Struct TokenManager 

pub struct TokenManager { /* private fields */ }

Thread-safe token manager with lazy refresh.

Implementations

impl TokenManager

pub fn new(transport: Arc<dyn HttpTransport>, config: AuthConfig) -> Self

Create a new token manager.

pub async fn get_access_token(&self) -> Result<String>

Get a valid access token, refreshing if necessary.

pub fn id_token(&self) -> Option<String>

Get the ID token (contains user claims).

pub fn get_tokens(&self) -> Option<Tokens>

Get all tokens if available.

Returns the tokens including access_token, refresh_token, and expiration. This is useful for CLI applications that need to store tokens after login.

pub fn set_tokens(&self, tokens: Tokens)

Set tokens from external source (e.g., config file).

This allows the CLI to restore tokens from a previous session. The tokens will be used for authentication and refreshed automatically when needed.

pub async fn authenticate(&self) -> Result<()>

Authenticate and obtain tokens.

This method performs authentication if needed:

• If tokens exist and are valid, does nothing
• If tokens are expired, attempts to refresh
• If no tokens exist, performs fresh login

After calling this, you can use TokenManager::get_tokens to retrieve the tokens for storage.

pub async fn refresh(&self) -> Result<()>

Refresh the access token using the refresh token endpoint.

This method attempts to refresh the access token using the stored refresh token. If successful, the new access token and ID token are stored, while the refresh token remains unchanged.

Errors

Returns an error if:

• No refresh token is available
• The refresh request fails
• The response cannot be parsed

Example

token_manager.refresh().await?;

pub async fn revoke_token(&self) -> Result<()>

Revoke the current token using /v1/token-revoke endpoint.

This invalidates the refresh token on the server, preventing any future token refreshes. The local token state is cleared regardless of whether the server request succeeds.

Errors

Returns an error if no tokens are available to revoke or if the HTTP request fails.

Example

token_manager.revoke_token().await?;

pub fn clear_state(&self)

Clear internal state (force refresh on next use).

pub async fn forgot_password(&self, username: &str) -> Result<()>

Trigger forgot password email.

Sends a password reset email to the user with a confirmation code. The code can be used with TokenManager::forgot_password_confirm to set a new password.

Arguments

• username - The username to send the reset email to

Errors

Returns an error if the request fails or the user is not found.

Example

token_manager.forgot_password("user@example.com").await?;

pub async fn forgot_password_confirm( &self, username: &str, password: &str, code: &str, ) -> Result<()>

Confirm forgot password with code.

Completes the password reset flow by providing the confirmation code received via email and the new password.

Arguments

• username - The username being reset
• password - The new password to set
• code - The confirmation code from the email

Errors

Returns an error if the code is invalid, expired, or the request fails.

Example

token_manager.forgot_password_confirm("user@example.com", "new_password", "123456").await?;

pub async fn change_password( &self, previous_password: &str, proposed_password: &str, ) -> Result<()>

Change password (requires authentication).

Changes the password for the authenticated user. The user must provide their current password for verification.

Arguments

• previous_password - The current password
• proposed_password - The new password to set

Errors

Returns an error if the current password is incorrect or the request fails.

Example

token_manager.change_password("old_password", "new_password").await?;

pub async fn set_new_password( &self, username: &str, session: &str, new_password: &str, ) -> Result<()>

Set new password for NEW_PASSWORD_REQUIRED challenge.

Completes the authentication flow when a user is required to set a new password on first login or after a password reset.

Arguments

• username - The username
• session - The session identifier from the authentication challenge
• new_password - The new password to set

Errors

Returns an error if the session is invalid, password doesn’t meet requirements, or the request fails.

Example

token_manager.set_new_password("user@example.com", "session_id", "new_secure_password").await?;

Trait Implementations

impl Clone for TokenManager

fn clone(&self) -> TokenManager

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.