Class: PlatformSdk::Identity::Zitadel::AuthClient

Inherits:
Object
  • Object
show all
Includes:
ErrorHandleable
Defined in:
lib/platform_sdk/identity/zitadel/auth_client.rb

Overview

Fetches machine-user access tokens from Zitadel via client_credentials. Tokens are opaque bearer tokens; expiry tracking uses expires_in.

Constant Summary collapse

API_SCOPE = 
'openid urn:zitadel:iam:org:project:id:zitadel:aud'
EXPIRY_SKEW_SECONDS = 
60
OPEN_TIMEOUT_SECONDS = 
2
READ_TIMEOUT_SECONDS = 
5

Constants included from ErrorHandleable

ErrorHandleable::FORM_SECRET_PATTERN, ErrorHandleable::JSON_SECRET_PATTERN, ErrorHandleable::SENSITIVE_KEYS

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from ErrorHandleable

#error_log_payload, #raise_error_with_payload, #scrub_headers, #scrub_request, #scrub_response, #scrub_secrets, #with_rescue

Constructor Details

#initialize(base_url, client_id, client_secret, scope: API_SCOPE) ⇒ AuthClient

Returns a new instance of AuthClient.



18
19
20
21
22
23
24
 
# File 'lib/platform_sdk/identity/zitadel/auth_client.rb', line 18

def initialize(base_url, client_id, client_secret, scope: API_SCOPE)
  @client_id = client_id
  @client_secret = client_secret
  @scope = scope
  @token_lock = Mutex.new
  @conn = build_connection(base_url)
end

Instance Attribute Details

#conn ⇒ Object (readonly)

Returns the value of attribute conn.



16
17
18
 
# File 'lib/platform_sdk/identity/zitadel/auth_client.rb', line 16

def conn
  @conn
end

#expires_at ⇒ Object (readonly)

Returns the value of attribute expires_at.



16
17
18
 
# File 'lib/platform_sdk/identity/zitadel/auth_client.rb', line 16

def expires_at
  @expires_at
end

Instance Method Details

#auth_token ⇒ Object

The lock makes concurrent callers (Puma/Sidekiq threads) share one fetch instead of racing: an unguarded reader could also observe expired?. Serializing on the bounded (2s/5s) fetch is acceptable for the shadow path.



31
32
33
34
35
36
 
# File 'lib/platform_sdk/identity/zitadel/auth_client.rb', line 31

def auth_token
  @token_lock.synchronize do
    fetch_token if expired?
    @token
  end
end