Inject Codex auth into credential route proxy

codex-rs/network-proxy/src/lib.rs

@@ -25,6 +25,7 @@ pub use config::NetworkUnixSocketPermission;
 pub use config::NetworkUnixSocketPermissions;
 pub use config::host_and_port_from_network_addr;
 pub use mitm_hook::CredentialedRouteProxyActionConfig;
+pub use mitm_hook::CredentialedRouteProxyHeader;
 pub use mitm_hook::InjectedHeaderConfig;
 pub use mitm_hook::MitmHookActionsConfig;
 pub use mitm_hook::MitmHookBodyConfig;

codex-rs/network-proxy/src/mitm.rs

@@ -584,6 +584,9 @@ fn apply_credentialed_route_proxy_headers(
     action: &crate::mitm_hook::CredentialedRouteProxyAction,
     request_uri: &Uri,
 ) -> Result<()> {
+    for proxy_header in &action.proxy_headers {
+        headers.insert(proxy_header.name.clone(), proxy_header.value.clone());
+    }
     headers.insert(
         HeaderName::from_static(CREDENTIAL_ROUTE_CONNECTOR_ID_HEADER),
         HeaderValue::from_str(&action.connector_id)?,

codex-rs/network-proxy/src/mitm_hook.rs

@@ -116,6 +116,7 @@ pub enum SecretSource {
 pub struct CredentialedRouteProxyActionConfig {
     pub connector_id: String,
     pub link_id: String,
+    pub proxy_headers: Vec<CredentialedRouteProxyHeader>,
     pub proxy_url: String,
 }
 
@@ -123,9 +124,25 @@ pub struct CredentialedRouteProxyActionConfig {
 pub struct CredentialedRouteProxyAction {
     pub connector_id: String,
     pub link_id: String,
+    pub proxy_headers: Vec<CredentialedRouteProxyHeader>,
     pub proxy_url: String,
 }
 
+#[derive(Clone, PartialEq, Eq)]
+pub struct CredentialedRouteProxyHeader {
+    pub name: HeaderName,
+    pub value: HeaderValue,
+}
+
+impl std::fmt::Debug for CredentialedRouteProxyHeader {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("CredentialedRouteProxyHeader")
+            .field("name", &self.name)
+            .field("value", &"<redacted>")
+            .finish()
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct MitmHookBodyMatcher {
     pub raw: serde_json::Value,
@@ -339,6 +356,7 @@ where
                 .map(|action| CredentialedRouteProxyAction {
                     connector_id: action.connector_id.clone(),
                     link_id: action.link_id.clone(),
+                    proxy_headers: action.proxy_headers.clone(),
                     proxy_url: action.proxy_url.clone(),
                 });
 

codex-rs/network-proxy/src/mitm_tests.rs

@@ -282,10 +282,18 @@ fn credentialed_route_proxy_request_rewrites_upstream_target() {
     let action = crate::mitm_hook::CredentialedRouteProxyAction {
         connector_id: "connector_123".to_string(),
         link_id: "link_123".to_string(),
+        proxy_headers: vec![crate::mitm_hook::CredentialedRouteProxyHeader {
+            name: HeaderName::from_static("authorization"),
+            value: HeaderValue::from_static("Bearer codex-token"),
+        }],
         proxy_url: "http://localhost:8080/api/codex/credential_routes/proxy".to_string(),
     };
     let request_uri: Uri = "https://api.example.com/v1/items?limit=5".parse().unwrap();
     let mut headers = HeaderMap::new();
+    headers.insert(
+        HeaderName::from_static("authorization"),
+        HeaderValue::from_static("Bearer provider-token"),
+    );
     headers.insert(
         HeaderName::from_static(CREDENTIAL_ROUTE_REQUEST_URL_HEADER),
         HeaderValue::from_static("https://spoofed.example.com"),
@@ -299,6 +307,10 @@ fn credentialed_route_proxy_request_rewrites_upstream_target() {
         "http://localhost:8080/api/codex/credential_routes/proxy"
     );
     assert_eq!(proxy_authority, "localhost:8080");
+    assert_eq!(
+        headers.get("authorization"),
+        Some(&HeaderValue::from_static("Bearer codex-token"))
+    );
     assert_eq!(
         headers.get(CREDENTIAL_ROUTE_CONNECTOR_ID_HEADER),
         Some(&HeaderValue::from_static("connector_123"))