mirror of
https://github.com/openai/codex.git
synced 2026-10-24 18:18:41 +00:00
Adrian
904c751a40
## Summary Introduces a single background/control-plane agent task for ChatGPT backend requests that do not have a thread-scoped task, with `AuthManager` owning the default ChatGPT backend authorization decision. Callers now ask `AuthManager` for the default ChatGPT backend authorization header. `AuthManager` decides whether that is bearer or background AgentAssertion based on config/internal state, while low-level bootstrap paths can explicitly request bearer-only auth. This PR is stacked on PR4 and focuses on the shared background task auth plumbing plus the first tranche of backend/control-plane consumers. The remaining callsite wiring is split into PR4.2 to keep review size down. ## Stack - PR1: https://github.com/openai/codex/pull/17385 - add `features.use_agent_identity` - PR2: https://github.com/openai/codex/pull/17386 - register agent identities when enabled - PR3: https://github.com/openai/codex/pull/17387 - register agent tasks when enabled - PR3.1: https://github.com/openai/codex/pull/17978 - persist and prewarm registered tasks per thread - PR4: https://github.com/openai/codex/pull/17980 - use task-scoped `AgentAssertion` for downstream calls - PR4.1: this PR - introduce AuthManager-owned background/control-plane `AgentAssertion` auth - PR4.2: https://github.com/openai/codex/pull/18260 - use background task auth for additional backend/control-plane calls ## What Changed - add background task registration and assertion minting inside `codex-login` - persist `agent_identity.background_task_id` separately from per-session task state - make `BackgroundAgentTaskManager` private to `codex-login`; call sites do not instantiate or pass it around - teach `AuthManager` the ChatGPT backend base URL and feature-derived background auth mode from resolved config - expose bearer-only helpers for bootstrap/registration/refresh-style paths that must not use AgentAssertion - wire `AuthManager` default ChatGPT authorization through app listing, connector directory listing, remote plugins, MCP status/listing, analytics, and core-skills remote calls - preserve bearer fallback when the feature is disabled, the backend host is unsupported, or background task registration is not available ## Validation - `just fmt` - `cargo check -p codex-core -p codex-login -p codex-analytics -p codex-app-server -p codex-cloud-requirements -p codex-cloud-tasks -p codex-models-manager -p codex-chatgpt -p codex-model-provider -p codex-mcp -p codex-core-skills` - `cargo test -p codex-login agent_identity` - `cargo test -p codex-model-provider bearer_auth_provider` - `cargo test -p codex-core agent_assertion` - `cargo test -p codex-app-server remote_control` - `cargo test -p codex-cloud-requirements fetch_cloud_requirements` - `cargo test -p codex-models-manager manager::tests` - `cargo test -p codex-chatgpt` - `cargo test -p codex-cloud-tasks` - `just fix -p codex-core -p codex-login -p codex-analytics -p codex-app-server -p codex-cloud-requirements -p codex-cloud-tasks -p codex-models-manager -p codex-chatgpt -p codex-model-provider -p codex-mcp -p codex-core-skills` - `just fix -p codex-app-server` - `git diff --check`
53 lines
1.7 KiB
Rust
53 lines
1.7 KiB
Rust
pub mod agent_identity;
|
|
pub mod auth;
|
|
pub mod auth_env_telemetry;
|
|
pub mod token_data;
|
|
|
|
mod device_code_auth;
|
|
mod pkce;
|
|
mod server;
|
|
|
|
pub use codex_client::BuildCustomCaTransportError as BuildLoginHttpClientError;
|
|
pub use codex_config::types::AuthCredentialsStoreMode;
|
|
pub use device_code_auth::DeviceCode;
|
|
pub use device_code_auth::complete_device_code_login;
|
|
pub use device_code_auth::request_device_code;
|
|
pub use device_code_auth::run_device_code_login;
|
|
pub use server::LoginServer;
|
|
pub use server::ServerOptions;
|
|
pub use server::ShutdownHandle;
|
|
pub use server::run_login_server;
|
|
|
|
pub use agent_identity::BackgroundAgentTaskAuthMode;
|
|
pub use agent_identity::cached_background_agent_task_authorization_header_value;
|
|
pub use auth::AgentIdentityAuthRecord;
|
|
pub use auth::AgentTaskAuthorizationTarget;
|
|
pub use auth::AuthConfig;
|
|
pub use auth::AuthDotJson;
|
|
pub use auth::AuthManager;
|
|
pub use auth::AuthManagerConfig;
|
|
pub use auth::CLIENT_ID;
|
|
pub use auth::CODEX_API_KEY_ENV_VAR;
|
|
pub use auth::CodexAuth;
|
|
pub use auth::ExternalAuth;
|
|
pub use auth::ExternalAuthChatgptMetadata;
|
|
pub use auth::ExternalAuthRefreshContext;
|
|
pub use auth::ExternalAuthRefreshReason;
|
|
pub use auth::ExternalAuthTokens;
|
|
pub use auth::OPENAI_API_KEY_ENV_VAR;
|
|
pub use auth::REFRESH_TOKEN_URL_OVERRIDE_ENV_VAR;
|
|
pub use auth::REVOKE_TOKEN_URL_OVERRIDE_ENV_VAR;
|
|
pub use auth::RefreshTokenError;
|
|
pub use auth::UnauthorizedRecovery;
|
|
pub use auth::default_client;
|
|
pub use auth::enforce_login_restrictions;
|
|
pub use auth::load_auth_dot_json;
|
|
pub use auth::login_with_api_key;
|
|
pub use auth::logout;
|
|
pub use auth::logout_with_revoke;
|
|
pub use auth::read_openai_api_key_from_env;
|
|
pub use auth::save_auth;
|
|
pub use auth_env_telemetry::AuthEnvTelemetry;
|
|
pub use auth_env_telemetry::collect_auth_env_telemetry;
|
|
pub use token_data::TokenData;
|