Struct TokenManager 

pub struct TokenManager { /* private fields */ }

Holds the current JWT and keeps it fresh. Share via Arc between connectors.

A background task renews the token ahead of expiry (see refresh_after for the rule). If a renewal fails, the old token stays in use and the task retries with a growing pause (1 s up to 30 s). The task ends when the last Arc is dropped.

The Debug output hides the secret.

See the module docs for an example.

Implementations

impl TokenManager

pub async fn start( api: Arc<dyn TokenApi>, secret: impl Into<String>, source_app_id: impl Into<String>, ) -> Result<Arc<Self>, FinamError>

Authenticates once (failure here means a bad secret or no connectivity) and starts the background refresher.

Must be called inside a Tokio runtime, because it spawns the refresher task.

Errors

• FinamError::Config: the secret is empty or only spaces. Nothing is sent.
• FinamError::Auth: the server answered with an empty token.
• FinamError::Status: the Auth call failed (a wrong secret is UNAUTHENTICATED).

A failure of TokenDetails is not an error: the lifetime then comes from the JWT claims, or from ASSUMED_TTL.

pub fn current(&self) -> Arc<str>

Current JWT (what goes into the authorization metadata).

Cheap: no network. Call it for every request instead of keeping the value.

pub fn info(&self) -> TokenInfo

Details of the current token: lifetime, accounts, read-only flag. No network.

pub fn account_ids(&self) -> Vec<String>

Accounts available to this secret (TokenDetails.account_ids).

Empty when TokenDetails failed or listed none.

pub fn generation(&self) -> u64

Number of successful issues so far (1 after TokenManager::start).

Changes every time the token is replaced, so it tells a reader whether its copy is stale.

pub fn request_refresh(&self)

Asks the refresher to renew now, e.g. after UNAUTHENTICATED. Non-blocking.

The renewal runs in the background. Use TokenManager::refresh to wait for it.

pub async fn refresh(&self) -> Result<(), FinamError>

Renews the token immediately.

If another task renewed the token while this one waited for the lock, nothing more is sent and the call returns Ok. So parallel callers cause one Auth, not many.

Errors

The same as TokenManager::start without the empty-secret check. The old token stays in use when the renewal fails.

Trait Implementations

impl Debug for TokenManager

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.