agentmux_srv/identity/
mod.rs

1// Copyright 2025-2026, AgentMux Corp.
2// SPDX-License-Identifier: Apache-2.0
3
4//! Identity injection at agent CLI spawn time.
5//!
6//! When an agent instance is launched, the launch modal records an
7//! `identity_id` on the `db_agent_instances` row (v7 schema). Right
8//! before the CLI subprocess starts, this module:
9//!
10//! 1. Looks up the active instance for the spawning block.
11//! 2. Reads its `identity_id` (a legacy filter value; credentials come
12//!    from the links in step 3, not from this).
13//! 3. Reads the direct `db_agent_identity_links` rows for the instance's
14//!    definition.
15//! 4. For each link: looks up the Account row, resolves its
16//!    `SecretRef` to a plaintext value, looks up the provider →
17//!    env-var matrix, and merges those env vars into the spawn
18//!    `env_vars` HashMap.
19//!
20//! Failure modes differ by provider class. An api-key-class failure
21//! (missing account, unresolvable secret, unknown provider) is logged and
22//! skipped. An oauth-class provider with no resolvable bound account
23//! blocks the spawn (`resolver::inject`'s `gate_oauth_failure`); there is
24//! no fallback to the user's global CLI login.
25//!
26//! Closes Phase 2 of issue #678 (the per-instance injection layer).
27//! Phase 1 (Account registry + UI) and the v7 schema reshape (Bundle
28//! entity) were prerequisites; Phase 3 (encrypted vault, OAuth flows)
29//! is deferred.
30
31pub mod account_email;
32pub mod auth_diag;
33pub mod auth_patterns;
34pub mod auth_session;
35pub mod browser_credential_store;
36pub mod cleanup;
37pub mod key_validator;
38pub mod oauth_client;
39pub mod resolver;
40pub mod secret_store;
41
42// Legacy convenience re-export — newer call sites use
43// `resolver::inject_identity_env_with_broker` directly so the OAuth
44// expiry probe (PR D, spec §4.4) can publish on status change. The
45// broker-less wrapper is kept for tests and is intentionally allowed
46// to be unused in production.
47#[allow(unused_imports)]
48pub use resolver::inject_identity_env;
agentmux_srv/identity/mod.rs

agentmux_srv/identity/
mod.rs
