adk_token_manager (erlang_adk v0.7.0)

View Source

Concurrent, scoped access-token cache and refresh coordinator.

A request is keyed by principal, provider, credential reference, scopes, and audience. The credential-consuming module and its base context come only from immutable, operator-supplied provider profiles; callers cannot choose either value. Concurrent callers for the same key share one supervised refresh. Access tokens and pending provider context are retained only in owner-private ETS tables, never in inspectable gen_server state.

Summary

Types

error_reason/0
provider_profile/0
server/0
token/0
token_request/0

Functions

child_spec(Opts)
code_change(OldVersion, State, Extra)
format_status(Status)
get_token(Server, Request)
get_token(Server, Request, Timeout)

Resolve a cached token or join/start a refresh. The caller-side alias is explicitly disabled on timeout, so a late token can never remain in the caller's mailbox.

handle_call(Request, From, State)
handle_cast(Request, State)
handle_info(Info, State)
init(Opts)
invalidate(Server, Selector)

Invalidate cached tokens and cancel matching in-flight refreshes.

start_link()
start_link(Opts)
terminate(Reason, State)

Types

error_reason/0

-type error_reason() ::
          invalid_request | manager_unavailable | caller_timeout | credential_not_found |
          credential_store_unavailable | credential_rotation_conflict | credential_rotation_failed |
          invalid_provider_response | refresh_timeout | refresh_worker_failed | refresh_start_failed |
          unknown_provider | scope_not_allowed | audience_not_allowed | refresh_capacity_reached |
          waiter_capacity_reached | token_invalidated | provider_process_failed | invalid_refresh_work |
          {provider_error, term()} |
          {provider_exception, atom(), term()}.

provider_profile/0

-type provider_profile() ::
          #{provider_module := module(),
            context => map(),
            allowed_scopes => [binary()],
            allowed_audiences => [binary()],
            resource_indicator => boolean(),
            allow_request_context => boolean()}.

server/0

-type server() :: pid() | atom().

token/0

-type token() :: #{access_token := binary(), token_type := binary()}.

token_request/0

-type token_request() ::
          #{principal := adk_credential_store:principal(),
            provider := adk_credential_store:provider_id(),
            credential_ref := adk_credential_store:credential_ref(),
            scopes => [binary()],
            audience => undefined | binary(),
            provider_module => term(),
            context => map()}.

Functions

child_spec(Opts)

-spec child_spec(map()) -> supervisor:child_spec().

code_change(OldVersion, State, Extra)

format_status(Status)

get_token(Server, Request)

-spec get_token(server(), token_request()) -> {ok, token()} | {error, error_reason()}.

get_token(Server, Request, Timeout)

-spec get_token(server(), token_request(), pos_integer()) -> {ok, token()} | {error, error_reason()}.

Resolve a cached token or join/start a refresh. The caller-side alias is explicitly disabled on timeout, so a late token can never remain in the caller's mailbox.

handle_call(Request, From, State)

handle_cast(Request, State)

handle_info(Info, State)

init(Opts)

invalidate(Server, Selector)

-spec invalidate(server(), map()) ->
                    {ok, non_neg_integer()} | {error, invalid_request | manager_unavailable}.

Invalidate cached tokens and cancel matching in-flight refreshes.

The selector must contain principal, provider, and the opaque credential_ref. Requiring the capability-like reference prevents a caller from evicting every token for a guessed tenant/provider pair. The count includes both deleted cache entries and cancelled refreshes. Waiters on a cancelled refresh receive {error, token_invalidated}.

start_link()

-spec start_link() -> gen_server:start_ret().

start_link(Opts)

-spec start_link(map()) -> gen_server:start_ret().

terminate(Reason, State)