Struct CredentialResolver 

pub struct CredentialResolver { /* private fields */ }

Resolves the credential for a single command invocation, memoizing the result.

Resolution — including any interactive browser/OAuth flow — runs once for a given scope set: a handler and an authorizer that both ask share a single resolution, and the engine resolves it up front for AuthRequirement::Required commands. For Optional commands resolution is deferred until a handler or authorizer calls resolve or try_resolve, and --schema/--dry-run short-circuit before any resolution happens.

resolve_with_scopes may trigger an additional resolution when it needs scopes the memoized credential does not yet cover (OAuth scope step-up); a scope-aware provider then re-authenticates for the wider set. Resolutions are serialized, so concurrent callers never launch overlapping interactive flows.

The resolved credential is memoized: callers that need no new scopes share a single resolution. Clones share the same underlying state, so the engine can observe (via peek) whatever a handler resolved.

Implementations

impl CredentialResolver

pub async fn resolve(&self) -> Result<Credential>

Resolves the credential, memoizing the result after the first success.

Errors

Returns an error when the command is marked no_auth (such commands have no credential), or when the auth provider fails to produce one.

pub async fn resolve_with_scopes(&self, extra: &[String]) -> Result<Credential>

Resolves a credential that additionally covers extra scopes (on top of the command’s declared CommandMeta::scopes).

Used by handlers whose required scopes are only known at runtime (for example a generic api call that derives scopes from the target endpoint). A scope-aware auth provider re-authenticates when the cached token does not already cover the requested set.

Ordering with the transport injector

The HTTP transport’s bearer injector resolves its token through the provider’s scope-unaware path and caches the first token it sees for the injector’s lifetime. So when a handler both steps up scopes and makes HTTP calls through that injector, call resolve_with_scopes (or CommandContext::credential_with_scopes) before the first request: that populates the provider cache with the wider-scoped token, which the injector then picks up. Resolving after the injector’s first inject would send the narrower token.

Errors

Returns an error when the command is marked no_auth, or when the auth provider fails to produce a credential.

pub async fn try_resolve(&self) -> Result<Option<Credential>>

Resolves the credential when one is available.

Returns Ok(None) for no-auth commands, Ok(Some(_)) on success, and propagates the provider error on failure. Use this for commands whose auth is genuinely optional; most commands should call resolve instead.

Errors

Propagates the auth provider error when resolution is attempted and fails.

pub fn peek(&self) -> Option<&Credential>

Returns the memoized credential without triggering resolution.

Yields None until something resolves the credential. Used by the engine to record identity in audit/activity output after a handler runs.

Trait Implementations

impl Clone for CredentialResolver

fn clone(&self) -> CredentialResolver

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CredentialResolver

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.