Module auth 

JWT lifecycle: secret -> AuthService.Auth -> JWT, refreshed ahead of expiry.

One TokenManager per secret. It is shared (Arc) by every connector that uses the secret, so several accounts or roles do not each run their own Auth. The refresher task holds only a Weak reference and ends when the last Arc is dropped.

Lifetime is the shorter of TokenDetails (expires_at - created_at, both server clock, so no local clock skew) and the JWT claims exp - iat. If only one of them is known, that one. If neither, a conservative assumption. Auth and TokenDetails each have a deadline of AUTH_TIMEOUT.

Examples

Start a manager against the in-process imitation of the broker, read the token and the accounts that the secret can reach:

use std::sync::Arc;
use brokapi_finam_protocol::client::connect_lazy;
use brokapi_finam_protocol::{ApiEndpoint, GrpcTokenApi, TokenManager};

let channel = connect_lazy(&endpoint)?;
let api = Arc::new(GrpcTokenApi::new(channel));
let tokens = TokenManager::start(api, secret, "my-app").await?;

assert_eq!(tokens.generation(), 1);
assert!(!tokens.current().is_empty());
assert_eq!(tokens.account_ids(), vec!["ACC1", "ACC2"]);

// Renew by hand, for example after you saw UNAUTHENTICATED.
tokens.refresh().await?;
assert_eq!(tokens.generation(), 2);

Structs

GrpcTokenApi

TokenApi over the gRPC AuthService of the broker.

TokenInfo

What TokenDetails says about a token.

TokenManager

Holds the current JWT and keeps it fresh. Share via Arc between connectors.

Constants

ASSUMED_TTL

Used only when neither TokenDetails nor the JWT claims tell the lifetime.

AUTH_TIMEOUT

Deadline of the Auth call and of the TokenDetails call. Without it a connection that accepted the request and never answers would hold the refresh lock for ever.

Traits

TokenApi

Auth transport, abstracted so refresh logic is testable without a network.

Functions

jwt_ttl

Lifetime from the JWT payload (exp - iat), if the token is a readable JWT.

refresh_after

How long after issuing to renew a token that lives ttl.