Refactor provider OIDC auth-header plumbing into a shared resolver (#5994)

* Initial plan

* refactor: dedupe oidc auth header wiring

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: Copilot

containers/api-proxy/providers/anthropic.js

@@ -21,7 +21,7 @@ const {
 const { createProviderAuthScaffold, createAdapterMethods, buildProviderAdapter } = require('../adapter-factory');
 const { AnthropicOidcTokenProvider } = require('../anthropic-oidc-token-provider');
 const { ANTHROPIC_ENV } = require('../provider-env-constants');
-const { createProviderOidcAuth } = require('./cloud-oidc-init');
+const { createProviderOidcAuth, createProviderOidcHeaderResolver } = require('./cloud-oidc-init');
 const { bearerAuthHeaders, providerKeyHeaders } = require('./auth-headers');
 
 let makeAnthropicTransform, loadCustomTransform, EXTENDED_CACHE_BETA;
@@ -116,10 +116,11 @@ function createAnthropicAdapter(env, deps = {}) {
   const composedBodyTransform = composeBodyTransforms(depsBodyTransform, optimisationsTransform);
   const buildOidcBearerAuthHeaders = (token) => bearerAuthHeaders(token);
   const buildStaticAuthHeaders = () => providerKeyHeaders(authHeaderName, apiKey);
-  const resolveAuthHeadersForValidationAndModels = () => resolveAuthHeaders(
-    buildOidcBearerAuthHeaders,
-    buildStaticAuthHeaders(),
-  );
+  const oidcHeaderResolver = createProviderOidcHeaderResolver({
+    resolveAuthHeaders,
+    buildOidcHeaders: buildOidcBearerAuthHeaders,
+    buildStaticHeaders: buildStaticAuthHeaders,
+  });
   const adapterMethods = createAdapterMethods({
     apiKey,
     rawTarget,
@@ -131,7 +132,7 @@ function createAnthropicAdapter(env, deps = {}) {
     validationMethod: 'POST',
     validationBody: '{}',
     validationHeaders: () => ({
-      ...resolveAuthHeadersForValidationAndModels(),
+      ...oidcHeaderResolver.resolveHeaders(),
       'anthropic-version': '2023-06-01',
       'content-type': 'application/json',
     }),
@@ -144,7 +145,7 @@ function createAnthropicAdapter(env, deps = {}) {
     skipModelsFetch: () => oidcConfigured && !oidcProvider?.isReady(),
     modelsPath: '/v1/models',
     modelsFetchHeaders: () => ({
-      ...resolveAuthHeadersForValidationAndModels(),
+      ...oidcHeaderResolver.resolveHeaders(),
       'anthropic-version': '2023-06-01',
     }),
     reflectionConfigured: !!apiKey || oidcRequested,
@@ -167,10 +168,7 @@ function createAnthropicAdapter(env, deps = {}) {
      * @returns {Record<string, string>}
      */
     getAuthHeaders(req) {
-      const headers = resolveAuthHeaders(
-        buildOidcBearerAuthHeaders,
-        buildStaticAuthHeaders(),
-      );
+      const headers = oidcHeaderResolver.resolveHeaders();
 
       // OIDC configured but token not yet ready: fail closed so static creds are not leaked.
       if (Object.keys(headers).length === 0) {

containers/api-proxy/providers/cloud-oidc-init.js

@@ -180,7 +180,32 @@ function createProviderOidcAuth(env, {
   };
 }
 
+/**
+ * Build a shared OIDC/static auth-header resolver for provider adapters.
+ *
+ * @param {object} options
+ * @param {(buildOidcHeaders: (token: string) => Record<string, string>, staticHeaders: Record<string, string>) => Record<string, string>} options.resolveAuthHeaders
+ * @param {(token: string) => Record<string, string>} options.buildOidcHeaders
+ * @param {() => Record<string, string>} options.buildStaticHeaders
+ * @returns {{ resolveHeaders: () => Record<string, string> }}
+ */
+function createProviderOidcHeaderResolver({
+  resolveAuthHeaders,
+  buildOidcHeaders,
+  buildStaticHeaders,
+}) {
+  return {
+    resolveHeaders() {
+      return resolveAuthHeaders(
+        buildOidcHeaders,
+        buildStaticHeaders(),
+      );
+    },
+  };
+}
+
 module.exports = {
   resolveCloudOidcProviders,
   createProviderOidcAuth,
+  createProviderOidcHeaderResolver,
 };

containers/api-proxy/providers/cloud-oidc-init.test.js

@@ -1,6 +1,10 @@
 'use strict';
 
-const { resolveCloudOidcProviders, createProviderOidcAuth } = require('./cloud-oidc-init');
+const {
+  resolveCloudOidcProviders,
+  createProviderOidcAuth,
+  createProviderOidcHeaderResolver,
+} = require('./cloud-oidc-init');
 
 describe('resolveCloudOidcProviders', () => {
   it('returns no providers when github-oidc is not configured', () => {
@@ -91,6 +95,43 @@ describe('createProviderOidcAuth', () => {
     expect(auth.skipModelsFetch()).toBe(false);
   });
 
+  describe('createProviderOidcHeaderResolver', () => {
+    it('resolves OIDC headers when token is available', () => {
+      const resolveAuthHeaders = jest.fn((buildOidcHeaders) => buildOidcHeaders('oidc-token'));
+      const resolver = createProviderOidcHeaderResolver({
+        resolveAuthHeaders,
+        buildOidcHeaders: (token) => ({ Authorization: 'Bearer ' + token }),
+        buildStaticHeaders: () => ({ 'x-api-key': 'static-key' }),
+      });
+
+      expect(resolver.resolveHeaders()).toEqual({ Authorization: 'Bearer ' + 'oidc-' + 'token' });
+      expect(resolveAuthHeaders).toHaveBeenCalledWith(
+        expect.any(Function),
+        { 'x-api-key': 'static-key' },
+      );
+    });
+
+    it('returns static headers when OIDC is not configured', () => {
+      const resolver = createProviderOidcHeaderResolver({
+        resolveAuthHeaders: (_buildOidcHeaders, staticHeaders) => staticHeaders,
+        buildOidcHeaders: (token) => ({ Authorization: 'Bearer ' + token }),
+        buildStaticHeaders: () => ({ 'x-api-key': 'static-key' }),
+      });
+
+      expect(resolver.resolveHeaders()).toEqual({ 'x-api-key': 'static-key' });
+    });
+
+    it('returns empty headers when OIDC is configured but token is unavailable', () => {
+      const resolver = createProviderOidcHeaderResolver({
+        resolveAuthHeaders: () => ({}),
+        buildOidcHeaders: (token) => ({ Authorization: 'Bearer ' + token }),
+        buildStaticHeaders: () => ({ 'x-api-key': 'static-key' }),
+      });
+
+      expect(resolver.resolveHeaders()).toEqual({});
+    });
+  });
+
   it('isEnabled() returns true when staticAuthToken is set (no OIDC)', () => {
     const auth = createProviderOidcAuth({}, { staticAuthToken: 'my-api-key' });
 

containers/api-proxy/providers/copilot.js

@@ -35,7 +35,7 @@ const {
   deriveCopilotApiTarget,
   copilotTargetRequiresGitHubTokenPrefix,
 } = require('./copilot-auth');
-const { createProviderOidcAuth } = require('./cloud-oidc-init');
+const { createProviderOidcAuth, createProviderOidcHeaderResolver } = require('./cloud-oidc-init');
 const { bearerAuthHeaders, withCopilotIntegration } = require('./auth-headers');
 const { URL } = require('url');
 const { COPILOT_ENV } = require('../provider-env-constants');
@@ -102,6 +102,16 @@ function createCopilotAdapter(env, deps = {}) {
     ? (body) => injectByokExtraBodyFields(body, byokExtraBodyFields)
     : null;
   const bodyTransform = composeBodyTransforms(sanitizedBodyTransform, byokBodyFieldTransform);
+  const requiresGitHubTokenPrefix = copilotTargetRequiresGitHubTokenPrefix(rawTarget, env);
+  const authPrefix = (requiresGitHubTokenPrefix && !apiKey) ? 'token' : 'Bearer';
+  const inferenceAuthHeaderResolver = createProviderOidcHeaderResolver({
+    resolveAuthHeaders,
+    buildOidcHeaders: (token) => withCopilotIntegration(bearerAuthHeaders(token), integrationId),
+    buildStaticHeaders: () => withCopilotIntegration({
+      ...(apiKey ? byokExtraHeaders : {}),
+      'Authorization': authPrefix + ' ' + authToken,
+    }, integrationId),
+  });
 
   // Pre-computed models path used by getModelsFetchConfig and getReflectionInfo.
   // For BYOK/custom providers the base path prefix is included (e.g. /api/v1/models
@@ -120,7 +130,7 @@ function createCopilotAdapter(env, deps = {}) {
    * @returns {{ url: string, opts: { method: string, headers: Record<string,string> } } & Record<string, unknown>}
    */
 function buildCopilotModelsRequest(extra = {}) {
-  const prefix = copilotTargetRequiresGitHubTokenPrefix(rawTarget, env) ? 'token' : 'Bearer';
+  const prefix = requiresGitHubTokenPrefix ? 'token' : 'Bearer';
   return {
     url: `https://${rawTarget}/models`,
     opts: {
@@ -219,24 +229,14 @@ function buildCopilotModelsRequest(extra = {}) {
       // Enterprise/Business Copilot API requires 'token <value>' for GitHub OAuth tokens.
       // BYOK API keys use 'Bearer' regardless of target.
       // Standard api.githubcopilot.com and GHEC (*.ghe.com) also use 'Bearer' for all credentials.
-      const requiresGitHubTokenPrefix = copilotTargetRequiresGitHubTokenPrefix(rawTarget, env);
-
       const isModelsPath = reqPathname === '/models' || reqPathname.startsWith('/models/');
       if (isModelsPath && req.method === 'GET' && githubToken) {
         // /models always uses the GitHub OAuth token (not BYOK key)
         const prefix = requiresGitHubTokenPrefix ? 'token' : 'Bearer';
         return withCopilotIntegration({ 'Authorization': prefix + ' ' + githubToken }, integrationId);
       }
 
-      // For inference: BYOK keys use 'Bearer'; GitHub tokens use 'token' on Enterprise/Business/GHES
-      const authPrefix = (requiresGitHubTokenPrefix && !apiKey) ? 'token' : 'Bearer';
-      return resolveAuthHeaders(
-        (token) => withCopilotIntegration(bearerAuthHeaders(token), integrationId),
-        withCopilotIntegration({
-          ...(apiKey ? byokExtraHeaders : {}),
-          'Authorization': authPrefix + ' ' + authToken,
-        }, integrationId),
-      );
+      return inferenceAuthHeaderResolver.resolveHeaders();
     },
     bodyTransform,
     missingCredentialResponse: {

containers/api-proxy/providers/openai.js

@@ -18,7 +18,7 @@ const { validateAuthHeaderEnv } = require('../oidc-adapter-utils');
 const { bearerAuthHeaders, providerKeyHeaders } = require('./auth-headers');
 
 const { createProviderAuthScaffold, createAdapterMethods, buildProviderAdapter } = require('../adapter-factory');
-const { createProviderOidcAuth } = require('./cloud-oidc-init');
+const { createProviderOidcAuth, createProviderOidcHeaderResolver } = require('./cloud-oidc-init');
 const { OPENAI_ENV, COPILOT_ENV } = require('../provider-env-constants');
 
 /**
@@ -78,6 +78,11 @@ function createOpenAIAdapter(env, deps = {}) {
     return bearerAuthHeaders(key);
   }
   const buildStaticAuthHeaders = () => buildTokenAuthHeaders(apiKey);
+  const oidcHeaderResolver = createProviderOidcHeaderResolver({
+    resolveAuthHeaders,
+    buildOidcHeaders: buildTokenAuthHeaders,
+    buildStaticHeaders: buildStaticAuthHeaders,
+  });
 
   const adapterMethods = createAdapterMethods({
     apiKey,
@@ -105,10 +110,7 @@ function createOpenAIAdapter(env, deps = {}) {
     isManagementPort: true,
     adapterMethods,
     getAuthHeaders() {
-      return resolveAuthHeaders(
-        buildTokenAuthHeaders,
-        buildStaticAuthHeaders(),
-      );
+      return oidcHeaderResolver.resolveHeaders();
     },
     bodyTransform,
     missingCredentialResponse: {