Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Duplicate Code] Share OIDC unavailable-response scaffold across provider adapters

Closed
  • Is something wrong?
#9,019 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
55/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Active
Tech stack
javascript
Domain
api, authentication, backend, security

Research direction

Review the repeated OIDC handling in containers/api-proxy/providers/openai.js, anthropic.js, and google-adapter.js, then inspect oidc-adapter-utils.js or adapter-factory.js for the appropriate shared-helper location. Confirm the requested-versus-configured behavior and provider-specific wording before extracting the response pair. Done means all three adapters use the shared logic while preserving retryability and matching unavailable health states.

Written by the indexing model from the issue text.

Description

code-quality refactoring

Duplicate Code Opportunity

Summary
  • Pattern: The provider adapters repeat the same OIDC failure-handling scaffold: compute an oidcUnavailableError, return a provider_not_configured response when OIDC was requested but the token is unavailable, and expose a matching unavailableWhen health state.
  • Locations: containers/api-proxy/providers/openai.js lines 105-121; containers/api-proxy/providers/anthropic.js lines 180-203; containers/api-proxy/providers/google-adapter.js lines 86-124.
  • Impact: This is security-critical auth-path logic. A change to OIDC retryability, error wording, or the "requested vs configured" distinction must be kept in sync across multiple adapters.
Evidence
// containers/api-proxy/providers/openai.js:105-121
buildAdapterOptions: ({ oidcConfigured }) => ({
  name: 'openai',
  port: 10000,
  isManagementPort: true,
  bodyTransform: composedBodyTransform,
  missingCredentialResponse: {
    kind: 'plain_error',
    statusCode: 404,
    message: 'OpenAI proxy not configured (no OPENAI_API_KEY/COPILOT_PROVIDER_API_KEY or OIDC auth)',
  },
  unconfiguredResponseWhen: () => (oidcConfigured
    ? {
        kind: 'provider_not_configured',
        message: 'OpenAI OIDC token unavailable; retry shortly',
        retryable: true,
      }
    : null),
  extra: {
    participatesInValidation: true,
    _hostedWebPolicy: hostedWebPolicy,
  },
}),

// containers/api-proxy/providers/anthropic.js:180-203
buildAdapterOptions: ({ oidcConfigured }) => {
  const oidcUnavailableError = oidcConfigured
    ? 'Anthropic OIDC token unavailable; retry shortly'
    : 'Anthropic OIDC requires ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN (permissions: id-token: write).';
  return {
    name: 'anthropic',
    port: 10001,
    isManagementPort: false,
    bodyTransform: composedBodyTransform,
    missingCredentialResponse: {
      kind: 'provider_not_configured',
      message: 'Credentials for Anthropic (port 10001) are not configured. Set ANTHROPIC_API_KEY to enable this provider.',
    },
    unconfiguredResponseWhen: () => (oidcRequested
      ? {
          kind: 'provider_not_configured',
          message: oidcUnavailableError,
          retryable: oidcConfigured,
        }
      : null),
    healthServiceName: 'awf-api-proxy-anthropic',
    missingCredentialMessage: 'ANTHROPIC_API_KEY not configured in api-proxy sidecar',
    unavailableWhen: () => oidcRequested ? { message: oidcUnavailableError, status: 'unavailable' } : null,
  };
},
Suggested Refactoring

Extract a small helper in oidc-adapter-utils.js or adapter-factory.js that builds the OIDC unavailable response pair from { provider, requested, configured, unavailableMessage }. That helper should return the retryable provider_not_configured payload and the matching health-state object so adapters only supply provider-specific wording.

Affected Files
  • containers/api-proxy/providers/openai.js — lines 105-121
  • containers/api-proxy/providers/anthropic.js — lines 180-203
  • containers/api-proxy/providers/google-adapter.js — lines 86-124
Effort Estimate

Low

Detected by Duplicate Code Detector workflow. Run date: 2026-09-25

Generated by Duplicate Code Detector · copilot · gpt50mini · 14.2 AIC · ⊞ 21K · ◷

  • expires on Oct 25, 2026, 9:45 PM UTC
Dominant language
TypeScript
Stars
145
Forks
63
Avg merge
6h 18m
Merged PRs (30d)
248

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/gh-aw-firewall

All issues in github/gh-aw-firewall

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.