Documentation
¶
Overview ¶
Package subscription yields the operator's LIVE Anthropic subscription OAuth access token from the resident ~/.claude credentials, so the egress proxy can inject a fresh token per request instead of the sandbox holding a COPY that goes stale.
Single-owner discipline: only the resident `claude` binary ever refreshes and rotates the token. This provider only ever READS the file, and on the rare near-expiry path DELEGATES the refresh to `claude` — it never reimplements Anthropic's undocumented OAuth refresh_token flow.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// CredPath is the path to the resident credentials file. Empty defaults to
// ~/.claude/.credentials.json.
CredPath string
// ClaudeBin is the resident CLI that delegates a refresh. Empty defaults
// to "claude" (resolved against PATH).
ClaudeBin string
// Now is overridable in tests; defaults to time.Now.
Now func() time.Time
}
Config configures the resident-credentials provider.
type Provider ¶
type Provider interface {
Current(ctx context.Context) (Token, error)
// Peek returns the resident token WITHOUT refreshing or delegating to
// `claude` — for status/provenance surfaces that must not trigger a
// refresh side effect. Unlike Current, it does NOT reject an expired token.
Peek() (Token, error)
}
Provider yields the operator's current Anthropic subscription access token.