Crate wiremux_auth 

TokenProvider and vendor profile catalog.

Feature net (default) enables HTTP TokenProviders. Maps-only hosts disable default features and keep profile parse/load without reqwest.

use wiremux_auth::shipped_profile_ids;

assert!(shipped_profile_ids().iter().any(|id| *id == "openai"));

Modules

device_flow

OAuth 2.0 device authorization grant (RFC 8628). Poll is bounded.

pkce

Generic PKCE (RFC 7636) for profile-driven login.

Structs

AwsCredentials

Temporary credentials from STS AssumeRole.

AwsSignParams

Inputs for sign_aws_request.

AwsStsConfig

Long-lived keys used to call STS AssumeRole.

AwsStsTokenProvider

STS AssumeRole. Session keys are not a Bearer API token.

AzureTokenProvider

Azure AD client-credentials grant.

Betas

Beta header values and merge policy.

Dialect

Dialect selection and stream/tool policies.

Fingerprint

Encode-time fingerprint (API request only).

GcpTokenProvider

Service-account JWT bearer grant, or authorized_user ADC refresh.

Http

HTTP request surface (API calls, not the token POST).

LoadOptions

Catalog load inputs. Same-id layers merge field-wise (shipped < user dir < explicit file).

OauthPack

The [oauth] table: token POST and login surface.

ProfileTokenProvider

Profile-driven OAuth refresh.

ResolvedProfile

Fully resolved profile document (one id).

StaticToken

A static API key. Used when no OAuth refresh is needed.

TokenExchangeResponse

Token response from an authorization-code or device-code exchange.

TokenResponse

[oauth.token_response] pointers into the refresh HTTP body.

Enums

AnyTokenProvider

Type-erased token provider.

AuthError

Failure from credential load, refresh, or fail-closed write-back.

AuthScheme

API auth scheme. none sends no Authorization and no x-api-key.

CredsFormat

Named credential-store layouts.

ExpiresUnit

Expiry field unit.

ForbiddenFieldPolicy

Encode-time policy for forbidden_body_fields.

ListMerge

List merge policy. verbatim is an alias of replace.

Login

Login engine selection.

ProfileError

Failure from parse, refuse, or catalog load.

StreamUnknownPolicy

How decode treats unrecognized SSE events.

TokenRequestFormat

Token POST body encoding.

ToolNameCase

Tool-name case conversion.

ToolTypePolicy

How encode treats unknown / namespaced tool types.

Wire

v1 wire dialects. Not a host registry name.

Constants

GROK_CHAT_PROXY_CLIENT_IDENTIFIER

x-grok-client-identifier this crate sends to the Grok chat proxy.

GROK_CHAT_PROXY_CLIENT_VERSION

x-grok-client-version for cli-chat-proxy.grok.com.

SCHEMA_VERSION_MAX

Highest schema_version this crate understands.

VERSION

Crate version from Cargo.toml.

Traits

TokenProvider

A provider of short-lived Bearer tokens.

Functions

credential_options

Ways a profile can authenticate, for error text shared by the proxy and auth login.

default_adc_path

Well-known gcloud ADC path (CLOUDSDK_CONFIG, else ~/.config/gcloud).

default_user_profile_dir

Directory wiremux profile ingest writes when --dir is omitted. Last user_profile_dirs entry so WIREMUX_PROFILE_DIR and the macOS Application Support path win the same way load does.

format_oauth_transport_error

Short reason plus origin only. Never format a raw reqwest error.

is_oauth_transport_error

list_profiles

List document ids from shipped ∪ user dir ∪ explicit file.

load_profile

Load the profile whose document id equals id.

load_profile_for_wire

Load a profile for a dialect wire.

load_profile_from_cli

--profile / path-vs-id disambiguation.

missing_credential_field

Field text for AuthError::MissingField. Display adds missing .

not_found_message

Catalog miss: known ids, plus a close-match hint when unique.

parse_profile_str

Parse a profile document from TOML or JSON text.

persist_login_tokens

Persist tokens from a login exchange.

provider_for_profile

Same load path as token_for_profile, but keep the provider so the host can mark_stale / wake. Catalog id only; paths use load_profile_from_cli then provider_from_profile.

provider_for_profile_opts

provider_from_oauth

Build a provider from an [oauth] pack (no fingerprint, no API headers).

provider_from_oauth_opts

Same as provider_from_oauth, with a host-supplied credentials path.

provider_from_profile

Build a provider from a resolved profile.

redact_secret_looking

Redact common token prefixes and JWT-looking blobs.

redact_url_origin

Scheme + host/port only. Drops userinfo, path, query, and fragment.

remove_store_entry

Remove one oidc-auth-json profile entry. Deletes the file when empty.

sanitize_oauth_error_text

Strip controls, redact secret-looking tokens, and cap length.

shipped_profile_ids

Every shipped catalog id, in the same order load_profile walks.

sign_aws_request

Sign a request with SigV4. Returns the Authorization header value.

token_for_profile

Load a catalog id (example anthropic-oauth) and return one access token.

token_for_profile_cached

Load a catalog id and return the stored Bearer without POSTing token_url. Empty access still fails closed. token_for_profile may still block on keychain plus one or two HTTP refreshes.

token_for_profile_opts

Same, with host LoadOptions (tests, IsolatedHome, no shipped).

token_for_profile_opts_cached

Same as token_for_profile_cached, with host LoadOptions.

user_profile_dirs

Overlay directories load_profile walks (XDG, then macOS Application Support, then WIREMUX_PROFILE_DIR). Later dirs win on the same id.