Crate spiral_auth 

Spiral credentials: bearer tokens, the providers that obtain them, and default discovery.

A TokenSource supplies the token for each request; every provider converts into one. Providers that need extra dependencies, such as a cloud SDK or a browser, are behind features. Signing and TLS use the rustls crypto provider that the aws-lc or ring feature selects, unless the application installed one first.

Modules

oauth_clients

OAuth client IDs of Spiral’s first-party applications, registered on every stack.

Structs

ClientCredentials

A client ID and secret used for OAuth2 client-credentials authentication.

ClientCredentialsProvider

CredentialChain

Ordered credential sources, with one selected identity retained during refresh.

FallbackAuthn

OAuth2ClientAuthentication

Client authentication parameters sent in the token request body.

OAuth2TokenRequest

A request to Spiral’s RFC 6749 token endpoint.

OAuth2TokenResponse

An RFC 6749 §5.1 token response.

OidcAuthProvider

Authenticates a workload with a token from any OpenID Connect issuer, read from SPIRAL_OIDC_PROVIDER_TOKEN, as a JWT-bearer grant at the authorization server. The token’s audience must be the authorization server’s token endpoint.

RefreshingAuthTokenProvider

Keeps a short-lived service token warm and returns only usable tokens.

Token

A bearer token, shared behind one pointer so that it stays cheap to clone and embed.

TokenSource

A source of bearer tokens, consulted immediately before each authenticated request.

Url

A parsed URL record.

WorkloadAuthn

Groups all workload-identity providers and warns if none of them detected a valid token.

Enums

CredentialError

A credential source could not supply a usable credential.

OAuth2Grant

The authorization grant presented to the token endpoint.

Constants

CLIENT_ASSERTION_TYPE_JWT_BEARER

RFC 7523 client authentication using a JWT bearer assertion.

Traits

ClientGrant

A registered client that obtains its own tokens with RFC 9396 authorization details: the grant that the client authorized, for a resource server to enforce.

Functions

default_auth_url

Spiral’s authorization server, which signs users in for every stack.

default_credentials

The default credential chain: SPIRAL_TOKEN, then a private key (SPIRAL_CLIENT_ID with SPIRAL_PRIVATE_KEY), then client credentials (SPIRAL_CLIENT_SECRET), then the host’s workload identity, then fallback.

exchange_for_jwt

RFC 8693 §2.1: exchange subject, an access token from the authorization server at token_endpoint, for a JWT for audience, which is not a Spiral API, such as another cloud’s token service. The RFC 9396 authorization_details say what the JWT speaks for.

exchange_token

RFC 8693 §2.1: narrow subject, an access token from the authorization server at token_endpoint, to resources (RFC 8707 §2 lets a request name several). The narrowed token keeps the subject’s claims and expiry, and names only resources, which the subject must name.

install_default_crypto_provider

Install the selected TLS crypto provider unless the application installed one first.

resolve_workload_id

Resolve the workload identity from the SPIRAL_WORKLOAD_ID environment variable. Returns None if the variable is unset or empty.

token_endpoint

The token endpoint of the authorization server at auth_url.

Type Aliases

CredentialResult

The result of consulting a credential source.