()
| 893 | """ |
| 894 | |
| 895 | def provider() -> str: |
| 896 | bundle = _read_oidc_token_bundle(gateway_dir) |
| 897 | if bundle is None: |
| 898 | raise SandboxError( |
| 899 | f"OIDC token for gateway '{cluster_name}' is missing or " |
| 900 | f"unreadable. Re-authenticate with: openshell gateway login" |
| 901 | ) |
| 902 | access_token = bundle.get("access_token") |
| 903 | if not isinstance(access_token, str) or not access_token: |
| 904 | raise SandboxError( |
| 905 | f"OIDC token for gateway '{cluster_name}' has no access " |
| 906 | f"token. Re-authenticate with: openshell gateway login" |
| 907 | ) |
| 908 | expires_at = bundle.get("expires_at") |
| 909 | if isinstance(expires_at, int): |
| 910 | now = int(time.time()) |
| 911 | if now + _OIDC_TOKEN_EXPIRY_GRACE_SECONDS >= expires_at: |
| 912 | raise SandboxError( |
| 913 | f"OIDC token for gateway '{cluster_name}' has expired. " |
| 914 | f"Re-authenticate with: openshell gateway login" |
| 915 | ) |
| 916 | return access_token |
| 917 | |
| 918 | return provider |
| 919 |
nothing calls this directly
no test coverage detected