mirror of
https://github.com/openai/codex.git
synced 2026-10-19 17:28:46 +00:00
riley-oai
b7ad941b1f
## What changed - Introduce `codex-user-verification` with a provider interface for credential status, creation, deletion, and challenge signing. Include typed errors, shared cancellation guards, and hashed account-user key namespaces. - Add P-256 public-key encoding as unpadded base64url SPKI DER, derive credential IDs from its SHA-256 digest, and redact proof fields in debug output. - Add app-server helpers to validate challenge and display-text bounds and map provider errors to typed RPC errors without exposing provider diagnostics. The platform implementation reports verification as unsupported. App-server requests still return typed unavailability, with the message updated to mention build or account availability. ## Testing Add tests for credential encoding and signature verification, invalid curve points, cancellation across guard clones, stable and distinct account namespaces, and invalid challenge or display values. Update the app-server unavailability test for the revised message. GitOrigin-RevId: fe4a4eb37c68d7fdc547704e76aa257abf3e9c81
34 lines
1015 B
Rust
34 lines
1015 B
Rust
//! Validates the wire-to-native boundary before any provider work can start.
|
|
|
|
use super::*;
|
|
use pretty_assertions::assert_eq;
|
|
use serde_json::json;
|
|
|
|
#[test]
|
|
fn invalid_challenge_and_display_values_are_rejected_before_native_work() {
|
|
for (challenge, title, description) in [
|
|
("".into(), "Approve".into(), String::new()),
|
|
("AQ==".into(), "Approve".into(), String::new()),
|
|
(
|
|
URL_SAFE_NO_PAD.encode(vec![0; 4097]),
|
|
"Approve".into(),
|
|
String::new(),
|
|
),
|
|
("AQ".into(), String::new(), String::new()),
|
|
("AQ".into(), "é".repeat(129), String::new()),
|
|
("AQ".into(), "Approve".into(), "x".repeat(4097)),
|
|
] {
|
|
let error = validate(rpc::UserVerificationVerifyParams {
|
|
challenge,
|
|
title,
|
|
description,
|
|
})
|
|
.err()
|
|
.unwrap();
|
|
assert_eq!(
|
|
error.data,
|
|
Some(json!({"type": "invalidRequest", "reason": "invalidParams"}))
|
|
);
|
|
}
|
|
}
|