Phase 2b of RFC 0008: settle and implement the Refresh trait contract and
connect TokenSource to live request authentication.
- TokenSource single-flight now coalesces on a generation counter and shares
one in-flight outcome (success or failure) across waiters, so a failing IdP
is hit once per attempt rather than once per waiter.
- refresh_now() forces a refresh regardless of expiry (recovers a revoked but
not-yet-expired token); current() stays expiry-gated. This fixes the
documented forced-refresh path that previously no-opped on unexpired tokens.
- EdgeAuthInterceptor holds the OIDC bearer in a shared, mutable slot the
interceptor reads per request; OpenShellClient refreshes proactively before
unary calls and reactively on Unauthenticated (one retry), writing the new
token into the slot so rotation reaches an already-connected client.
- AuthConfig::Oidc carries optional expires_at + Arc<dyn Refresh> (RFC shape).
The CLI keeps a static token (refresh: None), preserving phase-1 behavior.
Tests: refresh unit tests for forced-refresh-of-unexpired and shared-failure
coalescing; mock-gateway tests for reactive recovery from Unauthenticated and
single-attempt-without-refresher.
Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>
Apply rustfmt to client_mock.rs and replace then(|| ...) with then_some
in client.rs to satisfy clippy -D warnings.
Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>
Per RFC 0005, lift the gRPC client, TLS, OIDC, edge-tunnel, and refresh
plumbing out of openshell-cli into a new openshell-sdk crate. CLI and
TUI now consume the SDK; openshell-cli/src/{tls.rs,oidc_auth.rs} shrink
to thin wrappers over the SDK's transport and OIDC modules.
- New crate openshell-sdk exposes a typed gRPC client, TLS resolver,
OidcRefresher with single-flight semantics, edge-tunnel dialer, and a
Sandbox-API surface that mirrors the existing CLI behavior.
- crates/openshell-core/src/auth.rs moves into the SDK as auth.rs.
- crates/openshell-cli/src/edge_tunnel.rs moves into the SDK as
edge_tunnel.rs.
Tests: 3 unit + 10 mock-gateway integration tests in openshell-sdk.
Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>
Max Dubrinsky