├── model.rs            # Collection / SavedRequest / KeyValueRow / FieldDoc / OAuthConfig+AuthKind (serde)

    ├── secret.rs              # $(cmd) secret resolution via `sh -c`

    ├── send.rs                # send_with_auth: pick scheme; oauth cache/refresh + 401 retry

- **Auth is one struct, three schemes.** `OAuthConfig` (aliased `AuthConfig`)

  carries every scheme's fields, discriminated by `AuthKind` (`bearer` /

  `apikey` / `oauth2`). It stays a single flat JSON object so collections

  written before bearer/api-key support — whose `auth` has no `kind` — still

  deserialize (missing `kind` defaults to `oauth2`, which is what they were).

  The popup (`A`) builds its rows from `App::auth_fields` per kind; the first

  row is always the kind toggle. `send::send_with_auth` branches on the kind:

  bearer/apikey resolve their secret and send (no token cache, no 401 retry),

  oauth2 keeps the cache-and-retry path.

- **Secrets are plaintext, but can be indirected.** Secret fields

  (`token`, `client_secret`) are saved as-is in the collection JSON (explicit

  user choice). To avoid that, a field may hold a single `$(…)` command

  substitution — `http::resolve_secret` runs it through `sh -c` at send time

  and uses the trimmed stdout. Only a value that is *entirely* `$(…)` is

  executed, never one embedded in a longer string. The in-memory `OAuthToken`

  is never persisted.

Swagger 2.0, interactive OAuth flows (auth-code / device / implicit — only

client-credentials is automated; bearer and API-key are static),

- **Auth per collection** — a fixed bearer token, an API key in a header of

  your choice, or the OAuth2 client-credentials flow (tokens cached in memory

  only). Press `A` to configure.

- **Secrets from your shell** — any secret field (bearer token, API key,

  OAuth client secret) can be a `$(…)` command, resolved at send time, e.g.

  `$(op read "op://vault/item/field")`.

use crate::model::{

    AuthKind, Collection, KeyValueRow, LabelMode, OAuthConfig, SavedRequest, variables_map,

};

    /// Index into [`App::auth_fields`] for the current auth kind. An index (not

    /// the [`AuthField`] itself) so the enum stays `Copy`-cheap and the cursor

    /// and edit target share one notion of "which row".

}

/// One editable row in the auth popup. Which rows show depends on the selected

/// [`AuthKind`]; [`App::auth_fields`] builds the list.

#[derive(Debug, Clone, Copy, PartialEq, Eq)]

pub enum AuthField {

    /// The scheme selector (a toggle, not a text field).

    Kind,

    /// Bearer token, or API-key value (secret).

    Token,

    /// API-key header name.

    Header,

    TokenUrl,

    ClientId,

    ClientSecret,

    Scopes,

    /// OAuth client-auth placement (a toggle, not a text field).

    Style,

}

impl AuthField {

    /// Rows that carry a secret and should render masked.

    pub fn is_secret(self) -> bool {

        matches!(self, AuthField::Token | AuthField::ClientSecret)

    }

    /// Rows edited by toggling rather than typing.

    pub fn is_toggle(self) -> bool {

        matches!(self, AuthField::Kind | AuthField::Style)

    }

        // A brand-new config defaults to bearer — the simplest scheme, and the

        // one this popup mostly exists to make reachable. Existing configs open

        // on whatever `kind` they were saved with.

        self.auth_form = self.collection.auth.clone().unwrap_or(OAuthConfig {

            kind: AuthKind::Bearer,

            ..Default::default()

        });

    /// The rows shown for the form's current auth kind, in display order. Always

    /// leads with [`AuthField::Kind`] so the scheme is switchable from any state.

    pub fn auth_fields(&self) -> Vec<AuthField> {

        let mut fields = vec![AuthField::Kind];

        match self.auth_form.kind {

            AuthKind::Bearer => fields.push(AuthField::Token),

            AuthKind::ApiKey => fields.extend([AuthField::Header, AuthField::Token]),

            AuthKind::Oauth2 => fields.extend([

                AuthField::TokenUrl,

                AuthField::ClientId,

                AuthField::ClientSecret,

                AuthField::Scopes,

                AuthField::Style,

            ]),

        }

        fields

    }

    /// The [`AuthField`] under the cursor, resolving `auth_field` against the

    /// current kind's row list (clamped, so a stale index never panics).

    pub fn auth_field_at(&self, i: usize) -> AuthField {

        let fields = self.auth_fields();

        fields[i.min(fields.len() - 1)]

    }

    pub fn auth_field_label(&self, field: AuthField) -> &'static str {

        match field {

            AuthField::Kind => "Auth type",

            AuthField::Token => match self.auth_form.kind {

                AuthKind::ApiKey => "API key value",

                _ => "Bearer token",

            },

            AuthField::Header => "Header name",

            AuthField::TokenUrl => "Token URL",

            AuthField::ClientId => "Client ID",

            AuthField::ClientSecret => "Client Secret",

            AuthField::Scopes => "Scopes (space separated)",

            AuthField::Style => "Auth style",

        }

    }

        match self.auth_field_at(i) {

            AuthField::Kind => self.auth_form.kind.title().to_string(),

            AuthField::Token => self.auth_form.token.clone(),

            AuthField::Header => self.auth_form.header.clone(),

            AuthField::TokenUrl => self.auth_form.token_url.clone(),

            AuthField::ClientId => self.auth_form.client_id.clone(),

            AuthField::ClientSecret => self.auth_form.client_secret.clone(),

            AuthField::Scopes => self.auth_form.scopes.join(" "),

            AuthField::Style => match self.auth_form.auth_style {

        match self.auth_field_at(i) {

            AuthField::Token => self.auth_form.token = value.to_string(),

            AuthField::Header => self.auth_form.header = value.to_string(),

            AuthField::TokenUrl => self.auth_form.token_url = value.to_string(),

            AuthField::ClientId => self.auth_form.client_id = value.to_string(),

            AuthField::ClientSecret => self.auth_form.client_secret = value.to_string(),

            AuthField::Scopes => {

                self.auth_form.scopes = value.split_whitespace().map(String::from).collect()

            }

            // Toggles carry no typed value.

            AuthField::Kind | AuthField::Style => {}

    /// Advance the toggle under the cursor. `Kind` cycles the scheme (which

    /// changes the row list — the cursor stays put on `Kind` at index 0), and

    /// `Style` flips the OAuth client-auth placement. No-op on text fields.

    pub fn toggle_auth_field(&mut self, i: usize) {

        match self.auth_field_at(i) {

            AuthField::Kind => self.auth_form.kind = self.auth_form.kind.next(),

            AuthField::Style => {

                self.auth_form.auth_style = match self.auth_form.auth_style {

                    crate::model::AuthStyle::Basic => crate::model::AuthStyle::Post,

                    crate::model::AuthStyle::Post => crate::model::AuthStyle::Basic,

                }

            }

            _ => {}

        }

    /// Apply the auth form to the collection (called when the popup closes). A

    /// form with no meaningful field set clears auth entirely, so cycling to a

    /// scheme and leaving it blank doesn't attach an unusable config.

        let f = &self.auth_form;

        let empty = f.token.is_empty()

            && f.header.is_empty()

            && f.token_url.is_empty()

            && f.client_id.is_empty()

            && f.client_secret.is_empty()

            && f.scopes.is_empty();

/// header unless the request already defines one. `extra_headers` (e.g. an API

/// key) are added the same way — only for names the request didn't set itself.

    extra_headers: &[(String, String)],

        }

        headers.insert(name, value);

    }

    // Auth-supplied headers defer to anything the request set explicitly.

    for (key, val) in extra_headers {

        let name = HeaderName::from_bytes(key.as_bytes())

            .map_err(|e| anyhow!("invalid header name {key:?}: {e}"))?;

        if headers.contains_key(&name) {

            continue;

        }

        let value = HeaderValue::from_str(val)

            .map_err(|e| anyhow!("invalid value for header {key:?}: {e}"))?;

        if name == AUTHORIZATION {

            has_auth = true;

pub mod secret;

pub use secret::resolve_secret;

use super::secret::resolve_secret;

    // The client secret may be a `$(…)` command (e.g. a password manager read);

    // resolve it just before the exchange so it never sits in memory longer.

    let client_secret =

        resolve_secret(&cfg.client_secret).context("resolving OAuth client secret")?;

            rb = rb.basic_auth(cfg.client_id.clone(), Some(client_secret));

            form.push(("client_secret", client_secret));

//! Resolving secret values that shell out, e.g.

//! `$(op read "op://vault/item/field")`.

use anyhow::{Context, Result, bail};

use std::process::Command;

/// If `value` is *entirely* a single `$(…)` command substitution, run the inner

/// command through `sh -c` and return its trimmed stdout. Anything else is

/// returned unchanged — the whole value must be the substitution, so a literal

/// `$(...)` embedded in a longer string is never executed by accident.

pub fn resolve_secret(value: &str) -> Result<String> {

    let Some(cmd) = command_substitution(value) else {

        return Ok(value.to_string());

    };

    let output = Command::new("sh")

        .arg("-c")

        .arg(cmd)

        .output()

        .with_context(|| format!("running secret command `{cmd}`"))?;

    if !output.status.success() {

        let stderr = String::from_utf8_lossy(&output.stderr);

        bail!(

            "secret command `{cmd}` failed ({}): {}",

            output.status,

            stderr.trim()

        );

    }

    Ok(String::from_utf8_lossy(&output.stdout).trim().to_string())

}

/// The command inside a value shaped exactly like `$( … )`, or `None`.

fn command_substitution(value: &str) -> Option<&str> {

    let trimmed = value.trim();

    let inner = trimmed.strip_prefix("$(")?.strip_suffix(')')?.trim();

    (!inner.is_empty()).then_some(inner)

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn plain_values_pass_through() {

        assert_eq!(resolve_secret("hunter2").unwrap(), "hunter2");

        // A `$(…)` that isn't the whole value is left untouched.

        assert_eq!(

            resolve_secret("Bearer $(echo x)").unwrap(),

            "Bearer $(echo x)"

        );

        assert_eq!(resolve_secret("$()").unwrap(), "$()");

    }

    #[test]

    fn command_substitution_runs_and_trims() {

        assert_eq!(resolve_secret("$(printf 'sk-123')").unwrap(), "sk-123");

        // Surrounding whitespace on the value and on the output are both dropped.

        assert_eq!(resolve_secret("  $(echo padded)  ").unwrap(), "padded");

    }

    #[test]

    fn failing_command_is_an_error() {

        let err = resolve_secret("$(exit 3)").unwrap_err().to_string();

        assert!(err.contains("failed"), "unexpected error: {err}");

    }

}

//! App-level send orchestration: pick the auth scheme, and for OAuth cache the

//! token + retry once on 401.

use super::secret::resolve_secret;

use crate::model::{AuthKind, OAuthConfig, SavedRequest};

    /// Latest OAuth token cache (unchanged on failure, refreshed on (re)fetch).

    /// Always `None` for the bearer/API-key schemes, which hold no cache.

/// Send a request under the collection's auth scheme:

/// - **none** — send as-is.

/// - **bearer** — resolve the token (may be a `$(…)` secret) and send it as

///   `Authorization: Bearer …`.

/// - **apikey** — resolve the value and send it in the configured header.

/// - **oauth2** — reuse a cached client-credentials token while valid, fetch

///   one otherwise, and retry the request once with a fresh token on a 401.

    let Some(cfg) = auth.filter(|c| c.is_configured()) else {

        let result = send_request(client, base_url, req, vars, None, &[])

            .await

            .map_err(|e| format!("{e:#}"));

        return SendOutcome {

            result,

            token: cached,

        };

    };

    match cfg.kind {

        AuthKind::Bearer => {

            let token = match resolve_secret(&cfg.token) {

                Ok(t) => t,

                Err(e) => return secret_error(e, cached),

            };

            let result = send_request(client, base_url, req, vars, Some(&token), &[])

                .await

                .map_err(|e| format!("{e:#}"));

            SendOutcome {

                result,

                token: cached,

            }

        }

        AuthKind::ApiKey => {

            let value = match resolve_secret(&cfg.token) {

                Ok(v) => v,

                Err(e) => return secret_error(e, cached),

            };

            let extra = [(cfg.api_key_header().to_string(), value)];

            let result = send_request(client, base_url, req, vars, None, &extra)

                .await

                .map_err(|e| format!("{e:#}"));

            SendOutcome {

                result,

                token: cached,

            }

        }

        AuthKind::Oauth2 => oauth_send(client, base_url, req, vars, cfg, cached).await,

    }

}

fn secret_error(e: anyhow::Error, token: Option<OAuthToken>) -> SendOutcome {

    SendOutcome {

        result: Err(format!("secret resolution failed: {e:#}")),

        token,

    }

}

async fn oauth_send(

    client: &reqwest::Client,

    base_url: &str,

    req: &SavedRequest,

    vars: &HashMap<String, String>,

    cfg: &OAuthConfig,

    cached: Option<OAuthToken>,

) -> SendOutcome {

    let stale = token.as_ref().map(|t| !token_valid(t)).unwrap_or(true);

    if stale {

        match fetch_token(client, cfg).await {

            Ok(t) => token = Some(t),

            Err(e) => {

                return SendOutcome {

                    result: Err(format!("token fetch failed: {e:#}")),

                    token,

                };

    let mut bearer = token.as_ref().map(|t| t.access_token.clone());

    let mut resp = send_request(client, base_url, req, vars, bearer.as_deref(), &[])

    if let Ok(r) = &resp

        resp = send_request(client, base_url, req, vars, bearer.as_deref(), &[])

        Popup::Auth => {

            let count = app.auth_fields().len();

            match key.code {

                KeyCode::Esc => {

                    app.apply_auth_form();

                    app.popup = Popup::None;

                    app.status = "Auth config saved".into();

                KeyCode::Char('j') | KeyCode::Down | KeyCode::Tab => {

                    app.auth_field = (app.auth_field + 1) % count;

                }

                KeyCode::Char('k') | KeyCode::Up | KeyCode::BackTab => {

                    app.auth_field = (app.auth_field + count - 1) % count;

                }

                KeyCode::Enter | KeyCode::Char('i') => {

                    if app.auth_field_at(app.auth_field).is_toggle() {

                        app.toggle_auth_field(app.auth_field);

                    } else {

                        app.start_edit(EditTarget::AuthField(app.auth_field));

                    }

                }

                KeyCode::Char(' ') if app.auth_field_at(app.auth_field).is_toggle() => {

                    app.toggle_auth_field(app.auth_field);

                }

                _ => {}

        }

/// Which authentication scheme a collection uses. `Oauth2` is the default so

/// collections written before bearer/api-key support (their `auth` object has

/// no `kind`) keep loading as the client-credentials config they were.

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]

#[serde(rename_all = "lowercase")]

pub enum AuthKind {

    #[default]

    Oauth2,

    /// A fixed bearer token sent as `Authorization: Bearer <token>`.

    Bearer,

    /// A fixed value sent in an arbitrary header (defaults to `X-API-Key`).

    #[serde(rename = "apikey")]

    ApiKey,

}

impl AuthKind {

    pub const ALL: [AuthKind; 3] = [AuthKind::Bearer, AuthKind::ApiKey, AuthKind::Oauth2];

    pub fn next(self) -> Self {

        let i = Self::ALL.iter().position(|k| *k == self).unwrap_or(0);

        Self::ALL[(i + 1) % Self::ALL.len()]

    }

    pub fn title(self) -> &'static str {

        match self {

            AuthKind::Oauth2 => "oauth2",

            AuthKind::Bearer => "bearer",

            AuthKind::ApiKey => "apikey",

        }

    }

}

/// Header used for API-key auth when the user leaves the header name blank.

pub const DEFAULT_API_KEY_HEADER: &str = "X-API-Key";

/// Per-collection authentication. One struct carries every scheme's fields

/// (discriminated by `kind`) so the on-disk shape stays a single flat object

/// and older OAuth-only collections deserialize unchanged.

///

/// Secret-bearing fields (`token`, `client_secret`) may hold a `$(…)` command

/// substitution, resolved at send time — see [`crate::http::resolve_secret`].

    pub kind: AuthKind,

    /// Bearer token, or API-key value (secret; supports `$(…)`).

    #[serde(default)]

    pub token: String,

    /// Header name for `ApiKey` auth; empty means [`DEFAULT_API_KEY_HEADER`].

    #[serde(default)]

    pub header: String,

    #[serde(default)]

/// Historical name; `OAuthConfig` now covers every scheme via its `kind`.

pub type AuthConfig = OAuthConfig;

    /// Whether the active scheme has enough filled in to attempt auth.

        match self.kind {

            AuthKind::Oauth2 => !self.token_url.is_empty() && !self.client_id.is_empty(),

            AuthKind::Bearer | AuthKind::ApiKey => !self.token.is_empty(),

        }

    }

    /// The header name to carry an API key, falling back to the default.

    pub fn api_key_header(&self) -> &str {

        if self.header.trim().is_empty() {

            DEFAULT_API_KEY_HEADER

        } else {

            self.header.trim()

        }

            ..Default::default()

            ..Default::default()

        Line::raw("  A            auth config (bearer / API key / OAuth2)"),

    use crate::app::AuthField;

    use crate::model::{AuthKind, AuthStyle};

        .title(" Auth — j/k: field · i/Enter: edit · space: toggle · Esc: save & close ")

    let fields = app.auth_fields();

    for (i, field) in fields.iter().enumerate() {

        let value = match field {

            AuthField::Kind => toggle_row(app.auth_form.kind, AuthKind::ALL, AuthKind::title),

            AuthField::Style => toggle_row(

                app.auth_form.auth_style,

                [AuthStyle::Basic, AuthStyle::Post],

                |s| match s {

                    AuthStyle::Basic => "basic",

                    AuthStyle::Post => "post",

                },

            ),

            f if f.is_secret() && !app.auth_field_value(i).is_empty() => "••••••••".to_string(),

            _ => app.auth_field_value(i),

        let label = app.auth_field_label(*field);

    // A hint that secret fields understand `$(…)` command substitution.

    if fields.iter().any(|f| f.is_secret()) {

        lines.push(Line::raw(""));

        lines.push(Line::styled(

            " secret fields accept $(cmd), e.g. $(op read \"op://vault/item/field\")",

            Style::default().fg(Color::DarkGray),

        ));

    }

/// Render a toggle field as its options with the active one bracketed, e.g.

/// `[bearer]  apikey  oauth2`.

fn toggle_row<T: PartialEq + Copy, const N: usize>(

    current: T,

    all: [T; N],

    label: impl Fn(T) -> &'static str,

) -> String {

    all.iter()

        .map(|opt| {

            let name = label(*opt);

            if *opt == current {

                format!("[{name}]")

            } else {

                format!(" {name} ")

            }

        })

        .collect::<Vec<_>>()

        .join(" ")

}

        ..Default::default()

use cielago::http::{fetch_token, send_request, send_with_auth};

use cielago::model::{AuthKind, AuthStyle, KeyValueRow, Method, OAuthConfig, SavedRequest};

    let resp = send_request(&client, &server.uri(), &req, &vars, None, &[])

        ..Default::default()

        ..Default::default()

    send_request(

        &client,

        &server.uri(),

        &req,

        &HashMap::new(),

        Some("tok-1"),

        &[],

    )

    .await

    .unwrap();

        &[],

#[tokio::test]

async fn api_key_auth_resolves_shell_secret_into_header() {

    let server = MockServer::start().await;

    Mock::given(method("GET"))

        .and(path("/x"))

        .respond_with(ResponseTemplate::new(200))

        .mount(&server)

        .await;

    // Value is a `$(…)` command substitution, resolved at send time.

    let cfg = OAuthConfig {

        kind: AuthKind::ApiKey,

        token: "$(printf 'sk-secret')".into(),

        header: "X-Api-Key".into(),

        ..Default::default()

    };

    let req = SavedRequest::blank("x");

    let client = reqwest::Client::new();

    let outcome = send_with_auth(

        &client,

        &server.uri(),

        &req,

        &HashMap::new(),

        Some(&cfg),

        None,

    )

    .await;

    assert!(outcome.result.is_ok(), "{:?}", outcome.result.err());

    assert!(outcome.token.is_none());

    let received = server.received_requests().await.unwrap();

    assert_eq!(

        received[0]

            .headers

            .get("x-api-key")

            .unwrap()

            .to_str()

            .unwrap(),

        "sk-secret"

    );

}

#[tokio::test]

async fn bearer_auth_sends_resolved_token() {

    let server = MockServer::start().await;

    Mock::given(method("GET"))

        .and(path("/x"))

        .respond_with(ResponseTemplate::new(200))

        .mount(&server)

        .await;

    let cfg = OAuthConfig {

        kind: AuthKind::Bearer,

        token: "plain-tok".into(),

        ..Default::default()

    };

    let req = SavedRequest::blank("x");

    let client = reqwest::Client::new();

    let outcome = send_with_auth(

        &client,

        &server.uri(),

        &req,

        &HashMap::new(),

        Some(&cfg),

        None,

    )

    .await;

    assert!(outcome.result.is_ok(), "{:?}", outcome.result.err());

    let received = server.received_requests().await.unwrap();

    assert_eq!(

        received[0]

            .headers

            .get("authorization")

            .unwrap()

            .to_str()

            .unwrap(),

        "Bearer plain-tok"

    );

}

    let resp = send_request(

        &client,

        &parts.origin.unwrap(),

        &req,

        &HashMap::new(),

        None,

        &[],

    )

    .await

    .unwrap();

    use cielago::model::AuthKind;

    // Field 0 is the kind toggle, defaulting to bearer for a fresh config.

    // Cycle it to oauth2 (bearer -> apikey -> oauth2).

    handle_key(&mut app, char_key(' '));

    handle_key(&mut app, char_key(' '));

    assert_eq!(app.auth_form.kind, AuthKind::Oauth2);

    // Now the oauth rows show: 1 = token url, 2 = client id, 5 = style.

    handle_key(&mut app, char_key('j'));

    // style toggle: field 5

    assert_eq!(app.auth_field, 5);

    assert_eq!(auth.kind, AuthKind::Oauth2);

}

#[test]

fn auth_popup_sets_bearer_token() {

    use cielago::model::AuthKind;

    let mut app = test_app();

    handle_key(&mut app, char_key('A'));

    // Defaults to bearer; field 1 is the token.

    assert_eq!(app.auth_form.kind, AuthKind::Bearer);

    handle_key(&mut app, char_key('j'));

    handle_key(&mut app, char_key('i'));

    type_str(&mut app, "sk-live-123");

    handle_key(&mut app, key(KeyCode::Enter));

    handle_key(&mut app, key(KeyCode::Esc));

    let auth = app.collection.auth.as_ref().unwrap();

    assert_eq!(auth.kind, AuthKind::Bearer);

    assert_eq!(auth.token, "sk-live-123");

}

#[test]

fn auth_popup_sets_api_key_header() {

    use cielago::model::AuthKind;

    let mut app = test_app();

    handle_key(&mut app, char_key('A'));

    // bearer -> apikey.

    handle_key(&mut app, char_key(' '));

    assert_eq!(app.auth_form.kind, AuthKind::ApiKey);

    // apikey rows: 1 = header name, 2 = value.

    handle_key(&mut app, char_key('j'));

    handle_key(&mut app, char_key('i'));

    type_str(&mut app, "X-Custom-Key");

    handle_key(&mut app, key(KeyCode::Enter));

    handle_key(&mut app, char_key('j'));

    handle_key(&mut app, char_key('i'));

    type_str(&mut app, "abc123");

    handle_key(&mut app, key(KeyCode::Enter));

    handle_key(&mut app, key(KeyCode::Esc));

    let auth = app.collection.auth.as_ref().unwrap();

    assert_eq!(auth.kind, AuthKind::ApiKey);

    assert_eq!(auth.header, "X-Custom-Key");

    assert_eq!(auth.token, "abc123");

    assert_eq!(auth.api_key_header(), "X-Custom-Key");