Struct TokenProvider 

pub struct TokenProvider { /* private fields */ }

Fetches and caches an OAuth2 bearer token via the client-credentials grant, refreshing it shortly before expiry. Cloning shares the cache.

Implementations

impl TokenProvider

pub fn new(config: OidcConfig) -> Self

Create a provider for the given OIDC configuration.

Token fetches are bounded by a per-request timeout (see Self::token), so a hung token endpoint can never block callers indefinitely (the fetch holds the cache lock while in flight).

pub async fn invalidate(&self)

Drop the cached token so the next Self::token call fetches a fresh one. Call this after a server rejects a token as expired/invalid so the client can self-heal instead of replaying the stale token.

pub async fn token(&self) -> Result<String>

Return a valid bearer token, fetching or refreshing if the cached one is absent or within the refresh-skew window of expiry.

Concurrent callers that arrive during a refresh serialize behind a single in-flight fetch (single-flight de-duplication), bounded by the HTTP client’s timeout — a slow IdP therefore stalls concurrent token consumers for at most that timeout rather than triggering a fetch storm.

Errors

Returns Error::Auth if the endpoint rejects the credentials (401/403, e.g. invalid_client); Error::Http for other non-success statuses (5xx/429 stay retriable); Error::Connection if the endpoint is unreachable or the fetch times out; Error::Json if the response cannot be parsed.

Trait Implementations

impl Clone for TokenProvider

fn clone(&self) -> TokenProvider

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TokenProvider

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl TokenSource for TokenProvider

Lets a TokenProvider back the SDK’s shared canton_core::Auth without canton-core depending on this crate: Config::with_oidc(provider) stores it as an Arc<dyn TokenSource>.

fn fetch_bearer( &self, ) -> Pin<Box<dyn Future<Output = Result<Option<String>>> + Send + '_>>

Resolve the current bearer token (fetching/refreshing as needed), or None for an unauthenticated call.