mirror of
https://github.com/openai/codex.git
synced 2026-10-29 19:08:43 +00:00
riley-oai
b7ad941b1f
## What changed - Introduce `codex-user-verification` with a provider interface for credential status, creation, deletion, and challenge signing. Include typed errors, shared cancellation guards, and hashed account-user key namespaces. - Add P-256 public-key encoding as unpadded base64url SPKI DER, derive credential IDs from its SHA-256 digest, and redact proof fields in debug output. - Add app-server helpers to validate challenge and display-text bounds and map provider errors to typed RPC errors without exposing provider diagnostics. The platform implementation reports verification as unsupported. App-server requests still return typed unavailability, with the message updated to mention build or account availability. ## Testing Add tests for credential encoding and signature verification, invalid curve points, cancellation across guard clones, stable and distinct account namespaces, and invalid challenge or display values. Update the app-server unavailability test for the revised message. GitOrigin-RevId: fe4a4eb37c68d7fdc547704e76aa257abf3e9c81
26 lines
779 B
Rust
26 lines
779 B
Rust
//! Keychain labels isolate account-user identities within the fixed plugin-service scope.
|
|
|
|
use base64::Engine as _;
|
|
use base64::engine::general_purpose::URL_SAFE_NO_PAD;
|
|
use sha2::Digest as _;
|
|
use sha2::Sha256;
|
|
|
|
/// An opaque account-user namespace. App-server authenticates and selects the identity.
|
|
#[derive(Clone, Debug, PartialEq, Eq)]
|
|
pub struct UserVerificationKeyNamespace {
|
|
pub(crate) label: String,
|
|
}
|
|
|
|
impl UserVerificationKeyNamespace {
|
|
pub fn new(account_user_id: &str) -> Self {
|
|
let identity = URL_SAFE_NO_PAD.encode(Sha256::digest(account_user_id.as_bytes()));
|
|
Self {
|
|
label: format!("com.openai.codex.user-verification.plugin-service.v1.{identity}"),
|
|
}
|
|
}
|
|
}
|
|
|
|
#[cfg(test)]
|
|
#[path = "key_namespace_tests.rs"]
|
|
mod tests;
|