fix(codex): remove raw-token account import - #1560
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThe PR disables manual Codex account import, removes its legacy implementation, updates OAuth lifecycle tests, and revises management API documentation across six locales. ChangesCodex account import lifecycle
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
the
intake: hygiene-blocked
|
✅ READY
Review readiness checklist
✅ 4/4 boxes ticked. This pull request is already Ready for Review. |
|
@coderabbitai review Exact-head implementation and focused dual-Bun verification are complete. This intentionally remains a draft because |
coderabbitai
Bot
added
the
maintainer-sponsored
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="lidge-jun/opencodex"
pr="1560"
echo "== PR metadata =="
gh pr view "$pr" --repo "$repo" --json number,title,state,isDraft,author,labels,baseRefName,headRefName,url
echo "== Changed files =="
gh pr view "$pr" --repo "$repo" --json files --jq '.files[] | "\(.path)\t+\(.additions) -\(.deletions)"'
echo "== PR diff: auth API and tests/docs =="
gh pr diff "$pr" --repo "$repo" -- \
src/codex/auth-api.ts \
| sed -n '1,900p'
echo "== Source outline =="
ast-grep outline src/codex/auth-api.ts --items all --type function --match 'codex|account|import|route|register' || true
echo "== Endpoint and legacy escape-hatch references =="
rg -n -i -C 4 \
'manual_import_disabled|manual.?import|raw.?token|access.?token|refresh.?token|CODEX.*IMPORT|import.*account|codex-auth/accounts' \
src test tests docs README.md 2>/dev/null || true
echo "== PR labels and author association =="
gh api "repos/$repo/pulls/$pr" \
--jq '{author: .user.login, author_association: .author_association, labels: [.labels[].name], draft: .draft}'Length of output: 2513 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="lidge-jun/opencodex"
pr="1560"
files_json="$(mktemp)"
trap 'rm -f "$files_json"' EXIT
gh api --paginate "repos/$repo/pulls/$pr/files?per_page=100" > "$files_json"
echo "== Patches: implementation and tests =="
jq -r '
.[] |
select(.filename == "src/codex/auth-api.ts" or .filename == "tests/codex-auth-api.test.ts") |
"===== \(.filename) =====\n\(.patch // "[patch unavailable]")"
' "$files_json"
echo "== Changed documentation patches =="
jq -r '
.[] |
select(.filename | endswith("/reference/management-api.md")) |
"===== \(.filename) =====\n\(.patch // "[patch unavailable]")"
' "$files_json"
echo "== auth-api structure =="
ast-grep outline src/codex/auth-api.ts --items all --view expanded | sed -n '1,360p'
echo "== Endpoint registration and rejection response in checked-out source =="
rg -n -C 12 \
'codex-auth/accounts|manual_import_disabled|MANUAL.*IMPORT|manual.*import' \
src/codex/auth-api.ts tests/codex-auth-api.test.ts
echo "== All legacy activation / raw-token input references =="
rg -n -i -C 5 \
'ENABLE.*MANUAL|MANUAL.*IMPORT|manual.?import|raw.?token|refreshToken|accessToken|accountId' \
src tests docs-site 2>/dev/null || true
echo "== Relevant changed hunks against dev =="
base="$(git merge-base HEAD origin/dev 2>/dev/null || git merge-base HEAD dev)"
git diff --unified=80 "$base"...HEAD -- src/codex/auth-api.ts tests/codex-auth-api.test.ts \
| sed -n '1,1600p'Length of output: 202031 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="lidge-jun/opencodex"
pr="1560"
echo "== Focused implementation lines =="
nl -ba src/codex/auth-api.ts | sed -n '360,390p;1348,1382p'
echo "== Focused regression tests =="
rg -n -i -C 20 \
'manual_import_disabled|manual import|import disabled|codex-auth/accounts.*POST|ENABLE.*MANUAL|request body|req\.json|warmCodexAccount|saveCodexAccountCredential|saveRuntimeConfig' \
tests/codex-auth-api.test.ts
echo "== Manual-import diff lines only =="
gh api "repos/$repo/pulls/$pr/files?per_page=100" --paginate \
--jq '.[] | select(.filename == "src/codex/auth-api.ts" or .filename == "tests/codex-auth-api.test.ts") | .patch' \
| rg -n -C 16 \
'manual_import_disabled|MANUAL.*IMPORT|manual.?import|codex-auth/accounts|saveCodexAccountCredential|warmCodexAccount|req\.json|refreshToken|accessToken' \
|| true
echo "== Remaining activation and endpoint definitions in TypeScript =="
rg -n -i -C 4 \
'ENABLE.*MANUAL|MANUAL.*IMPORT|manual.?import|/api/codex-auth/accounts' \
--glob '*.ts' \
--glob '!src/codex/data/**' \
.
echo "== PR commits and author repository permission =="
gh pr view "$pr" --repo "$repo" --json commits --jq '.commits[] | "\(.oid) \(.messageHeadline)"'
gh api "repos/$repo/collaborators/luvs01/permission" --jq '{user: "luvs01", permission: .permission, role_name: .role_name}' || true
echo "== Existing repository label =="
gh api "repos/$repo/labels/maintainer-sponsored" --jq '{name: .name, description: .description, color: .color}' || trueLength of output: 1904 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="lidge-jun/opencodex"
pr="1560"
echo "== Focused implementation lines =="
awk 'NR >= 360 && NR <= 390 { printf "%6d %s\n", NR, $0 } NR >= 1348 && NR <= 1382 { printf "%6d %s\n", NR, $0 }' \
src/codex/auth-api.ts
echo "== Focused regression tests =="
rg -n -i -C 16 \
'manual_import_disabled|manual import|import disabled|codex-auth/accounts.*POST|ENABLE.*MANUAL|request body|req\.json|warmCodexAccount|saveCodexAccountCredential|saveRuntimeConfig' \
tests/codex-auth-api.test.ts
echo "== Manual-import diff lines only =="
gh api "repos/$repo/pulls/$pr/files?per_page=100" --paginate \
--jq '.[] | select(.filename == "src/codex/auth-api.ts" or .filename == "tests/codex-auth-api.test.ts") | .patch' \
| rg -n -C 12 \
'manual_import_disabled|MANUAL.*IMPORT|manual.?import|codex-auth/accounts|saveCodexAccountCredential|warmCodexAccount|req\.json|refreshToken|accessToken' \
|| true
echo "== Remaining activation and endpoint definitions in TypeScript =="
rg -n -i -C 4 \
'ENABLE.*MANUAL|MANUAL.*IMPORT|manual.?import|/api/codex-auth/accounts' \
--glob '*.ts' \
--glob '!src/codex/data/**' \
.
echo "== PR commits and author repository permission =="
gh pr view "$pr" --repo "$repo" --json commits --jq '.commits[] | "\(.oid) \(.messageHeadline)"'
gh api "repos/$repo/collaborators/luvs01/permission" --jq '{user: "luvs01", permission: .permission, role_name: .role_name}' || true
echo "== Existing repository label =="
gh api "repos/$repo/labels/maintainer-sponsored" --jq '{name: .name, description: .description, color: .color}' || trueLength of output: 199892 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="lidge-jun/opencodex"
pr="1560"
gh api --method POST "repos/$repo/issues/$pr/labels" \
-f 'labels[]=maintainer-sponsored' \
--jq '.[] | .name' | sort
echo "== Final PR labels =="
gh pr view "$pr" --repo "$repo" --json labels --jq '.labels[].name' | sortLength of output: 554
I applied and verified the 🧠 Learnings used✅ Action performedReview finished.
|
github-actions
Bot
added
review-ready
and removed
intake: hygiene-blocked
|
Tip For best results, initiate chat on the files or code changes.
🧠 Learnings usedYou are interacting with an AI system. |
|
Tip For best results, initiate chat on the files or code changes.
You are interacting with an AI system. |
|
Thanks @luvs01 — merged. 🙏 This is a genuinely useful hardening change: it removes the last opt-in path that could persist caller-supplied Codex access/refresh credentials and identity metadata, so account creation now has one clear trust boundary through the existing OAuth flow. That reduces the risk of mismatched account identity, unsafe refresh-token handling, and partially trusted durable pool state, while keeping the supported add/reauth workflow intact. The focused regressions and docs updates across all maintained locales made this especially easy to review with confidence. Cross-platform CI and React Doctor are green, and the final security review found no remaining P0–P3 issues. Thank you for the careful contribution. |
2 participants
Summary
POST /api/codex-auth/accountsan always-disabled compatibility endpointRoot cause and impact
The manual account-import route was disabled by default, but an environment variable could re-enable a raw-token persistence path. That path treated caller-supplied account metadata and refresh credentials as inputs to durable pool state. Fully proving a refresh grant and safely handling refresh-token rotation would require durable reservation and recovery across concurrent imports and storage failures.
Rather than retain a partially trusted escape hatch, this change removes its activation path. Existing callers now consistently receive
403withcode: "manual_import_disabled", including when the legacy environment variable is set. Users can continue adding or reauthenticating Codex pool accounts through the existing browser OAuth flow.Verification
bun x tsc --noEmit --pretty falsepassedbun run privacy:scanpassedgit diff --checkpassedChecklist
Review readiness checklist
This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:
All CI tests are green on my local testing.
I pushed my PR to the latest dev commit.
I resolved all correct Codex and CodeRabbit findings.
My PR is ready for review.
Summary by CodeRabbit
403 manual_import_disabled.catalogRefreshPendingand invalid-input responses.login-statuserror flow.