mirror of
https://github.com/openai/codex.git
synced 2026-09-11 20:36:49 +00:00
3929c99a97
## Why Bedrock sessions that use the AWS SDK credential chain need a way to recover when credentials expire during a request. ## What changed - Add `aws.auth_refresh` provider configuration with an `aws` command, arguments, and a configurable timeout. - Run the command for refreshable Bedrock authentication failures, reload the SDK credentials, re-sign the request, and retry it. - Share refresh state across matching provider configurations so concurrent failures invoke the command only once. Bearer tokens, command auth, and static environment credentials do not use this recovery path. ## Testing - Add coverage for configuration validation, refreshable error classification, concurrent refresh sharing, and an end-to-end retry signed with refreshed credentials. GitOrigin-RevId: 0302fe3aabdbc1097e7bd62a74d407ba38a3cc57
48 lines
1.2 KiB
Rust
48 lines
1.2 KiB
Rust
use codex_model_provider_info::AMAZON_BEDROCK_RUNTIME_PROVIDER_ID;
|
|
use codex_model_provider_info::ModelProviderAwsAuthInfo;
|
|
use pretty_assertions::assert_eq;
|
|
|
|
use super::ConfigToml;
|
|
|
|
#[test]
|
|
fn runtime_provider_accepts_aws_profile_and_region_overrides() {
|
|
let config = toml::from_str::<ConfigToml>(
|
|
r#"
|
|
[model_providers.amazon-bedrock-runtime.aws]
|
|
profile = "runtime-profile"
|
|
region = "us-west-2"
|
|
"#,
|
|
)
|
|
.expect("Bedrock Runtime AWS overrides should deserialize");
|
|
|
|
assert_eq!(
|
|
config
|
|
.model_providers
|
|
.get(AMAZON_BEDROCK_RUNTIME_PROVIDER_ID)
|
|
.and_then(|provider| provider.aws.clone()),
|
|
Some(ModelProviderAwsAuthInfo {
|
|
profile: Some("runtime-profile".to_string()),
|
|
region: Some("us-west-2".to_string()),
|
|
auth_refresh: None,
|
|
})
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn custom_provider_still_rejects_aws_auth() {
|
|
let error = toml::from_str::<ConfigToml>(
|
|
r#"
|
|
[model_providers.custom]
|
|
name = "Custom"
|
|
|
|
[model_providers.custom.aws]
|
|
region = "us-west-2"
|
|
"#,
|
|
)
|
|
.expect_err("custom providers must not accept AWS auth");
|
|
|
|
assert!(error.to_string().contains(
|
|
"provider aws is only supported for `amazon-bedrock` or `amazon-bedrock-runtime`"
|
|
));
|
|
}
|