alexsong-oai a129392ebb Add OAuth credential management for model provider gateways (#46318) ...

## What changed

- Export `GatewayAuthConfig` and `GatewayAuthManager` with PKCE browser sign-in, loopback callbacks, cached token resolution, and refresh after expiry or rejection.
- Store gateway credentials in a dedicated encrypted namespace with an independent keyring key. Serialize token exchanges and persistence across processes, preserve refresh rotations after caller cancellation, and retain pending credentials when saving fails.
- Validate OAuth endpoints and token responses, disable token-request redirects and logging, and redact sensitive error details.

## Testing

Add tests covering browser authorization, callback state validation and cleanup, concurrent refreshes, cancellation, failed-save recovery, storage isolation, endpoint validation, and credential redaction.

GitOrigin-RevId: e0c17f1eab7acca378a14b2d00b80940d8542e47

2026-09-17 23:35:32 +00:00

..

src

Add OAuth credential management for model provider gateways (#46318)

2026-09-17 23:35:32 +00:00

BUILD.bazel

…

Cargo.toml

Disable empty Cargo test targets (#21584)

2026-05-07 15:44:17 -07:00