omnigraph/crates/omnigraph-server
andrew af41630520 Extract TokenSource trait for bearer token loading
Pure refactor. No behavior change. Introduces a TokenSource trait so
additional backends (AWS Secrets Manager, Vault, etc.) can plug in
behind feature flags without touching the server wiring.

- New module crates/omnigraph-server/src/auth.rs with the TokenSource
  trait and a single EnvOrFileTokenSource implementation that delegates
  to the existing server_bearer_tokens_from_env() function.
- serve() now constructs EnvOrFileTokenSource and calls load() instead
  of calling the free function directly.
- The trait has a supports_refresh() hook (false for env/file) for
  future implementations that can rotate without restart.
- async-trait added to omnigraph-server deps; it's already in the
  workspace.

Tests:
- Unit tests in auth.rs covering load paths and the default supports_refresh
  / name values.
- Existing 128 tests (lib + integration + openapi) pass unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-18 03:31:43 +03:00
..
src Extract TokenSource trait for bearer token loading 2026-04-18 03:31:43 +03:00
tests Harden bearer auth: constant-time compare, hashed at rest, authoritative actor_id 2026-04-18 01:41:02 +03:00
Cargo.toml Extract TokenSource trait for bearer token loading 2026-04-18 03:31:43 +03:00