Struct CredentialHost 

pub struct CredentialHost { /* private fields */ }

Implementations

impl CredentialHost

pub fn new(store: Arc<dyn CredentialStore>, component: String) -> Self

pub fn with_refresher(self, refresher: Arc<dyn CredentialRefresher>) -> Self

Give this host a way to renew credentials. Without one, a near-expiry credential is served as it is: the alternative — refusing it — would break every component whose upstream issues short-lived tokens, and the host has nothing better to offer.

pub fn component(&self) -> &str

The component reference this host serves — resolve::profile_key of the reference the operator wrote, not the literal spelling. It is the profile namespace — the boundary the whole design rests on (design §2.1) — and it is what a consent prompt must name (design §5.5).

pub fn note_session_opened(&self, id: &str)

pub fn note_session_closed(&self, id: &str)

pub fn get_secret(&self, session: &str, key: &str) -> Result<Secret, HostError>

A hit returns the projection only. The host-only compartment — refresh tokens, issuer binding — never crosses the boundary (design D4).

The caller must have resolved the act:credentials capability decision before getting here: a denial must not depend on whether the key exists, or denied becomes a probing channel (design §3.4).

pub async fn refresh_if_due(&self, key: &str, now: u64)

Renew any field of this credential that is too close to expiry, before it is served.

Silent by design (design §5.4): the component asked for a credential and gets one that works. It never sees a refresh token and never re-opens a session because one expired.

Failure is not fatal. A renewal that cannot happen — no refresher, no issuer recorded, the server refusing — leaves the stored value alone and lets it be served. It may still work: the skew is a margin, not an expiry, and a token inside it is usually still valid. Refusing here would turn a renewal problem into a failed tool call for a credential that was very likely fine, and the component’s own upstream is the thing that actually knows. The attempt is logged; the reason never reaches the guest.

pub fn list_secrets( &self, session: Option<&str>, ) -> Result<Vec<SecretInfo>, HostError>

Metadata only — no value can reach this path, because SecretInfo has no field that could hold one. Deliberately unaudited (design §9): a listing hands over nothing, and recording it would bury the issue records that matter.