Struct Authenticator 

pub struct Authenticator<K: Clock> { /* private fields */ }

Acquires and caches an OAuth2 client-credentials bearer token for Unity Catalog. Cheap to share; the token cache is internally synchronised.

Debug is implemented manually and never prints the client secret.

Implementations

impl<K: Clock> Authenticator<K>

pub const DEFAULT_TOKEN_PATH: &'static str = "/oidc/v1/token"

Default OAuth token endpoint on a Databricks workspace host.

pub const DEFAULT_REFRESH_SKEW_S: i64 = 300

Default refresh skew: renew 5 minutes before expiry, so a long-running operation never crosses the expiry with a token it acquired just before.

pub const MAX_TOKEN_TTL_S: i64 = 3600

Hard cap on how long a token is trusted, regardless of the endpoint’s expires_in. Unity Catalog / Databricks tokens live at most ~1 hour; if a response ever claims longer we still refresh within the hour rather than hold a token the server has already rotated.

pub fn new( client_id: impl Into<String>, client_secret: impl Into<String>, clock: K, ) -> Self

Construct an authenticator with the default token path and refresh skew.

pub fn with_token_path(self, path: impl Into<String>) -> Self

Builder: override the token endpoint path.

pub fn with_refresh_skew(self, seconds: i64) -> Self

Builder: override how far ahead of expiry the token is refreshed.

Larger values refresh more eagerly (safer for long operations, at the cost of a few extra token exchanges); it is clamped to at least 0.

pub async fn token(&self, client: &dyn UcClient) -> Result<String, AuthError>

Return a valid bearer token, reusing the cached one until it nears expiry and otherwise acquiring a fresh one via client.

Errors

Returns AuthError if the token endpoint is unreachable, returns a non-success status, or returns a body that cannot be parsed.

Trait Implementations

impl<K: Clock> Debug for Authenticator<K>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Redacts the client secret; the cached token is never printed.