mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-18 05:39:50 +08:00
Max Dubrinsky
63ca95dccc
Phase 2b of RFC 0008: settle and implement the Refresh trait contract and connect TokenSource to live request authentication. - TokenSource single-flight now coalesces on a generation counter and shares one in-flight outcome (success or failure) across waiters, so a failing IdP is hit once per attempt rather than once per waiter. - refresh_now() forces a refresh regardless of expiry (recovers a revoked but not-yet-expired token); current() stays expiry-gated. This fixes the documented forced-refresh path that previously no-opped on unexpired tokens. - EdgeAuthInterceptor holds the OIDC bearer in a shared, mutable slot the interceptor reads per request; OpenShellClient refreshes proactively before unary calls and reactively on Unauthenticated (one retry), writing the new token into the slot so rotation reaches an already-connected client. - AuthConfig::Oidc carries optional expires_at + Arc<dyn Refresh> (RFC shape). The CLI keeps a static token (refresh: None), preserving phase-1 behavior. Tests: refresh unit tests for forced-refresh-of-unexpired and shared-failure coalescing; mock-gateway tests for reactive recovery from Unauthenticated and single-attempt-without-refresher. Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>