alexsong-oai b1263c593d Support credential export commands for gateway authentication (#59787) ...

## What changed

Allow `model_providers.<id>.gateway_oauth.credential_export` to supply a gateway access token instead of browser OAuth. Run the configured command on first use, cache its token in memory, and deliver it through the configured header or cookie. Export failures surface directly, and command-backed providers do not require an OAuth session.

Require mutually exclusive OAuth and exporter settings, same-origin model catalog access, and rejection of HTTP redirects for command-backed gateway credentials. Share the bounded, timeout-controlled command runner with AWS credential export.

## Testing

Add tests for inference and model listing without OAuth, token caching and recovery after invalid output, preservation of primary authentication, and rejection of mixed OAuth/exporter configuration.

GitOrigin-RevId: e3dbfd8823b1992045f1c1efd56ec98ee17e07a5

2026-11-06 02:00:39 +00:00

..

src

Support credential export commands for gateway authentication (#59787)

2026-11-06 02:00:39 +00:00

tests

Share runtime authentication with model providers and catalogs (#57607)

2026-10-28 00:51:29 +00:00

BUILD.bazel

feat: add opt-in provider runtime abstraction (#17713)

2026-04-17 02:27:45 +00:00

Cargo.toml

Share runtime authentication with model providers and catalogs (#57607)

2026-10-28 00:51:29 +00:00