Struct OauthClientCache 

pub struct OauthClientCache { /* private fields */ }

Implementations

impl OauthClientCache

pub fn new(managers: Arc<DashMap<String, UpstreamOauthManager>>) -> Self

Create a new cache backed by the gateway’s OAuth manager map.

pub async fn get_or_build( &self, config: &UpstreamConfig, subject: &str, ) -> Result<Arc<AuthClient<Client>>, OauthError>

Return a cached AuthClient<reqwest::Client> for (upstream, subject), building one on first use.

Kept for callers that need a shared Arc<AuthClient<reqwest::Client>> (e.g. status-check endpoints). The MCP connection path uses get_or_build_capped instead so the BodyCappedHttpClient cap applies.

If a cached entry exists but was built from a different OAuth registration than the current config, the entry is evicted and rebuilt so stale client_ids never sign requests.

For Dynamic upstreams the fingerprint includes the stored client_id (fetched from SQLite via the upstream manager) so a re-registration cycle evicts the cached AuthClient.

Concurrent first-request callers for the same key are serialised by a per-key mutex so only one token exchange runs.

pub async fn get_or_build_capped<C>( &self, config: &UpstreamConfig, subject: &str, http_client: C, ) -> Result<AuthClient<C>, OauthError>

where C: StreamableHttpClient + Clone,

Build an AuthClient<C> wrapping the supplied HTTP client and return it WITHOUT caching it.

Entry point for callers that manage their own per-connection cache and need to pass a pre-built HTTP client (e.g. one with a response-size cap) so the OAuth path gets identical transport behavior to the non-OAuth path. The caller is responsible for caching the resulting AuthClient at whatever level it owns, so there is no double-caching here.

pub fn evict_subject(&self, upstream: &str, subject: &str)

Evict the entry for a single (upstream, subject) pair.

Used by API handlers when credentials are cleared or when a refresh fails terminally and the next request must reauthenticate.

pub fn evict_upstream(&self, upstream: &str)

Evict every entry for upstream.

Used at config reload when an upstream is removed or its OAuth registration changes, and when the whole server shuts down the upstream’s sessions.

pub fn evict_upstreams_not_in(&self, known: &HashSet<&str>)

Evict every entry whose upstream is not in known.

Used at config reload to drop cached clients for upstreams that no longer exist in config.

pub fn len(&self) -> usize

Number of cached clients. Intended for tests and observability.

pub fn is_empty(&self) -> bool

True when the cache holds no clients.

pub fn insert_for_tests( &self, upstream: &str, subject: &str, fingerprint: &str, client: Arc<AuthClient<Client>>, )

Insert a pre-built AuthClient directly into the cache.

Test-only seam: available in labby-auth’s own tests and downstream debug test builds. It is intentionally not gated by a Cargo feature so --all-features --release cannot expose it in production artifacts.

Trait Implementations

impl Clone for OauthClientCache

fn clone(&self) -> OauthClientCache

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.