crates/nornir-auth-client/Cargo.toml
[package]
name = "nornir-auth-client"
version = "0.1.2"
edition = "2021"
authors = ["Ignalina ApS"]
description = "Shared CLIENT-side login for the nordisk apps — the missing `<app> login`. OIDC device-authorization-grant (RFC 8628) login reusing the `nornir-auth-oidc` device helper, access-token acquire + silent refresh, and a `TokenStore` seam (default 0600 file store; pluggable to the dwarves encrypted Vault). Any CLI/client calls `login()` / `current_token()` so interactive SSO login works the same in korp, holger, dwarves."
license = "MIT OR Apache-2.0"
repository = "https://git.gunnar.rs/nordisk/edda"
keywords = ["auth", "oidc", "device-code", "login", "token"]
categories = ["authentication", "command-line-interface"]
[lib]
name = "nornir_auth_client"
[features]
default = []
# `online` — compile the networked login (device-code request + poll) and the
# silent token refresh. Reuses `nornir-auth-oidc`'s online HTTP client. WITHOUT
# it the crate is the offline surface: `TokenStore` + `TokenBundle` + the file
# store + `cached_token` (read a non-expired cached token; no network).
online = ["nornir-auth-oidc/online", "dep:tokio"]
# `test-support` — expose `stub_idp`, the localhost RFC 8628 IdP test double
# (`/device` + `/token` over raw tokio, bound to 127.0.0.1:0), as a `pub mod` so a
# DOWNSTREAM crate's tests can drive `login()`/`current_token()` end-to-end
# without a real IdP. Mirrors the sibling `nornir-auth-oidc/test-support`.
#
# WHY IT EXISTS: this crate shipped the login CLIENT but no server double, so
# korp, holger and dwarves (twice) each hand-rolled the SAME ~40-line stub — four
# copies of one fixture. LAW 5 says add the missing knob to the leaf, so here it
# is. Off by default: no stub server rides in a release build.
test-support = ["dep:tokio", "tokio/net", "tokio/io-util", "tokio/rt", "dep:base64"]
[dependencies]
# The device-authorization-grant helper + token acquire/refresh live in the OIDC
# provider crate (where the pooled HTTP client is) — consumed, never twinned.
nornir-auth-oidc = { version = "0.2.0", path = "../nornir-auth-oidc", default-features = false }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
anyhow = "1"
# Online only: the device-code poll loop sleeps on the IdP-advised interval.
# `test-support` additionally turns on net/io-util/rt for the stub IdP server.
tokio = { version = "1", features = ["time"], optional = true }
# `test-support` only: the unsigned display-only JWT the stub IdP mints.
base64 = { version = "0.23", optional = true }
[dev-dependencies]
tempfile = "3"
# Self dev-dep so THIS crate's own tests see `stub_idp` and the online login it
# drives (feature unification) — the same pattern nornir-release-ledger uses for
# its `testkit`. Without it the stub would ship untested, which is exactly how
# four downstream copies drifted in the first place.
nornir-auth-client = { path = ".", features = ["online", "test-support"] }
tokio = { version = "1", features = ["macros", "rt-multi-thread", "time", "net", "io-util"] }