rock
c338d33ccb
Phase 6.6: Add Authentik Service Account (OAuth2 client_credentials)
AuthentikServiceAccount:
├─ OAuth2 client_credentials flow
├─ Token caching with TTL (refresh 60s before expiry)
├─ Auto-renewal on cache miss/expiry
├─ Thread-safe: Arc<RwLock<Option<CachedToken>>>
└─ Tests: 5 unit tests (all passing)
Configuration:
├─ client_id: "poimen-memory-service" (from Authentik)
├─ client_secret: encrypted via SOPS
├─ token_endpoint: https://authentik.riotpiao.com/application/o/token/
└─ cache_ttl_secs: 3600 (default)
Usage:
let sa = AuthentikServiceAccount::new(config);
let token = sa.get_token().await?; // Returns cached or fresh
Compilation: ✅