Celia Chen b7a5d81f84 feat: prefer managed Bedrock auth in model provider (#27689) ...

## Why

The Amazon Bedrock model provider currently discards the shared
`AuthManager`, so a Codex-managed Bedrock API key cannot reach
request-time provider auth. Bedrock instead falls through to AWS
environment or SDK credentials, and the request endpoint can be resolved
from a different region than the managed credential.

Managed Bedrock login should control both the bearer credential and
Mantle region. Unrelated OpenAI or ChatGPT credentials must remain
isolated from Bedrock.

## What changed

- Pass the shared `AuthManager` into `AmazonBedrockModelProvider`.
- Select `CodexAuth::BedrockApiKey` before the existing
`AWS_BEARER_TOKEN_BEDROCK` and AWS SDK/SigV4 paths.
- Use the managed Bedrock auth region when resolving the Mantle
endpoint.
- Filter other `CodexAuth` variants so OpenAI and ChatGPT auth are not
exposed to Bedrock request auth or unauthorized recovery.
- Add focused coverage for provider construction, managed-auth
precedence, bearer headers, endpoint selection, and OpenAI-auth
isolation.

b7a5d81f84 · 2026-06-11 15:33:38 -07:00

History

..

src

feat: prefer managed Bedrock auth in model provider (#27689)

2026-06-11 15:33:38 -07:00

BUILD.bazel

feat: add opt-in provider runtime abstraction (#17713)

2026-04-17 02:27:45 +00:00

Cargo.toml

feat: let model providers own model discovery (#18950)

2026-04-24 04:28:25 +00:00