Struct AuthStorage 

pub struct AuthStorage { /* private fields */ }

Main auth storage struct.

Provides multi-layered credential lookup with the following priority:

1. Runtime override (CLI –api-key)
2. Stored API key from auth.json
3. OAuth token from auth.json (with auto-refresh awareness)
4. Session token from auth.json
5. Environment variable
6. Fallback resolver (e.g., custom provider config from models.json)

Implementations

impl AuthStorage

pub fn new() -> AuthStorage

Create a new auth storage with default file backend

pub fn with_backend(backend: impl AuthStorageBackend + 'static) -> AuthStorage

Create with explicit storage backend

pub fn in_memory() -> AuthStorage

Create a memory-only storage (for testing)

pub fn default_path() -> Option<PathBuf>

Get the default auth file path

pub fn set_runtime_key(&self, provider: &str, api_key: String)

Set a runtime API key override (from CLI –api-key)

pub fn remove_runtime_key(&self, provider: &str)

Remove a runtime override

pub fn set_fallback_resolver(&self, resolver: Arc<dyn FallbackResolver>)

Set a fallback resolver for API keys not found in auth.json or env vars. Used for custom provider keys from models.json.

pub fn clear_fallback_resolver(&self)

Clear the fallback resolver

pub fn has_auth(&self, provider: &str) -> bool

Check if a provider has any auth configured

pub fn get_status(&self, provider: &str) -> AuthStatus

Get auth status for a provider (without exposing credentials)

pub fn get_api_key(&self, provider: &str) -> Option<String>

Get API key for a provider.

Priority:

1. Runtime override (CLI –api-key)
2. Stored API key from auth.json
3. OAuth token from auth.json (auto-refreshed)
4. Session token from auth.json
5. Fallback resolver

pub fn get_api_key_with_options( &self, provider: &str, include_fallback: bool, ) -> Option<String>

Get API key with option to include/exclude fallback resolver

pub fn set_api_key(&self, provider: &str, key: String)

Set API key for a provider

pub fn set_oauth( &self, provider: &str, access_token: String, refresh_token: Option<String>, expires_at: u64, )

Set OAuth credential for a provider

pub fn set_oauth_full( &self, provider: &str, access_token: String, refresh_token: Option<String>, expires_at: u64, scopes: Option<String>, provider_data: Option<Value>, )

Set OAuth credential with full details

pub fn set_session( &self, provider: &str, token: String, expires_at: u64, metadata: Option<Value>, )

Set session token for a provider

pub fn update_oauth_tokens( &self, provider: &str, new_access_token: String, new_refresh_token: Option<String>, new_expires_at: u64, ) -> Result<(), AuthError>

Update an existing OAuth credential (for token refresh)

pub fn get(&self, provider: &str) -> Option<AuthCredential>

Get credential for a provider

pub fn get_oauth_credential(&self, provider: &str) -> Option<AuthCredential>

Get OAuth credential for a provider (for token refresh)

pub fn has_oauth_with_refresh(&self, provider: &str) -> bool

Check if a provider has OAuth credentials that can be refreshed

pub fn set(&self, provider: &str, credential: AuthCredential)

Set a credential for a provider

pub fn remove(&self, provider: &str)

Remove credential for a provider

pub fn list_providers(&self) -> Vec<String>

List all providers with credentials

pub fn has(&self, provider: &str) -> bool

Check if credential exists for provider in storage

pub fn get_all(&self) -> HashMap<String, AuthCredential>

Get all credentials

pub fn clear(&self)

Clear all stored credentials

pub fn reload(&self)

Reload from disk

pub fn drain_errors(&self) -> Vec<AuthError>

Drain collected errors

pub fn load_error(&self) -> Option<AuthError>

Get the last load error

pub fn validate_all(&self) -> Vec<(String, CredentialValidationError)>

Validate all stored credentials

pub fn validate(&self, provider: &str) -> Result<(), CredentialValidationError>

Validate credential for a specific provider

pub fn configured_providers(&self) -> Vec<String>

Get all configured provider IDs (sorted)

pub fn has_multiple_providers(&self) -> bool

Check if multiple providers are configured

pub fn primary_provider(&self) -> Option<String>

Get the primary provider (first configured, preferring stored over env)

pub fn migrate_provider(&self, from: &str, to: &str) -> Result<(), AuthError>

Migrate credentials from one provider to another

Trait Implementations

impl Default for AuthStorage

fn default() -> AuthStorage

Returns the “default value” for a type.