fix(auth): address header auth review feedback

codex-rs/core-api/src/lib.rs

@@ -71,6 +71,11 @@ pub use codex_features::Features;
 pub use codex_home::CodexHomeUserInstructionsProvider;
 pub use codex_login::AuthHeaders;
 pub use codex_login::AuthManager;
+pub use codex_login::CodexAuth;
+pub use codex_login::ExternalAuth;
+pub use codex_login::ExternalAuthFuture;
+pub use codex_login::ExternalAuthRefreshContext;
+pub use codex_login::ExternalAuthRefreshReason;
 pub use codex_login::default_client::set_default_originator;
 pub use codex_model_provider_info::OPENAI_PROVIDER_ID;
 pub use codex_model_provider_info::built_in_model_providers;

codex-rs/core/tests/suite/external_auth.rs

@@ -0,0 +1,42 @@
+use codex_login::AuthHeaders;
+use codex_login::CodexAuth;
+use core_test_support::responses::ev_completed;
+use core_test_support::responses::ev_response_created;
+use core_test_support::responses::mount_sse_once;
+use core_test_support::responses::sse;
+use core_test_support::responses::start_mock_server;
+use core_test_support::skip_if_no_network;
+use core_test_support::test_codex::test_codex;
+use reqwest::header::AUTHORIZATION;
+use reqwest::header::HeaderMap;
+use reqwest::header::HeaderValue;
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn header_auth_is_attached_to_responses_requests() -> anyhow::Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let server = start_mock_server().await;
+    let response_mock = mount_sse_once(
+        &server,
+        sse(vec![ev_response_created("resp-1"), ev_completed("resp-1")]),
+    )
+    .await;
+    let mut headers = HeaderMap::new();
+    headers.insert(AUTHORIZATION, HeaderValue::from_static("Bearer external"));
+    headers.insert("x-external-auth", HeaderValue::from_static("enabled"));
+    let mut builder = test_codex().with_auth(CodexAuth::Headers(AuthHeaders::new(headers)));
+    let test = builder.build_with_auto_env(&server).await?;
+
+    test.submit_turn("hello").await?;
+
+    let request = response_mock.single_request();
+    assert_eq!(
+        request.header("authorization").as_deref(),
+        Some("Bearer external")
+    );
+    assert_eq!(
+        request.header("x-external-auth").as_deref(),
+        Some("enabled")
+    );
+    Ok(())
+}

codex-rs/core/tests/suite/mod.rs

@@ -54,6 +54,7 @@ mod exec;
 mod exec_policy;
 #[cfg(not(target_os = "windows"))]
 mod extension_sandbox;
+mod external_auth;
 mod fork_thread;
 #[cfg(not(target_os = "windows"))]
 mod guardian_review;

codex-rs/model-provider-info/src/lib.rs

@@ -244,6 +244,7 @@ impl ModelProviderInfo {
             Some(
                 AuthMode::Chatgpt
                     | AuthMode::ChatgptAuthTokens
+                    | AuthMode::Headers
                     | AuthMode::AgentIdentity
                     | AuthMode::PersonalAccessToken
             )

codex-rs/model-provider-info/src/model_provider_info_tests.rs

@@ -148,6 +148,15 @@ fn test_personal_access_token_uses_chatgpt_codex_base_url() {
     assert_eq!(api_provider.base_url, CHATGPT_CODEX_BASE_URL);
 }
 
+#[test]
+fn test_header_auth_uses_chatgpt_codex_base_url() {
+    let api_provider = ModelProviderInfo::create_openai_provider(/*base_url*/ None)
+        .to_api_provider(Some(AuthMode::Headers))
+        .expect("OpenAI provider should build API provider");
+
+    assert_eq!(api_provider.base_url, CHATGPT_CODEX_BASE_URL);
+}
+
 #[test]
 fn test_supports_remote_compaction_for_azure_name() {
     let provider = ModelProviderInfo {