Enum Auth 

pub enum Auth {
    Session(SessionAuth),
    Oauth(OauthPlaceholder),
    Anonymous,
}

The auth material a PdsClient carries.

A small enum rather than a bare string, so the match stays exhaustive if a second direct-auth mechanism is added alongside app-password sessions.

Variants

Session(SessionAuth)

A bearer access token from a com.atproto.server.createSession (app-password) session. This is the direct-PDS auth used by local runs and tests; the live web path authenticates via the OAuth sidecar instead (see SidecarClient).

Oauth(OauthPlaceholder)

The atproto OAuth confidential-client path is handled entirely by the @atproto/oauth-client sidecar (SidecarClient), which mints, DPoP-binds, and refreshes tokens. The direct PdsClient does not carry OAuth tokens; this variant is a placeholder so the Auth enum documents that the OAuth path lives elsewhere.

Anonymous

No credentials at all — an unauthenticated public read of a repo the caller does not own. com.atproto.repo.listRecords is public on a standard PDS, so a stranger’s community.lexicon.rss.* records can be read with no session; this variant makes that expressible without inventing a fake token.

A client holding it is read-only: Auth::bearer returns an error, so every write path (create_record / put_record / delete_record / apply_writes, all of which go through authed_headers) fails closed. Construct one via PdsClient::anonymous.

Implementations

impl Auth

pub fn bearer(&self) -> Result<&str>

The bearer access token to present on com.atproto.repo.* calls.

Only Auth::Session carries a token (the session’s accessJwt). Auth::Oauth carries none — the sidecar owns the OAuth path — so it returns an error pointing callers at SidecarClient. Auth::Anonymous carries none by construction, which is what makes an anonymous client read-only.

Trait Implementations

impl Clone for Auth

fn clone(&self) -> Auth

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.