Struct AuthManager 

pub struct AuthManager { /* private fields */ }

Manages OIDC discovery, token exchange, and the DPoP flow.

Implementations

impl AuthManager

pub async fn discover( oidc_config: OidcConfig, resource: String, vault: Vault, resource_metadata_url: Option<&str>, ) -> Result<Self>

Resolves the authorization server endpoints for resource.

resource_metadata_url is the (already validated) RFC 9728 metadata URL taken from a WWW-Authenticate challenge, if any.

pub async fn set_internal_url_tx(&self, tx: Sender<String>)

Delivers the next authorization URL to tx instead of opening a browser (for automation and tests).

pub async fn set_internal_callback_tx(&self, tx: Sender<SocketAddr>)

Reports the address the next loopback callback server binds to.

pub async fn reauthenticate( &self, user_id: &str, scopes: Option<Vec<String>>, url_tx: Option<Sender<String>>, ) -> Result<()>

Full re-authentication flow: PAR -> Loopback Callback -> Token Exchange

pub async fn refresh(&self, user_id: &str) -> Result<bool>

Renews the access token with the stored refresh token (RFC 6749 §6), without user interaction.

Returns Ok(false) when there is nothing to refresh with or the authorization server rejects the refresh token (which is then deleted), so the caller can fall back to the interactive flow.

pub fn enforce_issuer_binding(&self, user_id: &str) -> Result<()>

Discards stored credentials issued by a different authorization server than the one discovered now. Credentials are bound to their issuer.

pub fn get_token(&self, user_id: &str) -> Result<Option<String>>

Retrieves the current access token for a user from the vault.

Trait Implementations

impl Clone for AuthManager

fn clone(&self) -> AuthManager

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.