Function acquire_sandbox_token

crates/openshell-core/src/grpc_client.rs:242–281

Resolve the sandbox JWT used to authenticate every outbound RPC. `endpoint` is logged on errors but never used for transport here; the actual network call lives inside this function only on the K8s bootstrap path, which uses `plain_channel` to call `IssueSandboxToken` once before the steady-state Bearer-authenticated channel is built.

(endpoint: &str, plain_channel: &Channel)

/// bootstrap path, which uses `plain_channel` to call `IssueSandboxToken`
/// once before the steady-state Bearer-authenticated channel is built.
async fn acquire_sandbox_token(endpoint: &str, plain_channel: &Channel) -> Result<AcquiredToken> {
    if let Ok(t) = std::env::var(sandbox_env::SANDBOX_TOKEN)
        && !t.is_empty()
    {
        debug!(source = "env", "loaded sandbox token");
        return Ok(AcquiredToken {
            token: t,
            refresh_mode: RefreshMode::GatewayJwt(TokenSource::Env),
        });
    }

    if let Ok(path) = std::env::var(sandbox_env::SANDBOX_TOKEN_FILE)
        && !path.is_empty()
    {
        let contents = std::fs::read_to_string(&path)
            .into_diagnostic()
            .wrap_err_with(|| format!("failed to read sandbox token from {path}"))?;
        debug!(source = "file", path = %path, "loaded sandbox token");
        return Ok(AcquiredToken {
            token: contents.trim().to_string(),
            refresh_mode: RefreshMode::GatewayJwt(TokenSource::File),
        });
    }

    if let Ok(sa_path) = std::env::var(sandbox_env::K8S_SA_TOKEN_FILE)
        && !sa_path.is_empty()
    {
        return Ok(AcquiredToken {
            token: acquire_k8s_sandbox_token(endpoint, plain_channel, &sa_path).await?,
            refresh_mode: RefreshMode::GatewayJwt(TokenSource::K8sServiceAccount),
        });
    }

    Err(miette::miette!(
        "no sandbox token source available — set one of {}, {}, or {}",
        sandbox_env::SANDBOX_TOKEN,
        sandbox_env::SANDBOX_TOKEN_FILE,
        sandbox_env::K8S_SA_TOKEN_FILE,
    ))
}

async fn acquire_k8s_sandbox_token(
    endpoint: &str,