feat: add support for login with ChatGPT (#1212)

This does not implement the full Login with ChatGPT experience, but it
should unblock people.

**What works**

* The `codex` multitool now has a `login` subcommand, so you can run
`codex login`, which should write `CODEX_HOME/auth.json` if you complete
the flow successfully. The TUI will now read the `OPENAI_API_KEY` from
`auth.json`.
* The TUI should refresh the token if it has expired and the necessary
information is in `auth.json`.
* There is a `LoginScreen` in the TUI that tells you to run `codex
login` if both (1) your model provider expects to use `OPENAI_API_KEY`
as its env var, and (2) `OPENAI_API_KEY` is not set.

**What does not work**

* The `LoginScreen` does not support the login flow from within the TUI.
Instead, it tells you to quit, run `codex login`, and then run `codex`
again.
* `codex exec` does read from `auth.json` yet, nor does it direct the
user to go through the login flow if `OPENAI_API_KEY` is not be found.
* The `maybeRedeemCredits()` function from `get-api-key.tsx` has not
been ported from TypeScript to `login_with_chatgpt.py` yet:


https://github.com/openai/codex/blob/a67a67f3258fc21e147b6786a143fe3e15e6d5ba/codex-cli/src/utils/get-api-key.tsx#L84-L89

**Implementation**

Currently, the OAuth flow requires running a local webserver on
`127.0.0.1:1455`. It seemed wasteful to incur the additional binary cost
of a webserver dependency in the Rust CLI just to support login, so
instead we implement this logic in Python, as Python has a `http.server`
module as part of its standard library. Specifically, we bundle the
contents of a single Python file as a string in the Rust CLI and then
use it to spawn a subprocess as `python3 -c
{{SOURCE_FOR_PYTHON_SERVER}}`.

As such, the most significant files in this PR are:

```
codex-rs/login/src/login_with_chatgpt.py
codex-rs/login/src/lib.rs
```

Now that the CLI may load `OPENAI_API_KEY` from the environment _or_
`CODEX_HOME/auth.json`, we need a new abstraction for reading/writing
this variable, so we introduce:

```
codex-rs/core/src/openai_api_key.rs
```

Note that `std::env::set_var()` is [rightfully] `unsafe` in Rust 2024,
so we use a LazyLock<RwLock<Option<String>>> to store `OPENAI_API_KEY`
so it is read in a thread-safe manner.

Ultimately, it should be possible to go through the entire login flow
from the TUI. This PR introduces a placeholder `LoginScreen` UI for that
right now, though the new `codex login` subcommand introduced in this PR
should be a viable workaround until the UI is ready.

**Testing**

Because the login flow is currently implemented in a standalone Python
file, you can test it without building any Rust code as follows:

```
rm -rf /tmp/codex_home && mkdir /tmp/codex_home
CODEX_HOME=/tmp/codex_home python3 codex-rs/login/src/login_with_chatgpt.py
```

For reference:

* the original TypeScript implementation was introduced in
https://github.com/openai/codex/pull/963
* support for redeeming credits was later added in
https://github.com/openai/codex/pull/974

codex-rs/login/src/lib.rs

@@ -0,0 +1,168 @@
+use chrono::DateTime;
+use chrono::Utc;
+use serde::Deserialize;
+use serde::Serialize;
+use std::fs::OpenOptions;
+use std::io::Read;
+use std::io::Write;
+#[cfg(unix)]
+use std::os::unix::fs::OpenOptionsExt;
+use std::path::Path;
+use std::process::Stdio;
+use tokio::process::Command;
+
+const SOURCE_FOR_PYTHON_SERVER: &str = include_str!("./login_with_chatgpt.py");
+
+const CLIENT_ID: &str = "app_EMoamEEZ73f0CkXaXp7hrann";
+
+/// Run `python3 -c {{SOURCE_FOR_PYTHON_SERVER}}` with the CODEX_HOME
+/// environment variable set to the provided `codex_home` path. If the
+/// subprocess exits 0, read the OPENAI_API_KEY property out of
+/// CODEX_HOME/auth.json and return Ok(OPENAI_API_KEY). Otherwise, return Err
+/// with any information from the subprocess.
+///
+/// If `capture_output` is true, the subprocess's output will be captured and
+/// recorded in memory. Otherwise, the subprocess's output will be sent to the
+/// current process's stdout/stderr.
+pub async fn login_with_chatgpt(
+    codex_home: &Path,
+    capture_output: bool,
+) -> std::io::Result<String> {
+    let child = Command::new("python3")
+        .arg("-c")
+        .arg(SOURCE_FOR_PYTHON_SERVER)
+        .env("CODEX_HOME", codex_home)
+        .stdin(Stdio::null())
+        .stdout(if capture_output {
+            Stdio::piped()
+        } else {
+            Stdio::inherit()
+        })
+        .stderr(if capture_output {
+            Stdio::piped()
+        } else {
+            Stdio::inherit()
+        })
+        .spawn()?;
+
+    let output = child.wait_with_output().await?;
+    if output.status.success() {
+        try_read_openai_api_key(codex_home).await
+    } else {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        Err(std::io::Error::other(format!(
+            "login_with_chatgpt subprocess failed: {stderr}"
+        )))
+    }
+}
+
+/// Attempt to read the `OPENAI_API_KEY` from the `auth.json` file in the given
+/// `CODEX_HOME` directory, refreshing it, if necessary.
+pub async fn try_read_openai_api_key(codex_home: &Path) -> std::io::Result<String> {
+    let auth_path = codex_home.join("auth.json");
+    let mut file = std::fs::File::open(&auth_path)?;
+    let mut contents = String::new();
+    file.read_to_string(&mut contents)?;
+    let auth_dot_json: AuthDotJson = serde_json::from_str(&contents)?;
+
+    if is_expired(&auth_dot_json) {
+        let refresh_response = try_refresh_token(&auth_dot_json).await?;
+        let mut auth_dot_json = auth_dot_json;
+        auth_dot_json.tokens.id_token = refresh_response.id_token;
+        if let Some(refresh_token) = refresh_response.refresh_token {
+            auth_dot_json.tokens.refresh_token = refresh_token;
+        }
+        auth_dot_json.last_refresh = Utc::now();
+
+        let mut options = OpenOptions::new();
+        options.write(true).create(true);
+        #[cfg(unix)]
+        {
+            options.mode(0o600);
+        }
+
+        let json_data = serde_json::to_string(&auth_dot_json)?;
+        {
+            let mut file = options.open(&auth_path)?;
+            file.write_all(json_data.as_bytes())?;
+            file.flush()?;
+        }
+
+        Ok(auth_dot_json.openai_api_key)
+    } else {
+        Ok(auth_dot_json.openai_api_key)
+    }
+}
+
+fn is_expired(auth_dot_json: &AuthDotJson) -> bool {
+    let last_refresh = auth_dot_json.last_refresh;
+    last_refresh < Utc::now() - chrono::Duration::days(28)
+}
+
+async fn try_refresh_token(auth_dot_json: &AuthDotJson) -> std::io::Result<RefreshResponse> {
+    let refresh_request = RefreshRequest {
+        client_id: CLIENT_ID,
+        grant_type: "refresh_token",
+        refresh_token: auth_dot_json.tokens.refresh_token.clone(),
+        scope: "openid profile email",
+    };
+
+    let client = reqwest::Client::new();
+    let response = client
+        .post("https://auth.openai.com/oauth/token")
+        .header("Content-Type", "application/json")
+        .json(&refresh_request)
+        .send()
+        .await
+        .map_err(std::io::Error::other)?;
+
+    if response.status().is_success() {
+        let refresh_response = response
+            .json::<RefreshResponse>()
+            .await
+            .map_err(std::io::Error::other)?;
+        Ok(refresh_response)
+    } else {
+        Err(std::io::Error::other(format!(
+            "Failed to refresh token: {}",
+            response.status()
+        )))
+    }
+}
+
+#[derive(Serialize)]
+struct RefreshRequest {
+    client_id: &'static str,
+    grant_type: &'static str,
+    refresh_token: String,
+    scope: &'static str,
+}
+
+#[derive(Deserialize)]
+struct RefreshResponse {
+    id_token: String,
+    refresh_token: Option<String>,
+}
+
+/// Expected structure for $CODEX_HOME/auth.json.
+#[derive(Deserialize, Serialize)]
+struct AuthDotJson {
+    #[serde(rename = "OPENAI_API_KEY")]
+    openai_api_key: String,
+
+    tokens: TokenData,
+
+    last_refresh: DateTime<Utc>,
+}
+
+#[derive(Deserialize, Serialize)]
+struct TokenData {
+    /// This is a JWT.
+    id_token: String,
+
+    /// This is a JWT.
+    #[allow(dead_code)]
+    access_token: String,
+
+    refresh_token: String,
+}