Merge pull request #1454 from Ac-spider/codex/latest-20260709

Support Codex personal access token reverse proxy

Author: jlcodes99

sidecars/cockpit-cliproxy/main.go

@@ -18,6 +18,7 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
+	"runtime"
 	"sort"
 	"strconv"
 	"strings"
@@ -93,6 +94,8 @@ type manifest struct {
 	accountByID       map[string]*accountSpec
 	accountByAuthID   map[string]*accountSpec
 	accountByAPIKey   map[string]*accountSpec
+	accountByChatGPT  map[string]*accountSpec
+	accountByEmail    map[string]*accountSpec
 	aliasToSource     map[string]string
 	originalIndexByID map[string]int
 }
@@ -127,6 +130,9 @@ type accountSpec struct {
 	ID                   string            `json:"id"`
 	Email                string            `json:"email"`
 	AuthID               string            `json:"authId,omitempty"`
+	AuthKind             string            `json:"authKind,omitempty"`
+	AccessTokenOnly      bool              `json:"accessTokenOnly,omitempty"`
+	ChatGPTAccountID     string            `json:"chatgptAccountId,omitempty"`
 	UpstreamAPIKey       string            `json:"upstreamApiKey,omitempty"`
 	PlanRank             *int              `json:"planRank,omitempty"`
 	RemainingQuota       *int              `json:"remainingQuota,omitempty"`
@@ -493,23 +499,42 @@ func loadManifest(path string) (*manifest, error) {
 	m.accountByID = make(map[string]*accountSpec)
 	m.accountByAuthID = make(map[string]*accountSpec)
 	m.accountByAPIKey = make(map[string]*accountSpec)
+	m.accountByChatGPT = make(map[string]*accountSpec)
+	m.accountByEmail = make(map[string]*accountSpec)
 	m.originalIndexByID = make(map[string]int)
 	for i := range m.Accounts {
 		account := &m.Accounts[i]
 		account.ID = strings.TrimSpace(account.ID)
 		if account.ID == "" {
 			continue
 		}
+		account.Email = strings.TrimSpace(account.Email)
+		account.AuthKind = strings.ToLower(strings.TrimSpace(account.AuthKind))
+		account.ChatGPTAccountID = strings.TrimSpace(account.ChatGPTAccountID)
 		m.accountByID[account.ID] = account
 		m.originalIndexByID[account.ID] = i
 		if authID := strings.TrimSpace(account.AuthID); authID != "" {
 			account.AuthID = authID
 			m.accountByAuthID[strings.ToLower(authID)] = account
+			if base := filepath.Base(authID); base != authID {
+				m.accountByAuthID[strings.ToLower(base)] = account
+			}
 		}
 		if key := strings.TrimSpace(account.UpstreamAPIKey); key != "" {
 			account.UpstreamAPIKey = key
 			m.accountByAPIKey[key] = account
 		}
+		if account.ChatGPTAccountID != "" {
+			m.accountByChatGPT[strings.ToLower(account.ChatGPTAccountID)] = account
+		}
+		if account.Email != "" {
+			key := strings.ToLower(account.Email)
+			if existing, exists := m.accountByEmail[key]; exists && existing != account {
+				m.accountByEmail[key] = nil
+			} else {
+				m.accountByEmail[key] = account
+			}
+		}
 	}
 	m.aliasToSource = make(map[string]string)
 	for _, alias := range m.ModelAliases {
@@ -2530,6 +2555,10 @@ func newSidecarRuntime(ctx context.Context, configPath string, cfg *config.Confi
 		cancel()
 		return nil, err
 	}
+	if err := registerManifestCodexTokenAuths(runtimeCtx, service, cfg, m, manager); err != nil {
+		cancel()
+		return nil, err
+	}
 	for _, auth := range manager.List() {
 		if auth == nil || !strings.EqualFold(strings.TrimSpace(auth.Provider), "codex") {
 			continue
@@ -2571,6 +2600,187 @@ func registerConfigCodexAPIKeyAuths(ctx context.Context, service *cliproxy.Servi
 	return nil
 }
 
+func registerManifestCodexTokenAuths(
+	ctx context.Context,
+	service *cliproxy.Service,
+	cfg *config.Config,
+	m *manifest,
+	manager *coreauth.Manager,
+) error {
+	if service == nil || cfg == nil || m == nil {
+		return nil
+	}
+	for i := range m.Accounts {
+		account := &m.Accounts[i]
+		authID := strings.TrimSpace(account.AuthID)
+		if authID == "" || manifestAccountAuthKind(account) == "api_key" {
+			continue
+		}
+		path := authID
+		if !filepath.IsAbs(path) {
+			path = filepath.Join(cfg.AuthDir, path)
+		}
+		auth, err := readManifestCodexTokenAuth(account, cfg.AuthDir, path)
+		if err != nil {
+			return err
+		}
+		registered, err := service.UpsertRuntimeAuth(coreauth.WithSkipPersist(ctx), auth)
+		if err != nil {
+			return fmt.Errorf("register codex token auth %s: %w", auth.ID, err)
+		}
+		linkManifestAccountForAuth(m, registered)
+		registerManifestModelsForAuth(manager, m, registered)
+	}
+	return nil
+}
+
+func readManifestCodexTokenAuth(account *accountSpec, authDir, path string) (*coreauth.Auth, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("read codex token auth file %s: %w", path, err)
+	}
+	metadata := make(map[string]any)
+	if err = json.Unmarshal(data, &metadata); err != nil {
+		return nil, fmt.Errorf("parse codex token auth file %s: %w", path, err)
+	}
+	provider := strings.TrimSpace(metadataString(metadata, "type"))
+	if provider == "" {
+		provider = "codex"
+	}
+	if !strings.EqualFold(provider, "codex") {
+		return nil, fmt.Errorf("codex token auth file %s has unsupported provider %q", path, provider)
+	}
+	accessToken := firstMetadataString(
+		metadata,
+		"personal_access_token",
+		"at_token",
+		"access_token",
+	)
+	if accessToken == "" {
+		return nil, fmt.Errorf("codex token auth file %s is missing access_token", path)
+	}
+	metadata["access_token"] = accessToken
+	if strings.TrimSpace(metadataString(metadata, "token_type")) == "" {
+		metadata["token_type"] = "Bearer"
+	}
+	if account != nil &&
+		(account.AccessTokenOnly || manifestAccountAuthKind(account) == "access_token") {
+		if strings.TrimSpace(metadataString(metadata, "auth_mode")) == "" {
+			metadata["auth_mode"] = "personal_access_token"
+		}
+		if strings.TrimSpace(metadataString(metadata, "openai_auth_mode")) == "" {
+			metadata["openai_auth_mode"] = "personal_access_token"
+		}
+	}
+
+	info, err := os.Stat(path)
+	if err != nil {
+		return nil, fmt.Errorf("stat codex token auth file %s: %w", path, err)
+	}
+	id := manifestAuthFileID(authDir, path)
+	label := ""
+	if account != nil {
+		label = strings.TrimSpace(account.Email)
+	}
+	if label == "" {
+		label = firstMetadataString(metadata, "email", "label")
+	}
+	disabled, _ := metadata["disabled"].(bool)
+	status := coreauth.StatusActive
+	if disabled {
+		status = coreauth.StatusDisabled
+	}
+	auth := &coreauth.Auth{
+		ID:       id,
+		Provider: "codex",
+		FileName: id,
+		Label:    label,
+		Status:   status,
+		Disabled: disabled,
+		Attributes: map[string]string{
+			"path":      path,
+			"auth_kind": manifestAccountAuthKind(account),
+		},
+		Metadata:        metadata,
+		CreatedAt:       info.ModTime(),
+		UpdatedAt:       info.ModTime(),
+		LastRefreshedAt: time.Time{},
+	}
+	if account != nil {
+		auth.Attributes["account_id"] = strings.TrimSpace(account.ID)
+		if strings.TrimSpace(account.Email) != "" {
+			auth.Attributes["email"] = strings.TrimSpace(account.Email)
+		}
+		if strings.TrimSpace(account.ChatGPTAccountID) != "" {
+			auth.Attributes["chatgpt_account_id"] = strings.TrimSpace(account.ChatGPTAccountID)
+		}
+	}
+	if email := firstMetadataString(metadata, "email"); email != "" {
+		auth.Attributes["email"] = email
+	}
+	if proxyURL := firstMetadataString(metadata, "proxy_url", "proxy-url"); proxyURL != "" {
+		auth.ProxyURL = proxyURL
+	}
+	coreauth.ApplyCustomHeadersFromMetadata(auth)
+	return auth, nil
+}
+
+func manifestAccountAuthKind(account *accountSpec) string {
+	if account == nil {
+		return ""
+	}
+	if kind := strings.ToLower(strings.TrimSpace(account.AuthKind)); kind != "" {
+		switch kind {
+		case "api-key", "apikey", "api key":
+			return "api_key"
+		case "access-token", "accesstoken", "access token",
+			"personal_access_token", "pat", "at":
+			return "access_token"
+		default:
+			return kind
+		}
+	}
+	if strings.TrimSpace(account.UpstreamAPIKey) != "" {
+		return "api_key"
+	}
+	if account.AccessTokenOnly {
+		return "access_token"
+	}
+	return "oauth"
+}
+
+func manifestAuthFileID(authDir, path string) string {
+	id := path
+	if strings.TrimSpace(authDir) != "" {
+		if rel, err := filepath.Rel(authDir, path); err == nil && strings.TrimSpace(rel) != "" {
+			id = rel
+		}
+	}
+	if runtime.GOOS == "windows" {
+		id = strings.ToLower(id)
+	}
+	return id
+}
+
+func metadataString(metadata map[string]any, key string) string {
+	if metadata == nil {
+		return ""
+	}
+	if raw, ok := metadata[key].(string); ok {
+		return strings.TrimSpace(raw)
+	}
+	return ""
+}
+
+func firstMetadataString(metadata map[string]any, keys ...string) string {
+	for _, key := range keys {
+		if value := metadataString(metadata, key); value != "" {
+			return value
+		}
+	}
+	return ""
+}
+
 func (r *sidecarRuntime) Execute(ctx context.Context, providers []string, req cliproxyexecutor.Request, opts cliproxyexecutor.Options) (cliproxyexecutor.Response, error) {
 	if r == nil || r.service == nil {
 		return cliproxyexecutor.Response{}, fmt.Errorf("runtime is not initialized")
@@ -2626,16 +2836,84 @@ func linkManifestAccountForAuth(m *manifest, auth *coreauth.Auth) {
 	if m.accountByAuthID == nil {
 		m.accountByAuthID = make(map[string]*accountSpec)
 	}
-	if _, exists := m.accountByAuthID[strings.ToLower(auth.ID)]; exists {
+	authID := strings.ToLower(strings.TrimSpace(auth.ID))
+	if _, exists := m.accountByAuthID[authID]; exists {
+		return
+	}
+	if account := findManifestAccountForAuth(m, auth); account != nil {
+		m.accountByAuthID[authID] = account
+		if base := strings.ToLower(filepath.Base(strings.TrimSpace(auth.ID))); base != "" && base != authID {
+			m.accountByAuthID[base] = account
+		}
 		return
 	}
+}
+
+func findManifestAccountForAuth(m *manifest, auth *coreauth.Auth) *accountSpec {
+	if m == nil || auth == nil {
+		return nil
+	}
+	for _, candidate := range []string{
+		strings.TrimSpace(auth.ID),
+		filepath.Base(strings.TrimSpace(auth.ID)),
+		strings.TrimSpace(auth.FileName),
+		filepath.Base(strings.TrimSpace(auth.FileName)),
+	} {
+		if candidate == "." || candidate == "" {
+			continue
+		}
+		if account := m.accountByAuthID[strings.ToLower(candidate)]; account != nil {
+			return account
+		}
+	}
 	if auth.Attributes != nil {
+		if path := strings.TrimSpace(auth.Attributes["path"]); path != "" {
+			if account := m.accountByAuthID[strings.ToLower(path)]; account != nil {
+				return account
+			}
+			if account := m.accountByAuthID[strings.ToLower(filepath.Base(path))]; account != nil {
+				return account
+			}
+		}
 		if key := strings.TrimSpace(auth.Attributes["api_key"]); key != "" {
 			if account := m.accountByAPIKey[key]; account != nil {
-				m.accountByAuthID[strings.ToLower(auth.ID)] = account
+				return account
+			}
+		}
+		if accountID := strings.TrimSpace(auth.Attributes["account_id"]); accountID != "" {
+			if account := m.accountByID[accountID]; account != nil {
+				return account
+			}
+		}
+		if chatGPTID := strings.TrimSpace(auth.Attributes["chatgpt_account_id"]); chatGPTID != "" {
+			if account := m.accountByChatGPT[strings.ToLower(chatGPTID)]; account != nil {
+				return account
+			}
+		}
+		if email := strings.TrimSpace(auth.Attributes["email"]); email != "" {
+			if account := m.accountByEmail[strings.ToLower(email)]; account != nil {
+				return account
 			}
 		}
 	}
+	if auth.Metadata != nil {
+		for _, key := range []string{"account_id", "chatgpt_account_id"} {
+			if value := metadataString(auth.Metadata, key); value != "" {
+				if account := m.accountByChatGPT[strings.ToLower(value)]; account != nil {
+					return account
+				}
+				if account := m.accountByID[value]; account != nil {
+					return account
+				}
+			}
+		}
+		if email := metadataString(auth.Metadata, "email"); email != "" {
+			if account := m.accountByEmail[strings.ToLower(email)]; account != nil {
+				return account
+			}
+		}
+	}
+	return nil
 }
 
 func registerManifestModelsForAuth(manager *coreauth.Manager, m *manifest, auth *coreauth.Auth) {