mirror of
https://github.com/openai/codex.git
synced 2026-08-23 13:09:46 +00:00
936f5eb3ee
## What changed - Add the `codex-workload-identity` crate for exchanging a file-backed JWT assertion and federation rule ID for short-lived ChatGPT credentials. - Cache valid access tokens, refresh them before expiry or after rejection, and coalesce concurrent exchanges. Continue using a still-valid cached token when a proactive refresh fails transiently. - Validate assertion files, token endpoints, and exchange responses; honor outbound proxy policy for HTTPS endpoints and redact access tokens from debug output. ## Testing - Cover request encoding, assertion rotation, caching, concurrent refreshes, transient-failure fallback, configuration validation, and malformed inputs and responses. GitOrigin-RevId: 5496851683c2dcf6aaad6840053b97f7c0be076e
28 lines
686 B
TOML
28 lines
686 B
TOML
[package]
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
name = "codex-workload-identity"
|
|
version.workspace = true
|
|
|
|
[lib]
|
|
doctest = false
|
|
name = "codex_workload_identity"
|
|
path = "src/lib.rs"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
codex-http-client = { workspace = true }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true, features = ["fs", "io-util", "sync"] }
|
|
url = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
pretty_assertions = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
|
|
wiremock = { workspace = true }
|