openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-14 11:57:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

oauth: invert macOS debug keyring env flag semantics

Browse Source 
Rename CODEX_MCP_OAUTH_KEYRING_DEBUG_ALLOW to
CODEX_MCP_OAUTH_KEYRING_DEBUG_DISABLE and flip the logic so that
setting CODEX_MCP_OAUTH_KEYRING_DEBUG_DISABLE=1 disables keyring
access in debug builds on macOS. Update the error message accordingly.
This commit is contained in:
pakrym-oai
2026-01-08 11:58:59 -08:00
parent 069dc2895f
commit f2a14cea60
1 changed files with 5 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
codex-rs/rmcp-client/src/oauth.rs
View File

@@ -50,7 +50,7 @@ use tokio::sync::Mutex;
use crate::find_codex_home::find_codex_home;
const KEYRING_SERVICE: &str = "Codex MCP Credentials";
const MCP_OAUTH_KEYRING_DEBUG_ALLOW_ENV_VAR: &str = "CODEX_MCP_OAUTH_KEYRING_DEBUG_ALLOW";
const MCP_OAUTH_KEYRING_DEBUG_DISABLE_ENV_VAR: &str = "CODEX_MCP_OAUTH_KEYRING_DEBUG_DISABLE";
const REFRESH_SKEW_MILLIS: u64 = 30_000;
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
@@ -97,12 +97,9 @@ pub(crate) fn load_oauth_tokens(
store_mode: OAuthCredentialsStoreMode,
) -> Result<Option<StoredOAuthTokens>> {
if keyring_load_disabled_in_debug() {
if store_mode == OAuthCredentialsStoreMode::Keyring {
return Err(anyhow::anyhow!(
"MCP OAuth keyring access is disabled in debug builds on macOS; set {MCP_OAUTH_KEYRING_DEBUG_ALLOW_ENV_VAR}=1 to enable."
));
}
return load_oauth_tokens_from_file(server_name, url);
return Err(anyhow::anyhow!(
"MCP OAuth keyring access is disabled in debug because {MCP_OAUTH_KEYRING_DEBUG_DISABLE_ENV_VAR} is set."
));
}
let keyring_store = DefaultKeyringStore;
@@ -129,7 +126,7 @@ pub(crate) fn has_oauth_tokens(
fn keyring_load_disabled_in_debug() -> bool {
cfg!(debug_assertions)
&& cfg!(target_os = "macos")
&& std::env::var_os(MCP_OAUTH_KEYRING_DEBUG_ALLOW_ENV_VAR).is_none()
&& std::env::var_os(MCP_OAUTH_KEYRING_DEBUG_DISABLE_ENV_VAR).is_some_and(|v| v == "1")
}
fn refresh_expires_in_from_timestamp(tokens: &mut StoredOAuthTokens) {