Skip to content

Accept resolved Vertex OAuth bearer secrets and WIF auth_types #660

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Erin McNulty (erin2722) merged 3 commits into from
May 26, 2026
Merged

Accept resolved Vertex OAuth bearer secrets and WIF auth_types #660

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c9371c0
Accept resolved Vertex OAuth bearer secrets
erin2722 May 21, 2026
3a0e272
tests and add WIF metadata
erin2722 May 26, 2026
d004fbd
pull out OIDC specific schmea to its own schema
erin2722 May 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions packages/proxy/schema/index.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -344,6 +344,62 @@ describe("APISecretSchema compatibility", () => {
});
});

it("accepts resolved Vertex OAuth bearer metadata", () => {
const parsed = APISecretSchema.parse({
secret: "google-access-token",
type: "vertex",
metadata: {
authType: "oauth_bearer",
auth_source: "google_workload_identity_federation",
connection_id: 123,
project: "vertex-project",
future_field: "future-value",
},
});

expect(parsed.type).toBe("vertex");
expect(parsed.metadata).toMatchObject({
authType: "oauth_bearer",
connection_id: 123,
auth_source: "google_workload_identity_federation",
future_field: "future-value",
project: "vertex-project",
});
});

it("accepts raw Vertex workload identity metadata", () => {
const parsed = APISecretSchema.parse({
secret: "__VERTEX_WIF__",
type: "vertex",
metadata: {
authType: "workload_identity_federation",
project: "vertex-project",
workload_identity_provider: "//iam.googleapis.com/projects/123",
},
});

expect(parsed.type).toBe("vertex");
expect(parsed.metadata).toMatchObject({
authType: "workload_identity_federation",
project: "vertex-project",
workload_identity_provider: "//iam.googleapis.com/projects/123",
});
});

it("validates OIDC metadata only for raw Vertex workload identity metadata", () => {
const result = APISecretSchema.safeParse({
secret: "__VERTEX_WIF__",
type: "vertex",
metadata: {
authType: "workload_identity_federation",
project: "vertex-project",
connection_id: 123,
},
});

expect(result.success).toBe(false);
});

it("defaults Anthropic auth metadata to api_key", () => {
const parsed = APISecretSchema.parse({
secret: "anthropic-api-key",
Expand Down
28 changes: 26 additions & 2 deletions packages/proxy/schema/secrets.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,15 @@ export const BedrockMetadataSchemaWithAuth =
});
export type BedrockMetadata = z.infer<typeof BedrockMetadataSchema>;

export const VertexOIDCSecretMetadataSchema = z.object({
connection_id: z.string().nullish(),
scopes: z.array(z.string()).nullish(),
workload_identity_provider: z.string().nullish(),
});
export type VertexOIDCSecretMetadata = z.infer<
typeof VertexOIDCSecretMetadataSchema
>;

export const VertexMetadataSchema = BaseMetadataSchema.merge(
z.object({
project: z.string().min(1, "Project cannot be empty"),
Expand All @@ -97,10 +106,25 @@ export const VertexMetadataSchema = BaseMetadataSchema.merge(
}
return value;
}, z.string().min(1, "Location cannot be empty").optional()),
authType: z.enum(["access_token", "service_account_key"]),
authType: z.enum([
"access_token",
"oauth_bearer",
"service_account_key",
"workload_identity_federation",
]),
Comment on lines +109 to +114
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Reject unsupported Vertex authType values

Allowing "oauth_bearer" and "workload_identity_federation" here introduces a runtime failure path: these secrets now pass schema validation, but request handling still only treats authType === "access_token" as a bearer token and otherwise calls getGoogleAccessToken (which parses secret as a service-account JSON key). For resolved OAuth/WIF secrets (for example a raw access token or __VERTEX_WIF__ placeholder), this causes parse errors during request execution instead of a valid auth flow.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Contributor Author

@erin2722 Erin McNulty (erin2722) May 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

support for these auth types aren't implemented in the legacy proxy, and so this comment isn't relevant

api_base: z.union([z.string().url(), z.string().length(0)]).nullish(),
}),
).passthrough();
export const VertexAPISecretMetadataSchema = z.union([
VertexMetadataSchema.extend({
authType: z.literal("workload_identity_federation"),
})
.merge(VertexOIDCSecretMetadataSchema)
.passthrough(),
VertexMetadataSchema.extend({
authType: z.enum(["access_token", "oauth_bearer", "service_account_key"]),
}).passthrough(),
]);

export const DatabricksMetadataSchema = BaseMetadataSchema.merge(
z.object({
Expand Down Expand Up @@ -213,7 +237,7 @@ export const APISecretSchema = z.union([
APISecretBaseSchema.merge(
z.object({
type: z.literal("vertex"),
metadata: VertexMetadataSchema.nullish(),
metadata: VertexAPISecretMetadataSchema.nullish(),
}),
).passthrough(),
APISecretBaseSchema.merge(
Expand Down
7 changes: 7 additions & 0 deletions packages/proxy/src/proxy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ import {
MessageTypeToMessageType,
modelProviderHasReasoning,
ModelSpec,
VertexOIDCSecretMetadataSchema,
VertexMetadataSchema,
} from "@schema";
import { translateParams } from "../schema/translate";
Expand Down Expand Up @@ -2136,6 +2137,9 @@ async function fetchOpenAI(

const { project, location, authType, api_base } =
VertexMetadataSchema.parse(secret.metadata);
if (authType === "workload_identity_federation") {
VertexOIDCSecretMetadataSchema.parse(secret.metadata);
}
const resolvedLocation = resolveVertexLocation({
metadataLocation: location,
modelSpec,
Expand Down Expand Up @@ -2625,6 +2629,9 @@ async function vertexEndpointInfo({
}): Promise<VertexEndpointInfo> {
const { project, location, authType, api_base } =
VertexMetadataSchema.parse(metadata);
if (authType === "workload_identity_federation") {
VertexOIDCSecretMetadataSchema.parse(metadata);
}
const resolvedLocation = resolveVertexLocation({
metadataLocation: location,
modelSpec,
Expand Down
Loading