[Duplicate Code] OIDC/static auth scaffolding repeats across provider adapters

[github-actions]

Duplicate Code Opportunity

Summary

• Pattern: The provider adapters for OpenAI, Anthropic, and Copilot each rebuild the same auth/bootstrap scaffold: createProviderAuthScaffold(...), OIDC header strategy setup, validation/model-fetch wiring, and buildProviderAdapter(...) wiring.
• Locations:
  • containers/api-proxy/providers/openai.js — lines 31-131
  • containers/api-proxy/providers/anthropic.js — lines 47-220
  • containers/api-proxy/providers/copilot.js — lines 50-264
• Impact: Repeated security-critical credential-selection logic across 3 adapters; changes to auth/header behavior, startup validation, or OIDC fallback rules must be made in multiple places.

Evidence

OpenAI

const { apiKey: openaiApiKey, rawTarget: openaiTarget, basePath: openaiBasePath, bodyTransform, } = createProviderAuthScaffold(...);
...
const { authProvider, oidcConfigured, runtimeMethods: oidcRuntimeMethods, validationSkip, skipModelsFetch, resolveHeaders: resolveOidcHeaders, } = createProviderOidcHeaderStrategy(...);
...
const adapterMethods = createAdapterMethods({
  apiKey,
  rawTarget,
  basePath,
  validationPath: '/v1/models',
  validationHeaders: buildStaticAuthHeaders,
  skipModelsFetch,
  modelsPath: '/v1/models',
  modelsFetchHeaders: buildStaticAuthHeaders,
  ...
});

Anthropic

const { apiKey, rawTarget, basePath, bodyTransform: depsBodyTransform } = createProviderAuthScaffold(...);
...
const { oidcProvider, oidcConfigured, runtimeMethods: oidcRuntimeMethods, resolveHeaders: resolveOidcHeaders } = createProviderOidcHeaderStrategy(...);
...
const adapterMethods = createAdapterMethods({
  apiKey,
  rawTarget,
  basePath,
  validationPath: '/v1/messages',
  validationHeaders: () => ({ ...resolveOidcHeaders(), 'anthropic-version': '2023-06-01', 'content-type': 'application/json' }),
  skipModelsFetch: () => oidcConfigured && !oidcProvider?.isReady(),
  modelsPath: '/v1/models',
  modelsFetchHeaders: () => ({ ...resolveOidcHeaders(), 'anthropic-version': '2023-06-01' }),
  ...
});

Copilot

const apiKey = resolveApiKey(env);
const staticAuthToken = resolveCopilotAuthToken(env);
const rawTarget = deriveCopilotApiTarget(env);
const basePath = normalizeBasePath(env[COPILOT_ENV.API_BASE_PATH]);
...
const { authProvider, oidcProvider, awsOidcProvider, oidcConfigured, runtimeMethods: oidcRuntimeMethods, resolveHeaders: resolveInferenceHeaders, } = createProviderOidcHeaderStrategy(...);
...
const adapterMethods = createAdapterMethods({
  apiKey: authToken,
  rawTarget,
  basePath,
  modelsPath,
  getValidationProbe() { ... },
  getModelsFetchConfig() { ... },
});

Suggested Refactoring

Extract a shared createOidcAwareProviderAdapter(...) helper that owns the repeated scaffold and accepts provider-specific hooks for:

• auth header construction
• validation probe / model-fetch paths
• unconfigured / unavailable responses
• reflection metadata

That would leave only provider-specific request transformations and error messages in each module.

Affected Files

• containers/api-proxy/providers/openai.js — lines 31-131
• containers/api-proxy/providers/anthropic.js — lines 47-220
• containers/api-proxy/providers/copilot.js — lines 50-264

Effort Estimate

Medium

---

Detected by Duplicate Code Detector workflow. Run date: 2026-07-26

Generated by Duplicate Code Detector · gpt54mini · 11.7 AIC · ⊞ 24.2K · ◷

• expires on Aug 25, 2026, 6:37 AM UTC