Function ResolveAuthProvider

auth/resolver.go:35–82

ResolveAuthProvider resolves credentials for the given provider and returns a TokenProvider that refreshes OAuth tokens transparently. Lookup order: 1. Auth-profiles store (first match by provider). 2. Environment variables. The returned provider is alive: callers that retain it across requests get

(ctx context.Context, provider ProviderID, logger *zap.Logger)

// Caller is responsible for calling Close() when discarding the provider
// (typically the LLMManager owns and closes them).
func ResolveAuthProvider(ctx context.Context, provider ProviderID, logger *zap.Logger) (TokenProvider, error) {
	store := LoadStore(logger)
	for id, c := range store.Profiles {
		if c == nil {
			continue
		}
		if !isProviderMatch(c.Provider, provider) {
			continue
		}
		switch c.CredType {
		case CredentialOAuth:
			tp := newOAuthTokenProvider(c, id, "auth-store", logger)
			return tp, nil
		case CredentialToken:
			key := strings.TrimSpace(c.Token)
			if key == "" {
				continue
			}
			return &staticTokenProvider{
				token:     key,
				mode:      AuthModeToken,
				provider:  provider,
				profileID: id,
				source:    "auth-store",
				email:     c.Email,
			}, nil
		case CredentialAPIKey:
			key := strings.TrimSpace(c.Key)
			if key == "" {
				continue
			}
			return &staticTokenProvider{
				token:     key,
				mode:      AuthModeAPIKey,
				provider:  provider,
				profileID: id,
				source:    "auth-store",
				email:     c.Email,
			}, nil
		}
	}

	if tp := envFallbackProvider(provider); tp != nil {
		return tp, nil
	}

	return nil, fmt.Errorf("%s", i18n.T("auth.resolver.no_credentials", provider))
}

func envFallbackProvider(provider ProviderID) TokenProvider {
	switch provider {