Struct BackendCredentials 

pub struct BackendCredentials {
    pub access_key_id: String,
    pub secret_access_key: String,
    pub session_token: String,
    pub expiration: DateTime<Utc>,
}

The backend credential value type — its fields, secret-redacting Debug, and BucketConfig injection (BackendCredentials::apply_to) — is owned by multistore core (next to the BucketConfig it injects into, and its sibling TemporaryCredentials). It is re-exported here so this crate is the single front door: callers import the type from multistore-oidc-provider and need not name core’s types module.

Bearer-only backends (Azure/GCP) leave access_key_id/secret_access_key empty and carry the token in session_token. Short-lived credentials obtained by federating the proxy’s OIDC identity into a backend cloud’s STS (e.g. AWS AssumeRoleWithWebIdentity), used to sign requests to the backend object store.

Distinct from TemporaryCredentials, which the proxy’s own STS mints for callers: those carry the proxy’s authorization model (allowed_scopes, assumed_role_id, source_identity), whereas these carry only what an object-store client needs to sign, plus the expiry so the caller can cache and refresh them.

Fields

access_key_id: String

Temporary access key id (AWS ASIA…).

secret_access_key: String

Temporary secret access key.

session_token: String

Session token that must accompany requests using these credentials.

expiration: DateTime<Utc>

When these credentials expire.

Implementations

impl BackendCredentials

pub fn apply_to(&self, config: &mut BucketConfig)

Inject these credentials into a BucketConfig so the multistore backend signs requests with them instead of going anonymous.

Sets the canonical S3 option keys (access_key_id, secret_access_key, and token — the alias object_store maps to the session token and that BucketConfig’s Debug redacts) and clears skip_signature so the backend signs.

This governs only outbound (backend) signing. It deliberately leaves BucketConfig::anonymous_access untouched: that flag controls inbound authorization (whether proxy callers may read the bucket unauthenticated), which is orthogonal — a bucket can be public to anonymous callers yet served from a private backend the proxy signs into.

Trait Implementations

impl Clone for BackendCredentials

fn clone(&self) -> BackendCredentials

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for BackendCredentials

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.