mirror of
https://github.com/openai/codex.git
synced 2026-10-21 17:48:44 +00:00
jif
c419fd01a7
## What changed - Prefer an eligible account grant over saved enterprise credentials, with a fallback to saved enterprise sign-in during initial connection if the account grant is rejected. - Remember rejected account grants per enterprise MCP registration across threads and report authentication failures as requiring reauthentication. Keep administrator configuration errors distinct from sign-in failures. - Compare account grants independently of access and ID token rotation, recheck the latest identity eligibility after exchange, and retry once when the refresh grant changes. - Make MCP authentication status reflect usable account grants, saved enterprise credentials, and completed connection failures. ## Testing Extend regression coverage for enterprise sign-in failures and recovery, MCP authentication status, account grant identity across token refreshes, and retries after transient credential failures. GitOrigin-RevId: eeac65f668d5d2d55e9d8bf4547fbcbdd6a6c42d
97 lines
3.5 KiB
Rust
97 lines
3.5 KiB
Rust
pub mod auth;
|
|
pub mod auth_env_telemetry;
|
|
pub mod test_support;
|
|
pub mod token_data;
|
|
pub use auth::WorkspaceRouting;
|
|
pub use auth::WorkspaceRoutingRequest;
|
|
pub use auth::WorkspaceRoutingResolver;
|
|
pub use auth::WorkspaceRoutingSession;
|
|
|
|
mod callback_params;
|
|
mod device_code_auth;
|
|
mod oauth;
|
|
mod oauth_session;
|
|
mod outbound_proxy;
|
|
mod pkce;
|
|
mod server;
|
|
mod success_page;
|
|
|
|
pub use callback_params::LoginCallbackResult;
|
|
pub use callback_params::LoginOnboardingEntrypoint;
|
|
pub use codex_config::types::AuthCredentialsStoreMode;
|
|
pub use codex_http_client::BuildCustomCaTransportError as BuildLoginHttpClientError;
|
|
pub use device_code_auth::DeviceCode;
|
|
pub use device_code_auth::complete_device_code_login;
|
|
pub use device_code_auth::request_device_code;
|
|
pub use device_code_auth::run_device_code_login;
|
|
pub use server::LoginServer;
|
|
pub use server::ServerOptions;
|
|
pub use server::ShutdownHandle;
|
|
pub use server::run_login_server;
|
|
pub use success_page::CODEX_OPEN_APP_URL;
|
|
pub use success_page::LoginSuccessPage;
|
|
pub use success_page::LoginSuccessPageBrand;
|
|
|
|
pub use auth::AccountOAuthGrant;
|
|
pub use auth::AccountOAuthGrantLease;
|
|
pub use auth::AccountOAuthGrantRevision;
|
|
pub use auth::AgentIdentityAuthPolicy;
|
|
pub use auth::AuthChangeState;
|
|
pub use auth::AuthConfig;
|
|
pub use auth::AuthDotJson;
|
|
pub use auth::AuthHeaders;
|
|
pub use auth::AuthKeyringBackendKind;
|
|
pub use auth::AuthManager;
|
|
pub use auth::AuthManagerConfig;
|
|
pub use auth::AuthManagerInitializationError;
|
|
pub use auth::AuthRuntimeConfig;
|
|
pub use auth::CLIENT_ID;
|
|
pub use auth::CLIENT_ID_OVERRIDE_ENV_VAR;
|
|
pub use auth::CODEX_ACCESS_TOKEN_ENV_VAR;
|
|
pub use auth::CODEX_API_KEY_ENV_VAR;
|
|
pub use auth::CodexAuth;
|
|
pub use auth::ExternalAuth;
|
|
pub use auth::ExternalAuthFuture;
|
|
pub use auth::ExternalAuthRefreshContext;
|
|
pub use auth::ExternalAuthRefreshReason;
|
|
pub use auth::OPENAI_API_KEY_ENV_VAR;
|
|
pub use auth::REFRESH_TOKEN_URL_OVERRIDE_ENV_VAR;
|
|
pub use auth::REVOKE_TOKEN_URL_OVERRIDE_ENV_VAR;
|
|
pub use auth::RefreshTokenError;
|
|
pub use auth::UnauthorizedRecovery;
|
|
pub use auth::default_client;
|
|
pub use auth::enforce_login_restrictions;
|
|
pub use auth::is_workload_identity_selected;
|
|
pub use auth::load_auth_dot_json;
|
|
pub use auth::login_with_access_token;
|
|
pub use auth::login_with_api_key;
|
|
pub use auth::login_with_bedrock_access_keys;
|
|
pub use auth::login_with_bedrock_api_key;
|
|
pub use auth::logout;
|
|
pub use auth::logout_with_revoke;
|
|
pub use auth::oauth_client_id;
|
|
pub use auth::read_codex_access_token_from_env;
|
|
pub use auth::read_openai_api_key_from_env;
|
|
pub use auth::save_auth;
|
|
pub use auth_env_telemetry::AuthEnvTelemetry;
|
|
pub use auth_env_telemetry::collect_auth_env_telemetry;
|
|
pub use outbound_proxy::AuthRouteConfig;
|
|
pub use token_data::TokenData;
|
|
|
|
// Existing inference-gateway names continue to refer to the same grant manager.
|
|
pub use oauth_session::OAuthLoginControl as GatewayLoginControl;
|
|
pub use oauth_session::OAuthSessionConfig as GatewayAuthConfig;
|
|
pub use oauth_session::OAuthSessionError as GatewayAuthError;
|
|
pub use oauth_session::OAuthSessionManager as GatewayAuthManager;
|
|
pub use oauth_session::OAuthSessionStatus as GatewayAuthStatus;
|
|
pub use oauth_session::OAuthSessionStatusChange as GatewayAuthStatusChange;
|
|
pub use oauth_session::subscribe_oauth_session_status as subscribe_gateway_auth_status;
|
|
|
|
pub use oauth_session::OAuthLoginControl;
|
|
pub use oauth_session::OAuthSessionConfig;
|
|
pub use oauth_session::OAuthSessionError;
|
|
pub use oauth_session::OAuthSessionManager;
|
|
pub use oauth_session::OAuthSessionStatus;
|
|
pub use oauth_session::OAuthSessionStatusChange;
|
|
pub use oauth_session::subscribe_oauth_session_status;
|