fix(auth): serve env_key bearer admission on Direct by substituting stored main auth #1861
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,159 @@ | ||
| import { afterEach, beforeEach, describe, expect, test } from "bun:test"; | ||
| import { mkdtempSync, rmSync, writeFileSync } from "node:fs"; | ||
| import { tmpdir } from "node:os"; | ||
| import { join } from "node:path"; | ||
| import { saveConfig } from "../src/config"; | ||
| import { startServer } from "../src/server"; | ||
| import type { OcxConfig } from "../src/types"; | ||
|
|
||
| /** | ||
| * #1686 end to end: a Codex client injected with `env_key` presents the proxy admission | ||
| * secret as `Authorization: Bearer`. Direct must ADMIT that request and substitute the | ||
| * stored main credential; the admission secret must never appear upstream. | ||
| * | ||
| * The unit matrix in tests/codex-auth-context.test.ts proves the materializer in isolation. | ||
| * It cannot prove the HTTP handler passes the presentation source down to it, which is the | ||
| * half that was missing: the source was resolved at the door and dropped one frame later. | ||
| */ | ||
|
|
||
| const originalFetch = globalThis.fetch; | ||
| const previousOcxHome = process.env.OPENCODEX_HOME; | ||
| const previousCodexHome = process.env.CODEX_HOME; | ||
| const previousDataToken = process.env.OPENCODEX_API_AUTH_TOKEN; | ||
|
|
||
| let ocxHome = ""; | ||
| let codexHome = ""; | ||
| let upstreamAuth: Array<string | null> = []; | ||
|
|
||
| const ADMISSION_SECRET = "ocx_data_envkeysecret"; | ||
|
|
||
| /** A JWT whose `exp` is far in the future, so the stored main token reads as live. */ | ||
| function liveJwt(): string { | ||
| const payload = Buffer.from(JSON.stringify({ exp: Math.floor(Date.now() / 1000) + 86_400 })).toString("base64url"); | ||
| return `header.${payload}.signature`; | ||
| } | ||
|
|
||
| function directConfig(): OcxConfig { | ||
| return { | ||
| port: 0, | ||
| // Remote bind, so admission is actually required rather than loopback-waived. | ||
| hostname: "0.0.0.0", | ||
| defaultProvider: "openai", | ||
| openaiProviderTierVersion: 2, | ||
| providers: { | ||
| openai: { | ||
| adapter: "openai-responses", | ||
| baseUrl: "https://chatgpt.com/backend-api/codex", | ||
| authMode: "forward", | ||
| codexAccountMode: "direct", | ||
| defaultModel: "gpt-5.6-luna", | ||
| }, | ||
| }, | ||
| apiKeys: [ | ||
| { id: "env-key", name: "env_key", key: ADMISSION_SECRET, createdAt: "2026-08-16T00:00:00.000Z" }, | ||
| ], | ||
| } as OcxConfig; | ||
| } | ||
|
|
||
| function writeStoredMain(accessToken: string): void { | ||
| writeFileSync( | ||
| join(codexHome, "auth.json"), | ||
| JSON.stringify({ tokens: { access_token: accessToken, account_id: "stored_main_acc" } }), | ||
| ); | ||
| } | ||
|
|
||
| beforeEach(() => { | ||
| ocxHome = mkdtempSync(join(tmpdir(), "ocx-1686-home-")); | ||
| codexHome = mkdtempSync(join(tmpdir(), "ocx-1686-codex-")); | ||
| process.env.OPENCODEX_HOME = ocxHome; | ||
| process.env.CODEX_HOME = codexHome; | ||
| delete process.env.OPENCODEX_API_AUTH_TOKEN; | ||
| upstreamAuth = []; | ||
| globalThis.fetch = (async (input, init) => { | ||
| const raw = input instanceof Request ? input.url : String(input); | ||
| const url = new URL(raw); | ||
| if (url.hostname === "chatgpt.com" || url.hostname === "api.openai.com") { | ||
| const headers = new Headers(input instanceof Request ? input.headers : init?.headers); | ||
| upstreamAuth.push(headers.get("authorization")); | ||
| return Response.json({ id: "resp_1686", object: "response", status: "completed", output: [] }); | ||
| } | ||
| return originalFetch(input, init); | ||
| }) as typeof fetch; | ||
| }); | ||
|
|
||
| afterEach(() => { | ||
| globalThis.fetch = originalFetch; | ||
| if (previousOcxHome === undefined) delete process.env.OPENCODEX_HOME; | ||
| else process.env.OPENCODEX_HOME = previousOcxHome; | ||
| if (previousCodexHome === undefined) delete process.env.CODEX_HOME; | ||
| else process.env.CODEX_HOME = previousCodexHome; | ||
| if (previousDataToken === undefined) delete process.env.OPENCODEX_API_AUTH_TOKEN; | ||
| else process.env.OPENCODEX_API_AUTH_TOKEN = previousDataToken; | ||
| if (ocxHome) rmSync(ocxHome, { recursive: true, force: true }); | ||
| if (codexHome) rmSync(codexHome, { recursive: true, force: true }); | ||
| ocxHome = ""; | ||
| codexHome = ""; | ||
| }); | ||
|
|
||
| async function postResponses(url: string | URL, authorization: string): Promise<Response> { | ||
| return originalFetch(new URL("/v1/responses", url), { | ||
| method: "POST", | ||
| headers: { "content-type": "application/json", authorization }, | ||
| body: JSON.stringify({ model: "gpt-5.6-luna", input: "hi", stream: false }), | ||
| }); | ||
| } | ||
|
|
||
| describe("#1686 env_key bearer admission reaches Direct with substitution", () => { | ||
| test("an admission bearer is served and the stored main credential goes upstream", async () => { | ||
| saveConfig(directConfig()); | ||
| const stored = liveJwt(); | ||
| writeStoredMain(stored); | ||
|
|
||
| const server = startServer(0); | ||
| try { | ||
| const response = await postResponses(server.url, `Bearer ${ADMISSION_SECRET}`); | ||
|
|
||
| // Before this change the same request answered 401: admission accepted the bearer at the | ||
| // door, then Direct refused it because it could not tell it from a user's own credential. | ||
| expect(response.status).toBe(200); | ||
| expect(upstreamAuth).toEqual([`Bearer ${stored}`]); | ||
| // The proof that matters: our own secret never reached the wire. | ||
| expect(upstreamAuth.join("|")).not.toContain(ADMISSION_SECRET); | ||
| } finally { | ||
| await server.stop(true); | ||
| } | ||
| }); | ||
|
|
||
| test("substitution fails closed before any upstream I/O when no main credential is stored", async () => { | ||
| saveConfig(directConfig()); | ||
| writeFileSync(join(codexHome, "auth.json"), JSON.stringify({ tokens: {} })); | ||
|
|
||
| const server = startServer(0); | ||
| try { | ||
| const response = await postResponses(server.url, `Bearer ${ADMISSION_SECRET}`); | ||
|
|
||
| expect(response.status).toBe(401); | ||
| // Falling through would have forwarded the admission secret, which is the leak the | ||
| // forward guard exists to prevent. Nothing may reach an upstream on this path. | ||
| expect(upstreamAuth).toHaveLength(0); | ||
| } finally { | ||
| await server.stop(true); | ||
| } | ||
| }); | ||
|
|
||
| test("a foreign bearer is still Codex Direct passthrough, not admission", async () => { | ||
| saveConfig(directConfig()); | ||
| writeStoredMain(liveJwt()); | ||
|
|
||
| const server = startServer(0); | ||
| try { | ||
| // A real ChatGPT credential is NOT one of our secrets, so it must not be admitted as one. | ||
| const response = await postResponses(server.url, "Bearer sk-user-chatgpt-token"); | ||
| expect(response.status).toBe(401); | ||
| expect(upstreamAuth).toHaveLength(0); | ||
| } finally { | ||
| await server.stop(true); | ||
| } | ||
| }); | ||
| }); | ||
|
|
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For a remotely admitted
/v1/responses/compactDirect request using a proxy bearer,materializeCodexUpstreamAuththrowsCodexMainSubstitutionUnavailableErrorwhen the stored main credential is absent or expired. The surrounding compact-auth catch does not handle that newly imported error and rethrows it, after which the server-level wrapper converts it to a generic 500, whereas the regular Responses path returns the intended 401. Catch this error here and return the same authentication response while continuing to fail before upstream I/O.Useful? React with 👍 / 👎.