mirror of
https://github.com/openai/codex.git
synced 2026-11-06 20:20:34 +00:00
alexsong-oai
fe52d795c9
## What changed Support `model_providers.amazon-bedrock.aws.credential_export` with `command`, `args`, and `timeout_ms` to supply SigV4 signing credentials from a command's JSON output. Accept both flat credential-process output and nested STS `Credentials` objects. Cache credentials in memory, refresh before expiration, and share exports across sessions with matching AWS configuration. On recoverable authentication failures, run the optional `aws.auth_refresh` command before exporting fresh credentials, coalescing concurrent recovery attempts. Bound command execution time and output size, and keep credential values out of errors. Reject combining `aws.credential_export` with `aws.profile`. Bedrock setup and login reject changes while an exporter is configured, preserving configuration and saved credentials. ## Testing Add coverage for output formats, expiration, credential precedence, caching, concurrent recovery, command failures, and secret redaction. Integration tests verify request signing with rotated credentials, bounded recovery attempts, and setup/login rejection across configuration layers. GitOrigin-RevId: 4ef799f88ab5e3b2578f8f41a5e56e4f30e2cd81
49 lines
1.3 KiB
Rust
49 lines
1.3 KiB
Rust
use codex_model_provider_info::AMAZON_BEDROCK_RUNTIME_PROVIDER_ID;
|
|
use codex_model_provider_info::ModelProviderAwsAuthInfo;
|
|
use pretty_assertions::assert_eq;
|
|
|
|
use super::ConfigToml;
|
|
|
|
#[test]
|
|
fn runtime_provider_accepts_aws_profile_and_region_overrides() {
|
|
let config = toml::from_str::<ConfigToml>(
|
|
r#"
|
|
[model_providers.amazon-bedrock-runtime.aws]
|
|
profile = "runtime-profile"
|
|
region = "us-west-2"
|
|
"#,
|
|
)
|
|
.expect("Bedrock Runtime AWS overrides should deserialize");
|
|
|
|
assert_eq!(
|
|
config
|
|
.model_providers
|
|
.get(AMAZON_BEDROCK_RUNTIME_PROVIDER_ID)
|
|
.and_then(|provider| provider.aws.clone()),
|
|
Some(ModelProviderAwsAuthInfo {
|
|
profile: Some("runtime-profile".to_string()),
|
|
region: Some("us-west-2".to_string()),
|
|
credential_export: None,
|
|
auth_refresh: None,
|
|
})
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn custom_provider_still_rejects_aws_auth() {
|
|
let error = toml::from_str::<ConfigToml>(
|
|
r#"
|
|
[model_providers.custom]
|
|
name = "Custom"
|
|
|
|
[model_providers.custom.aws]
|
|
region = "us-west-2"
|
|
"#,
|
|
)
|
|
.expect_err("custom providers must not accept AWS auth");
|
|
|
|
assert!(error.to_string().contains(
|
|
"provider aws is only supported for `amazon-bedrock` or `amazon-bedrock-runtime`"
|
|
));
|
|
}
|