Module auth 

Silicon Accounts sign-in for Commit’s own tools.

Commit’s CLI (or any tool of Commit’s that runs on someone’s machine) is a public client at Silicon Accounts: it holds no app secret, only Commit’s app id. A Carbon signs in with the device flow (approve a code on the account site); a Silicon hands over a short-lived token (slt_…) it minted with silicon-accounts login --app commit -q. Both return Commit’s tokens: an access token (30 minutes, aud = commit) and a refresh token that rotates on every use. Presenting a used refresh token ends the whole sign-in, so refresh one at a time and store the new pair before using it.

This module is stateless like the rest of the crate: callers decide where tokens live.

Structs

AccountLink

A reference to another account: its permanent uuid and current id.

AccountsAuth

Signs Carbons and Silicons in to Commit at Silicon Accounts, without an app secret.

AccountsAuthBuilder

Builder for AccountsAuth.

Claims

The claims of a Silicon Accounts access token.

DeviceAuthorization

POST /v1/device/authorize: show user_code and verification_uri to the Carbon, then poll with the device code.

Revocation

The answer of a revocation.

SignIn

A finished sign-in: Commit’s tokens and the account they belong to.

SignedInAccount

The account a sign-in belongs to, as Silicon Accounts shows it to Commit.

Enums

AccountKind

Whether an account belongs to a Carbon or a Silicon.

DeviceEvent

What AccountsAuth::wait_for_device_sign_in reports between polls.

DeviceStatus

One poll of a device sign-in.

SignInRefusal

Why Silicon Accounts refused a short-lived token or refresh token (invalid_grant), from its description. None when the error is not such a refusal.

Constants

APP_ID

Commit’s app id at Silicon Accounts.

DEFAULT_ACCOUNTS_URL

The production Silicon Accounts URL.

Functions

peek_claims

Reads an access token’s claims WITHOUT verifying it: for display only (which account, which app, until when). Never authorize anything with the result; Commit verifies every token itself. None when the value is not a JWT.