From 94def617495a43cc0fd2ce614b7306ef19f0a160 Mon Sep 17 00:00:00 2001
From: rreichel3-oai <rreichel3@openai.com>
Date: Wed, 6 May 2026 15:24:56 -0400
Subject: [PATCH] Send forced workspaces as one auth query param

codex-rs/login/src/server.rs: join forced ChatGPT workspace IDs into one comma-separated allowed_workspace_id query parameter for authapi compatibility.

codex-rs/login/tests/suite/login_server_e2e.rs: update the multi-workspace login-server regression test to assert exactly one allowed_workspace_id value.
---
 codex-rs/login/src/server.rs                  |  7 +------
 .../login/tests/suite/login_server_e2e.rs     | 21 ++++++++++---------
 2 files changed, 12 insertions(+), 16 deletions(-)

diff --git a/codex-rs/login/src/server.rs b/codex-rs/login/src/server.rs
index c137be9273..b72bc946f2 100644
--- a/codex-rs/login/src/server.rs
+++ b/codex-rs/login/src/server.rs
@@ -508,12 +508,7 @@ fn build_authorize_url(
         ("originator".to_string(), originator().value),
     ];
     if let Some(workspace_ids) = forced_chatgpt_workspace_ids {
-        query.extend(
-            workspace_ids
-                .iter()
-                .cloned()
-                .map(|workspace_id| ("allowed_workspace_id".to_string(), workspace_id)),
-        );
+        query.push(("allowed_workspace_id".to_string(), workspace_ids.join(",")));
     }
     let qs = query
         .into_iter()
diff --git a/codex-rs/login/tests/suite/login_server_e2e.rs b/codex-rs/login/tests/suite/login_server_e2e.rs
index ee9aca131e..f8f6223d9a 100644
--- a/codex-rs/login/tests/suite/login_server_e2e.rs
+++ b/codex-rs/login/tests/suite/login_server_e2e.rs
@@ -12,7 +12,9 @@ use codex_config::types::AuthCredentialsStoreMode;
 use codex_login::ServerOptions;
 use codex_login::run_login_server;
 use core_test_support::skip_if_no_network;
+use pretty_assertions::assert_eq;
 use tempfile::tempdir;
+use url::Url;
 
 const DEFAULT_LOGIN_PORT: u16 = 1455;
 const FALLBACK_LOGIN_PORT: u16 = 1457;
@@ -205,7 +207,7 @@ async fn creates_missing_codex_home_dir() -> Result<()> {
 }
 
 #[tokio::test]
-async fn login_server_includes_all_forced_workspace_query_params() -> Result<()> {
+async fn login_server_includes_forced_workspaces_as_one_query_param() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let (issuer_addr, _issuer_handle) = start_mock_issuer("org-123");
@@ -230,15 +232,14 @@ async fn login_server_includes_all_forced_workspace_query_params() -> Result<()>
         codex_streamlined_login: false,
     };
     let server = run_login_server(opts)?;
-    assert!(
-        server
-            .auth_url
-            .contains("allowed_workspace_id=org-required-a")
-    );
-    assert!(
-        server
-            .auth_url
-            .contains("allowed_workspace_id=org-required-b")
+    let auth_url = Url::parse(&server.auth_url)?;
+    let allowed_workspace_ids = auth_url
+        .query_pairs()
+        .filter_map(|(key, value)| (key == "allowed_workspace_id").then(|| value.into_owned()))
+        .collect::<Vec<_>>();
+    assert_eq!(
+        allowed_workspace_ids,
+        vec!["org-required-a,org-required-b".to_string()]
     );
 
     Ok(())