Merge pull request #1520 from stainless-sdks/dev/jtian/remove-unnecessary-params

[feat] Remove unnecessary params client id during init

Author: jtian-oai

README.md

@@ -111,6 +111,7 @@ Note that you can also pass a raw `IO` descriptor, but this disables retries, as
 
 For secure, automated environments like cloud-managed Kubernetes, Azure, and GCP, you can use workload identity authentication with short-lived tokens from cloud identity providers instead of long-lived API keys.
 
+`client_id` remains available as an optional parameter for token exchange setups that require an explicit OAuth client ID.
 
 ### Kubernetes Service Account
 
@@ -121,7 +122,6 @@ require "openai"
 provider = OpenAI::Auth::SubjectTokenProviders::K8sServiceAccountTokenProvider.new
 
 workload_identity = OpenAI::Auth::WorkloadIdentity.new(
-  client_id: ENV["OAUTH_CLIENT_ID"], # This is the default and can be omitted
   identity_provider_id: ENV["IDENTITY_PROVIDER_ID"], # This is the default and can be omitted
   service_account_id: ENV["SERVICE_ACCOUNT_ID"], # This is the default and can be omitted
   provider: provider
@@ -143,7 +143,6 @@ response = client.chat.completions.create(
 provider = OpenAI::Auth::SubjectTokenProviders::AzureManagedIdentityTokenProvider.new
 
 workload_identity = OpenAI::Auth::WorkloadIdentity.new(
-  client_id: ENV["OAUTH_CLIENT_ID"], # This is the default and can be omitted
   identity_provider_id: ENV["IDENTITY_PROVIDER_ID"], # This is the default and can be omitted
   service_account_id: ENV["SERVICE_ACCOUNT_ID"], # This is the default and can be omitted
   provider: provider
@@ -160,7 +159,6 @@ client = OpenAI::Client.new(
 provider = OpenAI::Auth::SubjectTokenProviders::GCPIDTokenProvider.new
 
 workload_identity = OpenAI::Auth::WorkloadIdentity.new(
-  client_id: ENV["OAUTH_CLIENT_ID"], # This is the default and can be omitted
   identity_provider_id: ENV["IDENTITY_PROVIDER_ID"], # This is the default and can be omitted
   service_account_id: ENV["SERVICE_ACCOUNT_ID"], # This is the default and can be omitted
   provider: provider
@@ -191,7 +189,6 @@ end
 provider = CustomProvider.new
 
 workload_identity = OpenAI::Auth::WorkloadIdentity.new(
-  client_id: ENV["OAUTH_CLIENT_ID"], # This is the default and can be omitted
   identity_provider_id: ENV["IDENTITY_PROVIDER_ID"], # This is the default and can be omitted
   service_account_id: ENV["SERVICE_ACCOUNT_ID"], # This is the default and can be omitted
   provider: provider

lib/openai/auth/workload_identity.rb

@@ -6,13 +6,13 @@ class WorkloadIdentity
       attr_reader :client_id, :identity_provider_id, :service_account_id, :provider, :refresh_buffer_seconds
 
       def initialize(
-        client_id:,
         identity_provider_id:,
         service_account_id:,
         provider:,
+        client_id: nil,
         refresh_buffer_seconds: 1200
       )
-        @client_id = client_id.to_s
+        @client_id = client_id&.to_s
         @identity_provider_id = identity_provider_id.to_s
         @service_account_id = service_account_id.to_s
         @provider = provider

lib/openai/auth/workload_identity_auth.rb

@@ -92,14 +92,15 @@ def fetch_token_from_exchange
 
         request = Net::HTTP::Post.new(@token_exchange_url)
         request["Content-Type"] = "application/json"
-        request.body = JSON.generate(
+        body = {
           grant_type: TOKEN_EXCHANGE_GRANT_TYPE,
-          client_id: @config.client_id,
           subject_token: subject_token,
           subject_token_type: subject_token_type,
           identity_provider_id: @config.identity_provider_id,
           service_account_id: @config.service_account_id
-        )
+        }
+        body[:client_id] = @config.client_id unless @config.client_id.nil?
+        request.body = JSON.generate(body)
 
         response = Net::HTTP.start(
           @token_exchange_url.hostname,

rbi/openai/auth.rbi

@@ -18,7 +18,7 @@ module OpenAI
     end
 
     class WorkloadIdentity
-      sig { returns(String) }
+      sig { returns(T.nilable(String)) }
       attr_reader :client_id
 
       sig { returns(String) }
@@ -35,18 +35,18 @@ module OpenAI
 
       sig do
         params(
-          client_id: T.any(String, Symbol),
           identity_provider_id: T.any(String, Symbol),
           service_account_id: T.any(String, Symbol),
           provider: SubjectTokenProvider,
+          client_id: T.nilable(T.any(String, Symbol)),
           refresh_buffer_seconds: Integer
         ).void
       end
       def initialize(
-        client_id:,
         identity_provider_id:,
         service_account_id:,
         provider:,
+        client_id: nil,
         refresh_buffer_seconds: 1200
       )
       end

test/openai/auth/workload_identity_test.rb

@@ -119,6 +119,39 @@ def test_workload_identity_auth_token_exchange
       token_path: @token_path
     )
 
+    stub_request(:post, "https://auth.openai.com/oauth/token")
+      .with do |request|
+        JSON.parse(request.body) == {
+          "grant_type" => "urn:ietf:params:oauth:grant-type:token-exchange",
+          "subject_token" => "k8s-jwt-token",
+          "subject_token_type" => "urn:ietf:params:oauth:token-type:jwt",
+          "identity_provider_id" => "idp-123",
+          "service_account_id" => "sa-456"
+        }
+      end
+      .to_return(
+        status: 200,
+        body: JSON.generate({"access_token" => "oauth-access-token", "expires_in" => 3600})
+      )
+
+    config = OpenAI::Auth::WorkloadIdentity.new(
+      identity_provider_id: "idp-123",
+      service_account_id: "sa-456",
+      provider: provider
+    )
+
+    auth = OpenAI::Auth::WorkloadIdentityAuth.new(config, "org-123")
+    token = auth.get_token
+
+    assert_equal("oauth-access-token", token)
+  end
+
+  def test_workload_identity_auth_token_exchange_with_optional_client_id
+    File.write(@token_path, "k8s-jwt-token")
+    provider = OpenAI::Auth::SubjectTokenProviders::K8sServiceAccountTokenProvider.new(
+      token_path: @token_path
+    )
+
     stub_request(:post, "https://auth.openai.com/oauth/token")
       .with(
         body: hash_including(
@@ -136,10 +169,10 @@ def test_workload_identity_auth_token_exchange
       )
 
     config = OpenAI::Auth::WorkloadIdentity.new(
-      client_id: "test-client",
       identity_provider_id: "idp-123",
       service_account_id: "sa-456",
-      provider: provider
+      provider: provider,
+      client_id: "test-client"
     )
 
     auth = OpenAI::Auth::WorkloadIdentityAuth.new(config, "org-123")
@@ -166,7 +199,6 @@ def test_workload_identity_auth_oauth_error
       )
 
     config = OpenAI::Auth::WorkloadIdentity.new(
-      client_id: "bad-client",
       identity_provider_id: "idp-123",
       service_account_id: "sa-456",
       provider: provider
@@ -190,7 +222,6 @@ def test_workload_identity_client_initialization
     )
 
     config = OpenAI::Auth::WorkloadIdentity.new(
-      client_id: "test-client",
       identity_provider_id: "idp-123",
       service_account_id: "sa-456",
       provider: provider
@@ -210,7 +241,6 @@ def test_workload_identity_client_initialization
   def test_workload_identity_mutually_exclusive_with_api_key
     provider = OpenAI::Auth::SubjectTokenProviders::K8sServiceAccountTokenProvider.new
     config = OpenAI::Auth::WorkloadIdentity.new(
-      client_id: "test-client",
       identity_provider_id: "idp-123",
       service_account_id: "sa-456",
       provider: provider
@@ -233,7 +263,6 @@ def test_workload_identity_preserves_admin_auth_requests
       token_path: @token_path
     )
     config = OpenAI::Auth::WorkloadIdentity.new(
-      client_id: "test-client",
       identity_provider_id: "idp-123",
       service_account_id: "sa-456",
       provider: provider
@@ -316,7 +345,6 @@ def test_401_retry_with_token_invalidation
       )
 
     config = OpenAI::Auth::WorkloadIdentity.new(
-      client_id: "test-client",
       identity_provider_id: "idp-123",
       service_account_id: "sa-456",
       provider: provider
@@ -379,7 +407,6 @@ def test_workload_identity_token_caching
       )
 
     config = OpenAI::Auth::WorkloadIdentity.new(
-      client_id: "test-client",
       identity_provider_id: "idp-123",
       service_account_id: "sa-456",
       provider: provider