[v12] Stop using TokenPath for API key in Assist (#26671)

api/proto/teleport/legacy/types/types.proto

@@ -5100,13 +5100,8 @@ message PluginBearerTokenCredentials {
   // Token is the literal bearer token to be submitted to the 3rd-party API provider.
   string token = 1;
 
-  // TokenFile is a path to the local file containing a bearer token.
-  // This takes precedence over Token, and is currently only used by
-  // OpenAI plugin in Cloud, where by default a Teleport-owned key is used.
-  // This avoids exposing the token itself to the cluster.
-  // The file must exist and be readable on whatever runs the plugin
-  // (in the OpenAI case, it is the Proxy).
-  string token_file = 2;
+  reserved 2; // token_file
+  reserved "token_file";
 }
 
 // PluginList represents a list of plugin resources

api/types/plugin.go

@@ -108,8 +108,8 @@ func (p *PluginV1) CheckAndSetDefaults() error {
 		if bearer == nil {
 			return trace.BadParameter("openai plugin must be used with the bearer token credential type")
 		}
-		if (bearer.Token == "") == (bearer.TokenFile == "") {
-			return trace.BadParameter("exactly one of Token and TokenFile must be specified")
+		if bearer.Token == "" {
+			return trace.BadParameter("Token must be specified")
 		}
 	default:
 		return trace.BadParameter("settings are not set or have an unknown type")

api/types/plugin_test.go

@@ -99,19 +99,6 @@ func TestPluginOpenAIValidation(t *testing.T) {
 				require.NoError(t, err)
 			},
 		},
-		{
-			name: "valid credentials (token file)",
-			creds: &PluginCredentialsV1{
-				Credentials: &PluginCredentialsV1_BearerToken{
-					BearerToken: &PluginBearerTokenCredentials{
-						TokenFile: "/var/lib/secrets/openai_token",
-					},
-				},
-			},
-			assertErr: func(t require.TestingT, err error, args ...any) {
-				require.NoError(t, err)
-			},
-		},
 	}
 
 	for _, tc := range testCases {