mirror of
https://github.com/openai/codex.git
synced 2026-11-06 20:20:34 +00:00
smurching-oai
df38cb3b2a
## Why Gateway sign-in needs an alternative for terminals that cannot open a browser. ## What changed - Add optional `gateway_oauth.device_authorization_url` configuration and a `login_with_device_code` API that presents a verification URL and user code, polls for approval, and persists the resulting credentials. - Use the configured proxy and network policy, validate verification URLs, and bound OAuth responses. Support cancellation and report denied or expired codes without exposing issuer error details. ## Testing Add tests for successful authorization and credential persistence, unsafe verification URLs, network-policy denials, denied and expired codes, and cancellation during approval or credential storage. GitOrigin-RevId: 96398578fb866d34929e85c04eadf468d8cd3255
37 lines
1.2 KiB
Rust
37 lines
1.2 KiB
Rust
//! Mock OAuth endpoints for device sign-in tests.
|
|
|
|
use serde_json::json;
|
|
use wiremock::Mock;
|
|
use wiremock::MockGuard;
|
|
use wiremock::MockServer;
|
|
use wiremock::ResponseTemplate;
|
|
use wiremock::matchers::body_string_contains;
|
|
use wiremock::matchers::method;
|
|
use wiremock::matchers::path;
|
|
|
|
/// Issues a challenge and answers one token poll. The guard lets a test wait for that poll.
|
|
pub async fn mount_device_code_grant(
|
|
server: &MockServer,
|
|
token_response: ResponseTemplate,
|
|
) -> MockGuard {
|
|
Mock::given(method("POST"))
|
|
.and(path("/devicecode"))
|
|
.respond_with(ResponseTemplate::new(200).set_body_json(json!({
|
|
"device_code": "secret-device-code", "user_code": "ABCD-EFGH",
|
|
"verification_uri": "https://login.example/device", "expires_in": 60, "interval": 1,
|
|
})))
|
|
.expect(1)
|
|
.mount(server)
|
|
.await;
|
|
Mock::given(method("POST"))
|
|
.and(path("/token"))
|
|
.and(body_string_contains(
|
|
"grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code",
|
|
))
|
|
.and(body_string_contains("device_code=secret-device-code"))
|
|
.respond_with(token_response)
|
|
.expect(1)
|
|
.mount_as_scoped(server)
|
|
.await
|
|
}
|