cooper-oai f39e45e4a6 Support API workload identity authentication (#59275) ...

## Why

Workload identity authentication assumed every token exchange resolved to ChatGPT, preventing API service accounts from using the same flow.

## What changed

- Accept `wif_product: "api"` responses with organization, project, and service account metadata. Preserve ChatGPT compatibility when `wif_product` is omitted.
- Resolve API workload identity tokens as API key authentication and apply login restrictions to the resolved product. Read the actual login status during TUI startup instead of assuming ChatGPT.
- Preserve auth ownership across token renewal for the same API identity, and reject product or identity changes during refresh.
- Redact API keys from debug output.

## Testing

Add coverage for both exchange products, malformed metadata, assertion rotation and unauthorized recovery, identity changes, login and workspace restrictions, and CLI login status under both forced login methods.

GitOrigin-RevId: f4fc4da74b86e4a9ae47b28221d3e065500f5b6e

2026-11-04 00:52:58 +00:00

..

assertion.rs

Add workload identity token exchange support (#37610)

2026-08-08 17:18:02 +00:00

exchange.rs

Support API workload identity authentication (#59275)

2026-11-04 00:52:58 +00:00

lib.rs

Support API workload identity authentication (#59275)

2026-11-04 00:52:58 +00:00

workload_identity_tests.rs

Support API workload identity authentication (#59275)

2026-11-04 00:52:58 +00:00