@ -143,7 +143,7 @@ async fn concurrent_requests_share_registration_and_replacement_preserves_in_fli
replacement
.clone()
.into_auth_provider(RuntimeAuthMode::DualHeader)
.resolve_auth_headers()
.apply_auth_headers(HeaderMap::new())
.await
.unwrap()["authorization"],
"Bearer key-b"
@@ -230,7 +230,7 @@ async fn policy_recovery_preserves_pending_registration() {
let headers = selected
.clone()
.into_auth_provider(RuntimeAuthMode::DualHeader)
.resolve_auth_headers()
.apply_auth_headers(HeaderMap::new())
.await
.unwrap();
assert_eq!(headers["authorization"], "Bearer key-a");
@@ -450,14 +450,14 @@ async fn new_request_uses_refreshed_credentials_without_replacing_the_runtime()
let provider = runtime
.clone()
.into_auth_provider(RuntimeAuthMode::DualHeader);
let first = provider.resolve_auth_headers().await.unwrap();
let first = provider.apply_auth_headers(HeaderMap::new()).await.unwrap();
let refreshed = oauth(Some("login-a"), "new");
*source.current.write().unwrap() = refreshed.clone();
let next_runtime = manager.auth().await.unwrap();
let next = next_runtime
.clone()
.into_auth_provider(RuntimeAuthMode::DualHeader)
.resolve_auth_headers()
.apply_auth_headers(HeaderMap::new())
.await
.unwrap();
assert_eq!(
@@ -466,7 +466,7 @@ async fn new_request_uses_refreshed_credentials_without_replacing_the_runtime()
);
assert_ne!(first[AUTHORIZATION], next[AUTHORIZATION]);
assert_eq!(
provider.resolve_auth_headers().await.unwrap()[AUTHORIZATION],
provider.apply_auth_headers(HeaderMap::new()).await.unwrap()[AUTHORIZATION],
first[AUTHORIZATION]
);
assert!(Arc::ptr_eq(runtime.runtime(), next_runtime.runtime()));