Module ui_auth 

Credential handoff for red ui (issue #1048, PRD #1041; ADR 0051 auth model, ADR 0036 handshake auth).

When the user supplies a token, red owns it and the UI never sees it:

• Served-UI path (red ui <uri> --token <X>): the token is held in this process and presented in the RedWire handshake (ADR 0036 bearer) by the loopback bridge — the UI runs in injected-auth mode and never sees or persists the secret. The injection itself lives in super::ui_bridge; this module owns the mode decision and the credential-free config snippet served into the page.
• Deep-link / desktop path: the token crosses via a local secret channel — a one-time loopback fetch keyed by a single-use nonce (OneTimeSecret + spawn_handoff_server). The dispatched deep-link URL carries only the nonce/handoff URL, never the secret, so nothing lands in ps, shell history, or URL logs.

The database’s auth configuration is the source of truth for whether the UI prompts (UiAuthMode::resolve): an authenticated DB with no supplied token → the UI prompts via its own connect flow; an unauthenticated DB → no prompt.

Structs

HandoffServer

A running loopback server that hands the held credential to the desktop app exactly once, keyed by a single-use nonce. The deep-link URL carries only Self::handoff_url (host/port + nonce) — never the secret — so nothing sensitive lands in ps, shell history, or URL logs.

OneTimeSecret

A credential that can be fetched exactly once. The desktop app fetches it from the loopback handoff endpoint; a second fetch (a replay, or a stray request) gets nothing. Thread-safe so the handoff server’s handler and the waiting CLI can share it.

Enums

UiAuthMode

What the served UI should do about authentication, decided by red from the database’s auth configuration and whether a token was supplied. The mode is injected into the page (credential-free) so the UI knows whether to prompt without ever holding the secret itself.

Functions

auth_mode_config_snippet

Build the <script> snippet that tells the served page which auth mode to run in. Never carries the token — only the mode hint. Injected before </head> by the bridge’s static-file handler.

inject_auth_mode_config

Insert auth_mode_config_snippet just before </head> in an HTML document. Returns the original bytes unchanged when </head> is absent. The mode string is a fixed enum rendering (no "/\), so plain interpolation is safe.

new_handoff_nonce

A single-use nonce, hex-encoded from 16 bytes of OS CSPRNG. Used to key the one-time loopback handoff so the deep-link URL can carry the nonce (a throwaway lookup key) instead of the secret.

spawn_handoff_server

Bind a loopback handoff server holding token, retrievable once via the nonce-keyed path. Returns once the listener is bound. Must be called from within a tokio runtime.