mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
cooper-oai
df7818c7d1
## Summary - add v2 personal access token support for `codex login --with-access-token` and `CODEX_ACCESS_TOKEN` - classify opaque `at-` tokens separately from legacy Agent Identity JWTs - hydrate required ChatGPT account metadata through AuthAPI `/v1/user-auth-credential/whoami` - use PATs directly as bearer tokens while preserving existing ChatGPT account surfaces - expose PAT-backed auth as the explicit `personalAccessToken` app-server auth mode ## Implementation PAT auth is intentionally small and stateless. Loading a PAT performs one AuthAPI metadata request, stores the hydrated metadata in the in-memory auth object, and redacts the secret from debug output. Legacy Agent Identity JWT handling remains unchanged. The shared access-token classifier lives in a private neutral module because it dispatches between both credential types. PAT hydration fails closed when AuthAPI omits any required metadata, including email. Hydrated metadata is intentionally not persisted: startup performs a live `whoami` preflight so revoked tokens or changed account metadata are not accepted from a stale cache. ## Workspace restriction scope This change intentionally does **not** apply `forced_chatgpt_workspace_id` to PAT authentication. The setting is a client-side config guardrail, not an authorization boundary, and PAT does not currently require workspace-ID parity. The PAT login and `CODEX_ACCESS_TOKEN` paths therefore validate through AuthAPI without threading workspace-restriction state through access-token loading. Existing workspace checks for non-PAT auth remain on their established paths. ## App-server compatibility The public app-server `AuthMode` is shared across v1 and v2, and PAT-backed auth reports `personalAccessToken` through both APIs. Following human review, this intentionally removes the temporary v1 compatibility mapping that reported PATs as `chatgpt`; the deprecated v1 API is kept in parity with v2 rather than maintaining a separate closed enum. Clients with exhaustive auth-mode handling in either API version must add the new case and should generally treat it as ChatGPT-backed unless they need PAT-specific behavior. The v1 auth-status response still omits the raw PAT when `includeToken` is requested because that response cannot carry the account metadata needed to reuse the credential safely. Persisted PAT auth also omits the new enum value so older Codex builds can deserialize `auth.json` and infer PAT auth from the credential field after a rollback. ## Validation Latest review-fix validation: - `CARGO_INCREMENTAL=0 just test -p codex-login` (126 passed) - `CARGO_INCREMENTAL=0 just test -p codex-cli` (263 passed) - `CARGO_INCREMENTAL=0 just test -p codex-cli stored_auth_validation_handles_personal_access_token` - `CARGO_INCREMENTAL=0 just test -p codex-app-server-protocol` (226 passed) - `CARGO_INCREMENTAL=0 just test -p codex-models-manager refresh_available_models_uses_remote_only_catalog_for_chatgpt_auth` - `CARGO_INCREMENTAL=0 just test -p codex-tui existing_non_oauth_chatgpt_login_counts_as_signed_in` - `CARGO_INCREMENTAL=0 just fix -p codex-login -p codex-app-server-protocol -p codex-models-manager -p codex-tui -p codex-cli` - `just fmt` - `git diff --check` The broader `codex-tui` suite previously compiled and ran 2,834 tests. Three unrelated environment-sensitive guardian/IDE-socket tests failed after retries; the PAT-relevant TUI coverage passed.
86 lines
2.0 KiB
JSON
Generated
86 lines
2.0 KiB
JSON
Generated
{
|
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
"definitions": {
|
|
"AuthMode": {
|
|
"description": "Authentication mode for OpenAI-backed providers.",
|
|
"oneOf": [
|
|
{
|
|
"description": "OpenAI API key provided by the caller and stored by Codex.",
|
|
"enum": [
|
|
"apikey"
|
|
],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"description": "ChatGPT OAuth managed by Codex (tokens persisted and refreshed by Codex).",
|
|
"enum": [
|
|
"chatgpt"
|
|
],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"description": "[UNSTABLE] FOR OPENAI INTERNAL USE ONLY - DO NOT USE.\n\nChatGPT auth tokens are supplied by an external host app and are only stored in memory. Token refresh must be handled by the external host app.",
|
|
"enum": [
|
|
"chatgptAuthTokens"
|
|
],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"description": "Programmatic Codex auth backed by a registered Agent Identity.",
|
|
"enum": [
|
|
"agentIdentity"
|
|
],
|
|
"type": "string"
|
|
},
|
|
{
|
|
"description": "Programmatic Codex auth backed by a personal access token.",
|
|
"enum": [
|
|
"personalAccessToken"
|
|
],
|
|
"type": "string"
|
|
}
|
|
]
|
|
},
|
|
"PlanType": {
|
|
"enum": [
|
|
"free",
|
|
"go",
|
|
"plus",
|
|
"pro",
|
|
"prolite",
|
|
"team",
|
|
"self_serve_business_usage_based",
|
|
"business",
|
|
"enterprise_cbp_usage_based",
|
|
"enterprise",
|
|
"edu",
|
|
"unknown"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"properties": {
|
|
"authMode": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AuthMode"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"planType": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/PlanType"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"title": "AccountUpdatedNotification",
|
|
"type": "object"
|
|
} |