Move auth code into login crate by aibrahim-oai · Pull Request #15150 · openai/codex

aibrahim-oai · 2026-03-19T06:49:18Z

Move the auth implementation and token data into codex-login.
Keep codex-core re-exporting that surface from codex-login for existing callers.

Fix moved auth test imports, add auth-crate test deps, and expose testing constructors used by codex-core. Co-authored-by: Codex <noreply@openai.com>

Make auth testing constructors public for codex-core callers across the new crate boundary. Co-authored-by: Codex <noreply@openai.com>

Add a Bazel package marker for the extracted auth crate so the new source package is visible to Bazel. Co-authored-by: Codex <noreply@openai.com>

Define the auth source filegroup expected by the parent Bazel package after extracting auth into a nested crate. Co-authored-by: Codex <noreply@openai.com>

Declare the extracted auth package as a Bazel Rust crate target so codex-core can depend on it under Bazel. Co-authored-by: Codex <noreply@openai.com>

Point the extracted auth Bazel crate at its nonstandard root-level Rust sources so the :auth library target is generated. Co-authored-by: Codex <noreply@openai.com>

Pass the extracted auth config to enforce_login_restrictions at the remaining Rust callsites. Co-authored-by: Codex <noreply@openai.com>

Construct AuthConfig explicitly at the remaining login restriction callsites after the auth split. Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai · 2026-03-19T17:53:24Z

@codex review this

chatgpt-codex-connector

💡 Codex Review

codex/codex-rs/tui/src/lib.rs

Line 455 in 380d83f

if let Err(err) = enforce_login_restrictions(&config) {

Replace removed auth restriction call in TUI startup

run_main still calls enforce_login_restrictions(&config), but this commit removed that API in favor of enforce_login_restrictions_with_client. With no in-scope replacement at this callsite, codex-tui no longer compiles.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/core/src/auth/auth.rs

Switch the remaining TUI login restriction callsite to the explicit client path so codex-tui builds after removing the no-client auth wrapper. Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai · 2026-03-19T18:44:40Z

@codex review this

chatgpt-codex-connector · 2026-03-19T18:56:57Z

Codex Review: Didn't find any major issues. Can't wait for the next one!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Move the codex-terminal dev-dependency to the mcp test support crate that imports it so CI can compile mcp_test_support again. Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai · 2026-03-19T19:10:11Z

codex-rs/core/src/default_client.rs

-#[cfg(test)]
-#[path = "default_client_tests.rs"]
-mod tests;
+pub use codex_client::CODEX_INTERNAL_ORIGINATOR_OVERRIDE_ENV_VAR;


should I reexport like that or make other crates depend on the new auth crate?

I think reexporting makes more sense to keep auth centralized

Instantiate the environment before fetching the filesystem so app-server compiles under Bazel again. Co-authored-by: Codex <noreply@openai.com>

Instantiate the exec-server environment before fetching the filesystem so the PR merge ref compiles under Bazel. Co-authored-by: Codex <noreply@openai.com>

Co-authored-by: Codex <noreply@openai.com>

- Move the auth implementation and token data into . - Keep re-exporting that surface from for existing callers. Co-authored-by: Codex <noreply@openai.com>

Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai · 2026-03-19T20:53:22Z

@codex review this

Co-authored-by: Codex <noreply@openai.com>

Move the telemetry auth-mode conversion back into codex-core callsites to avoid an orphan impl in codex-login, and include the stale Cargo.lock cleanup from the core dependency removal. Co-authored-by: Codex <noreply@openai.com>

Import AuthMode from the auth module in codex-core; it is not re-exported at the crate root. Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai · 2026-03-19T22:44:58Z

@codex review this

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fa2b69dc78

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-19T22:49:38Z

codex-rs/login/src/server.rs

            "originator".to_string(),
-            originator().value.as_str().to_string(),
+            std::env::var("CODEX_INTERNAL_ORIGINATOR_OVERRIDE")
+                .unwrap_or_else(|_| "codex_cli_rs".to_string()),


Preserve runtime originator in OAuth authorize URL

build_authorize_url now derives originator only from CODEX_INTERNAL_ORIGINATOR_OVERRIDE or a hardcoded codex_cli_rs. That ignores runtime originators set via set_default_originator (used by non-CLI entrypoints), so login requests are mislabeled. This changes behavior from pre-move code and can break client attribution or backend logic keyed on the originator query parameter.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-03-19T22:49:38Z

codex-rs/login/src/auth/manager.rs

+fn build_auth_http_client() -> CodexHttpClient {
+    let inner =
+        build_reqwest_client_with_custom_ca(reqwest::Client::builder()).unwrap_or_else(|error| {
+            tracing::warn!(error = %error, "failed to build auth reqwest client");
+            reqwest::Client::new()
+        });
+    CodexHttpClient::new(inner)


Reuse default HTTP client policy for token refresh

Auth refresh now uses a bare reqwest builder (build_auth_http_client) instead of the previous default client path. This drops default header wiring (originator/residency) and sandbox proxy behavior (no_proxy). In proxied or residency-constrained environments, refresh calls can fail or be routed with incorrect request metadata.

Useful? React with 👍 / 👎.

joshka-oai

LGTM generally - a few questions about the reasons for the changed behavior bits

joshka-oai · 2026-03-19T23:57:10Z

codex-rs/app-server/src/codex_message_processor.rs

            Some(auth) => match auth.auth_mode() {
                CoreAuthMode::ApiKey => Some(Account::ApiKey {}),
-                CoreAuthMode::Chatgpt => {
+                CoreAuthMode::Chatgpt | CoreAuthMode::ChatgptAuthTokens => {


What's this change about?

We have multiple enums and we should unify at some point

joshka-oai · 2026-03-20T00:03:15Z

codex-rs/login/src/server.rs

            "originator".to_string(),
-            originator().value.as_str().to_string(),
+            std::env::var("CODEX_INTERNAL_ORIGINATOR_OVERRIDE")
+                .unwrap_or_else(|_| "codex_cli_rs".to_string()),


What's the reasone for this change?

codex-rs/login/src/auth/manager.rs

aibrahim-oai · 2026-03-20T00:19:49Z

@codex review this

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 178a0dc31c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/core/src/lib.rs

codex-rs/login/src/lib.rs

aibrahim-oai · 2026-03-20T00:42:14Z

@codex review latest commit

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 178a0dc31c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-20T00:57:55Z

codex-rs/login/src/lib.rs

+pub use auth::login_with_api_key;
+pub use auth::logout;
+pub use auth::read_openai_api_key_from_env;
+pub use auth::save_auth;


Re-export missing auth helpers for compatibility

The commit message says codex-core should keep the old auth surface, but codex-login root no longer re-exports helpers like login_with_chatgpt_auth_tokens and read_codex_api_key_from_env. Internal code had to switch to codex_login::auth::..., so downstream callers using codex_core::auth::... will hit source-level breakage.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-03-20T00:57:55Z

codex-rs/login/src/lib.rs

+pub use auth::logout;
+pub use auth::read_openai_api_key_from_env;
+pub use auth::save_auth;
 pub use codex_app_server_protocol::AuthMode;


Preserve old AuthMode type at re-export boundary

codex-login now re-exports codex_app_server_protocol::AuthMode, which adds ChatgptAuthTokens. Existing callers that exhaustively match codex_core::auth::AuthMode will no longer compile (the repo itself added new match arms). That contradicts the stated goal of keeping existing caller compatibility.

Useful? React with 👍 / 👎.

aibrahim-oai added a commit that referenced this pull request Mar 19, 2026

codex: fix CI failure on PR #15150

1412ccd

Fix moved auth test imports, add auth-crate test deps, and expose testing constructors used by codex-core. Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai added a commit that referenced this pull request Mar 19, 2026

codex: fix CI failure on PR #15150

2c1d6d4

Make auth testing constructors public for codex-core callers across the new crate boundary. Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai added a commit that referenced this pull request Mar 19, 2026

codex: fix CI failure on PR #15150

2d4c894

Add a Bazel package marker for the extracted auth crate so the new source package is visible to Bazel. Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai added a commit that referenced this pull request Mar 19, 2026

codex: fix CI failure on PR #15150

da91e51

Define the auth source filegroup expected by the parent Bazel package after extracting auth into a nested crate. Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai added a commit that referenced this pull request Mar 19, 2026

codex: fix CI failure on PR #15150

ce4382c

Declare the extracted auth package as a Bazel Rust crate target so codex-core can depend on it under Bazel. Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai added a commit that referenced this pull request Mar 19, 2026

codex: fix CI failure on PR #15150

1774364

Point the extracted auth Bazel crate at its nonstandard root-level Rust sources so the :auth library target is generated. Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai added a commit that referenced this pull request Mar 19, 2026

codex: fix CI failure on PR #15150

0c8b330

Pass the extracted auth config to enforce_login_restrictions at the remaining Rust callsites. Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai added a commit that referenced this pull request Mar 19, 2026

codex: fix CI failure on PR #15150

c747662

Construct AuthConfig explicitly at the remaining login restriction callsites after the auth split. Co-authored-by: Codex <noreply@openai.com>

chatgpt-codex-connector bot reviewed Mar 19, 2026

View reviewed changes

codex-rs/core/src/auth/auth.rs Outdated Show resolved Hide resolved

aibrahim-oai added a commit that referenced this pull request Mar 19, 2026

codex: fix CI failure on PR #15150

8e34b76

Move the codex-terminal dev-dependency to the mcp test support crate that imports it so CI can compile mcp_test_support again. Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai commented Mar 19, 2026

View reviewed changes

aibrahim-oai added a commit that referenced this pull request Mar 19, 2026

codex: fix CI failure on PR #15150

cd78b89

Instantiate the environment before fetching the filesystem so app-server compiles under Bazel again. Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai added a commit that referenced this pull request Mar 19, 2026

codex: fix CI failure on PR #15150

fd454af

Instantiate the exec-server environment before fetching the filesystem so the PR merge ref compiles under Bazel. Co-authored-by: Codex <noreply@openai.com>

Move terminal module to its own crate

df7a587

Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai force-pushed the auth-crate-split branch from d6c58be to 60192f2 Compare March 19, 2026 19:56

aibrahim-oai changed the base branch from main to terminal-crate-split March 19, 2026 19:56

aibrahim-oai changed the title ~~Make core auth a separate crate~~ Move auth code into login crate Mar 19, 2026

Rename terminal crate to terminal-detection

3661c08

Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai changed the base branch from terminal-crate-split to auth-behavioral-split March 19, 2026 20:26

aibrahim-oai changed the base branch from auth-behavioral-split to terminal-crate-split March 19, 2026 20:34

aibrahim-oai and others added 3 commits March 19, 2026 13:39

codex: fix CI failure on PR #15216

9e6c404

Co-authored-by: Codex <noreply@openai.com>

Move auth code into login crate

4b9dde5

- Move the auth implementation and token data into . - Keep re-exporting that surface from for existing callers. Co-authored-by: Codex <noreply@openai.com>

codex: clean up auth import style on PR #15150

a717396

Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai force-pushed the auth-crate-split branch from 8d19906 to a717396 Compare March 19, 2026 20:46

codex: fix CI failure on PR #15150

905255d

Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai added a commit that referenced this pull request Mar 19, 2026

codex: fix CI failure on PR #15150

5848ca1

Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai added a commit that referenced this pull request Mar 19, 2026

codex: fix CI failure on PR #15150

ba52b1f

Import AuthMode from the auth module in codex-core; it is not re-exported at the crate root. Co-authored-by: Codex <noreply@openai.com>

aibrahim-oai force-pushed the auth-crate-split branch from ba52b1f to cfbec84 Compare March 19, 2026 21:38

aibrahim-oai added 11 commits March 19, 2026 14:48

fix

e2cd38a

fix

5c3bdad

fix

589fe5f

fix

e73bd63

fix

c13f83d

fix

019ab69

fix

b6c3ecf

fix

37e4e55

fix

7c374c1

fix

7c9e4b4

fix

fa2b69d

chatgpt-codex-connector bot reviewed Mar 19, 2026

View reviewed changes

joshka-oai approved these changes Mar 20, 2026

View reviewed changes

aibrahim-oai added 3 commits March 19, 2026 17:10

fix

e57552f

fix

d3c83a4

fix

178a0dc

chatgpt-codex-connector bot reviewed Mar 20, 2026

View reviewed changes

codex-rs/core/src/lib.rs Show resolved Hide resolved

codex-rs/login/src/lib.rs Show resolved Hide resolved

chatgpt-codex-connector bot reviewed Mar 20, 2026

View reviewed changes

aibrahim-oai added 2 commits March 19, 2026 18:01

unify

112d231

unify

0461e2a

aibrahim-oai merged commit 2aa4873 into main Mar 20, 2026
33 checks passed

aibrahim-oai deleted the auth-crate-split branch March 20, 2026 01:58

github-actions bot locked and limited conversation to collaborators Mar 20, 2026

Conversation

aibrahim-oai commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aibrahim-oai commented Mar 19, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

aibrahim-oai commented Mar 19, 2026

Uh oh!

chatgpt-codex-connector bot commented Mar 19, 2026

Uh oh!

aibrahim-oai Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aibrahim-oai Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

aibrahim-oai commented Mar 19, 2026

Uh oh!

aibrahim-oai commented Mar 19, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

joshka-oai left a comment

Choose a reason for hiding this comment

Uh oh!

joshka-oai Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

aibrahim-oai Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

joshka-oai Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

aibrahim-oai Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

aibrahim-oai commented Mar 20, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

aibrahim-oai commented Mar 20, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

aibrahim-oai commented Mar 19, 2026 •

edited

Loading

aibrahim-oai Mar 19, 2026 •

edited

Loading