mirror of
https://github.com/headroomlabs-ai/headroom.git
synced 2026-08-27 14:17:10 -04:00
6b0c09ffd5
## Description Improve Copilot API authentication behavior by correctly handling incoming bearer tokens and ensuring required Copilot headers are present. ## Type of Change - [x] Bug fix (non-breaking change that fixes an issue) - [ ] New feature (non-breaking change that adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update - [ ] Performance improvement - [ ] Code refactoring (no functional changes) ## Changes Made - Added token classification logic to distinguish short-lived Copilot API tokens (`tid_`) from GitHub OAuth tokens. - Updated auth flow to pass through valid existing Copilot API bearer tokens and replace unsuitable bearer tokens. - Added default `Copilot-Integration-Id` and `editor-version` headers when missing. - Improved Windows credential lookup to consider both GitHub CLI (`gh:`) and Copilot CLI credential target prefixes. - Added regression tests for pass-through, replacement, header injection, and token prefix classification. ## Testing Describe the tests you ran to verify your changes: - [x] Unit tests pass (`pytest`) - [x] Linting passes (`ruff check .`) - [ ] Type checking passes (`mypy headroom`) - [x] New tests added for new functionality - [x] Manual testing performed ## Test Output ```text pytest -q tests/test_copilot_auth.py 29 passed in 0.40s ``` ## Checklist - [x] My code follows the project's style guidelines - [x] I have performed a self-review of my code - [x] I have commented my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [ ] I have updated the CHANGELOG.md if applicable ## Screenshots (if applicable) N/A ## Additional Notes This change is intentionally scoped to auth behavior and tests in: - `headroom/copilot_auth.py` - `tests/test_copilot_auth.py` --------- Co-authored-by: Abhinav Kaurav <abhinav.kaurav@e2open.com>
50 lines
2.4 KiB
YAML
50 lines
2.4 KiB
YAML
# GitGuardian configuration — secret-detection allowlist
|
|
#
|
|
# Two entries below are test fixtures, NOT real credentials. They live in
|
|
# tests that exercise our own detectors (volatile-content scanner, auth-mode
|
|
# classifier) — by definition we have to embed plausible-looking tokens to
|
|
# verify the detectors recognise them. The strings are syntactically valid
|
|
# but carry no privilege against any real service.
|
|
#
|
|
# Anything else GitGuardian flags should be treated as a real incident: do
|
|
# NOT extend this allowlist without verifying the secret is unauthenticated
|
|
# fixture data, and rotate any genuine leaks before adding the row.
|
|
|
|
version: 2
|
|
|
|
secret:
|
|
ignored-matches:
|
|
# Canonical fake JWT used across the JS/Python ecosystem to demonstrate
|
|
# JWT-shaped strings. Header `{"alg":"HS256"}`, payload `{"sub":"1"}`.
|
|
# We use it to verify our `detect_volatile_content` recogniser flags JWTs.
|
|
# File: tests/test_cache_aligner_detector_only.py
|
|
- name: "fake JWT in volatile-content detector test"
|
|
match: "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
|
|
|
|
# Anthropic-shaped strings whose payloads literally contain the word
|
|
# "fixture" — used in `test_realignment_live_multi_turn` to assert the
|
|
# auth-mode classifier routes PAYG / OAuth / subscription headers
|
|
# correctly. No live API call is ever made with these tokens.
|
|
# File: tests/test_realignment_live_multi_turn.py
|
|
- name: "Anthropic-shaped fixture token (PAYG via x-api-key)"
|
|
match: "sk-ant-api03-payg-fixture"
|
|
- name: "Anthropic-shaped fixture token (OAuth bearer)"
|
|
match: "sk-ant-oat01-oauth-fixture"
|
|
- name: "Anthropic-shaped fixture token (PAYG via bearer)"
|
|
match: "sk-ant-api03-payg-bearer-fixture"
|
|
|
|
# Minimal GitHub-shaped tokens used in tests/test_copilot_auth.py to
|
|
# exercise _token_kind() prefix detection and _is_copilot_api_token().
|
|
# Values are intentionally short/low-entropy — they carry no privilege.
|
|
- name: "GitHub OAuth token fixture (test_copilot_auth)"
|
|
match: "gho_x"
|
|
- name: "GitHub Apps token fixture (test_copilot_auth)"
|
|
match: "ghs_x"
|
|
- name: "GitHub PAT fixture (test_copilot_auth)"
|
|
match: "ghp_x"
|
|
- name: "GitHub fine-grained PAT fixture (test_copilot_auth)"
|
|
match: "github_pat_x"
|
|
- name: "Copilot session token fixture (test_copilot_auth)"
|
|
match: "tid_x"
|
|
- name: "GitHub OAuth token fixture for exchange_token test"
|
|
match: "gho_test"
|