subscription

Documentation

Overview

Package subscription yields the operator's LIVE Anthropic subscription OAuth access token from the resident ~/.claude credentials, so the egress proxy can inject a fresh token per request instead of the sandbox holding a COPY that goes stale (access-token expiry + refresh-token rotation lock the copy out).

Single-owner discipline: only the resident `claude` binary ever refreshes and rotates the token (it owns the atomic write-back and coordinates with the operator's other claude sessions). This provider only ever READS the file, and on the rare near-expiry path DELEGATES the refresh to `claude` — it never reimplements Anthropic's undocumented OAuth refresh_token flow.

Index

• type Config
• type Provider
  • func New(cfg Config) (Provider, error)
• type Token

Types

type Config

type Config struct {
	// CredPath is the path to the resident credentials file. Empty defaults to
	// ~/.claude/.credentials.json.
	CredPath string
	// ClaudeBin is the resident CLI used to delegate a refresh. Empty defaults
	// to "claude" (resolved against PATH).
	ClaudeBin string
	// RefreshMargin / RefreshTimeout override the defaults above (0 = default).
	RefreshMargin  time.Duration
	RefreshTimeout time.Duration
	// Now is overridable in tests; defaults to time.Now.
	Now func() time.Time
}

Config configures the resident-credentials provider.

type Provider

type Provider interface {
	Current(ctx context.Context) (Token, error)
	// Peek returns the resident token WITHOUT refreshing or delegating to `claude`
	// (read-only). It is for status/provenance surfaces that must not trigger a
	// refresh side effect; unlike Current it does NOT reject an expired token — the
	// expiry is returned for the caller to interpret against its own clock.
	Peek() (Token, error)
}

Provider yields the operator's current Anthropic subscription access token.

func New

func New(cfg Config) (Provider, error)

New builds a resident-credentials Provider. It does NOT verify the file or the binary at construction time (either may appear later); a missing token surfaces as a clear, fail-closed error on Current.

type Token

type Token struct {
	Value     string
	ExpiresAt time.Time
}

Token is a live subscription access token and its expiry.