mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-11 22:53:00 +00:00
6dfc96d3fd
lithos-llm now owns which named secrets each provider reads and how they
shape into its auth scheme, including a derived `<PROVIDER>_API_KEY` for
operator-defined providers. Fabro's job shrinks to supplying the store:
`VaultCredentialSource` hands lithos a lookup that reads the process
environment, then the vault, under the same conventional names.
What Fabro still adds on top: the Codex OAuth credential in the vault,
refreshed and persisted when it expires; `{{ secrets.NAME }}` tokens in a
provider's `default_headers`, resolved against the vault and re-sent as
credential headers; and OpenAI organization and project headers from the
environment.
Deleted with the `metadata.fabro.credentials` list: `CredentialRef`,
`CredentialResolver`, `EnvCredentialSource` (now
`VaultCredentialSource::environment_only`), and the `env_var_names` /
`expected_vault_secret_name` helpers, replaced by `secret_names` and
`expected_secret_name` over the lithos table. `openai-codex` joins the
first-party provider id constants.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
38 lines
1 KiB
TOML
38 lines
1 KiB
TOML
[package]
|
|
name = "fabro-auth"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
publish = false
|
|
license.workspace = true
|
|
description = "Typed provider credential storage and resolution for Fabro"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[features]
|
|
test-support = []
|
|
|
|
[dependencies]
|
|
anyhow.workspace = true
|
|
async-trait.workspace = true
|
|
base64.workspace = true
|
|
chrono = { workspace = true, features = ["serde"] }
|
|
fabro-http.workspace = true
|
|
fabro-oauth = { path = "../fabro-oauth" }
|
|
fabro-redact.workspace = true
|
|
fabro-static.workspace = true
|
|
fabro-types = { path = "../fabro-types" }
|
|
fabro-vault = { path = "../fabro-vault" }
|
|
lithos-llm = { workspace = true, features = ["runtime", "environment-credentials", "bedrock-aws"] }
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
thiserror.workspace = true
|
|
tokio.workspace = true
|
|
tracing.workspace = true
|
|
|
|
[dev-dependencies]
|
|
httpmock = "0.8"
|
|
lithos-llm = { workspace = true, features = ["runtime", "builtin-catalog"] }
|
|
tempfile = "3"
|
|
tokio = { workspace = true, features = ["macros", "test-util"] }
|
|
toml.workspace = true
|