jpm.plat.cli.auth

Cross-platform token caching for CLI authentication using OS keychain storage.

Overview

• Stores tokens per server under the key {serviceName}.jwt.{serverId}.
• Uses OS-specific cache accessors (DPAPI file on Windows, Keychain on macOS, Secret Service on Linux).
• If the cache accessor is unavailable, tokens are not persisted and a warning should be shown.

Basic usage

services.AddKeychainTokenStore(options => { options.ServiceName = "jpm.plat"; options.CacheFilePath = "token-cache.dat"; }); services.AddSingleton(provider => new TokenManager( provider.GetRequiredService<ITokenStore>(), provider.GetRequiredService<IAuthClient>(), _ => { console.MarkupLine("[yellow]Token cache unavailable; credentials will not be stored.[/]"); return Task.CompletedTask; })); var accessToken = await tokenManager.GetAccessTokenAsync(serverId, cancellationToken);

Notes

• Ensure serverId is stable (e.g., normalized server URL).
• Refresh happens silently when the access token is expired or near expiry.