Struct Token 

pub struct Token { /* private fields */ }

An access token returned by a successful authentication flow.

The token contains a SecretToken (the bearer credential), a token type (typically "Bearer"), and an absolute expiry timestamp.

Implementations

impl Token

pub fn access_token(&self) -> &SecretToken

Returns a reference to the access token credential.

The returned SecretToken is opaque — its Debug output is masked. Pass it to API clients that need the raw bearer token.

pub fn token_type(&self) -> &str

The token type (e.g. "Bearer").

pub fn expires_at(&self) -> u64

The absolute epoch timestamp when the token expires.

pub fn expires_in(&self) -> u64

How many seconds until the token expires (computed from the current time).

pub fn is_expired(&self) -> bool

Returns true if the token has expired (with 90 seconds of leeway).

The 90-second leeway triggers preemptive refresh well before the token becomes unusable, giving the HTTP refresh call plenty of time to complete while the current token is still valid for concurrent callers.

For checking whether the token is still usable as a bearer credential, use is_usable instead.

pub fn is_usable(&self) -> bool

Returns true if the token is still usable (before the actual expiry timestamp).

Unlike is_expired which includes 90s leeway for preemptive refresh, this only returns false when the token has genuinely expired.

pub fn refresh_token(&self) -> Option<&SecretToken>

Returns a reference to the refresh token, if one was provided.

pub fn take_refresh_token(&mut self) -> Option<SecretToken>

Takes the refresh token out, leaving None in its place.

pub fn region(&self) -> Option<&str>

Returns the stored region identifier, if any.

pub fn client_id(&self) -> Option<&str>

Returns the stored client ID, if any.

pub fn device_instance_id(&self) -> Option<&str>

Returns the stored device instance ID, if any.

pub fn workspace_id(&self) -> Result<WorkspaceId, AuthError>

Returns the workspace ID from the JWT claims.

The access token is decoded (without signature verification) to extract the workspace claim.

pub fn workspace_crn(&self) -> Result<Crn, AuthError>

Returns the workspace CRN derived from the token’s region and workspace ID.

The region is set during the device code flow, and the workspace ID is extracted from the JWT workspace claim.

pub fn issuer(&self) -> Result<Url, AuthError>

Returns the issuer URL from the JWT claims.

The iss claim in CipherStash tokens is the CTS host URL for the workspace, so this can be used directly as the CTS base URL.

pub async fn refresh( refresh_token: &SecretToken, base_url: &Url, client_id: &str, device_instance_id: Option<&str>, ) -> Result<Token, AuthError>

Exchange a refresh token for a new Token via the /oauth/token endpoint.

This is a static constructor — it takes a bare SecretToken (the refresh token) rather than operating on an existing Token. This allows callers to manage the refresh token lifecycle independently (e.g. taking it out of a cached token for cascade prevention and restoring it on failure).

Errors

• AuthError::InvalidGrant — the refresh token was revoked or expired.
• AuthError::InvalidClient — the client ID is not recognized.
• AuthError::Request — a network error occurred.

Trait Implementations

impl Debug for Token

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Token

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl ProfileData for Token

const FILENAME: &'static str = "auth.json"

The filename used when saving/loading this type (e.g. "secretkey.json").

const MODE: Option<u32>

Unix file permissions for this file. None uses the default umask. Sensitive files should return Some(0o600).

impl Serialize for Token

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.