Enum TokenOp 

pub enum TokenOp {
    Issue {
        ttl_hours: i64,
        label: String,
        account: Option<String>,
        max_requests: Option<u64>,
        max_tokens: Option<u64>,
        rate_limit_per_minute: Option<u64>,
        admin: bool,
        github_repo: Vec<String>,
        target: AuthTarget,
    },
    Rotate {
        id: String,
        ttl_hours: i64,
        label: String,
        max_requests: Option<u64>,
        max_tokens: Option<u64>,
        rate_limit_per_minute: Option<u64>,
        account: Option<String>,
        target: AuthTarget,
    },
    List {
        json: bool,
        target: AuthTarget,
    },
    Revoke {
        id: String,
        target: AuthTarget,
    },
    Expire {
        id: String,
        target: AuthTarget,
    },
    Show {
        id: String,
        json: bool,
        target: AuthTarget,
    },
    RecoverAdmin {
        revoke_others: bool,
        ttl_hours: i64,
        label: String,
        json: bool,
        target: AuthTarget,
    },
}

Variants

Issue

Issue a new token and print it to stdout.

create and add are accepted too: creating something was tokens issue, providers add and clients setup — three verbs for one idea (issue #314).

Fields

ttl_hours: i64

label: String

account: Option<String>

max_requests: Option<u64>

Cap on the number of upstream requests this token may make. Omit for an unlimited token.

max_tokens: Option<u64>

Cap on actual input plus output tokens reported by upstreams. Omit for unlimited spend.

rate_limit_per_minute: Option<u64>

Maximum requests admitted per one-minute window.

admin: bool

Issue an administrative token (scope: admin) that unlocks the admin endpoints instead of only the inference proxy.

github_repo: Vec<String>

Restrict this token’s GitHub proxy access to owner/repo. Repeat for several repositories; omit for unrestricted access, which is the default and what every existing token keeps.

target: AuthTarget

Rotate

Replace a token, preserving its controls, and revoke the old token.

Fields

id: String

Subject id (sub) of the token being replaced.

ttl_hours: i64

label: String

max_requests: Option<u64>

Replacement request cap; omitted keeps the existing one.

max_tokens: Option<u64>

Replacement token spend cap; omitted keeps the existing one.

rate_limit_per_minute: Option<u64>

Replacement per-minute request rate; omitted keeps the existing one.

account: Option<String>

Replacement account pin; omitted keeps the existing one.

target: AuthTarget

List

List all known tokens.

Fields

json: bool

Emit JSON instead of the table.

Every list printed a table unconditionally and every show printed JSON unconditionally, so neither could be asked for the other form — and --json existed on two subcommands only (issue #314).

target: AuthTarget

Revoke

Revoke a token by id.

remove and delete are accepted too: destroying something was providers remove, clients remove, server remove, tokens revoke and tokens expire (issue #314).

Fields

id: String

target: AuthTarget

Expire

Revoke a token by id — an alias of revoke, kept for scripts.

Both arms have always collapsed into the same call and printed revoked <ID>, while the help promised a distinct operation (issue #314). It is documented as the alias it is.

Fields

id: String

target: AuthTarget

Show

Show metadata for one token.

Fields

id: String

json: bool

Accepted for symmetry with list: show already emits JSON, so this changes nothing (issue #314). A script should not have to know which verb of a family takes the flag.

target: AuthTarget

RecoverAdmin

Mint a replacement administrative token from the local token store.

The recovery path for a lost admin token. Every other verb in this family authenticates with the admin credential, so losing it left an operator who still owned the store, the volume and the machine with no way back in — and the standing advice was to destroy the deployment and discard every issued client token and the whole request log to recover from having misplaced one string (issue #573).

The admin token is a signed JWT and the store keeps only its metadata, so the lost value cannot be re-read. What can be done is to sign a new one: this reads TOKEN_SECRET and the store directly, exactly as the server does at boot, and mints an admin token the running deployment already accepts — no restart, and issued client tokens, provider configuration and the request log are untouched.

Gated on local ownership rather than on a credential. Reading the store is already equivalent to full control of the deployment, so this grants no authority its caller lacks; it only makes existing authority usable. For that reason it is never available over HTTP: with another router selected it refuses and names the machine it would have acted on, the same boundary auth import and auth clear draw.

Fields

revoke_others: bool

Revoke every other admin token once the replacement is minted.

For a credential believed to be in someone else’s hands: recovery alone adds an administrator without removing the lost one.

ttl_hours: i64

label: String

json: bool

Emit the stable JSON envelope instead of human-readable output.

target: AuthTarget

Implementations

impl TokenOp

pub const fn target(&self) -> &AuthTarget

Which router this token operation acts on.

Trait Implementations

impl Debug for TokenOp

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromArgMatches for TokenOp

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut<'b>( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Subcommand for TokenOp

fn augment_subcommands<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_subcommands_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

fn has_subcommand(__clap_name: &str) -> bool

Test whether Self can parse a specific subcommand