import CodexBarCoreimport CryptoKitimport Foundation struct CodexLimitResetOwnerKey: Equatable, Hashable, Sendable { let rawValue: String init?(identity: CodexIdentity, accountEmail: String?) { guard case let .providerAccount(id) = identity, let normalizedID = CodexOpenAIWorkspaceResolver.normalizeWorkspaceAccountID(id), let normalizedEmail = CodexIdentityResolver.normalizeEmail(accountEmail) else { return nil } let input = "codex-limit-reset-owner:v2\0\(normalizedID)\0\(normalizedEmail)" let digest = SHA256.hash(data: Data(input.utf8)) self.rawValue = digest.map { String(format: "%02x", $0) }.joined() }} struct CodexSessionQuotaOwnerKey: Equatable, Sendable { let rawValue: String init?(refreshGuard: CodexAccountScopedRefreshGuard) { let input: String switch refreshGuard.identity { case let .providerAccount(id): guard let normalizedID = CodexOpenAIWorkspaceResolver.normalizeWorkspaceAccountID(id), let normalizedEmail = CodexIdentityResolver.normalizeEmail(refreshGuard.accountKey) else { return nil } input = "codex-session-quota-owner:v1\0provider\0\(normalizedID)\0\(normalizedEmail)" case let .emailOnly(normalizedEmail): guard let email = CodexIdentityResolver.normalizeEmail(normalizedEmail) else { return nil } if let accountKey = CodexIdentityResolver.normalizeEmail(refreshGuard.accountKey), accountKey != email { return nil } guard let sourceKey = Self.sourceKey(refreshGuard.source) else { return nil } // Email-only auth cannot distinguish same-email workspaces. Include the credential fingerprint // and deliberately establish a new baseline after rotation rather than risk a cross-account alert. guard let fingerprint = CodexAuthFingerprint.normalize(refreshGuard.authFingerprint) else { return nil } input = "codex-session-quota-owner:v1\0email\0\(sourceKey)\0\(email)\0\(fingerprint)" case .unresolved: return nil } let digest = SHA256.hash(data: Data(input.utf8)) self.rawValue = digest.map { String(format: "%02x", $0) }.joined() } private static func sourceKey(_ source: CodexActiveSource) -> String? { switch source { case .liveSystem: "live-system" case let .managedAccount(id): "managed:\(id.uuidString.lowercased())" case let .profileHome(path): CodexHomeScope.normalizedHomePath(path).map { "profile:\($0)" } } }} extension UsageStore { func codexLimitResetOwnerKey( expectedGuard: CodexAccountScopedRefreshGuard, visibleAccounts _: [CodexVisibleAccount]) -> CodexLimitResetOwnerKey? { CodexLimitResetOwnerKey( identity: expectedGuard.identity, accountEmail: expectedGuard.accountKey) } func codexLimitResetOwnerKey( forVisibleAccount account: CodexVisibleAccount, visibleAccounts _: [CodexVisibleAccount]) -> CodexLimitResetOwnerKey? { guard let workspaceAccountID = CodexOpenAIWorkspaceResolver.normalizeWorkspaceAccountID( account.workspaceAccountID) else { return nil } return CodexLimitResetOwnerKey( identity: .providerAccount(id: workspaceAccountID), accountEmail: account.email) }}
import CodexBarCore
import CryptoKit
import Foundation
struct CodexLimitResetOwnerKey: Equatable, Hashable, Sendable {
let rawValue: String
init?(identity: CodexIdentity, accountEmail: String?) {
guard case let .providerAccount(id) = identity,
let normalizedID = CodexOpenAIWorkspaceResolver.normalizeWorkspaceAccountID(id),
let normalizedEmail = CodexIdentityResolver.normalizeEmail(accountEmail)
else {
return nil
}
let input = "codex-limit-reset-owner:v2\0\(normalizedID)\0\(normalizedEmail)"
let digest = SHA256.hash(data: Data(input.utf8))
self.rawValue = digest.map { String(format: "%02x", $0) }.joined()
}
}
struct CodexSessionQuotaOwnerKey: Equatable, Sendable {
let rawValue: String
init?(refreshGuard: CodexAccountScopedRefreshGuard) {
let input: String
switch refreshGuard.identity {
case let .providerAccount(id):
guard let normalizedID = CodexOpenAIWorkspaceResolver.normalizeWorkspaceAccountID(id),
let normalizedEmail = CodexIdentityResolver.normalizeEmail(refreshGuard.accountKey)
else {
return nil
}
input = "codex-session-quota-owner:v1\0provider\0\(normalizedID)\0\(normalizedEmail)"
case let .emailOnly(normalizedEmail):
guard let email = CodexIdentityResolver.normalizeEmail(normalizedEmail) else { return nil }
if let accountKey = CodexIdentityResolver.normalizeEmail(refreshGuard.accountKey), accountKey != email {
return nil
}
guard let sourceKey = Self.sourceKey(refreshGuard.source) else { return nil }
// Email-only auth cannot distinguish same-email workspaces. Include the credential fingerprint
// and deliberately establish a new baseline after rotation rather than risk a cross-account alert.
guard let fingerprint = CodexAuthFingerprint.normalize(refreshGuard.authFingerprint) else { return nil }
input = "codex-session-quota-owner:v1\0email\0\(sourceKey)\0\(email)\0\(fingerprint)"
case .unresolved:
return nil
}
let digest = SHA256.hash(data: Data(input.utf8))
self.rawValue = digest.map { String(format: "%02x", $0) }.joined()
}
private static func sourceKey(_ source: CodexActiveSource) -> String? {
switch source {
case .liveSystem:
"live-system"
case let .managedAccount(id):
"managed:\(id.uuidString.lowercased())"
case let .profileHome(path):
CodexHomeScope.normalizedHomePath(path).map { "profile:\($0)" }
}
}
}
extension UsageStore {
func codexLimitResetOwnerKey(
expectedGuard: CodexAccountScopedRefreshGuard,
visibleAccounts _: [CodexVisibleAccount]) -> CodexLimitResetOwnerKey?
{
CodexLimitResetOwnerKey(
identity: expectedGuard.identity,
accountEmail: expectedGuard.accountKey)
}
func codexLimitResetOwnerKey(
forVisibleAccount account: CodexVisibleAccount,
visibleAccounts _: [CodexVisibleAccount]) -> CodexLimitResetOwnerKey?
{
guard let workspaceAccountID = CodexOpenAIWorkspaceResolver.normalizeWorkspaceAccountID(
account.workspaceAccountID)
else { return nil }
return CodexLimitResetOwnerKey(
identity: .providerAccount(id: workspaceAccountID),
accountEmail: account.email)
}
}