Struct CredentialManager 

pub struct CredentialManager { /* private fields */ }

Resolves AuthConfig into a ready AuthCredential per the 8-step workflow:

1. validate config
2. return immediately if is_ready and not expired
3. try cache: credential_service.load(app, user, key)
4. (preprocessor-stored) auth response (handled at runner layer)
5. authorization-code flow with no exchanged credential → NeedsUserConsent
6. exchange (service-account / authorization-code → access token)
7. refresh if expired
8. save back to credential service

Implementations

impl CredentialManager

pub fn new(config: AuthConfig) -> Self

Construct with default exchangers + refreshers.

pub fn with_registries( config: AuthConfig, exchangers: Arc<ExchangerRegistry>, refreshers: Arc<RefresherRegistry>, providers: Arc<AuthProviderRegistry>, ) -> Self

Construct with explicit registries (override for tests / custom providers).

pub fn credential_key(&self) -> String

The cache key this manager resolves to.

pub fn config(&self) -> &AuthConfig

Borrowed view of the wrapped config.

pub async fn resolve( &self, app: &str, user: &str, credentials: Option<&dyn CredentialService>, ) -> Result<ResolveOutcome>

Run the resolution workflow.

pub async fn begin_consent( &self, credentials: &dyn CredentialService, ) -> Result<ConsentRequest>

Start an OAuth 2.0 authorization-code consent flow.

Generates a fresh CSRF state + PKCE verifier via the oauth2 crate, persists them in credentials keyed by an opaque flow_id, and returns the URL the caller should redirect the user to. After the provider redirects back, call Self::complete_consent with the flow_id, the inbound state, and the inbound authorization code — it will reject any mismatched state, perform the token exchange, and save the resolved credential under the regular cache key.

Requires a credentials service: the verifier and state must outlive the HTTP redirect, so transient None storage isn’t an option here.

pub async fn complete_consent( &self, app: &str, user: &str, flow_id: &str, callback_state: &str, callback_code: &str, credentials: &dyn CredentialService, ) -> Result<AuthCredential>

Complete an OAuth 2.0 authorization-code consent flow.

callback_state and callback_code are the state and code query params received at the provider’s redirect_uri. Validates that callback_state == flow_id (the persisted state), exchanges the code for an access token using the PKCE verifier persisted by begin_consent, and writes the resolved credential under the regular cache key for (app, user). Returns the exchanged credential.

Trait Implementations

impl Debug for CredentialManager

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.