Struct BearerAuthInterceptor 

pub struct BearerAuthInterceptor { /* private fields */ }

A CallInterceptor that injects Authorization: Bearer <token> from a TokenProvider before every request.

When the agent answers 401, it calls TokenProvider::invalidate with the token it sent, so a refused token is not sent again. That catches a 401 surfaced as ClientError::UnexpectedStatus, which is how every binding reports it: the gRPC transport maps UNAUTHENTICATED to a 401 for this reason. A 403 (gRPC PERMISSION_DENIED) leaves the token cached, since a caller who is known and not allowed gains nothing from a new one.

Because the token is fetched per request, a provider that refreshes (like OAuth2ClientCredentials) keeps long-lived clients authenticated across token rotations — including on retries, which re-enter the transport below the interceptor chain with the header this interceptor set for the call.

Like AuthInterceptor, it overwrites any authorization header set earlier in the interceptor chain.

Implementations

impl BearerAuthInterceptor

pub fn new(provider: Arc<dyn TokenProvider>) -> Self

Creates an interceptor backed by the given provider.

Trait Implementations

impl CallInterceptor for BearerAuthInterceptor

fn on_error<'a>( &'a self, req: &'a ClientRequest, err: &'a ClientError, ) -> impl Future<Output = ()> + Send + 'a

A 401 from the agent means the token this interceptor attached was refused, so the provider is told to stop serving it. The failing call still fails; the next one gets a fresh token. Other errors say nothing about the token and leave it cached.

fn before<'a>( &'a self, req: &'a mut ClientRequest, ) -> impl Future<Output = ClientResult<()>> + Send + 'a

Called before the request is sent.

fn after<'a>( &'a self, _resp: &'a ClientResponse, ) -> impl Future<Output = ClientResult<()>> + Send + 'a

Called after a successful response is received.

impl Debug for BearerAuthInterceptor

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.