Documentation
¶
Overview ¶
Package credentialclient adapts a credentials.Source to the call-scoped authorization seam exposed by inference transports. It owns provider policy checks, lease acquisition, provider auth-failure classification, and the bounded recovery exchange; the low-level transport only authorizes and sends.
Index ¶
- func ClassifyAuthFailure(err error) (credentials.Failure, bool)
- func New(inner inference.Client, source credentials.Source, policy llm.AuthPolicy) (inference.Client, error)
- func NewLegacyCompatible(inner inference.Client, source credentials.Source, policy llm.AuthPolicy) (inference.Client, error)
- func SupportsCallScoped(inner inference.Client) bool
- func ValidateSource(source credentials.Source, policy llm.AuthPolicy) error
- type Client
- type ConstructionError
- type LeaseError
- type RecoveryError
- type StaticSource
- func (s *StaticSource) Acquire(ctx context.Context) (credentials.Lease, error)
- func (s *StaticSource) Close() error
- func (s *StaticSource) Descriptor() credentials.Descriptor
- func (s *StaticSource) Invalidate(ctx context.Context, generation credentials.Generation, ...) error
- func (s *StaticSource) Reference() credentials.Reference
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ClassifyAuthFailure ¶
func ClassifyAuthFailure(err error) (credentials.Failure, bool)
ClassifyAuthFailure maps bounded provider errors into the closed credentials failure classes. Only explicit authentication codes can trigger a refresh; malformed requests, permission denials, quota, and rate limits cannot.
func New ¶
func New(inner inference.Client, source credentials.Source, policy llm.AuthPolicy) (inference.Client, error)
New binds source to inner under one exact policy. A nil source is never interpreted as unauthenticated; callers must pass credentials.NewNoneSource for an explicitly local/no-credential transport. A legacy-only inner client is rejected because using its default authenticator would bypass the source.
func NewLegacyCompatible ¶
func NewLegacyCompatible(inner inference.Client, source credentials.Source, policy llm.AuthPolicy) (inference.Client, error)
NewLegacyCompatible is the narrow compatibility escape hatch for old provider clients that predate call-scoped transport methods. It is permitted only for an immutable StaticSource created by auto.New; dynamic sources must use New and are rejected rather than silently bypassing lease authorization.
func SupportsCallScoped ¶
SupportsCallScoped reports whether an inference client exposes at least one additive call-scoped authorization method. It is used by composition roots to keep legacy concrete clients source-compatible while ensuring every transport that can consume leases is wrapped by Client.
func ValidateSource ¶
func ValidateSource(source credentials.Source, policy llm.AuthPolicy) error
ValidateSource performs the construction-time source and exact-policy checks without allocating a transport. Composition roots can call it before dispatch so a nil or mismatched source cannot even construct a provider network object.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client is a provider-bound source adapter. It is safe for concurrent use: source and inner are immutable references, and all per-call state is local.
func (*Client) Invoke ¶
Invoke acquires and verifies one lease before every initial/recovery wire attempt. Authentication recovery is deliberately bounded to one extra wire attempt and never implements or resets an outer inference retry budget.
func (*Client) Stream ¶
func (c *Client) Stream(ctx context.Context, req inference.Request) (*stream.StreamReader[content.Chunk], error)
Stream follows the same lease/recovery contract as Invoke. If a failed streaming call returned a reader alongside an error, close it before recovery so no body/connection is leaked.
type ConstructionError ¶
type ConstructionError struct{ Reason string }
ConstructionError reports fail-closed adapter construction failures.
func (*ConstructionError) Error ¶
func (e *ConstructionError) Error() string
type LeaseError ¶
type LeaseError struct{ Reason string }
LeaseError reports an invalid source lease before any authorization or I/O.
func (*LeaseError) Error ¶
func (e *LeaseError) Error() string
type RecoveryError ¶
RecoveryError reports a safe source recovery boundary failure.
func (*RecoveryError) Error ¶
func (e *RecoveryError) Error() string
func (*RecoveryError) Unwrap ¶
func (e *RecoveryError) Unwrap() error
type StaticSource ¶
type StaticSource struct {
// contains filtered or unexported fields
}
StaticSource is an immutable in-memory source used solely by the legacy API-key compatibility wrapper. It has a real descriptor and generation so it still passes the same exact policy and per-lease checks as a dynamic source.
func NewStaticSource ¶
func NewStaticSource(binding llm.AuthBinding, authorizer httpauth.Authorizer) (*StaticSource, error)
NewStaticSource constructs a source around one already-built HTTP authorizer. The binding's scheme/usage/authority metadata is validated before the source can be used.
func (*StaticSource) Acquire ¶
func (s *StaticSource) Acquire(ctx context.Context) (credentials.Lease, error)
func (*StaticSource) Close ¶
func (s *StaticSource) Close() error
func (*StaticSource) Descriptor ¶
func (s *StaticSource) Descriptor() credentials.Descriptor
func (*StaticSource) Invalidate ¶
func (s *StaticSource) Invalidate(ctx context.Context, generation credentials.Generation, failureClass credentials.Failure) error
func (*StaticSource) Reference ¶
func (s *StaticSource) Reference() credentials.Reference
Source Files