Struct HttpWidgetAuth 

pub struct HttpWidgetAuth { /* private fields */ }

HTTP-backed provider: resolves agentId → AgentWidgetAuth by GETting {base_url}/{agentId} from a host’s policy service, with TTL caching.

This is the generic mechanism a host installs instead of writing a custom WidgetAuthProvider: stand up an endpoint that returns the AgentWidgetAuth JSON ({ "allowed_origins": [...], "public_key": "..." }) for an agent, point HttpWidgetAuth at it, and embed-auth is enforced against live data. (SmooAI backs this with an api-prime route over its agent DB.)

Response handling — chosen so a flaky policy service never silently opens a hole:

• 2xx → parse + cache the policy.
• 404 → cache None (the agent legitimately has no policy; in WIDGET_AUTH_STRICT the server then denies it).
• 5xx / network / malformed body → return None without caching, so the next connect retries. Combined with strict mode this fails closed; in permissive mode enforcement is off anyway.

Cached results (incl. 404s) are reused for ttl (default 60s) so a busy embed doesn’t hammer the policy service on every WebSocket connect.

Implementations

impl HttpWidgetAuth

pub fn new(base_url: impl Into<String>) -> Self

Build a provider that resolves policies from base_url (e.g. https://api.smoo.ai/internal/widget-auth). Uses a client with a 5s timeout so a hung policy service can’t stall widget connects.

pub fn with_client(base_url: impl Into<String>, client: Client) -> Self

Build with a caller-supplied reqwest::Client (to share a pool / set custom timeouts or TLS).

pub fn with_bearer(self, token: impl Into<String>) -> Self

Send Authorization: Bearer <token> to the policy service (builder).

pub fn with_ttl(self, ttl: Duration) -> Self

Override the cache TTL (builder). Default 60s.

Trait Implementations

impl WidgetAuthProvider for HttpWidgetAuth

fn agent_widget_auth<'life0, 'life1, 'async_trait>( &'life0 self, agent_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Option<AgentWidgetAuth>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

The embed-auth policy for agent_id, or None if the agent has none / is unknown.