Class: Keycardai::OAuth::FileTokenSource

Inherits:
Object
  • Object
show all
Defined in:
lib/keycardai/oauth/token_sources.rb

Overview

Reads a platform-projected identity token file, fresh on every call. Covers EKS (AWS_* env vars), AKS (AZURE_FEDERATED_TOKEN_FILE), any Kubernetes projected service-account token, and file-mode CI providers.

Path discovery through the well-known env vars below is the one blessed environment read in the SDK (a deliberate platform convention). An explicit token_file_path wins; env_var_name is consulted first when given. The resolved file is validated at construction (exists, non-empty), preserving fail-fast behavior.

Constant Summary collapse

DEFAULT_ENV_VARS = 
%w[
  KEYCARD_EKS_WORKLOAD_IDENTITY_TOKEN_FILE
  AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE
  AWS_WEB_IDENTITY_TOKEN_FILE
  AZURE_FEDERATED_TOKEN_FILE
].freeze

Instance Method Summary collapse

Constructor Details

#initialize(token_file_path: nil, env_var_name: nil, env: ENV) ⇒ FileTokenSource

Returns a new instance of FileTokenSource.

Parameters:

  • token_file_path (String, nil) (defaults to: nil) —

    explicit path; skips discovery

  • env_var_name (String, nil) (defaults to: nil) —

    extra env var consulted first

  • env (Hash) (defaults to: ENV) —

    the environment to discover from; override in tests

Raises:



31
32
33
34
 
# File 'lib/keycardai/oauth/token_sources.rb', line 31

def initialize(token_file_path: nil, env_var_name: nil, env: ENV)
  @path = token_file_path || discover_path(env_var_name, env)
  validate_file
end

Instance Method Details

#identity_token ⇒ String

Returns the current platform token, read fresh.

Returns:

  • (String) —

    the current platform token, read fresh

Raises:



38
39
40
41
42
43
44
45
 
# File 'lib/keycardai/oauth/token_sources.rb', line 38

def identity_token
  token = File.read(@path).strip
  raise WorkloadIdentityRuntimeError.new("token file #{@path} is empty", source: "file") if token.empty?

  token
rescue SystemCallError => e
  raise WorkloadIdentityRuntimeError.new("token file #{@path} is unreadable: #{e.message}", source: "file")
end

#source_identifier ⇒ Object 



47
48
49
 
# File 'lib/keycardai/oauth/token_sources.rb', line 47

def source_identifier
  "file"
end