Module auth 

The credential store: API keys drep holds on the user’s behalf.

drep.toml is a repository file. It names an endpoint, a model and a protocol, all of which are shareable, and it is meant to survive being committed - which is why api_key = "${VAR}" names an environment variable rather than holding a secret. That indirection is the right answer for CI, where the key arrives as a secret and nobody is at a keyboard, and the wrong answer for a person setting drep up on their laptop: it makes the first-run experience “now go and export something into the right shell profile”.

So keys live here instead, once per machine, outside any repository:

~/.config/drep/auth.toml     (macOS: ~/Library/Application Support/dev.slb350.drep)

Keyed by endpoint, not by provider name

A key authenticates a host, so the endpoint is what it belongs to. Keying by a preset name instead would mean a config that named no preset - a custom endpoint, or one edited by hand after drep init - could not find its own credential, and two presets pointed at the same host would each need their own copy of one key.

The endpoint is normalised before use (see normalise) so a trailing slash or a difference in case does not hide a key from the config that stored it.

There is deliberately no load_default/save_default pair. Both were thin wrappers over default_path(), which reads the environment - so nothing could test them without std::env::set_var, and the mutation gate found them undetectable. Every caller resolves the path once, at its own entry point, and passes it down; that is also what keeps tests off the real store.

Resolution order

resolve fills in what drep.toml left unset, and an explicit value in the file always wins. A user who writes api_key = "${OPENROUTER_API_KEY}" has said where the key comes from, and silently preferring a stored one would make the file lie about what the run used.

Structs

AuthStore

Keys held for this machine, keyed by normalised endpoint.

Enums

AuthError

What can go wrong reading or writing the store.

KeySource

Where a provider’s key came from, for doctor to report.

Constants

PATH_VAR

The environment variable that relocates the store.

Functions

default_path

The store location: PATH_VAR if set, else the platform’s config dir.

normalise

Canonical form of an endpoint for use as a store key.

path_from

default_path with the override supplied rather than read.

resolve

Fill in keys the config left unset, and report where each one came from.

source_of

Where a provider’s key will come from, given what its config names.