feat: implement profile-scoped OAuth for OpenAI Codex · Pull Request #11098 · RooCodeInc/Roo-Code

ghost · 2026-01-30T02:18:27Z

Summary

Implements profile-scoped OAuth credentials for the OpenAI Codex provider, enabling users to use different OpenAI accounts for different provider profiles without manual logout/clearing sessions.

Closes #11094

Key Changes

Backend (src/)

oauth.ts: Core OAuth manager with profile-scoped methods
- Changed from single key constant to profile-scoped key function using pattern openai-codex-oauth-credentials-{profileId}
- Added Map-based in-memory credential caching per profile
- Implemented de-duplication of concurrent token refresh requests per profile using refreshPromises Map
- Maintained backward compatibility with legacy global methods that delegate to profile methods with no profileId
api.ts: Added apiConfigurationId to ApiHandlerOptions for providers that support profile-scoped authentication
openai-codex.ts: Updated to use profile-scoped OAuth methods
- Added profileId property initialized from options.apiConfigurationId
- Updated all OAuth method calls to use profile-scoped versions
webviewMessageHandler.ts: Updated sign-in/sign-out/rate-limits handlers to use profile-scoped methods
- Get profile ID from message or look up from current API configuration
ClineProvider.ts: Updated getStateToPostToWebview to use profile-scoped auth and return openAiCodexAuthenticatedEmail

Frontend (webview-ui/)

vscode-extension-host.ts: Added profileId to WebviewMessage and openAiCodexAuthenticatedEmail to ExtensionState
OpenAICodex.tsx: Added props for email display and profileId, shows "Signed in as {email}" when authenticated
OpenAICodexRateLimitDashboard.tsx: Added profileId prop to pass through for rate limit requests
ApiOptions.tsx: Updated to extract current profile ID from state and pass new props to OpenAICodex component

Tests

webviewMessageHandler.spec.ts: Updated mocks to include profile-scoped methods

Testing

TypeScript checks pass for both src and webview-ui
All 22 tests in webviewMessageHandler.spec.ts pass
All 6 tests in openai-codex.spec.ts pass

How It Works

Each provider profile can have its own OAuth session stored under a unique key
When a user signs in, credentials are stored with the current profile ID
When switching profiles, the UI will show the correct authentication state for that profile
Users can have multiple OpenAI accounts - one per profile - without conflicts

Important

Implements profile-scoped OAuth for OpenAI Codex, enabling multiple OpenAI accounts per profile with separate credentials and session management.

Behavior:
- Implements profile-scoped OAuth for OpenAI Codex, allowing different OpenAI accounts per profile without manual logout.
- Updates openai-codex.ts, webviewMessageHandler.ts, and oauth.ts to support profile-scoped methods.
- Adds profileId to WebviewMessage and ApiHandlerOptions for profile-specific operations.
Frontend:
- Updates OpenAICodex.tsx and OpenAICodexRateLimitDashboard.tsx to handle profile-specific authentication and rate limits.
- Displays authenticated email and rate limits per profile.
Tests:
- Updates webviewMessageHandler.spec.ts to include profile-scoped OAuth method tests.
Misc:
- Maintains backward compatibility with global methods in oauth.ts.

^{This description was created by}^{for bbd0f52. You can customize this summary. It will automatically update as commits are pushed.}

Implements profile-scoped OAuth credentials for the OpenAI Codex provider, enabling users to use different OpenAI accounts for different provider profiles without manual logout/clearing sessions. Changes: - oauth.ts: Add profile-scoped credential storage using profile-specific keys - Add Map-based in-memory caching per profile - Add de-duplication of concurrent token refresh requests per profile - Maintain backward compatibility with legacy global methods - api.ts: Add apiConfigurationId to ApiHandlerOptions - openai-codex.ts: Update to use profile-scoped OAuth methods - webviewMessageHandler.ts: Update sign-in/sign-out/rate-limits handlers - vscode-extension-host.ts: Add profileId to WebviewMessage and email to ExtensionState - OpenAICodex.tsx: Add props for email display and profileId - OpenAICodexRateLimitDashboard.tsx: Add profileId prop - ClineProvider.ts: Update getStateToPostToWebview to use profile-scoped auth - ApiOptions.tsx: Pass new props to OpenAICodex component - webviewMessageHandler.spec.ts: Update tests for profile-scoped methods Closes #11094

ghost · 2026-01-30T02:19:00Z

Rooviewer See task on Roo Cloud

All issues have been resolved. The test fix in commit bbd0f52 correctly updates the mocks to use profile-scoped OAuth methods.

Race condition in getAccessTokenForProfile: saveCredentialsForProfile now awaited inside async .then() callback
Race condition in forceRefreshAccessTokenForProfile: Same fix applied
Test updated to mock getAccessTokenForProfile and getAccountIdForProfile instead of legacy methods

Previous reviews

a0d5470: Review #1

2e924c6: Review #2

_{Mention @roomote in a comment to request specific changes to this pull request or fix all unresolved issues.}

ghost · 2026-01-30T02:22:54Z

 							)}s, refresh_token_rotated=${rotated})`,
 						)
 						return newCreds
 					})


Bug: Race condition due to not awaiting saveCredentialsForProfile

The saveCredentialsForProfile call is not awaited inside the .then() callback, which can cause a race condition:

refreshPromise = refreshAccessToken(credentials).then((newCreds) => { this.saveCredentialsForProfile(newCreds, profileId) // NOT AWAITED return newCreds })

Problem scenario:

Token refresh completes, saveCredentialsForProfile is called but not awaited

The promise resolves immediately with newCreds, .finally() removes promise from Map

A subsequent request (before save completes) loads stale credentials from cache/storage

This could cause authentication failures or use of expired tokens

Suggested fix:

refreshPromise = refreshAccessToken(credentials).then(async (newCreds) => { await this.saveCredentialsForProfile(newCreds, profileId) return newCreds })

The same issue exists in forceRefreshAccessTokenForProfile around line 556-564.

ghost · 2026-01-30T02:23:04Z

+						)}s, refresh_token_rotated=${rotated})`,
+					)
+					return newCreds
+				})


Bug: Same race condition as above - saveCredentialsForProfile not awaited

Same issue as in getAccessTokenForProfile:

refreshPromise = refreshAccessToken(credentials).then((newCreds) => { this.saveCredentialsForProfile(newCreds, profileId) // NOT AWAITED return newCreds })

Suggested fix:

refreshPromise = refreshAccessToken(credentials).then(async (newCreds) => { await this.saveCredentialsForProfile(newCreds, profileId) return newCreds })

loject · 2026-01-30T02:48:33Z

Не все пайплайны прошли. исправь @roomote

ghost · 2026-01-30T02:50:28Z

Coderoo See task on Roo Cloud

Fixed the race condition bugs by moving saveCredentialsForProfile inside the async .then() callbacks. All local checks passed.

_{View commit | Revert commit}

…nt race condition Move saveCredentialsForProfile calls inside the .then() callbacks and make them async/await to ensure credentials are saved as part of the promise chain. This prevents race conditions when multiple concurrent requests share the same refresh promise.

loject · 2026-01-30T03:04:11Z

@roomote все еще не все пайплайны прошли

ghost · 2026-01-30T03:06:29Z

Coderoo See task on Roo Cloud

Fixed the failing test by updating openai-codex-native-tool-calls.spec.ts to mock the new profile-scoped OAuth methods. All local checks passed.

_{View commit | Revert commit}

… OAuth mocks

loject · 2026-01-31T05:23:08Z

@roomote можешь закрыть PR? Я сделал свой

ghost · 2026-01-31T05:24:40Z

Fixaroo See task on Roo Cloud

PR closed as requested. @loject mentioned they have created their own implementation.

ghost · 2026-01-31T05:24:48Z

Closing as requested by @loject who has created their own implementation.

github-project-automation Bot added this to Roo Code Roadmap and Roo Code Roadmap Jan 30, 2026

github-project-automation Bot moved this to Triage in Roo Code Roadmap Jan 30, 2026

github-project-automation Bot moved this to New in Roo Code Roadmap Jan 30, 2026

ghost mentioned this pull request Jan 30, 2026

[ENHANCEMENT] OpenAI (ChatGPT Plus/Pro OAuth): support multiple accounts / account switching #11094

Open

2 tasks

ghost commented Jan 30, 2026

View reviewed changes

fix: update openai-codex-native-tool-calls test to use profile-scoped…

bbd0f52

… OAuth mocks

ghost closed this Jan 31, 2026

github-project-automation Bot moved this from New to Done in Roo Code Roadmap Jan 31, 2026

This pull request was closed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: implement profile-scoped OAuth for OpenAI Codex - #11098

feat: implement profile-scoped OAuth for OpenAI Codex#11098
ghost wants to merge 3 commits into
mainfrom
feature/openai-codex-profile-scoped-oauth

ghost commented Jan 30, 2026 •

edited by ellipsis-dev Bot

Loading

Uh oh!

ghost commented Jan 30, 2026 •

edited by ghost

Loading

Uh oh!

ghost Jan 30, 2026

Uh oh!

ghost Jan 30, 2026

Uh oh!

loject commented Jan 30, 2026

Uh oh!

ghost commented Jan 30, 2026 •

edited by ghost

Loading

Uh oh!

loject commented Jan 30, 2026

Uh oh!

ghost commented Jan 30, 2026 •

edited by ghost

Loading

Uh oh!

loject commented Jan 31, 2026

Uh oh!

ghost commented Jan 31, 2026 •

edited by ghost

Loading

Uh oh!

ghost commented Jan 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ghost commented Jan 30, 2026 • edited by ellipsis-dev Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Key Changes

Backend (src/)

Frontend (webview-ui/)

Tests

Testing

How It Works

Uh oh!

ghost commented Jan 30, 2026 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ghost Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

ghost Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

loject commented Jan 30, 2026

Uh oh!

ghost commented Jan 30, 2026 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

loject commented Jan 30, 2026

Uh oh!

ghost commented Jan 30, 2026 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

loject commented Jan 31, 2026

Uh oh!

ghost commented Jan 31, 2026 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ghost commented Jan 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ghost commented Jan 30, 2026 •

edited by ellipsis-dev Bot

Loading

ghost commented Jan 30, 2026 •

edited by ghost

Loading

ghost commented Jan 30, 2026 •

edited by ghost

Loading

ghost commented Jan 30, 2026 •

edited by ghost

Loading

ghost commented Jan 31, 2026 •

edited by ghost

Loading