Trait Credential

Source

pub trait Credential: Send + Sync {
    // Required method
    fn token(&self) -> Result<String, CredentialError>;

    // Provided methods
    fn discard_rejected_token(&self, _rejected_token: &str) { ... }
    fn token_after_rejection(
        &self,
    ) -> Option<Pin<Box<dyn Future<Output = Result<String, CredentialError>> + Send + '_>>> { ... }
}

Expand description

Supplies the current bearer token before each Dex request.

Return the bare token without a Bearer prefix. Implementations may be called concurrently. The synchronous call can run on a Tokio worker thread; it must return promptly without network I/O. A call deadline cannot interrupt a blocked implementation. Sources requiring slow I/O should refresh in the background and return a cached token. An error fails the request locally with gRPC Unauthenticated. Pull Worker streams evaluate the token when each stream opens; a failed open normally backs off for about one minute. An API-key credential can reconnect once immediately after a token rejection. The token travels over the configured FlowService connection. Enable crate::FlowServiceTlsOptions to protect it on the network.

use std::sync::{Arc, RwLock};
use dex_sdk::{ClientOptions, Credential, CredentialError};
struct RotatingCredential { current: RwLock<Option<String>> }
impl Credential for RotatingCredential {
    fn token(&self) -> Result<String, CredentialError> {
        self.current.read()
            .map_err(|_| CredentialError::new("credential lock poisoned"))?
            .clone()
            .ok_or_else(|| CredentialError::new("token unavailable"))
    }
}
let credential = Arc::new(RotatingCredential {
    current: RwLock::new(Some("example-token".to_string())),
});
let client_options = ClientOptions::new().credential(credential);

Required Methods§

Source

fn token(&self) -> Result<String, CredentialError>

Returns the current bare token, or an error that fails the request locally.

Implementations must be safe for concurrent synchronous calls and return promptly. Do not include the Bearer prefix. A credential failure maps to gRPC Unauthenticated without contacting Dex.

Provided Methods§

Source

fn discard_rejected_token(&self, _rejected_token: &str)

Discards a token rejected by Dex if it is still the credential’s cached token.

The default does nothing, keeping existing credential implementations compatible. Sources that cache tokens can compare rejected_token with their current token before invalidating it. Worker streams call this on rejection and reconnect once immediately when refresh is supported. The SDK never logs this value.

Source

fn token_after_rejection( &self, ) -> Option<Pin<Box<dyn Future<Output = Result<String, CredentialError>> + Send + '_>>>

Supplies an asynchronous fresh token after rejection when supported.

The default returns None, so existing credentials continue handling rejection as before. An API-key credential returns a future bounded by its exchange timeout. The SDK uses this for one unary retry or one immediate Worker stream reconnect after Self::discard_rejected_token. Implementations must avoid returning the rejected token. Errors fail the attempt without exposing token contents.