Class: OpenAI::Auth::X509WorkloadIdentity

Inherits:
Object
  • Object
show all
Defined in:
lib/openai/auth/x509_workload_identity.rb,
sig/openai/auth/x509_workload_identity.rbs

Overview

Immutable configuration for certificate-authenticated workload identity. Certificate and private-key ownership remain with the attested transport.

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(identity_provider_id: ENV["IDENTITY_PROVIDER_ID"], service_account_id: ENV["SERVICE_ACCOUNT_ID"], refresh_buffer_seconds: 1200, http_client: nil, proxy: :direct, api_origin: "https://mtls.api.openai.com") ⇒ X509WorkloadIdentity

Returns a new instance of X509WorkloadIdentity.

Parameters:

  • http_client (OpenAI::NetHTTPClient, nil) (defaults to: nil) —

    application-owned native client configured with one static client certificate and private key.

  • proxy (Symbol) (defaults to: :direct) —

    explicitly approved :direct or :http_connect policy.

  • api_origin (String) (defaults to: "https://mtls.api.openai.com") —

    approved global, US, or EU OpenAI mTLS origin.



27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
 
# File 'lib/openai/auth/x509_workload_identity.rb', line 27

def initialize(
  identity_provider_id: ENV["IDENTITY_PROVIDER_ID"],
  service_account_id: ENV["SERVICE_ACCOUNT_ID"],
  refresh_buffer_seconds: 1200,
  http_client: nil,
  proxy: :direct,
  api_origin: "https://mtls.api.openai.com"
)
  @identity_provider_id = validate_identifier(identity_provider_id, "identity_provider_id").freeze
  @service_account_id = validate_identifier(, "service_account_id").freeze
  @refresh_buffer_seconds = Integer(refresh_buffer_seconds)
  if @refresh_buffer_seconds.negative?
    raise ArgumentError, "refresh_buffer_seconds must be greater than or equal to zero"
  end

  if http_client.nil? && (proxy != :direct || api_origin != "https://mtls.api.openai.com")
    raise ArgumentError, "X.509 transport configuration requires http_client:"
  end

  @transport = unless http_client.nil?
    X509Transport.new(
      http_client: http_client,
      certificate_identity: :static,
      proxy: proxy,
      api_origin: api_origin
    )
  end

  freeze
end

Instance Attribute Details

#identity_provider_id ⇒ String (readonly)

Returns:

  • (String) 


9
10
11
 
# File 'lib/openai/auth/x509_workload_identity.rb', line 9

def identity_provider_id
  @identity_provider_id
end

#refresh_buffer_seconds ⇒ Integer (readonly)

Returns:

  • (Integer) 


15
16
17
 
# File 'lib/openai/auth/x509_workload_identity.rb', line 15

def refresh_buffer_seconds
  @refresh_buffer_seconds
end

#service_account_id ⇒ String (readonly)

Returns:

  • (String) 


12
13
14
 
# File 'lib/openai/auth/x509_workload_identity.rb', line 12

def 
  @service_account_id
end

#transport ⇒ OpenAI::Auth::X509Transport? (readonly)

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

The internally guarded transport derived from the caller-owned native client.

Returns:



21
22
23
 
# File 'lib/openai/auth/x509_workload_identity.rb', line 21

def transport
  @transport
end

Instance Method Details

#inspect ⇒ String

Avoid exposing provider or service-account identifiers in diagnostics.

Returns:

  • (String) 


61
62
63
 
# File 'lib/openai/auth/x509_workload_identity.rb', line 61

def inspect
  "#<#{self.class.name}:0x#{object_id.to_s(16)}>"
end