Files
codex/codex-rs/runtime-agent-instance/src/actor.rs
T
cooper-oai 091008729d Share runtime authentication across requests and credential refreshes (#55413)
## What changed

Add `RuntimeAuthManager` to share one registered runtime per credential source and return request-scoped `RuntimeAuth` values that pair the runtime with its credentials and HTTP client factory.

- Preserve registration keys and idempotency IDs across retryable failures and refreshes that retain the credential source.
- Replace the runtime when the credential source changes, preserve existing request snapshots, and reject late registration responses for a previous source.
- Use bounded credential recovery for registration `401` responses and cache `403` denials until the credential source changes.
- Expose authenticated actor and agent host information on `RuntimeAgentInstance`.

## Testing

Add tests for concurrent registration sharing, retry identity preservation, network policy recovery, credential refresh and replacement, bounded recovery, cached denials, and credential changes during registration.

GitOrigin-RevId: ea1e6e10a5939e8c3f7c0c317ccf8a83522c635f
2026-10-20 00:48:09 +00:00

30 lines
594 B
Rust

//! Actor and host information returned by composite registration, without another hydration call.
use crate::ActorInfo;
use crate::AgentHostAuthorization;
pub struct AuthenticatedActor {
pub(crate) info: ActorInfo,
}
impl AuthenticatedActor {
pub fn info(&self) -> &ActorInfo {
&self.info
}
}
pub struct AgentHost {
pub(crate) id: String,
pub(crate) authorization: AgentHostAuthorization,
}
impl AgentHost {
pub fn id(&self) -> &str {
&self.id
}
pub fn authorization(&self) -> &AgentHostAuthorization {
&self.authorization
}
}