Files
codex/codex-rs/app-server/src/analytics_utils.rs
T
cooper-oai 388aee4b26 Use runtime authentication across backend request paths (#59572)
## What changed

- Share the harness runtime identity with analytics delivery and turn-cost queries, and resolve request authentication together with its account-bound transport policy.
- Add runtime authentication to ChatGPT request helpers and `codex cloud`, including environment discovery. Resolve environment credentials for each request and honor CLI configuration overrides when loading cloud authentication.
- Preserve custom-backend authentication, validate runtime destinations, and keep cloud requests from following redirects.
- Forward only organization and project selectors from model-provider headers to API-key analytics requests.

## Testing

Add regression coverage for runtime request signing, credential refresh, account and resource selection, redirect credential handling, custom destinations, and cloud credential-store overrides.

GitOrigin-RevId: 75f33961ee6482881e9ff9817e99d977f31b65b8
2026-11-05 05:09:32 +00:00

33 lines
1.1 KiB
Rust

use std::sync::Arc;
use codex_analytics::AnalyticsEventsClient;
use codex_core::config::Config;
use codex_login::AuthManager;
use codex_runtime_agent_instance::RuntimeAuthSlot;
pub(crate) fn analytics_events_client_from_config(
auth_manager: Arc<AuthManager>,
config: &Config,
runtime_auth_slot: Option<RuntimeAuthSlot>,
) -> AnalyticsEventsClient {
let api_key_headers =
if codex_model_provider::provider_uses_first_party_auth_path(&config.model_provider) {
match config.model_provider.build_header_map() {
Ok(headers) => headers,
Err(error) => {
tracing::warn!(%error, "failed to resolve analytics resource selectors");
return AnalyticsEventsClient::disabled();
}
}
} else {
Default::default()
};
AnalyticsEventsClient::new_with_runtime(
auth_manager,
config.chatgpt_backend_url(),
config.analytics_enabled,
runtime_auth_slot.map(|slot| (slot, config.runtime_auth_mode)),
api_key_headers,
)
}