Files
gbrain/test
2c758e23e8 feat(azure): keyless (Entra/AAD) auth for the azure-openai embedding recipe (#2354)
* feat(azure): keyless (Entra/AAD) auth for the azure-openai embedding recipe

Subscriptions that enforce `disableLocalAuth` via Azure Policy reject api-key
auth, so the azure-openai recipe was unusable there. Add an Entra path:

- recipes/azure-openai.ts: when AZURE_OPENAI_API_KEY is absent (or
  AZURE_OPENAI_USE_ENTRA=1), mint a short-lived AAD bearer token via
  `az account get-access-token --resource https://cognitiveservices.azure.com`,
  cached ~45min. resolveAuth is sync, so execSync is the seam. Returns an
  `Authorization: Bearer …` pair (gateway uses the SDK's native bearer path).
  AZURE_OPENAI_API_KEY moves from required → optional.
- config.ts + build-gateway-config.ts: add azure_openai_endpoint /
  azure_openai_deployment / azure_openai_use_entra config keys, folded into the
  gateway env (same pattern as openai_api_key) so the recipe works in any shell
  without per-shell env. Non-secret only; the token is minted at request time.

Caller needs `az login` + the "Cognitive Services OpenAI User" role on the
resource. Verified end-to-end: import + query retrieval against a keyless
Azure OpenAI text-embedding-3-large deployment.

* fix(azure): refresh Entra bearer per request + align recipe tests with keyless auth

The gateway caches model instances with auth baked in at instantiation, so
the AAD token minted in resolveAuth would go stale after ~1h in long-running
processes. The recipe's existing api-version fetch wrapper now re-sets the
Authorization header from the TTL-cached token on every request in Entra
mode. Adds a test seam (__setEntraTokenForTests) so unit tests never shell
out to az, and updates test/ai/recipe-azure-openai.test.ts for the
required->optional AZURE_OPENAI_API_KEY move.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(azure): non-null assert api key in key mode (typecheck)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: joncules <jon.in.christ@gmail.com>
Co-authored-by: Garry Tan <garrytan@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-27 16:45:42 -07:00
..