admin/CC-Switch
1
0
Fork 0
mirror of https://github.com/farion1231/cc-switch.git synced 2026-07-24 12:44:18 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(codex): preserve OAuth login state during third-party provider switching

Browse Source 
Codex provider switches now only write config.toml for third-party providers,
injecting the API key as experimental_bearer_token. The user's auth.json
(ChatGPT OAuth tokens) is preserved. Official providers with login material
still write auth.json normally. Backfill restores bearer tokens into stored
provider auth.OPENAI_API_KEY to maintain canonical shape.
This commit is contained in:
Jason
2026-05-25 17:46:23 +08:00
parent 88ba908bc4
commit 95f2dd4126
17 changed files with 1664 additions and 154 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src-tauri/src/codex_config.rs
+447 -14
View File
@@ -1,14 +1,12 @@
// unused imports removed
use std::path::PathBuf;
use std::path::{Path, PathBuf};
use crate::config::{
atomic_write, delete_file, get_home_dir, sanitize_provider_name, write_json_file,
write_text_file,
atomic_write, delete_file, get_home_dir, read_json_file, sanitize_provider_name,
write_json_file, write_text_file,
};
use crate::error::AppError;
use serde_json::{json, Value};
use std::fs;
use std::path::Path;
use std::process::Command;
use toml_edit::DocumentMut;
@@ -393,20 +391,123 @@ pub fn write_codex_live_atomic_with_stable_provider(
) -> Result<(), AppError> {
match config_text_opt {
Some(config_text) => {
let mut settings = serde_json::Map::new();
settings.insert("config".to_string(), Value::String(config_text.to_string()));
let mut settings = Value::Object(settings);
normalize_codex_settings_config_model_provider(&mut settings)?;
let config_text = settings
.get("config")
.and_then(|value| value.as_str())
.unwrap_or(config_text);
write_codex_live_atomic(auth, Some(config_text))
let config_text = normalize_codex_config_for_live_provider(config_text)?;
write_codex_live_atomic(auth, Some(&config_text))
}
None => write_codex_live_atomic(auth, None),
}
}
fn normalize_codex_config_for_live_provider(config_text: &str) -> Result<String, AppError> {
let mut settings = serde_json::Map::new();
settings.insert("config".to_string(), Value::String(config_text.to_string()));
let mut settings = Value::Object(settings);
normalize_codex_settings_config_model_provider(&mut settings)?;
Ok(settings
.get("config")
.and_then(|value| value.as_str())
.unwrap_or(config_text)
.to_string())
}
/// Write only Codex `config.toml` for provider switching.
///
/// Codex login state lives in `auth.json`; provider routing, endpoint, model,
/// and provider-scoped bearer tokens live in `config.toml`. Provider switches
/// should not overwrite the user's ChatGPT login cache.
pub fn write_codex_live_config_atomic_with_stable_provider(
config_text_opt: Option<&str>,
) -> Result<(), AppError> {
let config_path = get_codex_config_path();
let cfg_text = match config_text_opt {
Some(config_text) => normalize_codex_config_for_live_provider(config_text)?,
None => String::new(),
};
if !cfg_text.trim().is_empty() {
toml::from_str::<toml::Table>(&cfg_text).map_err(|e| AppError::toml(&config_path, e))?;
}
write_text_file(&config_path, &cfg_text)
}
pub fn extract_codex_auth_api_key(auth: &Value) -> Option<String> {
auth.get("OPENAI_API_KEY")
.and_then(|value| value.as_str())
.map(str::trim)
.filter(|key| !key.is_empty())
.map(str::to_string)
}
pub fn extract_codex_api_key(auth: Option<&Value>, config_text: Option<&str>) -> Option<String> {
auth.and_then(extract_codex_auth_api_key)
.or_else(|| config_text.and_then(extract_codex_experimental_bearer_token))
}
pub fn codex_auth_has_login_material(auth: &Value) -> bool {
let Some(obj) = auth.as_object() else {
return false;
};
obj.iter().any(|(key, value)| {
if key == "auth_mode" {
return false;
}
if key == "OPENAI_API_KEY" {
return value
.as_str()
.map(str::trim)
.is_some_and(|token| !token.is_empty());
}
match value {
Value::Null => false,
Value::String(text) => !text.trim().is_empty(),
Value::Array(items) => !items.is_empty(),
Value::Object(map) => !map.is_empty(),
_ => true,
}
})
}
pub fn codex_auth_has_oauth_login_material(auth: &Value) -> bool {
let Some(obj) = auth.as_object() else {
return false;
};
obj.iter().any(|(key, value)| {
if key == "auth_mode" || key == "OPENAI_API_KEY" {
return false;
}
match value {
Value::Null => false,
Value::String(text) => !text.trim().is_empty(),
Value::Array(items) => !items.is_empty(),
Value::Object(map) => !map.is_empty(),
_ => true,
}
})
}
pub fn should_restore_codex_provider_token_for_backfill(
category: Option<&str>,
template_settings: &Value,
) -> bool {
if category == Some("official") {
return false;
}
let Some(auth) = template_settings.get("auth") else {
return true;
};
let has_provider_api_key = extract_codex_auth_api_key(auth).is_some();
let has_oauth_login = codex_auth_has_oauth_login_material(auth);
!(has_oauth_login && !has_provider_api_key)
}
fn parse_codex_positive_u64(value: Option<&Value>) -> Option<u64> {
match value {
Some(Value::Number(n)) => n.as_u64().filter(|v| *v > 0),
@@ -787,6 +888,235 @@ pub fn write_codex_live_with_catalog(
write_codex_live_atomic_with_stable_provider(auth, prepared_config.as_deref())
}
pub fn write_codex_provider_live_with_catalog(
settings: &Value,
category: Option<&str>,
auth: &Value,
config_text: Option<&str>,
) -> Result<(), AppError> {
let prepared_config = config_text
.map(|text| prepare_codex_config_text_with_model_catalog(settings, text))
.transpose()?;
write_codex_live_for_provider(category, auth, prepared_config.as_deref())
}
/// Extract a provider-scoped `experimental_bearer_token` from Codex `config.toml`.
///
/// Mobile compat: third-party providers may store the API key inside
/// `[model_providers.<id>].experimental_bearer_token` while keeping the
/// user's ChatGPT login cache intact in `auth.json`. Falls back to the
/// top-level `experimental_bearer_token` when no active model provider is set.
pub fn extract_codex_experimental_bearer_token(config_text: &str) -> Option<String> {
if !config_text.contains("experimental_bearer_token") {
return None;
}
let doc = config_text.parse::<DocumentMut>().ok()?;
let provider_id = active_codex_model_provider_id(&doc);
let top_level_token = || {
doc.get("experimental_bearer_token")
.and_then(|item| item.as_str())
};
let token = match provider_id.as_deref() {
Some(id) if is_custom_codex_model_provider_id(id) => doc
.get("model_providers")
.and_then(|item| item.as_table())
.and_then(|table| table.get(id))
.and_then(|item| item.as_table())
.and_then(|table| table.get("experimental_bearer_token"))
.and_then(|item| item.as_str())
.or_else(top_level_token),
Some(_) => top_level_token(),
None => top_level_token(),
};
token
.map(str::trim)
.filter(|token| !token.is_empty())
.map(str::to_string)
}
fn set_codex_experimental_bearer_token(config_text: &str, token: &str) -> Result<String, AppError> {
if config_text.trim().is_empty() {
return Err(AppError::localized(
"provider.codex.config.missing",
"Codex 第三方供应商缺少 config.toml 配置，无法写入 bearer token",
"Codex third-party provider is missing config.toml, cannot write bearer token",
));
}
let mut doc = config_text
.parse::<DocumentMut>()
.map_err(|e| AppError::Message(format!("Invalid Codex config.toml: {e}")))?;
let Some(provider_id) = active_codex_model_provider_id(&doc) else {
doc["experimental_bearer_token"] = toml_edit::value(token);
return Ok(doc.to_string());
};
if !is_custom_codex_model_provider_id(&provider_id) {
// Reserved Codex provider IDs are owned by the CLI. Keep third-party
// bearer tokens at the top level so we do not shadow built-in tables.
doc["experimental_bearer_token"] = toml_edit::value(token);
return Ok(doc.to_string());
}
if let Some(model_providers) = doc
.get_mut("model_providers")
.and_then(|item| item.as_table_mut())
{
if let Some(provider_table) = model_providers
.get_mut(provider_id.as_str())
.and_then(|item| item.as_table_mut())
{
provider_table["experimental_bearer_token"] = toml_edit::value(token);
return Ok(doc.to_string());
}
}
doc["experimental_bearer_token"] = toml_edit::value(token);
Ok(doc.to_string())
}
fn remove_codex_experimental_bearer_token(config_text: &str) -> Result<String, AppError> {
if config_text.trim().is_empty() || !config_text.contains("experimental_bearer_token") {
return Ok(config_text.to_string());
}
let mut doc = config_text
.parse::<DocumentMut>()
.map_err(|e| AppError::Message(format!("Invalid Codex config.toml: {e}")))?;
if let Some(provider_id) = active_codex_model_provider_id(&doc) {
if let Some(provider_table) = doc
.get_mut("model_providers")
.and_then(|item| item.as_table_mut())
.and_then(|table| table.get_mut(provider_id.as_str()))
.and_then(|item| item.as_table_mut())
{
provider_table.remove("experimental_bearer_token");
}
}
doc.as_table_mut().remove("experimental_bearer_token");
Ok(doc.to_string())
}
/// Read the current Codex live settings as a `{ auth, config }` object.
///
/// Missing `auth.json` collapses to `{}` so a config-only third-party install
/// is still importable; both files empty is treated as "no live install".
pub fn read_codex_live_settings() -> Result<Value, AppError> {
let auth_path = get_codex_auth_path();
let auth_present = auth_path.exists();
let auth: Value = if auth_present {
read_json_file(&auth_path)?
} else {
json!({})
};
let cfg_text = read_and_validate_codex_config_text()?;
if !auth_present && cfg_text.trim().is_empty() {
return Err(AppError::localized(
"codex.live.missing",
"Codex 配置文件不存在",
"Codex configuration is missing",
));
}
Ok(json!({ "auth": auth, "config": cfg_text }))
}
/// Route a Codex live write between full auth+config or config-only.
///
/// Official providers with usable login material own `auth.json`; everyone
/// else only touches `config.toml` so the user's ChatGPT login cache survives
/// third-party switches.
pub fn write_codex_live_for_provider(
category: Option<&str>,
auth: &Value,
config_text: Option<&str>,
) -> Result<(), AppError> {
if category == Some("official") && codex_auth_has_login_material(auth) {
write_codex_live_atomic_with_stable_provider(auth, config_text)
} else {
let live_config = prepare_codex_provider_live_config(auth, config_text.unwrap_or(""))?;
write_codex_live_config_atomic_with_stable_provider(Some(&live_config))
}
}
/// Build the live Codex config for provider switching.
///
/// The stored provider keeps its API key in `auth.OPENAI_API_KEY`. Live Codex
/// requests can use a provider-scoped `experimental_bearer_token`, so switching
/// providers only needs to update `config.toml`; `auth.json` stays as the user's
/// long-lived ChatGPT login cache.
pub fn prepare_codex_provider_live_config(
auth: &Value,
config_text: &str,
) -> Result<String, AppError> {
let token = extract_codex_auth_api_key(auth)
.or_else(|| extract_codex_experimental_bearer_token(config_text));
Ok(match token {
Some(token) => set_codex_experimental_bearer_token(config_text, &token)?,
None => config_text.to_string(),
})
}
/// During DB backfill, lift a live `experimental_bearer_token` back into
/// `auth.OPENAI_API_KEY` so the stored provider keeps its canonical shape
/// and generated live tokens don't leak into stored provider TOML.
///
/// Only intervenes when the live config actually carries a bearer token —
/// otherwise the function is a no-op so the caller's normal backfill path
/// (which keeps live `auth` as the authoritative source) is unaffected.
pub fn restore_codex_provider_token_for_backfill(
settings: &mut Value,
template_settings: &Value,
) -> Result<(), AppError> {
let Some(config_text) = settings
.get("config")
.and_then(|value| value.as_str())
.map(str::to_string)
else {
return Ok(());
};
let Some(token) = extract_codex_experimental_bearer_token(&config_text) else {
return Ok(());
};
let cleaned_config = remove_codex_experimental_bearer_token(&config_text)?;
if let Some(obj) = settings.as_object_mut() {
obj.insert("config".to_string(), Value::String(cleaned_config));
let mut auth = template_settings
.get("auth")
.filter(|value| value.is_object())
.cloned()
.unwrap_or_else(|| Value::Object(serde_json::Map::new()));
if let Some(auth_obj) = auth.as_object_mut() {
auth_obj.insert("OPENAI_API_KEY".to_string(), Value::String(token));
}
obj.insert("auth".to_string(), auth);
}
Ok(())
}
pub fn restore_codex_settings_for_backfill(
settings: &mut Value,
template_settings: &Value,
restore_provider_token: bool,
) -> Result<(), AppError> {
restore_codex_settings_config_model_provider_for_backfill(settings, template_settings)?;
if restore_provider_token {
restore_codex_provider_token_for_backfill(settings, template_settings)?;
}
Ok(())
}
/// Update a field in Codex config.toml using toml_edit (syntax-preserving).
///
/// Supported fields:
@@ -905,6 +1235,7 @@ pub fn remove_codex_toml_base_url_if(toml_str: &str, predicate: impl Fn(&str) ->
#[cfg(test)]
mod tests {
use super::*;
use serde_json::json;
#[test]
fn normalize_live_config_uses_custom_for_third_party_model_provider_id() {
@@ -984,6 +1315,108 @@ wire_api = "responses"
assert_eq!(result, "");
}
#[test]
fn prepare_provider_live_config_rejects_key_without_config() {
let err = prepare_codex_provider_live_config(&json!({"OPENAI_API_KEY": "sk-test"}), "")
.expect_err("empty config with API key should not truncate live config");
assert!(
err.to_string().contains("config.toml"),
"error should explain missing config.toml, got: {err}"
);
}
#[test]
fn prepare_provider_live_config_uses_top_level_token_for_reserved_provider() {
let input = r#"model_provider = "openai"
model = "gpt-5"
"#;
let output =
prepare_codex_provider_live_config(&json!({"OPENAI_API_KEY": "sk-test"}), input)
.expect("prepare live config");
let parsed: toml::Value = toml::from_str(&output).expect("parse output");
assert_eq!(
parsed
.get("experimental_bearer_token")
.and_then(|v| v.as_str()),
Some("sk-test")
);
assert!(
parsed.get("model_providers").is_none(),
"reserved provider tables should not be synthesized"
);
}
#[test]
fn extract_bearer_uses_top_level_token_for_reserved_provider() {
let input = r#"model_provider = "openai"
experimental_bearer_token = "top-level-key"
[model_providers.openai]
experimental_bearer_token = "stale-table-key"
"#;
assert_eq!(
extract_codex_experimental_bearer_token(input).as_deref(),
Some("top-level-key")
);
}
#[test]
fn should_not_restore_provider_token_for_oauth_only_template() {
let oauth_template = json!({
"auth": {
"auth_mode": "chatgpt",
"tokens": {
"access_token": "oauth-access"
}
}
});
let api_key_template = json!({
"auth": {
"OPENAI_API_KEY": "sk-test"
}
});
assert!(
!should_restore_codex_provider_token_for_backfill(Some("custom"), &oauth_template),
"OAuth-only templates should not backfill bearer tokens into OPENAI_API_KEY"
);
assert!(
should_restore_codex_provider_token_for_backfill(Some("custom"), &api_key_template),
"custom API-key providers should still restore provider bearer tokens"
);
assert!(
!should_restore_codex_provider_token_for_backfill(Some("official"), &api_key_template),
"official providers should never restore third-party bearer tokens"
);
}
#[test]
fn prepare_provider_live_config_does_not_create_incomplete_provider_table() {
let input = r#"model_provider = "vendor_x"
model = "gpt-5"
"#;
let output =
prepare_codex_provider_live_config(&json!({"OPENAI_API_KEY": "sk-test"}), input)
.expect("prepare live config");
let parsed: toml::Value = toml::from_str(&output).expect("parse output");
assert_eq!(
parsed
.get("experimental_bearer_token")
.and_then(|v| v.as_str()),
Some("sk-test")
);
assert!(
parsed.get("model_providers").is_none(),
"missing provider tables should not be synthesized without endpoint fields"
);
}
#[test]
fn normalize_live_config_rewrites_matching_profile_model_provider_refs() {
let target = r#"model_provider = "vendor_alpha"
src-tauri/src/commands/config.rs
+2 -1
View File
@@ -82,7 +82,8 @@ pub async fn get_config_status(
}
AppType::Codex => {
let auth_path = codex_config::get_codex_auth_path();
let exists = auth_path.exists();
let config_text = codex_config::read_codex_config_text().unwrap_or_default();
let exists = auth_path.exists() || !config_text.trim().is_empty();
let path = codex_config::get_codex_config_dir()
.to_string_lossy()
.to_string();
src-tauri/src/deeplink/provider.rs
+4 -5
View File
@@ -616,12 +616,11 @@ fn merge_codex_config(
request: &mut DeepLinkImportRequest,
config: &serde_json::Value,
) -> Result<(), AppError> {
// Auto-fill API key from auth.OPENAI_API_KEY
// Auto-fill API key from auth.OPENAI_API_KEY or Codex mobile-compatible bearer token.
if request.api_key.as_ref().is_none_or(|s| s.is_empty()) {
if let Some(api_key) = config
.get("auth")
.and_then(|v| v.get("OPENAI_API_KEY"))
.and_then(|v| v.as_str())
let config_str = config.get("config").and_then(|v| v.as_str());
if let Some(api_key) =
crate::codex_config::extract_codex_api_key(config.get("auth"), config_str)
{
request.api_key = Some(api_key.to_string());
}
src-tauri/src/deeplink/tests.rs
+41
View File
@@ -267,6 +267,47 @@ fn test_parse_and_merge_config_claude() {
assert_eq!(merged.model, Some("claude-sonnet-4.5".to_string()));
}
#[test]
fn test_parse_and_merge_config_codex_uses_bearer_token() {
let config_toml = r#"model_provider = "rightcode"
model = "gpt-5-codex"
[model_providers.rightcode]
base_url = "https://rightcode.example/v1"
wire_api = "responses"
experimental_bearer_token = "sk-rightcode"
"#;
let config_json = serde_json::json!({
"auth": {},
"config": config_toml,
})
.to_string();
let config_b64 = BASE64_STANDARD.encode(config_json.as_bytes());
let request = DeepLinkImportRequest {
version: "v1".to_string(),
resource: "provider".to_string(),
app: Some("codex".to_string()),
name: Some("RightCode".to_string()),
config: Some(config_b64),
config_format: Some("json".to_string()),
..Default::default()
};
let merged = parse_and_merge_config(&request).unwrap();
assert_eq!(merged.api_key, Some("sk-rightcode".to_string()));
assert_eq!(
merged.endpoint,
Some("https://rightcode.example/v1".to_string())
);
assert_eq!(
merged.homepage,
Some("https://rightcode.example".to_string())
);
assert_eq!(merged.model, Some("gpt-5-codex".to_string()));
}
#[test]
fn test_parse_and_merge_config_url_override() {
let config_json = r#"{"env":{"ANTHROPIC_AUTH_TOKEN":"sk-old","ANTHROPIC_BASE_URL":"https://api.anthropic.com/v1"}}"#;
src-tauri/src/proxy/providers/codex.rs
+38 -2
View File
@@ -427,14 +427,19 @@ impl CodexAdapter {
fn extract_key(&self, provider: &Provider) -> Option<String> {
// 1. 尝试从 env 中获取
if let Some(env) = provider.settings_config.get("env") {
if let Some(key) = env.get("OPENAI_API_KEY").and_then(|v| v.as_str()) {
if let Some(key) = env
.get("OPENAI_API_KEY")
.and_then(|v| v.as_str())
.map(str::trim)
.filter(|key| !key.is_empty())
{
return Some(key.to_string());
}
}
// 2. 尝试从 auth 中获取 (Codex CLI 格式)
if let Some(auth) = provider.settings_config.get("auth") {
if let Some(key) = auth.get("OPENAI_API_KEY").and_then(|v| v.as_str()) {
if let Some(key) = crate::codex_config::extract_codex_auth_api_key(auth) {
return Some(key.to_string());
}
}
@@ -445,6 +450,8 @@ impl CodexAdapter {
.get("apiKey")
.or_else(|| provider.settings_config.get("api_key"))
.and_then(|v| v.as_str())
.map(str::trim)
.filter(|key| !key.is_empty())
{
return Some(key.to_string());
}
@@ -455,9 +462,19 @@ impl CodexAdapter {
.get("api_key")
.or_else(|| config.get("apiKey"))
.and_then(|v| v.as_str())
.map(str::trim)
.filter(|key| !key.is_empty())
{
return Some(key.to_string());
}
if let Some(config_str) = config.as_str() {
if let Some(key) =
crate::codex_config::extract_codex_experimental_bearer_token(config_str)
{
return Some(key);
}
}
}
None
@@ -619,6 +636,25 @@ mod tests {
assert_eq!(auth.strategy, AuthStrategy::Bearer);
}
#[test]
fn test_extract_auth_falls_back_to_config_bearer_when_auth_key_empty() {
let adapter = CodexAdapter::new();
let provider = create_provider(json!({
"auth": {
"OPENAI_API_KEY": ""
},
"config": r#"model_provider = "custom"
[model_providers.custom]
experimental_bearer_token = "sk-config-key"
"#
}));
let auth = adapter.extract_auth(&provider).unwrap();
assert_eq!(auth.api_key, "sk-config-key");
assert_eq!(auth.strategy, AuthStrategy::Bearer);
}
#[test]
fn test_extract_auth_from_env() {
let adapter = CodexAdapter::new();
src-tauri/src/services/config.rs
+26 -5
View File
@@ -159,8 +159,9 @@ impl ConfigService {
}
let cfg_text = settings.get("config").and_then(Value::as_str);
crate::codex_config::write_codex_live_with_catalog(
crate::codex_config::write_codex_provider_live_with_catalog(
&provider.settings_config,
provider.category.as_deref(),
auth,
cfg_text,
)?;
@@ -172,10 +173,30 @@ impl ConfigService {
if let Some(manager) = config.get_manager_mut(&AppType::Codex) {
if let Some(target) = manager.providers.get_mut(provider_id) {
if let Some(obj) = target.settings_config.as_object_mut() {
obj.insert(
"config".to_string(),
serde_json::Value::String(cfg_text_after),
);
let mut restored = serde_json::json!({
"auth": auth.clone(),
"config": cfg_text_after,
});
let restore_provider_token =
crate::codex_config::should_restore_codex_provider_token_for_backfill(
provider.category.as_deref(),
&provider.settings_config,
);
crate::codex_config::restore_codex_settings_for_backfill(
&mut restored,
&provider.settings_config,
restore_provider_token,
)?;
// 必须同时写回 auth 和 config: backfill 会恢复 stored provider id，
// 并把 live 的 experimental_bearer_token 移到 restored.auth.OPENAI_API_KEY。
if let Some(restored_obj) = restored.as_object() {
if let Some(auth_value) = restored_obj.get("auth") {
obj.insert("auth".to_string(), auth_value.clone());
}
if let Some(config_value) = restored_obj.get("config") {
obj.insert("config".to_string(), config_value.clone());
}
}
}
}
}
src-tauri/src/services/provider/live.rs
+38 -28
View File
@@ -580,12 +580,18 @@ fn restore_live_settings_for_provider_backfill(
}
let mut settings = live_settings;
if let Err(err) = crate::codex_config::restore_codex_settings_config_model_provider_for_backfill(
let restore_provider_token =
crate::codex_config::should_restore_codex_provider_token_for_backfill(
provider.category.as_deref(),
&provider.settings_config,
);
if let Err(err) = crate::codex_config::restore_codex_settings_for_backfill(
&mut settings,
&provider.settings_config,
restore_provider_token,
) {
log::warn!(
"Failed to restore Codex provider id while backfilling '{}': {err}",
"Failed to restore Codex settings while backfilling '{}': {err}",
provider.id
);
}
@@ -728,8 +734,9 @@ pub(crate) fn write_live_snapshot(app_type: &AppType, provider: &Provider) -> Re
.ok_or_else(|| AppError::Config("Codex 供应商配置缺少 'auth' 字段".to_string()))?;
let config_str = obj.get("config").and_then(|v| v.as_str());
crate::codex_config::write_codex_live_with_catalog(
crate::codex_config::write_codex_provider_live_with_catalog(
&provider.settings_config,
provider.category.as_deref(),
auth,
config_str,
)?;
@@ -951,17 +958,7 @@ pub fn sync_current_to_live(state: &AppState) -> Result<(), AppError> {
pub fn read_live_settings(app_type: AppType) -> Result<Value, AppError> {
match app_type {
AppType::Codex => {
let auth_path = get_codex_auth_path();
if !auth_path.exists() {
return Err(AppError::localized(
"codex.auth.missing",
"Codex 配置文件不存在：缺少 auth.json",
"Codex configuration missing: auth.json not found",
));
}
let auth: Value = read_json_file(&auth_path)?;
let cfg_text = crate::codex_config::read_and_validate_codex_config_text()?;
let mut result = json!({ "auth": auth, "config": cfg_text });
let mut result = crate::codex_config::read_codex_live_settings()?;
// `modelCatalog` is a cc-switch private field that lives only in
// the DB SSOT plus the `cc-switch-model-catalog.json` projection
// file — it is never inlined into `auth.json` or `config.toml`.
@@ -1091,19 +1088,7 @@ pub fn import_default_config(state: &AppState, app_type: AppType) -> Result<bool
}
let settings_config = match app_type {
AppType::Codex => {
let auth_path = get_codex_auth_path();
if !auth_path.exists() {
return Err(AppError::localized(
"codex.live.missing",
"Codex 配置文件不存在",
"Codex configuration file is missing",
));
}
let auth: Value = read_json_file(&auth_path)?;
let config_str = crate::codex_config::read_and_validate_codex_config_text()?;
json!({ "auth": auth, "config": config_str })
}
AppType::Codex => crate::codex_config::read_codex_live_settings()?,
AppType::Claude => {
let settings_path = get_claude_settings_path();
if !settings_path.exists() {
@@ -1169,7 +1154,32 @@ pub fn import_default_config(state: &AppState, app_type: AppType) -> Result<bool
settings_config,
None,
);
provider.category = Some("custom".to_string());
provider.category = Some(
if matches!(app_type, AppType::Codex) {
let config_text = provider
.settings_config
.get("config")
.and_then(Value::as_str);
let has_provider_key = crate::codex_config::extract_codex_api_key(
provider.settings_config.get("auth"),
config_text,
)
.is_some();
let has_login_material = provider
.settings_config
.get("auth")
.is_some_and(crate::codex_config::codex_auth_has_login_material);
if has_login_material && !has_provider_key {
"official"
} else {
"custom"
}
} else {
"custom"
}
.to_string(),
);
state.db.save_provider(app_type.as_str(), &provider)?;
state
src-tauri/src/services/provider/mod.rs
+13 -13
View File
@@ -2244,7 +2244,7 @@ impl ProviderService {
Ok((credentials.api_key, credentials.base_url))
}
AppType::Codex => {
let auth = provider
let _auth = provider
.settings_config
.get("auth")
.and_then(|v| v.as_object())
@@ -2256,24 +2256,24 @@ impl ProviderService {
)
})?;
let api_key = auth
.get("OPENAI_API_KEY")
.and_then(|v| v.as_str())
.ok_or_else(|| {
AppError::localized(
"provider.codex.api_key.missing",
"缺少 API Key",
"API key is missing",
)
})?
.to_string();
let config_toml = provider
.settings_config
.get("config")
.and_then(|v| v.as_str())
.unwrap_or("");
let api_key = crate::codex_config::extract_codex_api_key(
provider.settings_config.get("auth"),
Some(config_toml),
)
.ok_or_else(|| {
AppError::localized(
"provider.codex.api_key.missing",
"缺少 API Key",
"API key is missing",
)
})?;
let base_url = if config_toml.contains("base_url") {
let re = Regex::new(r#"base_url\s*=\s*["']([^"']+)["']"#).map_err(|e| {
AppError::localized(
src-tauri/src/services/proxy.rs
+126 -31
View File
@@ -357,7 +357,7 @@ impl ProxyService {
effective_settings["config"] = json!(updated_config);
Self::attach_codex_model_catalog_from_provider(&mut effective_settings, Some(provider));
self.write_codex_live(&effective_settings)?;
self.write_codex_live_for_provider(&effective_settings, Some(provider))?;
Ok(())
}
@@ -1190,7 +1190,7 @@ impl ProxyService {
codex_provider.as_ref(),
);
self.write_codex_live(&live_config)?;
self.write_codex_live_for_provider(&live_config, codex_provider.as_ref())?;
log::info!("Codex Live 配置已接管，代理地址: {proxy_codex_base_url}");
}
@@ -1257,7 +1257,7 @@ impl ProxyService {
codex_provider.as_ref(),
);
self.write_codex_live(&live_config)?;
self.write_codex_live_for_provider(&live_config, codex_provider.as_ref())?;
log::info!("Codex Live 配置已接管，代理地址: {proxy_codex_base_url}");
}
AppType::Gemini => {
@@ -1336,7 +1336,8 @@ impl ProxyService {
codex_provider.as_ref(),
);
let _ = self.write_codex_live(&live_config);
let _ =
self.write_codex_live_for_provider(&live_config, codex_provider.as_ref());
}
}
AppType::Gemini => {
@@ -2045,43 +2046,55 @@ impl ProxyService {
}
fn read_codex_live(&self) -> Result<Value, String> {
use crate::codex_config::{get_codex_auth_path, get_codex_config_path};
let auth_path = get_codex_auth_path();
if !auth_path.exists() {
return Err("Codex auth.json 不存在".to_string());
}
let auth: Value =
read_json_file(&auth_path).map_err(|e| format!("读取 Codex auth 失败: {e}"))?;
let config_path = get_codex_config_path();
let config_str = if config_path.exists() {
std::fs::read_to_string(&config_path)
.map_err(|e| format!("读取 Codex config 失败: {e}"))?
} else {
String::new()
};
Ok(json!({
"auth": auth,
"config": config_str
}))
crate::codex_config::read_codex_live_settings()
.map_err(|e| format!("读取 Codex Live 配置失败: {e}"))
}
fn write_codex_live(&self, config: &Value) -> Result<(), String> {
self.write_codex_live_verbatim(config)
}
fn write_codex_live_for_provider(
&self,
config: &Value,
provider: Option<&Provider>,
) -> Result<(), String> {
let Some(provider) = provider else {
return self.write_codex_live_verbatim(config);
};
let auth = config
.get("auth")
.ok_or_else(|| "Codex 配置缺少 auth 字段".to_string())?;
let config_str = config.get("config").and_then(|v| v.as_str());
crate::codex_config::write_codex_provider_live_with_catalog(
config,
provider.category.as_deref(),
auth,
config_str,
)
.map_err(|e| format!("写入 Codex 配置失败: {e}"))
}
fn write_codex_live_verbatim(&self, config: &Value) -> Result<(), String> {
use crate::codex_config::{get_codex_auth_path, get_codex_config_path};
let auth = config.get("auth");
let config_str = config.get("config").and_then(|v| v.as_str());
// Proxy restore writes saved live backups verbatim. Provider-driven writes go
// through write_live_with_common_config(), which normalizes Codex provider ids.
match (auth, config_str) {
(Some(auth), Some(cfg)) => {
// Use unified helper to prepare catalog if present
crate::codex_config::write_codex_live_with_catalog(config, auth, Some(cfg))
.map_err(|e| format!("写入 Codex 配置失败: {e}"))?;
let auth_path = get_codex_auth_path();
if auth.as_object().is_some_and(|obj| obj.is_empty()) {
let _ = crate::config::delete_file(&auth_path);
let config_path = get_codex_config_path();
crate::config::write_text_file(&config_path, cfg)
.map_err(|e| format!("写入 Codex config 失败: {e}"))?;
} else {
crate::codex_config::write_codex_live_with_catalog(config, auth, Some(cfg))
.map_err(|e| format!("写入 Codex 配置失败: {e}"))?;
}
}
(Some(auth), None) => {
let auth_path = get_codex_auth_path();
@@ -2547,6 +2560,88 @@ mod tests {
);
}
#[test]
#[serial]
fn codex_custom_provider_live_write_preserves_oauth_auth_json() {
let _home = TempHome::new();
crate::settings::reload_settings().expect("reload settings");
let db = Arc::new(Database::memory().expect("init db"));
let service = ProxyService::new(db);
let oauth_auth = json!({
"auth_mode": "chatgpt",
"tokens": {
"id_token": "oauth-id",
"access_token": "oauth-access"
}
});
crate::codex_config::write_codex_live_atomic(
&oauth_auth,
Some(
r#"model_provider = "openai"
model = "gpt-5-codex"
"#,
),
)
.expect("seed live OAuth auth");
let mut provider = Provider::with_id(
"rightcode".to_string(),
"RightCode".to_string(),
json!({
"auth": {
"OPENAI_API_KEY": "rightcode-key"
},
"config": r#"model_provider = "rightcode"
model = "gpt-5-codex"
[model_providers.rightcode]
name = "RightCode"
base_url = "https://rightcode.example/v1"
wire_api = "responses"
"#
}),
None,
);
provider.category = Some("custom".to_string());
let takeover_settings = json!({
"auth": {
"OPENAI_API_KEY": PROXY_TOKEN_PLACEHOLDER
},
"config": r#"model_provider = "rightcode"
model = "gpt-5-codex"
[model_providers.rightcode]
name = "RightCode"
base_url = "http://127.0.0.1:15721/v1"
wire_api = "responses"
"#
});
service
.write_codex_live_for_provider(&takeover_settings, Some(&provider))
.expect("write provider-driven Codex live config");
let live_auth: Value =
crate::config::read_json_file(&crate::codex_config::get_codex_auth_path())
.expect("read live auth");
assert_eq!(
live_auth, oauth_auth,
"third-party Codex proxy writes must not overwrite ChatGPT OAuth login state"
);
let live_config = std::fs::read_to_string(crate::codex_config::get_codex_config_path())
.expect("read live config");
assert!(
live_config.contains("experimental_bearer_token"),
"proxy placeholder should move into config.toml instead of auth.json"
);
assert!(
live_config.contains(PROXY_TOKEN_PLACEHOLDER),
"live config should carry the proxy placeholder token"
);
}
#[test]
fn update_toml_base_url_updates_active_model_provider_base_url() {
let input = r#"
src-tauri/tests/import_export_sync.rs
+85 -15
View File
@@ -70,14 +70,14 @@ fn sync_claude_provider_writes_live_settings() {
}
#[test]
fn sync_codex_provider_writes_auth_and_config() {
fn sync_codex_provider_writes_config_without_touching_auth() {
let _guard = test_mutex().lock().expect("acquire test mutex");
reset_test_fs();
let mut config = MultiAppConfig::default();
// 注意：v3.7.0 后 MCP 同步由 McpService 独立处理，不再通过 provider 切换触发
// 此测试仅验证 auth.json 和 config.toml 基础配置的写入
// Codex provider 切换只写 config.toml；auth.json 保留用户登录态。
let provider_config = json!({
"auth": {
@@ -105,8 +105,8 @@ fn sync_codex_provider_writes_auth_and_config() {
let config_path = cc_switch_lib::get_codex_config_path();
assert!(
auth_path.exists(),
"auth.json should exist at {}",
!auth_path.exists(),
"auth.json should not be created by provider switching at {}",
auth_path.display()
);
assert!(
@@ -115,20 +115,16 @@ fn sync_codex_provider_writes_auth_and_config() {
config_path.display()
);
let auth_value: serde_json::Value = read_json_file(&auth_path).expect("read auth");
assert_eq!(
auth_value,
provider_config.get("auth").cloned().expect("auth object")
);
let toml_text = fs::read_to_string(&config_path).expect("read config.toml");
// 验证基础配置正确写入
assert!(
toml_text.contains("base_url"),
"config.toml should contain base_url from provider config"
);
assert!(
toml_text.contains("experimental_bearer_token"),
"config.toml should contain provider-scoped bearer token"
);
// 当前供应商应同步最新 config 文本
let manager = config.get_manager(&AppType::Codex).expect("codex manager");
let synced = manager.providers.get("codex-1").expect("codex provider");
let synced_cfg = synced
@@ -136,7 +132,81 @@ fn sync_codex_provider_writes_auth_and_config() {
.get("config")
.and_then(|v| v.as_str())
.expect("config string");
assert_eq!(synced_cfg, toml_text);
assert!(
!synced_cfg.contains("experimental_bearer_token"),
"provider storage should not persist generated live bearer token"
);
assert!(
toml_text.contains("experimental_bearer_token"),
"live config should include generated bearer token"
);
}
#[test]
fn sync_codex_provider_with_config_only_token_backfills_auth() {
// P2-2 回归: stored provider 的 token 只藏在 config.toml 的 experimental_bearer_token 时,
// sync 路径必须把 token 从 live config 提取并写回 stored auth.OPENAI_API_KEY,
// 否则下一轮 sync 会在 cleaned config + 空 auth 之间丢失 token。
let _guard = test_mutex().lock().expect("acquire test mutex");
reset_test_fs();
let mut config = MultiAppConfig::default();
let stored_config = r#"model_provider = "thirdparty"
model = "gpt-5.4"
[model_providers.thirdparty]
name = "Thirdparty"
base_url = "https://thirdparty.example/v1"
wire_api = "responses"
requires_openai_auth = true
experimental_bearer_token = "stored-bearer-key"
"#;
let provider = Provider::with_id(
"thirdparty-1".to_string(),
"Thirdparty".to_string(),
json!({
"auth": {},
"config": stored_config,
}),
None,
);
let manager = config
.get_manager_mut(&AppType::Codex)
.expect("codex manager");
manager
.providers
.insert("thirdparty-1".to_string(), provider);
manager.current = "thirdparty-1".to_string();
ConfigService::sync_current_providers_to_live(&mut config).expect("sync codex live");
let manager = config.get_manager(&AppType::Codex).expect("codex manager");
let synced = manager
.providers
.get("thirdparty-1")
.expect("provider survives sync");
assert_eq!(
synced
.settings_config
.pointer("/auth/OPENAI_API_KEY")
.and_then(|v| v.as_str()),
Some("stored-bearer-key"),
"config-only bearer token must be backfilled into stored auth.OPENAI_API_KEY"
);
let synced_cfg = synced
.settings_config
.get("config")
.and_then(|v| v.as_str())
.expect("config string");
assert!(
!synced_cfg.contains("experimental_bearer_token"),
"live-only bearer token should not be persisted in stored provider config"
);
}
#[test]
@@ -221,8 +291,8 @@ requires_openai_auth = true
.and_then(|v| v.as_str())
.expect("synced config string");
assert!(
synced_cfg.contains("[model_providers.custom]"),
"ConfigService keeps its existing behavior of syncing provider config from live"
synced_cfg.contains("[model_providers.aihubmix]"),
"ConfigService should restore the provider-specific id before writing stored config"
);
}
src-tauri/tests/provider_commands.rs
+98 -2
View File
@@ -93,6 +93,98 @@ fn codex_startup_import_fresh_install_imports_once_and_syncs_current_setting() {
);
}
#[test]
fn codex_startup_import_accepts_config_without_auth_file() {
let _guard = test_mutex().lock().expect("acquire test mutex");
reset_test_fs();
let _home = ensure_test_home();
let config_path = get_codex_config_path();
if let Some(parent) = config_path.parent() {
std::fs::create_dir_all(parent).expect("create codex config dir");
}
std::fs::write(
&config_path,
r#"model_provider = "aihubmix"
[model_providers.aihubmix]
name = "AiHubMix"
base_url = "https://aihubmix.example/v1"
wire_api = "responses"
requires_openai_auth = true
experimental_bearer_token = "live-key"
"#,
)
.expect("seed config.toml without auth.json");
assert!(
!get_codex_auth_path().exists(),
"test should not seed auth.json"
);
let state = create_test_state().expect("create test state");
import_default_config_test_hook(&state, AppType::Codex)
.expect("import codex config-only default");
let providers = state
.db
.get_all_providers(AppType::Codex.as_str())
.expect("get codex providers after import");
let provider = providers.get("default").expect("default provider exists");
assert_eq!(
provider.settings_config.pointer("/auth"),
Some(&json!({})),
"missing auth.json should import as an empty auth object"
);
assert!(
provider
.settings_config
.get("config")
.and_then(|value| value.as_str())
.unwrap_or_default()
.contains("experimental_bearer_token"),
"config.toml content should still be imported"
);
}
#[test]
fn codex_startup_import_marks_oauth_only_default_official() {
let _guard = test_mutex().lock().expect("acquire test mutex");
reset_test_fs();
let _home = ensure_test_home();
let auth = json!({
"auth_mode": "chatgpt",
"tokens": {
"id_token": "oauth-id",
"access_token": "oauth-access"
}
});
let config = r#"[mcp_servers.echo]
command = "echo"
"#;
write_codex_live_atomic(&auth, Some(config)).expect("seed oauth-only codex live config");
let state = create_test_state().expect("create test state");
import_default_config_test_hook(&state, AppType::Codex).expect("import codex default");
let providers = state
.db
.get_all_providers(AppType::Codex.as_str())
.expect("get codex providers after import");
let provider = providers.get("default").expect("default provider exists");
assert_eq!(
provider.category.as_deref(),
Some("official"),
"OAuth-only live Codex installs should keep official behavior"
);
assert_eq!(
provider.settings_config.pointer("/auth/tokens/id_token"),
Some(&json!("oauth-id")),
"import should preserve OAuth login material"
);
}
#[test]
fn codex_startup_import_skips_when_only_official_seed_exists() {
let _guard = test_mutex().lock().expect("acquire test mutex");
@@ -228,8 +320,8 @@ command = "say"
.get("OPENAI_API_KEY")
.and_then(|v| v.as_str())
.unwrap_or(""),
"fresh-key",
"live auth.json should reflect new provider"
"legacy-key",
"Codex provider switching should preserve the existing live auth.json"
);
let config_text = std::fs::read_to_string(get_codex_config_path()).expect("read config.toml");
@@ -237,6 +329,10 @@ command = "say"
config_text.contains("mcp_servers.echo-server"),
"config.toml should contain synced MCP servers"
);
assert!(
config_text.contains("experimental_bearer_token"),
"config.toml should carry the selected provider API key as bearer token"
);
let current_id = app_state
.db
src-tauri/tests/provider_service.rs
+356 -2
View File
@@ -181,8 +181,8 @@ command = "say"
read_json_file(&cc_switch_lib::get_codex_auth_path()).expect("read auth.json");
assert_eq!(
auth_value.get("OPENAI_API_KEY").and_then(|v| v.as_str()),
Some("fresh-key"),
"live auth.json should reflect new provider"
Some("legacy-key"),
"Codex provider switching should preserve the existing live auth.json"
);
let config_text =
@@ -191,6 +191,10 @@ command = "say"
config_text.contains("mcp_servers.echo-server"),
"config.toml should contain synced MCP servers"
);
assert!(
config_text.contains("experimental_bearer_token"),
"config.toml should carry the selected provider API key"
);
let current_id = state
.db
@@ -347,6 +351,356 @@ requires_openai_auth = true
);
}
#[test]
fn provider_service_switch_codex_preserves_oauth_and_backfills_api_key_from_live_token() {
let _guard = test_mutex().lock().expect("acquire test mutex");
reset_test_fs();
let _home = ensure_test_home();
let live_auth = json!({
"auth_mode": "chatgpt",
"OPENAI_API_KEY": null,
"tokens": {
"access_token": "oauth-token",
"account_id": "acct-1"
}
});
let legacy_config = r#"model_provider = "rightcode"
model = "gpt-5.4"
[model_providers.rightcode]
name = "RightCode"
base_url = "https://rightcode.example/v1"
wire_api = "responses"
requires_openai_auth = true
"#;
write_codex_live_atomic(&live_auth, Some(legacy_config))
.expect("seed existing Codex OAuth live config");
let bridge_provider = Provider::with_id(
"bridge-provider".to_string(),
"Bridge Provider".to_string(),
json!({
"auth": {"OPENAI_API_KEY": "bridge-key"},
"config": r#"model_provider = "aihubmix"
model = "gpt-5.4"
[model_providers.aihubmix]
name = "AiHubMix"
base_url = "https://aihubmix.example/v1"
wire_api = "responses"
requires_openai_auth = true
"#
}),
None,
);
let mut initial_config = MultiAppConfig::default();
{
let manager = initial_config
.get_manager_mut(&AppType::Codex)
.expect("codex manager");
manager.current = "legacy-provider".to_string();
manager.providers.insert(
"legacy-provider".to_string(),
Provider::with_id(
"legacy-provider".to_string(),
"RightCode".to_string(),
json!({
"auth": {"OPENAI_API_KEY": "rightcode-key"},
"config": legacy_config
}),
None,
),
);
manager
.providers
.insert("bridge-provider".to_string(), bridge_provider);
manager.providers.insert(
"plain-provider".to_string(),
Provider::with_id(
"plain-provider".to_string(),
"Plain Provider".to_string(),
json!({
"auth": {"OPENAI_API_KEY": "plain-key"},
"config": r#"model_provider = "plain"
model = "gpt-5.4"
[model_providers.plain]
name = "Plain"
base_url = "https://plain.example/v1"
wire_api = "responses"
requires_openai_auth = true
"#
}),
None,
),
);
}
let state = create_test_state_with_config(&initial_config).expect("create test state");
ProviderService::switch(&state, AppType::Codex, "bridge-provider")
.expect("switch to bridge provider should succeed");
let auth_value: serde_json::Value =
read_json_file(&cc_switch_lib::get_codex_auth_path()).expect("read auth.json");
assert_eq!(
auth_value.get("auth_mode").and_then(|v| v.as_str()),
Some("chatgpt")
);
assert!(
auth_value
.get("OPENAI_API_KEY")
.is_some_and(|v| v.is_null()),
"provider switching should keep OPENAI_API_KEY null in live auth.json"
);
assert_eq!(
auth_value
.pointer("/tokens/access_token")
.and_then(|v| v.as_str()),
Some("oauth-token"),
"existing ChatGPT OAuth token should be preserved"
);
let live_config =
std::fs::read_to_string(cc_switch_lib::get_codex_config_path()).expect("read config.toml");
let parsed_live: toml::Value = toml::from_str(&live_config).expect("parse live config");
assert_eq!(
parsed_live
.get("model_providers")
.and_then(|v| v.get("custom"))
.and_then(|v| v.get("experimental_bearer_token"))
.and_then(|v| v.as_str()),
Some("bridge-key"),
"third-party key should be injected into the stable live provider table"
);
assert_eq!(
parsed_live
.get("model_providers")
.and_then(|v| v.get("custom"))
.and_then(|v| v.get("requires_openai_auth"))
.and_then(|v| v.as_bool()),
Some(true)
);
ProviderService::switch(&state, AppType::Codex, "plain-provider")
.expect("switch away should backfill bridge provider");
let providers = state
.db
.get_all_providers(AppType::Codex.as_str())
.expect("read providers");
let stored_bridge = providers
.get("bridge-provider")
.expect("bridge provider exists after backfill");
assert_eq!(
stored_bridge
.settings_config
.pointer("/auth/OPENAI_API_KEY")
.and_then(|v| v.as_str()),
Some("bridge-key"),
"backfill should restore the API key into stored provider auth"
);
assert!(
stored_bridge
.settings_config
.pointer("/auth/tokens")
.is_none(),
"backfill should not persist ChatGPT OAuth tokens into provider storage"
);
assert!(
!stored_bridge
.settings_config
.get("config")
.and_then(|v| v.as_str())
.unwrap_or_default()
.contains("experimental_bearer_token"),
"stored provider config should stay clean; bridge token is generated only for live config"
);
}
#[test]
fn provider_service_switch_codex_supports_official_login_provider_without_auth_write() {
let _guard = test_mutex().lock().expect("acquire test mutex");
reset_test_fs();
let _home = ensure_test_home();
let live_auth = json!({
"auth_mode": "chatgpt",
"OPENAI_API_KEY": null,
"tokens": {
"access_token": "official-oauth-token",
"account_id": "acct-official"
}
});
write_codex_live_atomic(&live_auth, Some("")).expect("seed official OAuth live config");
let mut initial_config = MultiAppConfig::default();
{
let manager = initial_config
.get_manager_mut(&AppType::Codex)
.expect("codex manager");
manager.current = "legacy-provider".to_string();
manager.providers.insert(
"legacy-provider".to_string(),
Provider::with_id(
"legacy-provider".to_string(),
"Legacy".to_string(),
json!({
"auth": {"OPENAI_API_KEY": "legacy-key"},
"config": r#"model_provider = "legacy"
[model_providers.legacy]
name = "Legacy"
base_url = "https://legacy.example/v1"
wire_api = "responses"
requires_openai_auth = true
"#
}),
None,
),
);
manager.providers.insert(
"official-provider".to_string(),
Provider::with_id(
"official-provider".to_string(),
"OpenAI Official".to_string(),
json!({
"auth": {},
"config": ""
}),
None,
),
);
}
let state = create_test_state_with_config(&initial_config).expect("create test state");
ProviderService::switch(&state, AppType::Codex, "official-provider")
.expect("switch to official provider should succeed without API key");
let auth_value: serde_json::Value =
read_json_file(&cc_switch_lib::get_codex_auth_path()).expect("read auth.json");
assert_eq!(
auth_value.get("auth_mode").and_then(|v| v.as_str()),
Some("chatgpt")
);
assert!(
auth_value
.get("OPENAI_API_KEY")
.is_some_and(|v| v.is_null()),
"official provider switching should keep OPENAI_API_KEY null"
);
assert_eq!(
auth_value
.pointer("/tokens/access_token")
.and_then(|v| v.as_str()),
Some("official-oauth-token"),
"official provider should preserve the existing ChatGPT OAuth token"
);
let live_config =
std::fs::read_to_string(cc_switch_lib::get_codex_config_path()).expect("read config.toml");
assert!(
!live_config.contains("experimental_bearer_token"),
"official login provider has no API key to inject"
);
}
#[test]
fn provider_service_switch_codex_official_accounts_write_auth_json() {
let _guard = test_mutex().lock().expect("acquire test mutex");
reset_test_fs();
let _home = ensure_test_home();
let live_auth_a = json!({
"auth_mode": "chatgpt",
"OPENAI_API_KEY": null,
"tokens": {
"access_token": "official-a-live-token",
"account_id": "acct-a"
}
});
write_codex_live_atomic(&live_auth_a, Some("")).expect("seed official account A live auth");
let mut official_a = Provider::with_id(
"official-a".to_string(),
"Official A".to_string(),
json!({
"auth": {
"auth_mode": "chatgpt",
"OPENAI_API_KEY": null,
"tokens": {
"access_token": "stale-a-token",
"account_id": "acct-a"
}
},
"config": ""
}),
None,
);
official_a.category = Some("official".to_string());
let mut official_b = Provider::with_id(
"official-b".to_string(),
"Official B".to_string(),
json!({
"auth": {
"auth_mode": "chatgpt",
"OPENAI_API_KEY": null,
"tokens": {
"access_token": "official-b-token",
"account_id": "acct-b"
}
},
"config": ""
}),
None,
);
official_b.category = Some("official".to_string());
let mut initial_config = MultiAppConfig::default();
{
let manager = initial_config
.get_manager_mut(&AppType::Codex)
.expect("codex manager");
manager.current = "official-a".to_string();
manager
.providers
.insert("official-a".to_string(), official_a);
manager
.providers
.insert("official-b".to_string(), official_b);
}
let state = create_test_state_with_config(&initial_config).expect("create test state");
ProviderService::switch(&state, AppType::Codex, "official-b")
.expect("switch to official account B should write auth.json");
let auth_b: serde_json::Value =
read_json_file(&cc_switch_lib::get_codex_auth_path()).expect("read auth B");
assert_eq!(
auth_b
.pointer("/tokens/access_token")
.and_then(|v| v.as_str()),
Some("official-b-token"),
"switching official accounts must replace auth.json with the selected account"
);
ProviderService::switch(&state, AppType::Codex, "official-a")
.expect("switch back to official account A should use backfilled live auth");
let auth_a: serde_json::Value =
read_json_file(&cc_switch_lib::get_codex_auth_path()).expect("read auth A");
assert_eq!(
auth_a
.pointer("/tokens/access_token")
.and_then(|v| v.as_str()),
Some("official-a-live-token"),
"backfill should preserve account A's latest live token for later official switches"
);
}
#[test]
fn provider_service_switch_codex_backfill_keeps_provider_specific_model_provider_id() {
let _guard = test_mutex().lock().expect("acquire test mutex");