openclaw

mirror of https://github.com/openclaw/openclaw.git synced 2026-08-23 10:55:31 -06:00

Files

T

Peter Steinberger 1b6c42d1f0 refactor(openai): unify ChatGPT auth identity derivation in plugin SDK (#126544 )

The OpenAI ChatGPT auth profile identity was derived in two drifted copies:
the plugin-sdk helper (used by Codex/Hermes import migrations) fell back to
bare JWT sub and leaked the workspace accountId into the user subject, while
the openai extension copy (used by login/refresh) composed the OIDC-stable
iss|sub pair and honored the credential email fallback.

Fold the extension's chain into the canonical SDK helper (credential-email
fallback, iss|sub before bare sub, no workspace-id subject), delete the
extension copy, and move all extension call sites onto
openclaw/plugin-sdk/provider-auth. Cross-checked against Codex OSS
(codex-rs/login/src/token_data.rs): chatgpt_account_id is workspace identity,
never user identity. No doctor migration: the divergent fallback branch only
fires for tokens lacking every user-id claim and email, which real ChatGPT
tokens do not produce, so no shipped install holds divergent keys from it.

2026-08-19 23:48:43 -07:00