Module refresh_source 

Renewing TokenSource — refresh-grant + rotated-token persistence

A RefreshTokenSource is a ppoppo_sdk_core::token_cache::TokenSource for clients that hold a durable refresh token and want a ppoppo_sdk_core::token_cache::TokenCache to renew the access token on its own: on cache lapse the cache calls TokenSource::fetch_token, which runs the OAuth refresh_token grant, persists the rotated refresh token (PAS applies RTR — RFC 9700 §2.2.2 — so every refresh returns a new token), and hands back the fresh access token + its TTL.

The persistence seam is TokenStore: the consumer plugs its keystore — CNC uses the macOS Keychain; a short-lived process can use MemoryTokenStore. RCW/CTW do not use this type — their OIDC RP flow refreshes per request and re-stores inline; this is for native / CLI clients that feed a long-lived TokenCache.

The Send discipline

TokenStore and TokenSource are #[async_trait] (their futures are boxed + Send), and crate::pas_port::PasAuthPort::refresh is + Send. So RefreshTokenSource’s fetch_token future is Send by construction — the impl only compiles if its body holds Send values across every await. Never introduce an async closure on this path: it carries a higher-ranked lifetime whose Send-ness fails to prove on a multi-threaded runtime (the yanked-0.5.2 lesson). A #[tokio::test(flavor = "multi_thread")] that spawns the future guards it.

Structs

MemoryTokenStore

An ephemeral in-memory TokenStore — a reference adapter and test double.

RefreshTokenSource

A renewing TokenSource: mints access tokens via the OAuth refresh_token grant and persists the rotated refresh token through a TokenStore.

TokenStoreError

A TokenStore backend error. Consumers wrap their native keystore error in the message; it is tunnelled through TokenCacheError::Source so the SDK layer can surface it intact.

Traits

TokenStore

Durable persistence seam for a rotated refresh token. All methods are Send-safe for multi-threaded runtimes.