mirror of
https://github.com/openai/codex.git
synced 2026-10-20 17:38:45 +00:00
Celia Chen
a44afa527c
## Why Successful file fallback can hide a secure-store failure. Storage diagnostics need to distinguish that fallback from explicit file storage while keeping credential values out of error output. ## What changed - Record credential load, save, delete, and fallback-file cleanup outcomes, including secure-store failures and fallback reasons. - Preserve the initiating client's attribution across app-server requests, login tasks, sessions, turns, and blocking token persistence. - Preserve storage error context and typed causes while redacting credential JSON data errors and payload-bearing keyring errors. - Include sanitized fallback completion warnings in the default `codex login` file logs. ## Testing Add coverage for storage policy and metric attribution, credential redaction, login diagnostics, concurrent app-server clients, device-code login, and token refresh during a turn. GitOrigin-RevId: 6d5651c1718d184016fa77befa02aa528750b2ae
52 lines
1.5 KiB
Rust
52 lines
1.5 KiB
Rust
//! Ensures credential payloads cannot escape through diagnostic error formatting.
|
|
|
|
use super::*;
|
|
use keyring::credential::CredentialApi;
|
|
use pretty_assertions::assert_eq;
|
|
|
|
#[test]
|
|
fn payload_bearing_errors_redact_credentials_and_end_the_source_chain() {
|
|
let credential = keyring::mock::MockCredential::default();
|
|
credential.set_password("private-credential-value").unwrap();
|
|
for (error, message) in [
|
|
(
|
|
KeyringError::Ambiguous(vec![Box::new(credential) as Box<keyring::Credential>]),
|
|
"Entry is matched by 1 credentials",
|
|
),
|
|
(
|
|
KeyringError::BadEncoding(b"private-credential-value".to_vec()),
|
|
"Data is not UTF-8 encoded",
|
|
),
|
|
] {
|
|
let error = CredentialStoreError::new(error);
|
|
assert_eq!(
|
|
(
|
|
error.to_string(),
|
|
error.message(),
|
|
format!("{error:?}"),
|
|
error.source().is_none()
|
|
),
|
|
(
|
|
message.to_string(),
|
|
message.to_string(),
|
|
message.to_string(),
|
|
true
|
|
),
|
|
);
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn debug_preserves_native_error_details() {
|
|
let error = CredentialStoreError::new(KeyringError::PlatformFailure(Box::new(
|
|
std::io::Error::new(
|
|
std::io::ErrorKind::PermissionDenied,
|
|
"permission denied by keyring",
|
|
),
|
|
)));
|
|
assert_eq!(
|
|
format!("{error:?}"),
|
|
"Platform secure storage failure: permission denied by keyring",
|
|
);
|
|
}
|