[aroff]

Summary

AuthenticatedHttpClient::send(build) sends a request once with the bearer token and returns the response whatever its status.

The verb methods (get, post, …) go through RetryableHttpClient. That client turns any 4xx or 5xx into an anyhow error through error_for_status(), which drops the body. It also retries 5xx, 429 and network errors up to three times. Two kinds of client can't use that:

• an API that answers errors with a JSON body the caller decodes (a 409 conflict, a 422 with the reason);
• a write that must not be sent twice because the first attempt may have landed (a 503 after the commit, a timeout).

send keeps the auth-layer behaviour of execute_with_retry. On a 401 it invalidates the token, re-acquires it and sends once more; a second 401 is returned as the response. Nothing else is retried. NotAuthenticated (no cached login) surfaces as AuthError inside the anyhow::Error, and nothing is sent.

The existing methods are unchanged.

What could leak or be bypassed

• The token. It goes only into the Authorization header, as before. AccessToken's Debug stays redacted, and send logs nothing.
• A double write. Only a 401 resends, and a 401 means the request was refused before it was handled. Test: send_returns_an_error_answer_with_its_body_and_does_not_retry_it sends 400, 403, 409, 429, 500 and 503 with expect(1). send_does_not_retry_a_request_that_got_no_answer covers a refused connection.

Tests (tests/unit/auth_provider.rs)

• send_returns_an_error_answer_with_its_body_and_does_not_retry_it
• send_renews_the_token_once_on_401_and_returns_the_second_answer: token-v1 gets a 401, token-v2 gets a 201; invalidate is called once.
• send_returns_a_second_401_as_an_answer: two sends, the body is readable.
• send_surfaces_not_authenticated_and_sends_nothing_without_a_token
• send_does_not_retry_a_request_that_got_no_answer

Docs

• README "Using AuthenticatedHttpClient"
• the CONTEXT.md AuthenticatedHttpClient entry
• skill/references/auth-and-oidc.md

Checks

• cargo fmt --all -- --check
• cargo clippy --all-features -- -D warnings
• cargo test --all-features --test unit_auth_provider: 15 passed.

🤖 Generated with Claude Code