mirror of
https://github.com/openai/codex.git
synced 2026-10-22 17:58:46 +00:00
Celia Chen
56c97e3b5c
## Why Windows Credential Manager limits generic credential blobs to 2,560 bytes. Large serialized ChatGPT auth payloads can exceed that limit, so keyring-mode CLI auth needs a backend that keeps only the encryption key in the OS keyring and stores the payload in Codex's encrypted local-secrets file. This is the third PR in the encrypted-auth stack: 1. #27504 — feature and config selection 2. #27535 — auth-specific local-secrets namespaces 3. This PR — CLI auth implementation and activation 4. MCP OAuth implementation and activation ## What Changed - Added encrypted CLI-auth storage using the `CliAuth` secrets namespace. - Preserved direct keyring storage for platforms/configurations where it remains selected. - Selected the backend consistently for login, logout, refresh, device-code login, auth loading, and login restrictions. - Threaded resolved bootstrap/full config through CLI, exec, TUI, app-server account handling, cloud config, and cloud tasks. - Removed stale `auth.json` fallback data after successful encrypted saves and removed encrypted, direct-keyring, and fallback data during logout. - Added storage and integration coverage for both direct and encrypted keyring modes. MCP OAuth persistence is intentionally left to the next PR. ## Validation - `just test -p codex-login` — 131 passed - `just test -p codex-cli` — 280 passed - `just test -p codex-app-server v2::account` — 25 passed - `just test -p codex-cloud-config service` — 21 passed, 7 skipped - `just fix -p codex-login` - `just fix -p codex-cli` - `just fmt`
58 lines
1.6 KiB
TOML
58 lines
1.6 KiB
TOML
[package]
|
|
name = "codex-login"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
base64 = { workspace = true }
|
|
chrono = { workspace = true, features = ["serde"] }
|
|
codex-agent-identity = { workspace = true }
|
|
codex-app-server-protocol = { workspace = true }
|
|
codex-client = { workspace = true }
|
|
codex-config = { workspace = true }
|
|
codex-keyring-store = { workspace = true }
|
|
codex-model-provider-info = { workspace = true }
|
|
codex-otel = { workspace = true }
|
|
codex-protocol = { workspace = true }
|
|
codex-secrets = { workspace = true }
|
|
codex-terminal-detection = { workspace = true }
|
|
codex-utils-template = { workspace = true }
|
|
once_cell = { workspace = true }
|
|
os_info = { workspace = true }
|
|
rand = { workspace = true }
|
|
reqwest = { workspace = true, features = ["json", "blocking"] }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tiny_http = { workspace = true }
|
|
tokio = { workspace = true, features = [
|
|
"io-std",
|
|
"macros",
|
|
"process",
|
|
"rt-multi-thread",
|
|
"signal",
|
|
] }
|
|
tracing = { workspace = true }
|
|
url = { workspace = true }
|
|
urlencoding = { workspace = true }
|
|
webbrowser = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
anyhow = { workspace = true }
|
|
core_test_support = { workspace = true }
|
|
jsonwebtoken = { workspace = true }
|
|
keyring = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
regex-lite = { workspace = true }
|
|
serial_test = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
wiremock = { workspace = true }
|
|
|
|
[lib]
|
|
doctest = false
|