Files
codex/codex-rs/cloud-config/src/validation_tests.rs
T
alexsong-oai 1aaa453ce2 Enforce managed model provider selection and definitions (#44650)
## What changed

- Support `model_provider` and `model_providers` in managed requirements. Required selection overrides local and session configuration; each required provider definition replaces the corresponding local entry, including its authentication and headers.
- Merge provider requirement fragments before validation, preserving source-relative `auth.cwd` paths. Reject invalid cloud provider definitions before replacing the cached bundle, including unsupported Bedrock overrides.
- Expose `modelProvider` and `modelProviders` through the configuration requirements API and generated schemas. Reject writes to managed provider settings and omit their local origins, including for provider IDs containing dots.

## Testing

Add tests for requirement precedence, authentication fragment merging, path resolution, cloud cache preservation, and read-only configuration RPCs. Integration tests verify that model discovery and inference use the required gateway and ChatGPT authentication without leaking local headers, and that provider requirements survive configuration rebuilds.

GitOrigin-RevId: d1448604d4ef5662ebb5df7b693712d3b8ad6d54
2026-09-10 21:41:39 +00:00

52 lines
1.9 KiB
Rust

use super::*;
use codex_config::CloudRequirementsFragment;
use pretty_assertions::assert_eq;
use tempfile::tempdir;
#[test]
fn cloud_fragments_combine_before_provider_validation() {
let home = tempdir().expect("tempdir");
let base_dir = AbsolutePathBuf::from_absolute_path(home.path()).expect("absolute path");
let mut bundle = CloudConfigBundle::default();
// Cloud fragments arrive highest-priority first.
bundle.requirements_toml.enterprise_managed = vec![
CloudRequirementsFragment {
id: "high".to_string(),
name: "URL".to_string(),
contents: "[model_providers.gateway]\nbase_url = 'https://gateway.example/v1'\n[model_providers.gateway.auth]\ntimeout_ms = 10000\ncwd = 'auth'"
.to_string(),
},
CloudRequirementsFragment {
id: "low".to_string(),
name: "Name".to_string(),
contents: "[model_providers.gateway]\nname = 'Gateway'\n[model_providers.gateway.auth]\ncommand = 'get-token'".to_string(),
},
];
assert_eq!(validate_bundle(&bundle, &base_dir), Ok(()));
}
#[test]
fn cloud_bedrock_overrides_accept_supported_fields() {
let home = tempdir().expect("tempdir");
let base_dir = AbsolutePathBuf::from_absolute_path(home.path()).expect("absolute path");
for provider in ["amazon-bedrock", "amazon-bedrock-runtime"] {
let mut bundle = CloudConfigBundle::default();
bundle.requirements_toml.enterprise_managed = vec![CloudRequirementsFragment {
id: "bedrock".to_string(),
name: "Bedrock".to_string(),
contents: format!(
r#"
[model_providers.{provider}]
base_url = "https://bedrock.example"
[model_providers.{provider}.http_headers]
X-Managed = "required"
[model_providers.{provider}.aws]
profile = "managed"
region = "us-east-1"
"#
),
}];
assert_eq!(validate_bundle(&bundle, &base_dir), Ok(()));
}
}