Struct AuthProvider 

pub struct AuthProvider { /* private fields */ }

Provides API key retrieval and HTTP request authentication for the CLI.

API key resolution order:

1. Environment variable APCORE_AUTH_API_KEY
2. Config resolver auth.api_key field (may be keyring: or enc: prefixed)
3. Return None if neither is present.

Audit D1-006 parity (v0.6.x): the optional encryptor injection slot mirrors the TypeScript AuthProvider(config, encryptor?) constructor. When omitted, a fresh ConfigEncryptor is constructed lazily on first keyring/enc lookup.

Implementations

impl AuthProvider

pub fn new(config: ConfigResolver) -> Self

Create a new AuthProvider with the given configuration resolver. The encryptor is constructed lazily on first keyring/enc lookup.

pub fn with_encryptor( config: ConfigResolver, encryptor: ConfigEncryptor, ) -> Self

Create a new AuthProvider with an explicit ConfigEncryptor. Useful for tests that want to inject a new_forced_aes() instance.

pub fn get_api_key(&self) -> Result<Option<String>, AuthenticationError>

Retrieve the API key using the resolution order above.

Returns Ok(None) when no key is configured, Ok(Some(key)) on success, or Err(DecryptionFailed) when a stored encrypted key cannot be decoded — distinguishes “not configured” from “stored key is corrupt”, which matters for user diagnostics.

pub fn authenticate_request( &self, headers: HashMap<String, String>, ) -> Result<HashMap<String, String>, AuthenticationError>

Add the Authorization header to the given headers map and return it.

Spec (SEC-02) cross-SDK contract: “On success: the input headers dict with Authorization added”. Takes ownership of the map, augments it, and returns it — matching Python’s mutate-and-return semantics. Callers who need to keep the original map should clone before passing.

Errors

• AuthenticationError::MissingApiKey — no key is configured.
• AuthenticationError::DecryptionFailed — stored key cannot be decrypted.
• AuthenticationError::MalformedApiKey — key contains CR/LF that HTTP rejects.

pub fn apply_to_reqwest( &self, builder: RequestBuilder, ) -> Result<RequestBuilder, AuthenticationError>

Inject the Authorization header into a reqwest::RequestBuilder.

Convenience adapter over authenticate_request for reqwest-based callers.

pub fn check_status_code(&self, status: u16) -> Result<(), AuthenticationError>

Check an HTTP status code for authentication errors.

Returns Ok(()) for non-auth-error codes, Err(InvalidApiKey) for 401/403. This is the testable core of handle_response.

pub fn handle_response( &self, response: Response, ) -> Result<Response, AuthenticationError>

Inspect an HTTP response for 401/403 codes and raise the appropriate error.

Returns the response unchanged if authentication succeeded.