mirror of
https://github.com/openai/codex.git
synced 2026-10-20 00:18:49 +00:00
jif
896604a12d
## Why Token refresh needs the issuer and client ID used at login. Unverified token claims cannot establish that authority, and OAuth error bodies may echo credentials. ## What changed - Save `oauth_provenance` and a new `login_owner_id` on browser and device-code login. Preserve the login identifier through token rotation. - Refresh using the recorded issuer and client ID, retaining the existing endpoint override and fallback behavior for legacy records. Clear provenance when an override changes the endpoint or when a response without token rotation encounters a concurrently replaced refresh token. - Keep both metadata fields optional for older records without inferring provenance from token claims. - Remove backend token error details from structured logs and refresh error messages. - Box large futures in token refresh, MCP initialization, and embedded app-server test startup to reduce surrounding async frame sizes. ## Testing Add coverage for legacy record compatibility and metadata round trips, browser and device-code login persistence, refresh using recorded OAuth settings, metadata preservation through rotation, and provenance clearing for a superseded refresh token. GitOrigin-RevId: b6b5d2fcbe2a284a171a242c1a17128af55f1024