Deduplicate cloud OIDC provider initialization across Copilot and OpenAI adapters

containers/api-proxy/providers/cloud-oidc-init.js

@@ -0,0 +1,80 @@
+'use strict';
+
+const { OidcTokenProvider } = require('../oidc-token-provider');
+
+/**
+ * Resolve cloud OIDC providers (Azure/AWS/GCP) from environment variables.
+ *
+ * @param {Record<string, string|undefined>} env
+ * @param {{ skipWhen?: boolean }} [options]
+ * @returns {{ authProvider: string, oidcProvider: any, awsOidcProvider: any, oidcConfigured: boolean }}
+ */
+function resolveCloudOidcProviders(env, options = {}) {
+  const { skipWhen = false } = options;
+  const authType = (env.AWF_AUTH_TYPE || '').trim().toLowerCase();
+  const authProvider = (env.AWF_AUTH_PROVIDER || 'azure').trim().toLowerCase();
+  let oidcProvider = null;
+  let awsOidcProvider = null;
+
+  if (authType === 'github-oidc' && !skipWhen) {
+    const requestUrl = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+    const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+
+    if (requestUrl && requestToken) {
+      if (authProvider === 'aws') {
+        const roleArn = env.AWF_AUTH_AWS_ROLE_ARN;
+        const region = env.AWF_AUTH_AWS_REGION;
+        if (roleArn && region) {
+          const { AwsOidcTokenProvider } = require('../aws-oidc-token-provider');
+          awsOidcProvider = new AwsOidcTokenProvider({
+            requestUrl,
+            requestToken,
+            roleArn,
+            region,
+            roleSessionName: env.AWF_AUTH_AWS_ROLE_SESSION_NAME,
+            oidcAudience: env.AWF_AUTH_OIDC_AUDIENCE,
+          });
+        }
+      } else if (authProvider === 'gcp') {
+        const workloadIdentityProvider = env.AWF_AUTH_GCP_WORKLOAD_IDENTITY_PROVIDER;
+        if (workloadIdentityProvider) {
+          const { GcpOidcTokenProvider } = require('../gcp-oidc-token-provider');
+          oidcProvider = new GcpOidcTokenProvider({
+            requestUrl,
+            requestToken,
+            workloadIdentityProvider,
+            serviceAccount: env.AWF_AUTH_GCP_SERVICE_ACCOUNT,
+            oidcAudience: env.AWF_AUTH_OIDC_AUDIENCE,
+            scope: env.AWF_AUTH_GCP_SCOPE,
+          });
+        }
+      } else {
+        // Azure (default)
+        const tenantId = env.AWF_AUTH_AZURE_TENANT_ID;
+        const clientId = env.AWF_AUTH_AZURE_CLIENT_ID;
+        if (tenantId && clientId) {
+          oidcProvider = new OidcTokenProvider({
+            requestUrl,
+            requestToken,
+            tenantId,
+            clientId,
+            oidcAudience: env.AWF_AUTH_OIDC_AUDIENCE || 'api://AzureADTokenExchange',
+            azureScope: env.AWF_AUTH_AZURE_SCOPE || 'https://cognitiveservices.azure.com/.default',
+            azureCloud: env.AWF_AUTH_AZURE_CLOUD,
+          });
+        }
+      }
+    }
+  }
+
+  return {
+    authProvider,
+    oidcProvider,
+    awsOidcProvider,
+    oidcConfigured: !!(oidcProvider || awsOidcProvider),
+  };
+}
+
+module.exports = {
+  resolveCloudOidcProviders,
+};

containers/api-proxy/providers/cloud-oidc-init.test.js

@@ -0,0 +1,79 @@
+'use strict';
+
+const { resolveCloudOidcProviders } = require('./cloud-oidc-init');
+
+describe('resolveCloudOidcProviders', () => {
+  it('returns no providers when github-oidc is not configured', () => {
+    const result = resolveCloudOidcProviders({});
+    expect(result.authProvider).toBe('azure');
+    expect(result.oidcProvider).toBeNull();
+    expect(result.awsOidcProvider).toBeNull();
+    expect(result.oidcConfigured).toBe(false);
+  });
+
+  it('supports skipping provider initialization when skipWhen=true', () => {
+    const result = resolveCloudOidcProviders({
+      AWF_AUTH_TYPE: 'github-oidc',
+      ACTIONS_ID_TOKEN_REQUEST_URL: 'http://localhost/token',
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'test-token',
+      AWF_AUTH_AZURE_TENANT_ID: 'tenant-uuid',
+      AWF_AUTH_AZURE_CLIENT_ID: 'client-uuid',
+    }, { skipWhen: true });
+
+    expect(result.oidcProvider).toBeNull();
+    expect(result.awsOidcProvider).toBeNull();
+    expect(result.oidcConfigured).toBe(false);
+  });
+
+  it('creates Azure provider by default when configured', () => {
+    const result = resolveCloudOidcProviders({
+      AWF_AUTH_TYPE: 'github-oidc',
+      ACTIONS_ID_TOKEN_REQUEST_URL: 'http://localhost/token',
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'test-token',
+      AWF_AUTH_AZURE_TENANT_ID: 'tenant-uuid',
+      AWF_AUTH_AZURE_CLIENT_ID: 'client-uuid',
+    });
+
+    expect(result.authProvider).toBe('azure');
+    expect(result.oidcProvider).toBeTruthy();
+    expect(result.awsOidcProvider).toBeNull();
+    expect(result.oidcConfigured).toBe(true);
+
+    result.oidcProvider.shutdown();
+  });
+
+  it('creates AWS provider when configured', () => {
+    const result = resolveCloudOidcProviders({
+      AWF_AUTH_TYPE: 'github-oidc',
+      AWF_AUTH_PROVIDER: 'aws',
+      ACTIONS_ID_TOKEN_REQUEST_URL: 'http://localhost/token',
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'test-token',
+      AWF_AUTH_AWS_ROLE_ARN: 'arn:aws:iam::123456789012:role/my-role',
+      AWF_AUTH_AWS_REGION: 'us-east-1',
+    });
+
+    expect(result.authProvider).toBe('aws');
+    expect(result.oidcProvider).toBeNull();
+    expect(result.awsOidcProvider).toBeTruthy();
+    expect(result.oidcConfigured).toBe(true);
+
+    result.awsOidcProvider.shutdown();
+  });
+
+  it('creates GCP provider when configured', () => {
+    const result = resolveCloudOidcProviders({
+      AWF_AUTH_TYPE: 'github-oidc',
+      AWF_AUTH_PROVIDER: 'gcp',
+      ACTIONS_ID_TOKEN_REQUEST_URL: 'http://localhost/token',
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'test-token',
+      AWF_AUTH_GCP_WORKLOAD_IDENTITY_PROVIDER: 'projects/123/locations/global/workloadIdentityPools/pool/providers/provider',
+    });
+
+    expect(result.authProvider).toBe('gcp');
+    expect(result.oidcProvider).toBeTruthy();
+    expect(result.awsOidcProvider).toBeNull();
+    expect(result.oidcConfigured).toBe(true);
+
+    result.oidcProvider.shutdown();
+  });
+});

containers/api-proxy/providers/copilot.js

@@ -24,7 +24,6 @@ const {
   composeBodyTransforms,
 } = require('../proxy-utils');
 const { sanitizeNullToolCallTypes } = require('../body-transform');
-const { OidcTokenProvider } = require('../oidc-token-provider');
 const {
   parseByokExtraHeaders,
   parseByokExtraBodyFields,
@@ -36,6 +35,7 @@ const {
   resolveCopilotAuthToken,
   deriveCopilotApiTarget,
 } = require('./copilot-auth');
+const { resolveCloudOidcProviders } = require('./cloud-oidc-init');
 const { URL } = require('url');
 
 /**
@@ -59,60 +59,12 @@ function createCopilotAdapter(env, deps = {}) {
   // adapter's OIDC plumbing so the Copilot CLI's direct-BYOK path can exchange a
   // GitHub Actions OIDC JWT for an upstream cloud token instead of requiring a
   // static COPILOT_PROVIDER_API_KEY.
-  const authType = (env.AWF_AUTH_TYPE || '').trim().toLowerCase();
-  const authProvider = (env.AWF_AUTH_PROVIDER || 'azure').trim().toLowerCase();
-  let oidcProvider = null;
-  let awsOidcProvider = null;
-  if (authType === 'github-oidc' && !staticAuthToken) {
-    const requestUrl = env.ACTIONS_ID_TOKEN_REQUEST_URL;
-    const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
-    if (requestUrl && requestToken) {
-      if (authProvider === 'aws') {
-        const roleArn = env.AWF_AUTH_AWS_ROLE_ARN;
-        const region = env.AWF_AUTH_AWS_REGION;
-        if (roleArn && region) {
-          const { AwsOidcTokenProvider } = require('../aws-oidc-token-provider');
-          awsOidcProvider = new AwsOidcTokenProvider({
-            requestUrl,
-            requestToken,
-            roleArn,
-            region,
-            roleSessionName: env.AWF_AUTH_AWS_ROLE_SESSION_NAME,
-            oidcAudience: env.AWF_AUTH_OIDC_AUDIENCE,
-          });
-        }
-      } else if (authProvider === 'gcp') {
-        const workloadIdentityProvider = env.AWF_AUTH_GCP_WORKLOAD_IDENTITY_PROVIDER;
-        if (workloadIdentityProvider) {
-          const { GcpOidcTokenProvider } = require('../gcp-oidc-token-provider');
-          oidcProvider = new GcpOidcTokenProvider({
-            requestUrl,
-            requestToken,
-            workloadIdentityProvider,
-            serviceAccount: env.AWF_AUTH_GCP_SERVICE_ACCOUNT,
-            oidcAudience: env.AWF_AUTH_OIDC_AUDIENCE,
-            scope: env.AWF_AUTH_GCP_SCOPE,
-          });
-        }
-      } else {
-        // Azure (default)
-        const tenantId = env.AWF_AUTH_AZURE_TENANT_ID;
-        const clientId = env.AWF_AUTH_AZURE_CLIENT_ID;
-        if (tenantId && clientId) {
-          oidcProvider = new OidcTokenProvider({
-            requestUrl,
-            requestToken,
-            tenantId,
-            clientId,
-            oidcAudience: env.AWF_AUTH_OIDC_AUDIENCE || 'api://AzureADTokenExchange',
-            azureScope: env.AWF_AUTH_AZURE_SCOPE || 'https://cognitiveservices.azure.com/.default',
-            azureCloud: env.AWF_AUTH_AZURE_CLOUD,
-          });
-        }
-      }
-    }
-  }
-  const oidcConfigured = !!(oidcProvider || awsOidcProvider);
+  const {
+    authProvider,
+    oidcProvider,
+    awsOidcProvider,
+    oidcConfigured,
+  } = resolveCloudOidcProviders(env, { skipWhen: !!staticAuthToken });
 
   // authToken is consumed by the existing validation/models-fetch/auth-header paths.
   // For OIDC mode the token isn't available synchronously at construction time, so