81a17bb2c1
This enables a new use case where `codex app-server` is embedded into a parent application that will directly own the user's ChatGPT auth lifecycle, which means it owns the user’s auth tokens and refreshes it when necessary. The parent application would just want a way to pass in the auth tokens for codex to use directly. The idea is that we are introducing a new "auth mode" currently only exposed via app server: **`chatgptAuthTokens`** which consist of the `id_token` (stores account metadata) and `access_token` (the bearer token used directly for backend API calls). These auth tokens are only stored in-memory. This new mode is in addition to the existing `apiKey` and `chatgpt` auth modes. This PR reuses the shape of our existing app-server account APIs as much as possible: - Update `account/login/start` with a new `chatgptAuthTokens` variant, which will allow the client to pass in the tokens and have codex app-server use them directly. Upon success, the server emits `account/login/completed` and `account/updated` notifications. - A new server->client request called `account/chatgptAuthTokens/refresh` which the server can use whenever the access token previously passed in has expired and it needs a new one from the parent application. I leveraged the core 401 retry loop which typically triggers auth token refreshes automatically, but made it pluggable: - **chatgpt** mode refreshes internally, as usual. - **chatgptAuthTokens** mode calls the client via `account/chatgptAuthTokens/refresh`, the client responds with updated tokens, codex updates its in-memory auth, then retries. This RPC has a 10s timeout and handles JSON-RPC errors from the client. Also some additional things: - chatgpt logins are blocked while external auth is active (have to log out first. typically clients will pick one OR the other, not support both) - `account/logout` clears external auth in memory - Ensures that if `forced_chatgpt_workspace_id` is set via the user's config, we respect it in both: - `account/login/start` with `chatgptAuthTokens` (returns a JSON-RPC error back to the client) - `account/chatgptAuthTokens/refresh` (fails the turn, and on next request app-server will send another `account/chatgptAuthTokens/refresh` request to the client).
71 lines
2 KiB
TOML
71 lines
2 KiB
TOML
[package]
|
|
name = "codex-app-server"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[[bin]]
|
|
name = "codex-app-server"
|
|
path = "src/main.rs"
|
|
|
|
[lib]
|
|
name = "codex_app_server"
|
|
path = "src/lib.rs"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
async-trait = { workspace = true }
|
|
codex-arg0 = { workspace = true }
|
|
codex-common = { workspace = true, features = ["cli"] }
|
|
codex-core = { workspace = true }
|
|
codex-backend-client = { workspace = true }
|
|
codex-file-search = { workspace = true }
|
|
codex-chatgpt = { workspace = true }
|
|
codex-login = { workspace = true }
|
|
codex-protocol = { workspace = true }
|
|
codex-app-server-protocol = { workspace = true }
|
|
codex-feedback = { workspace = true }
|
|
codex-rmcp-client = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-json-to-toml = { workspace = true }
|
|
chrono = { workspace = true }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
mcp-types = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
time = { workspace = true }
|
|
toml = { workspace = true }
|
|
tokio = { workspace = true, features = [
|
|
"io-std",
|
|
"macros",
|
|
"process",
|
|
"rt-multi-thread",
|
|
"signal",
|
|
] }
|
|
tracing = { workspace = true, features = ["log"] }
|
|
tracing-subscriber = { workspace = true, features = ["env-filter", "fmt"] }
|
|
uuid = { workspace = true, features = ["serde", "v7"] }
|
|
|
|
[dev-dependencies]
|
|
app_test_support = { workspace = true }
|
|
axum = { workspace = true, default-features = false, features = [
|
|
"http1",
|
|
"json",
|
|
"tokio",
|
|
] }
|
|
base64 = { workspace = true }
|
|
codex-execpolicy = { workspace = true }
|
|
core_test_support = { workspace = true }
|
|
mcp-types = { workspace = true }
|
|
os_info = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
rmcp = { workspace = true, default-features = false, features = [
|
|
"server",
|
|
"transport-streamable-http-server",
|
|
] }
|
|
serial_test = { workspace = true }
|
|
wiremock = { workspace = true }
|
|
shlex = { workspace = true }
|