Skip to content

Deduplicate WIF auth - #7247

Open
nishusheth wants to merge 2 commits into
masterfrom
dedupe-wif-auth
Open

nishusheth wants to merge 2 commits into
masterfrom
dedupe-wif-auth

Conversation

@nishusheth

Copy link
Copy Markdown
Contributor

Fixes #6317

@nishusheth
nishusheth requested a review from a team as a code owner October 20, 2026 16:19


@dataclass(frozen=True)
class WifConfig:

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of storing the env var names in the config class, the config class should hold the values themselves. Resolving env vars isn't the job of configure(), and moving that responsibility out gives us more flexibility to customize validation as needed.

I would make WifConfig an interface (i.e., inherit from Protocol). Then, for each provider, I would create a pydantic_settings model that maps env vars to its fields via a prefix configuration. Where a field name doesn't match the env var name after the prefix, we can use an alias on that field.


name: ClassVar[str] = "OpenAI"
provider_id: ClassVar[str] = "openai"
token_file_env: ClassVar[str] = "OPENAI_IDENTITY_TOKEN_FILE"

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This isn't quite what I had in mind. We don't need os.environ here at all, since pydantic_settings should handle that for us.

When the environment variable name doesn't match the field name in the provider-specific model, we can use Field() with an alias to customize it. For example:

Suggested change
token_file_env: ClassVar[str] = "OPENAI_IDENTITY_TOKEN_FILE"
token_file: Annotated[str, Field(validation_alias="OPENAI_IDENTITY_TOKEN_FILE")]

To support both embedding in existing settings and standalone settings, we can use the from_env() pattern:

@classmethod
def from_env(cls) -> PhabricatorSettings:
return _PhabricatorEnvSettings()

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Deduplicate WIF auth

2 participants