feat: Add OAuth credential system with OpenAI Codex support#1
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
broomva
force-pushed
the
feat/oauth-credentials
branch
from
2f9e0b9 to
92c4a69
Compare
Introduce a generic Credential trait abstraction for LLM provider authentication, replacing raw API key strings with pluggable credential types. Implement OpenAI Codex OAuth 2.0 flows (PKCE and Device Code) as the first concrete OAuth provider. - Add Credential trait with auth_header(), refresh(), and needs_refresh() - Add ApiKeyCredential and AnthropicApiKeyCredential implementations - Add OAuthCredential with automatic token refresh via RwLock - Add PKCE Authorization Code flow with local callback server - Add Device Code flow for headless/SSH environments - Add token storage to ~/.arcan/credentials/ with 0600 permissions - Refactor OpenAiConfig and AnthropicConfig to use Arc<dyn Credential> - Add 401 retry with credential refresh in execute_with_retry - Add `arcan login openai` and `arcan logout openai` CLI commands - Update provider auto-detection to check stored OAuth credentials Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
broomva
force-pushed
the
feat/oauth-credentials
branch
from
92c4a69 to
bc4161c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Credentialtrait abstraction for LLM provider authentication, replacing raw API key strings with pluggable credential typesarcan login openai/arcan logout openaiCLI commands and updates provider auto-detection to check stored OAuth credentialsChanges
New files
crates/arcan-provider/src/credential.rs—Credentialtrait +ApiKeyCredential+AnthropicApiKeyCredentialcrates/arcan-provider/src/oauth.rs—OAuthCredential, token storage (~/.arcan/credentials/), PKCE flow, Device Code flow, token refreshModified files
crates/arcan-core/src/error.rs— AddedCoreError::Authvariantcrates/arcan-provider/src/openai.rs—OpenAiConfigusesArc<dyn Credential>, 401 refresh retrycrates/arcan-provider/src/anthropic.rs—AnthropicConfigusesArc<dyn Credential>crates/arcan/src/main.rs— Login/Logout CLI commands, OAuth-aware provider selectionProvider selection order
ARCAN_PROVIDERenv var (explicit override)~/.arcan/credentials/)ANTHROPIC_API_KEY,OPENAI_API_KEY)Test plan
cargo fmt— cleancargo clippy --workspace— zero warningscargo test --workspace— 252 tests pass (+ 1 pre-existing ignored)arcan login openaiopens browser, completes PKCE flowarcan login openai --devicedisplays device code, polls until authorizedarcan logout openairemoves stored credentials🤖 Generated with Claude Code