mirror of
https://github.com/openai/codex.git
synced 2026-10-30 19:18:49 +00:00
Celia Chen
b724f5966e
## Why Windows Credential Manager limits generic credential blobs to 2,560 bytes. The encrypted local secrets backend avoids storing large serialized auth payloads directly in the OS keyring, but selecting that backend needs an independently reviewable feature/config layer before the auth and secrets implementation is wired in. ## What Changed - Added the stable `secret_auth_storage` feature, enabled by default on Windows and disabled by default elsewhere. - Added `AuthKeyringBackendKind` and config resolution for full and bootstrap config loading. - Applied managed feature requirements when resolving the bootstrap auth backend. - Updated the generated config schema and added focused tests. This is the base PR for #17931. The auth, secrets, MCP, CLI, TUI, and app-server implementation remains in that follow-up PR. ## Validation - `just test -p codex-features` - `just test -p codex-config` - `just test -p codex-core resolve_bootstrap_auth_keyring_backend_kind_uses_secret_auth_storage_feature` - `just write-config-schema` - `just fix -p codex-core` The full `just test -p codex-core` run compiled successfully and ran 2,690 tests; 2,589 passed, one was flaky, and 101 environment-sensitive tests failed because this shell injects a `pyenv` rehash warning into command output or because sandboxed subprocesses timed out.
60 lines
1.9 KiB
Rust
60 lines
1.9 KiB
Rust
use super::Config;
|
|
use super::ConfigTomlLoadResult;
|
|
use super::ManagedFeatures;
|
|
use codex_config::types::AuthKeyringBackendKind;
|
|
use codex_features::Feature;
|
|
use codex_features::FeatureConfigSource;
|
|
use codex_features::FeatureOverrides;
|
|
use codex_features::Features;
|
|
|
|
impl Config {
|
|
pub fn auth_keyring_backend_kind(&self) -> AuthKeyringBackendKind {
|
|
auth_keyring_backend_kind_from_secret_auth_storage(
|
|
self.features.enabled(Feature::SecretAuthStorage),
|
|
)
|
|
}
|
|
}
|
|
|
|
/// Resolve the auth keyring backend from a partially loaded bootstrap config.
|
|
///
|
|
/// This is intended for startup paths that must read auth before managed cloud
|
|
/// requirements can be loaded and before a full [`Config`] exists.
|
|
pub fn resolve_bootstrap_auth_keyring_backend_kind(
|
|
bootstrap_config: &ConfigTomlLoadResult,
|
|
) -> std::io::Result<AuthKeyringBackendKind> {
|
|
let config_toml = &bootstrap_config.config_toml;
|
|
let features = Features::from_sources(
|
|
FeatureConfigSource {
|
|
features: config_toml.features.as_ref(),
|
|
experimental_use_unified_exec_tool: config_toml.experimental_use_unified_exec_tool,
|
|
},
|
|
FeatureConfigSource::default(),
|
|
FeatureOverrides::default(),
|
|
);
|
|
let managed_features = ManagedFeatures::from_configured(
|
|
features,
|
|
bootstrap_config
|
|
.config_layer_stack
|
|
.requirements()
|
|
.feature_requirements
|
|
.clone(),
|
|
)?;
|
|
Ok(auth_keyring_backend_kind_from_secret_auth_storage(
|
|
managed_features.enabled(Feature::SecretAuthStorage),
|
|
))
|
|
}
|
|
|
|
fn auth_keyring_backend_kind_from_secret_auth_storage(
|
|
secret_auth_storage_enabled: bool,
|
|
) -> AuthKeyringBackendKind {
|
|
if secret_auth_storage_enabled {
|
|
AuthKeyringBackendKind::Secrets
|
|
} else {
|
|
AuthKeyringBackendKind::Direct
|
|
}
|
|
}
|
|
|
|
#[cfg(test)]
|
|
#[path = "auth_keyring_tests.rs"]
|
|
mod tests;
|