cli_engine/auth/
mod.rs

1//! Auth provider abstraction and built-in auth helpers.
2//!
3//! Consumer CLIs normally register one or more [`AuthProvider`] implementations
4//! with [`crate::CliConfig`]. Middleware then resolves credentials before
5//! business logic runs and passes a [`Credential`] to command handlers.
6//!
7//! The module also contains an [`crate::auth::exec::ExecProvider`] for provider
8//! binaries that speak the JSON stdin/stdout contract.
9//!
10//! When the `pkce-auth` feature is enabled, `pkce::PkceAuthProvider` adds a
11//! built-in browser-based OAuth 2.0 PKCE flow with system keychain storage.
12
13/// Built-in `auth login`, `auth status`, and `auth logout` command helpers.
14pub mod commands;
15mod credential;
16mod dispatcher;
17/// External process auth provider implementation.
18pub mod exec;
19/// OAuth 2.0 PKCE auth provider (requires the `pkce-auth` feature).
20#[cfg(feature = "pkce-auth")]
21pub mod pkce;
22
23use async_trait::async_trait;
24
25pub use commands::{
26    AuthLoginResult, AuthStatusEntry, auth_command_group, login_and_build, logout_result,
27    status_result, to_status_entry,
28};
29pub use credential::{CACHE_TTL, Credential};
30pub use dispatcher::{Dispatcher, SingleProvider, StatusEntry};
31pub use exec::{
32    ACTION_AUTHENTICATE, ACTION_LIST_ENVIRONMENTS, ACTION_LIST_REALMS, ACTION_LOGOUT,
33    ACTION_STATUS, AuthnRequest, EnvironmentsResponse, ExecProvider,
34};
35
36use crate::Result;
37
38#[async_trait]
39/// Named auth provider used by middleware and transport injectors.
40///
41/// Implementations own their credential cache strategy. The framework only
42/// routes calls and passes command context (`env`, colon command path, and tier).
43pub trait AuthProvider: Send + Sync + std::fmt::Debug {
44    /// Stable provider registration name, for example `primary` or `oauth`.
45    fn name(&self) -> &str;
46
47    /// Returns a credential for `env`, `command`, and `tier`.
48    async fn get_credential(&self, env: &str, command: &str, tier: &str) -> Result<Credential>;
49
50    /// Returns cached credential status for one environment.
51    async fn status(&self, env: &str) -> Result<Credential>;
52
53    /// Clears cached credentials for one environment.
54    async fn logout(&self, env: &str) -> Result<()>;
55
56    /// Lists environments with cached credentials.
57    async fn list_environments(&self) -> Result<Vec<String>>;
58}
cli_engine/auth/mod.rs

cli_engine/auth/
mod.rs
