Module auth_storage 

Authentication storage for API keys, OAuth tokens, and session tokens.

Storage model (F-1, code audit 2026-07-25)

Credentials are stored as a plaintext JSON file at ~/.oxicode/auth.json with Unix 0600 permissions — not encrypted at rest. This matches the convention used by aws-cli, gh, kubectl, and npm, all of which store secrets as mode-0600 plaintext on the local disk. Secret fields are masked in std::fmt::Debug output (see the manual Debug impl on AuthCredential) so tracing::debug!/dbg!/panic backtraces never echo raw keys. An OS-keyring backend is the planned hardening upgrade; the #[cfg(feature = "keyring")] helpers below are its scaffolding.

Modules

keyring_supportDeprecated

OS-keyring credential helpers. Currently stubbed because the keyring cargo feature is not enabled (see F-4 audit note above).

Structs

AuthStatus

Authentication status

AuthStorage

Main auth storage struct.

EnvVarFallbackResolver

Environment variable fallback resolver.

FileAuthStorage

File-based auth storage backend

FnFallbackResolver

A simple closure-based fallback resolver

MemoryAuthStorage

Memory-based auth storage (for testing)

Enums

AuthCredential

Authentication credential

AuthError

Authentication errors

CredentialValidationError

Credential validation error

Traits

AuthStorageBackend

Storage backend trait

FallbackResolver

Trait for fallback API key resolution (e.g., from models.json config)

Functions

shared_auth_storage

Get a shared singleton Arc<AuthStorage> instance.

Type Aliases

AuthResult

Result of an auth operation