synthigy.client.auth — com.synthigy/sdk 0.1.1

clj

Token providers for the Synthigy client.

A provider is a map {:token-fn f :invalidate-fn g}:

:token-fn — 0-arg returning a default bearer token. Optional 1-arg variant (token-fn audience) returns a token for another service that trusts Synthigy as IdP. :invalidate-fn — 0-arg clearing the provider's cache so the next token-fn call refetches. 1-arg variant clears a specific audience. Optional.

The SDK calls token-fn before every request; on HTTP 401 it calls invalidate-fn (if present) and retries once. How tokens are fetched, cached, or refreshed is entirely the provider's concern — this ns ships two sensible defaults:

(static token) — one fixed token, no refresh (oauth {:client-id ...}) — client-credentials flow, caches per audience, refreshes before expiry

cljs

Token providers for the Synthigy CLJS client.

A provider is a map {:token-fn f :invalidate-fn g}:

:token-fn — 0-arg returning a bearer token (string or Promise<string>). Optional 1-arg variant (token-fn audience) for IdP federation. :invalidate-fn — 0/1-arg clearing the provider's cache so the next token-fn call refetches.

The SDK calls token-fn before every request; on HTTP 401 it calls invalidate-fn (if present) and retries once. The two defaults shipped here cover 90% of SDK use — teams wanting OIDC / PKCE / silent renew should plug their own :token-fn / :invalidate-fn in.

no-token-error clj

(no-token-error)

The teaching throw — PLAN-EXEC-IDENTITY step 3: the error IS the UX, no flag, no silent anonymous fallback.

oauth clj/s≠

clj

(oauth {:keys [token-url client-id client-secret token-buffer audience]
        :or {token-buffer 30 audience (System/getenv "SYNTHIGY_AUDIENCE")}
        :as config})

OAuth client-credentials provider.

Options: :token-url — required; full URL of the token endpoint :client-id — required :client-secret — required :audience — default audience for every mint; the platform's audience model is opt-in, and a mint naming none resolves to the identity-only OIDC audience that /data rejects. Defaults to $SYNTHIGY_AUDIENCE. :token-buffer — seconds before expiry to refresh (default 30)

Tokens are cached per audience (nil = default). The returned map plugs straight into create-client opts via merge.

cljs

(oauth {:keys [token-url client-id client-secret token-buffer audience]
        :or {token-buffer 30}
        :as config})

OAuth client-credentials provider.

Options: :token-url — required; full URL of the token endpoint :client-id — required :client-secret — required :audience — default audience for every mint; the platform's audience model is opt-in, and a mint naming none resolves to the identity-only OIDC audience that /data rejects. :token-buffer — seconds before expiry to refresh (default 30)

Tokens are cached per audience (nil = default). :token-fn returns a Promise<string>.

static clj/s≠

(static token)

clj

Provider wrapping a single pre-fetched token. invalidate-fn is a no-op — there's nothing to refresh.

cljs

Provider wrapping a single pre-fetched token.

supervised clj

(supervised)

Provider for SYNTHIGY_SUPERVISED=1 — asks auth.token over the process's own stdio instead of minting locally; the CLI/commander is the platform's stdio owner (PLAN-EXEC-IDENTITY step 2). A thin handle onto a process-wide reader + cache: every supervised provider constructed in one process shares one stdin reader and one token cache instead of each asking the parent independently.