mirror of
https://github.com/openai/codex.git
synced 2026-05-20 03:05:02 +00:00
## Summary This PR moves Codex backend request authentication from direct bearer-token handling to `AuthProvider`. The new `codex-auth-provider` crate defines the shared request-auth trait. `CodexAuth::provider()` returns a provider that can apply all headers needed for the selected auth mode. This lets ChatGPT token auth and AgentIdentity auth share the same callsite path: - ChatGPT token auth applies bearer auth plus account/FedRAMP headers where needed. - AgentIdentity auth applies AgentAssertion plus account/FedRAMP headers where needed. Reference old stack: https://github.com/openai/codex/pull/17387/changes ## Callsite Migration | Area | Change | | --- | --- | | backend-client | accepts an `AuthProvider` instead of a raw token/header | | chatgpt client/connectors | applies auth through `CodexAuth::provider()` | | cloud tasks | keeps Codex-backend gating, applies auth through provider | | cloud requirements | uses Codex-backend auth checks and provider headers | | app-server remote control | applies provider headers for backend calls | | MCP Apps/connectors | gates on `uses_codex_backend()` and keys caches from generic account getters | | model refresh | treats AgentIdentity as Codex-backend auth | | OpenAI file upload path | rejects non-Codex-backend auth before applying headers | | core client setup | keeps model-provider auth flow and allows AgentIdentity through provider-backed OpenAI auth | ## Stack 1. https://github.com/openai/codex/pull/18757: full revert 2. https://github.com/openai/codex/pull/18871: isolated Agent Identity crate 3. https://github.com/openai/codex/pull/18785: explicit AgentIdentity auth mode and startup task allocation 4. This PR: migrate Codex backend auth callsites through AuthProvider 5. https://github.com/openai/codex/pull/18904: accept AgentIdentity JWTs and load `CODEX_AGENT_IDENTITY` ## Testing Tests: targeted Rust checks, cargo-shear, Bazel lock check, and CI.
78 lines
2.3 KiB
Rust
78 lines
2.3 KiB
Rust
use std::path::PathBuf;
|
|
|
|
use clap::Parser;
|
|
use codex_core::config::Config;
|
|
use codex_git_utils::ApplyGitRequest;
|
|
use codex_git_utils::apply_git_patch;
|
|
use codex_utils_cli::CliConfigOverrides;
|
|
|
|
use crate::get_task::GetTaskResponse;
|
|
use crate::get_task::OutputItem;
|
|
use crate::get_task::PrOutputItem;
|
|
use crate::get_task::get_task;
|
|
|
|
/// Applies the latest diff from a Codex agent task.
|
|
#[derive(Debug, Parser)]
|
|
pub struct ApplyCommand {
|
|
pub task_id: String,
|
|
|
|
#[clap(flatten)]
|
|
pub config_overrides: CliConfigOverrides,
|
|
}
|
|
pub async fn run_apply_command(
|
|
apply_cli: ApplyCommand,
|
|
cwd: Option<PathBuf>,
|
|
) -> anyhow::Result<()> {
|
|
let config = Config::load_with_cli_overrides(
|
|
apply_cli
|
|
.config_overrides
|
|
.parse_overrides()
|
|
.map_err(anyhow::Error::msg)?,
|
|
)
|
|
.await?;
|
|
|
|
let task_response = get_task(&config, apply_cli.task_id).await?;
|
|
apply_diff_from_task(task_response, cwd).await
|
|
}
|
|
|
|
pub async fn apply_diff_from_task(
|
|
task_response: GetTaskResponse,
|
|
cwd: Option<PathBuf>,
|
|
) -> anyhow::Result<()> {
|
|
let diff_turn = match task_response.current_diff_task_turn {
|
|
Some(turn) => turn,
|
|
None => anyhow::bail!("No diff turn found"),
|
|
};
|
|
let output_diff = diff_turn.output_items.iter().find_map(|item| match item {
|
|
OutputItem::Pr(PrOutputItem { output_diff }) => Some(output_diff),
|
|
_ => None,
|
|
});
|
|
match output_diff {
|
|
Some(output_diff) => apply_diff(&output_diff.diff, cwd).await,
|
|
None => anyhow::bail!("No PR output item found"),
|
|
}
|
|
}
|
|
|
|
async fn apply_diff(diff: &str, cwd: Option<PathBuf>) -> anyhow::Result<()> {
|
|
let cwd = cwd.unwrap_or(std::env::current_dir().unwrap_or_else(|_| std::env::temp_dir()));
|
|
let req = ApplyGitRequest {
|
|
cwd,
|
|
diff: diff.to_string(),
|
|
revert: false,
|
|
preflight: false,
|
|
};
|
|
let res = apply_git_patch(&req)?;
|
|
if res.exit_code != 0 {
|
|
anyhow::bail!(
|
|
"Git apply failed (applied={}, skipped={}, conflicts={})\nstdout:\n{}\nstderr:\n{}",
|
|
res.applied_paths.len(),
|
|
res.skipped_paths.len(),
|
|
res.conflicted_paths.len(),
|
|
res.stdout,
|
|
res.stderr
|
|
);
|
|
}
|
|
println!("Successfully applied diff");
|
|
Ok(())
|
|
}
|