Repository navigation
feat(auth): harden X.509 token lifecycle and tenant isolation - #2473
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9e9f746953
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
HAYDEN-OAI
left a comment
HAYDEN-OAI
left a comment
There was a problem hiding this comment.
One additional fail-closed authentication issue is noted inline. The existing retry-timer lifecycle finding also remains unresolved; both should be addressed before approval.
ba4e8c9 to
d16c878
Compare
9e9f746 to
02d6e60
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 02d6e60944
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
d16c878 to
4bedd94
Compare
02d6e60 to
c1c9ded
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c1c9ded659
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
4bedd94 to
9cee783
Compare
c1c9ded to
368ab64
Compare
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
368ab64 to
c1aa772
Compare
9cee783 to
8660250
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c1aa7722d0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
c1aa772 to
f1819b6
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f1819b6024
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
2cff517 to
c409002
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c409002bca
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
c409002 to
583118e
Compare
💡 Codex Reviewopenai-node/src/internal/auth/x509-workload-identity-auth.ts Lines 724 to 725 in 583118e  Normalize tenant selectors before exchanging credentials
When an enrolled selector contains leading or trailing HTTP whitespace (for example, AGENTS.md reference: AGENTS.md:L106-L110 ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
583118e to
71b69e9
Compare
HAYDEN-OAI
left a comment
HAYDEN-OAI
left a comment
There was a problem hiding this comment.
Re-reviewed the current stacked diff and all previously reported findings. Certificate-bound token caching and clone sharing now preserve tenant/request ownership and generations; refresh singleflight, suspend-aware expiry, transient-only fallback, bounded 401 rotation, Retry-After, cancellation/deadlines, and sanitized issuer/API failures are handled correctly. Verified the previous retry-timer, permanent-body-failure, tenant-alias/snapshot, hook-abort, and nested-clone-scope issues are resolved. No remaining substantive findings.
71b69e9 to
841bf72
Compare
26f8641 to
67b4165
Compare
bba2956 to
83d01f1
Compare
1f1d18e to
1c40590
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c04436c813
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
## Summary Part 5 of 5; based on `codex/x509-04-token-lifecycle`. - Document the Node-only X.509 contract, refresh policy, bearer-token handling, approved global endpoint, caller-owned dispatcher, and manual live-validation workflow. - Add a runnable example supporting both protected PEM variables and documented local certificate-path/identity fixtures, encrypted keys, explicit direct/CONNECT proxy modes, optional project selection, and sanitized proxy failures. - Extend the genuine local mTLS + CONNECT integration to verify cache reuse, a real API 401, one token refresh/replay, renewed-token reuse, issuer/API certificate identity/SNI, and zero proxy credential leakage. - Add child-process regressions for malformed secret-bearing proxy URLs, mismatched proxy modes, and ignored ambient proxies; verified against a fresh checkout with no prebuilt `dist/`. ## Verification - 246 focused X.509/client/transport/example regressions; exact minimum Node 22.22.0; real ephemeral certificate/CONNECT wire test. - `pnpm lint`, `pnpm exec tsc --noEmit`, `pnpm build`, packed npm artifact/export checks, Node version-policy validation, and the trusted custom-code budget check (2,791 / 3,000 lines). - Two independent security/code-review rounds; full-stack Codex Security diff scan completed across 12 production/package files with zero findings. - `pnpm test:live:x509` is intentionally manual and correctly fails closed without owner-provisioned enrolled credentials; no production-live success is claimed.
c04436c to
1038481
Compare
Castiron custom code✅ No new custom-code files detected. 32 mixed files remain; 1 existing customization changed. Compared
31 existing customizations unchanged
A changed generated baseline means this report cannot reliably identify which handwritten lines changed. Inspect the custom-code diffDownload the exact patch produced by this run (requires repository access): gh run download 32926826038 --repo openai/openai-node \
--name castiron-custom-code-32926826038-1 --dir /tmp/castiron-custom-code-32926826038-1
git apply --stat /tmp/castiron-custom-code-32926826038-1/custom-code.patch
cat /tmp/castiron-custom-code-32926826038-1/custom-code.patchOr reproduce it from an SDK checkout containing the vendored reporter: git fetch --no-tags origin ee5229b4aae0778719c5d0a0f23ea90b74aa837b 10384813d9817f1c5cf96b537b3b498fa3ee872e
python3 scripts/castiron/custom_code_report.py report \
--base ee5229b4aae0778719c5d0a0f23ea90b74aa837b \
--head 10384813d9817f1c5cf96b537b3b498fa3ee872e --fetch --require-head-hash --public \
--out /tmp/castiron-custom-code-10384813d981
cat /tmp/castiron-custom-code-10384813d981/custom-code.patchThis is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR. |
Raise the custom-code budget from 3,000 to 4,000 to unblock SDK generation. Main currently uses 2,983 lines; the current generation candidate uses 3,497, leaving 503 lines under the new limit. These remaining customizations are technical debt. We do not have time to address that debt at the moment, so this raises the budget to unblock the work and defers the underlying cleanup. Usage was 1,770 when the original budget landed in openai#2446. The increase on main came from: - Reporter and test changes: +696 lines in openai#2447 and openai#2464. - X.509 client integration: +513 lines in openai#2472, openai#2473 and openai#2479. - Webhook verification wiring: +4 lines in openai#2475. Only `.castiron-ratchet.json` changes.
Summary
Part 4 of 5; based on
codex/x509-03-client-integration.Verification
pnpm lint,pnpm exec tsc --noEmit,pnpm build, and packed npm artifact checks.Next:
codex/x509-05-e2e-docs-hardening.