mirror of
https://github.com/openai/codex.git
synced 2026-11-09 20:50:33 +00:00
Celia Chen
94d642d8b4
## Why Credentials can use a keyring backend, so describing all login and logout operations as reads or writes to `auth.json` is misleading. ## What changed - Remove the API-key onboarding claim that keys are stored in `auth.json`. - Describe authentication storage and credential-removal errors in terms of stored credentials and the selected backend. - Label the doctor output's auth-file path as the file backend or fallback, and document why startup checks also consider `config.toml` when credentials may be in a keyring. ## Testing Add API-key entry snapshots for terminal widths of 80 and 40 columns. GitOrigin-RevId: 87189f422448b88721ea2d7448930ece63102803
79 lines
2.9 KiB
Rust
79 lines
2.9 KiB
Rust
//! Conservative authentication checks that run before the provisional composer appears.
|
|
//!
|
|
//! Existing configuration, daemon, or authentication state keeps the composer visible.
|
|
|
|
use std::ffi::OsString;
|
|
use std::io;
|
|
use std::path::Path;
|
|
|
|
use codex_protocol::shell_environment::OPENAI_FEDERATION_RULE_ID_ENV_VAR;
|
|
use codex_protocol::shell_environment::OPENAI_IDENTITY_TOKEN_FILE_ENV_VAR;
|
|
use codex_utils_absolute_path::AbsolutePathBuf;
|
|
|
|
/// Recognize the single configuration override synthesized by the legacy `--search` flag.
|
|
pub(super) fn has_only_search_config_override(cli_kv_overrides: &[(String, toml::Value)]) -> bool {
|
|
matches!(
|
|
cli_kv_overrides,
|
|
[(key, toml::Value::String(value))] if key == "web_search" && value == "live"
|
|
)
|
|
}
|
|
|
|
/// Hide the composer when the default file-backed account cannot already be authenticated.
|
|
pub(super) fn should_delay_startup_composer_for_first_login(
|
|
codex_home: &Path,
|
|
system_config_path: io::Result<AbsolutePathBuf>,
|
|
managed_configuration: impl FnOnce() -> io::Result<bool>,
|
|
environment_variable: impl Fn(&str) -> Option<OsString>,
|
|
) -> bool {
|
|
if environment_variable(codex_login::CODEX_ACCESS_TOKEN_ENV_VAR).is_some_and(|credential| {
|
|
credential
|
|
.to_str()
|
|
.is_some_and(|value| !value.trim().is_empty())
|
|
}) || environment_variable(OPENAI_FEDERATION_RULE_ID_ENV_VAR).is_some()
|
|
|| environment_variable(OPENAI_IDENTITY_TOKEN_FILE_ENV_VAR).is_some()
|
|
{
|
|
return false;
|
|
}
|
|
|
|
let Ok(system_config_path) = system_config_path else {
|
|
return false;
|
|
};
|
|
if !matches!(system_config_path.as_path().try_exists(), Ok(false)) {
|
|
return false;
|
|
}
|
|
|
|
match std::fs::metadata(codex_home) {
|
|
Ok(metadata) if !metadata.is_dir() => return false,
|
|
Ok(_) => {
|
|
// With file auth as the default, auth.json is a hint of existing credentials.
|
|
// An existing config.toml may select keyring storage, which need not create
|
|
// auth.json. Keep the composer visible when any of these files exists;
|
|
// the normal account lookup decides whether sign-in is required.
|
|
for state_file in ["auth.json", "config.toml", "environments.toml"] {
|
|
if !matches!(codex_home.join(state_file).try_exists(), Ok(false)) {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
let Ok(daemon_socket) =
|
|
codex_app_server_client::app_server_control_socket_path(codex_home)
|
|
else {
|
|
return false;
|
|
};
|
|
if !matches!(daemon_socket.as_path().try_exists(), Ok(false)) {
|
|
return false;
|
|
}
|
|
}
|
|
Err(error)
|
|
if error.kind() == io::ErrorKind::NotFound
|
|
&& matches!(codex_home.try_exists(), Ok(false)) => {}
|
|
Err(_) => return false,
|
|
}
|
|
|
|
matches!(managed_configuration(), Ok(false))
|
|
}
|
|
|
|
#[cfg(test)]
|
|
#[path = "startup_preflight_tests.rs"]
|
|
mod tests;
|