Apply authentication token from local storage based on gateway auth mode. Handles Cloudflare Access and OIDC auth modes by loading the stored token and setting it on `TlsOptions`. For OIDC, automatically refreshes the token if it's near expiry.
(tls: &mut TlsOptions, gateway_name: &str)
| 157 | /// and setting it on `TlsOptions`. For OIDC, automatically refreshes the token |
| 158 | /// if it's near expiry. |
| 159 | fn apply_auth(tls: &mut TlsOptions, gateway_name: &str) { |
| 160 | let Some(meta) = get_gateway_metadata(gateway_name) else { |
| 161 | return; |
| 162 | }; |
| 163 | match meta.auth_mode.as_deref() { |
| 164 | Some("cloudflare_jwt") => { |
| 165 | if let Some(token) = load_edge_token(gateway_name) { |
| 166 | tls.edge_token = Some(token); |
| 167 | } |
| 168 | } |
| 169 | Some("oidc") => { |
| 170 | let Some(bundle) = openshell_bootstrap::oidc_token::load_oidc_token(gateway_name) |
| 171 | else { |
| 172 | return; |
| 173 | }; |
| 174 | if openshell_bootstrap::oidc_token::is_token_expired(&bundle) { |
| 175 | let insecure = std::env::var("OPENSHELL_GATEWAY_INSECURE") |
| 176 | .is_ok_and(|v| !v.is_empty() && v != "0" && v != "false"); |
| 177 | // Try to refresh the token in-place using block_in_place |
| 178 | // so the async refresh can run within the sync apply_auth call. |
| 179 | match tokio::task::block_in_place(|| { |
| 180 | tokio::runtime::Handle::current().block_on( |
| 181 | openshell_cli::oidc_auth::oidc_refresh_token(&bundle, insecure), |
| 182 | ) |
| 183 | }) { |
| 184 | Ok(refreshed) => { |
| 185 | let _ = openshell_bootstrap::oidc_token::store_oidc_token( |
| 186 | gateway_name, |
| 187 | &refreshed, |
| 188 | ); |
| 189 | tls.oidc_token = Some(refreshed.access_token); |
| 190 | } |
| 191 | Err(e) => { |
| 192 | tracing::warn!("OIDC token refresh failed: {e}"); |
| 193 | // Use the expired token anyway — server will reject it |
| 194 | // with a clear error prompting re-login. |
| 195 | tls.oidc_token = Some(bundle.access_token); |
| 196 | } |
| 197 | } |
| 198 | } else { |
| 199 | tls.oidc_token = Some(bundle.access_token); |
| 200 | } |
| 201 | } |
| 202 | _ => {} |
| 203 | } |
| 204 | } |
| 205 | |
| 206 | /// Resolve a sandbox name, falling back to the last-used sandbox for the gateway. |
| 207 | /// |