Gives tools the credentials of whoever the turn acts for.

Use it when a tool acts as a person, with their own token. For your own API keys, see WardrikCore.Keys.

defmodule MyApp.Vault do
  @behaviour WardrikCore.Credentials

  @impl true
  def resolve(_name, nil, _opts), do: {:error, "There's no one to act for."}

  def resolve(name, %WardrikCore.Principal{id: id}, _opts) do
    case MyApp.Tokens.get(id, name) do
      %{access_token: token} -> {:ok, token}
      nil -> {:authorize, "https://app.example.com/connect/#{name}"}
    end
  end
end

Give it to an agent as credentials: {MyApp.Vault, opts}. A tool then fetches what it needs:

run: fn %{title: title}, context ->
  with {:ok, token} <- WardrikCore.Credentials.fetch(context, "github") do
    GitHub.create_issue(token, title)
  end
end

If the person hasn't granted the credential yet, the call parks on a WardrikCore.Authorization. Once they've signed in, resume the turn and the call runs again.

If a service refuses a credential, such as with a 401, call refused/2 and fetch again. The module should return a fresh credential, or a new sign-in.

Credentials are never kept in the context, so they're never saved or emitted. Keep them out of private data and attributes too.

See the Credentials guide.