Repository navigation
feat(llm): provider auth abstraction — OAuth/device-code/session sign-in + vault-stored refresh, beyond API keys (#10551) - #10982
Merged
Merged
Conversation
…-in + vault-stored refresh, beyond API keys (#10551)
Contributor
✅ SSOT Configuration Compliance: Passing🎉 No hardcoded values detected that have SSOT config equivalents! |
Applied Black, isort, and autoflake to match code-quality checks. Triggered by workflow auto-fix-formatting.yml.
…(https/host/no-IP/no-redirect) on OAuth/device URLs (#10551 security review)
…se-in-depth SSRF (#10551)
Applied Black, isort, and autoflake to match code-quality checks. Triggered by workflow auto-fix-formatting.yml.
Closed
4 tasks
mrveiss
added a commit
that referenced
this pull request
Jul 6, 2026
…uth (empty setting names + vault type tag) — clears code-quality on base (#10982 follow-up)
mrveiss
added a commit
that referenced
this pull request
Jul 6, 2026
…sc errors on base (#10984) * fix(ui): MemoryPrivacyPanel — showToast takes positional (message, type), not an object; clears 3 vue-tsc errors on Dev_new_gui * fix(security): nosec 3 bandit B105/B106 false-positives in provider_auth (empty setting names + vault type tag) — clears code-quality on base (#10982 follow-up)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thinking Path
Agent-framework epic #10542 (model-choice freedom): providers assumed a per-token API key. Add an auth abstraction so users can use a subscription via OAuth/device-code/session, not only a billed key.
What Changed
llm_shared/provider_auth.py:ProviderAuthStrategywithApiKeyAuth(backward-compatible default),OAuthAuth(auth-code+PKCE, transparent refresh 5min-before-expiry),DeviceCodeAuth(RFC 8628),SessionAuth. Tokens sealed in the unified-secrets System vault (provider_auth:{provider}:{subject}), never logged, DEK-sprawl-safe upsert.base_providergains optionalauth_strategy+_get_auth_token(); auto-builds ApiKeyAuth from settings so every existing key-based provider keeps working unchanged.api/provider_auth.py: OAuth callback + device-initiate/poll + status/revoke. FrontendProviderOAuthConnect.vue"Sign in / API key" toggle. Reuses the existingoauth_flowPKCE/exchange/refresh machinery.Verification
30 tests pass (all strategies, api_key backward-compat, token-never-logged, expired→refresh+vault-upsert). Closes #10551. Live OAuth/device-code round-trip needs a real IdP/provider.
Model Used
Claude Opus 4.8 (senior-backend-engineer subagent).