refactor: extract shared auth header resolution helper for provider adapters#5641
Conversation
…dapters
Add resolveAuthHeadersWithFallback() to oidc-adapter-utils.js, which
encapsulates the repeated OIDC-check-then-static-fallback pattern used
across provider adapters.
Updated Anthropic adapter to use the new helper for validationHeaders
and modelsFetchHeaders, eliminating duplicated OIDC/static branching.
The new helper combines resolveOidcAuthHeaders() with static-key fallback
into a single call:
1. OIDC token available → use buildOidcHeaders(token)
2. OIDC configured but no token → return {} (fail-safe)
3. No OIDC → return staticHeaders
Closes #5620
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
There was a problem hiding this comment.
Pull request overview
This PR refactors the api-proxy provider auth header construction by adding a shared helper for the “OIDC headers when available, otherwise safe fallback” resolution pattern, and then using it to simplify Anthropic’s startup-time header builders.
Changes:
- Added
resolveAuthHeadersWithFallback()tocontainers/api-proxy/oidc-adapter-utils.jsto encapsulate OIDC vs static header selection (including the “OIDC configured but token not ready →{}” fail-safe). - Updated
containers/api-proxy/providers/anthropic.jsto use the new helper forvalidationHeadersandmodelsFetchHeaders, reducing duplicated branching.
Show a summary per file
| File | Description |
|---|---|
| containers/api-proxy/oidc-adapter-utils.js | Introduces resolveAuthHeadersWithFallback() and exports it for provider adapters. |
| containers/api-proxy/providers/anthropic.js | Refactors validation/model-fetch header construction to call the shared helper and then layer Anthropic-specific headers. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Low
| function resolveAuthHeadersWithFallback({ oidcProvider, awsOidcProvider, buildOidcHeaders, staticHeaders }) { | ||
| const oidcHeaders = resolveOidcAuthHeaders({ oidcProvider, awsOidcProvider, buildOidcHeaders }); | ||
| if (oidcHeaders !== null) { | ||
| return oidcHeaders; | ||
| } | ||
| return staticHeaders; | ||
| } |
|
@copilot run pr-finisher skill |
|
⏳ Copilot review left inline comments. @lpcox To proceed:
|
|
🔌 Smoke Services — All services reachable! ✅ |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓 |
|
✅ Build Test Suite completed successfully! |
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓 |
|
✅ Contribution Check completed successfully! Contribution guidelines review complete for PR #5641: no important gaps found. The PR includes tests for the new helper, has a clear description referencing #5620, and keeps changes in appropriate container/API proxy files. |
|
✅ Smoke Claude passed |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ |
|
✅ Smoke Gemini completed. All facets verified. 💎 Smoke test completed with partial failures. File writing and bash tools passed, but GitHub connectivity and MCP reads failed. |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓 |
|
🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅ |
|
✅ Security Guard completed successfully! Security review complete: PR #5641 describes OIDC adapter refactoring (oidc-adapter-utils.js, providers/anthropic.js). These are not firewall security-critical files (host-iptables.ts, setup-iptables.sh, squid-config.ts, docker-manager.ts, entrypoint.sh, domain-patterns.ts). No security weakening detected in firewall components. |
🔍 Smoke Test ResultsPR: refactor: extract shared auth header resolution helper for provider adapters
Overall: FAIL — pre-step template variables were not substituted (
|
Smoke Test: Copilot BYOK (Direct) Mode — PASS ✅
Mode: Direct BYOK via api-proxy sidecar → api.githubcopilot.com
|
Overall: PASS
|
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
|
@lpcox Smoke test results:\n- GitHub MCP Testing: ✅\n- GitHub.com Connectivity: ✅\n- File Write/Read Test: ✅\n- BYOK Inference Test: ✅\nRunning in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra\nOverall: PASS
|
🔭 Smoke Test: API Proxy OpenTelemetry Tracing
All scenarios pass. OTEL tracing is always-on with graceful file-based fallback when no collector endpoint is set.
|
Smoke Test: Claude Engine Validation
Overall result: PASS
|
Chroot Version Comparison Results
Overall: ❌ Not all tests passed — Python and Node.js versions differ between host and chroot environments.
|
🔬 Smoke Test Results — Auth mode: PAT (COPILOT_GITHUB_TOKEN)PR by @lpcox
Overall: FAIL — workflow template variables (
|
Smoke Test: GitHub Actions Services Connectivity
Overall: FAIL —
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS
|
Smoke Test Results: Gemini Engine
Overall Status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
Summary
Add
resolveAuthHeadersWithFallback()tooidc-adapter-utils.js, encapsulating the repeated OIDC-check-then-static-fallback pattern used across provider adapters.New helper
buildOidcHeaders(token){}(fail-safe)staticHeadersChanges
oidc-adapter-utils.js: AddedresolveAuthHeadersWithFallbackhelperproviders/anthropic.js: SimplifiedvalidationHeadersandmodelsFetchHeadersusing the new helper (eliminated 2 instances of duplicated OIDC/static branching)Benefits
Testing
Closes #5620