Struct AuthManager 

pub struct AuthManager { /* private fields */ }

Central manager providing a single source of truth for auth.json derived authentication data. It loads once (or on preference change) and then hands out cloned CodexAuth values so the rest of the program has a consistent snapshot.

External modifications to auth.json will NOT be observed until reload() is called explicitly. This matches the design goal of avoiding different parts of the program seeing inconsistent auth data mid‑run.

Implementations

impl AuthManager

pub async fn new( codex_home: PathBuf, enable_codex_api_key_env: bool, auth_credentials_store_mode: AuthCredentialsStoreMode, forced_chatgpt_workspace_id: Option<Vec<String>>, chatgpt_base_url: Option<String>, keyring_backend_kind: AuthKeyringBackendKind, auth_route_config: AuthRouteConfig, ) -> Self

Create a new manager loading the initial auth using the provided preferred auth method. Errors loading auth are swallowed; auth() will simply return None in that case so callers can treat it as an unauthenticated state.

pub fn from_auth_for_testing(auth: CodexAuth) -> Arc<Self>

Create an AuthManager with a specific CodexAuth, for testing only.

pub fn from_auth_for_testing_with_home( auth: CodexAuth, codex_home: PathBuf, ) -> Arc<Self>

Create an AuthManager with a specific CodexAuth and codex home, for testing only.

pub fn external_bearer_only(config: ModelProviderAuthInfo) -> Arc<Self>

pub fn auth_cached(&self) -> Option<CodexAuth>

Current cached auth (clone) without attempting a refresh.

pub fn auth_change_receiver(&self) -> Receiver<u64>

Subscribes to cached auth changes that can affect request recovery.

pub fn refresh_failure_for_auth( &self, auth: &CodexAuth, ) -> Option<RefreshTokenFailedError>

pub async fn auth(&self) -> Option<CodexAuth>

Current cached auth (clone). May be None if not logged in or load failed. For managed ChatGPT auth that needs a proactive refresh, first performs a guarded reload and then refreshes only if the on-disk auth is unchanged.

pub async fn agent_identity_auth( &self, policy: AgentIdentityAuthPolicy, session_source: SessionSource, ) -> Result<Option<AgentIdentityAuth>>

pub async fn reload(&self) -> bool

Reloads auth from the active source. Returns whether the auth value changed.

pub async fn set_external_auth( &self, external_auth: Arc<dyn ExternalAuth>, ) -> Result<(), RefreshTokenError>

pub fn clear_external_auth(&self)

pub fn set_forced_chatgpt_workspace_id(&self, workspace_id: Option<Vec<String>>)

pub fn forced_chatgpt_workspace_id(&self) -> Option<Vec<String>>

pub fn has_external_auth(&self) -> bool

pub fn is_external_chatgpt_auth_active(&self) -> bool

pub fn codex_api_key_env_enabled(&self) -> bool

pub async fn shared( codex_home: PathBuf, enable_codex_api_key_env: bool, auth_credentials_store_mode: AuthCredentialsStoreMode, forced_chatgpt_workspace_id: Option<Vec<String>>, chatgpt_base_url: Option<String>, keyring_backend_kind: AuthKeyringBackendKind, auth_route_config: AuthRouteConfig, ) -> Arc<Self>

Convenience constructor returning an Arc wrapper.

pub async fn shared_from_config( config: &impl AuthManagerConfig, enable_codex_api_key_env: bool, ) -> Arc<Self>

Convenience constructor returning an Arc wrapper from resolved config.

pub fn unauthorized_recovery(self: &Arc<Self>) -> UnauthorizedRecovery

pub async fn refresh_token(&self) -> Result<(), RefreshTokenError>

Attempt to refresh the token by first performing a guarded reload from the active auth source. If the loaded token differs from the cached token, we can assume that the source already refreshed it. Otherwise, ask the token authority to refresh.

pub async fn refresh_token_from_authority( &self, ) -> Result<(), RefreshTokenError>

Attempt to refresh the current auth token from the authority that issued it and update the shared cache. If the token refresh fails, returns the error to the caller.

pub async fn logout(&self) -> Result<bool>

Log out by deleting the on‑disk auth.json (if present). Returns Ok(true) if a file was removed, Ok(false) if no auth file existed. On success, reloads the in‑memory auth cache so callers immediately observe the unauthenticated state.

pub async fn logout_with_revoke(&self) -> Result<bool>

pub fn get_api_auth_mode(&self) -> Option<AuthMode>

Returns the precise kind of credentials backing the current authentication.

pub fn auth_mode(&self) -> Option<AuthMode>

Returns the effective backend auth mode for the current authentication.

pub fn current_auth_uses_codex_backend(&self) -> bool

Trait Implementations

impl Debug for AuthManager

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.