---

Class ::nsmcp::FileCredentials

::nsmcp::FileCredentials create ... \
           [ -authenticator:required authenticator:required ] \
           [ -mutex mutex ] \
           [ -section:required section:required ] \
           [ -store:required store:required ]

Defined in /usr/local/ns/tcl/nsmcp/credentials.tcl

Class Relations

• class: ::nx::Class
• superclass: ::nsmcp::Object

::nx::Class create ::nsmcp::FileCredentials \
     -superclass ::nsmcp::Object

Methods (to be applied on instances)

• describe (scripted, public)

   <instance of nsmcp::FileCredentials> describe

  Describe loaded credential bindings without revealing tokens. Read the credential metadata under the instance mutex.

  Returns:

  The credential metadata returned by the unlocked descriptor helper.

  Testcases:

  No testcase defined.

  ns_mutex lock ${:mutex}
  try {
      return [:describeUnlocked]
  } finally {
      ns_mutex unlock ${:mutex}
  }

• load (scripted, public)

   <instance of nsmcp::FileCredentials> load name

  Reload one configured credential file. Validate and install the selected credential while serializing updates with the instance mutex.

  Parameters:

  name (required)

  Name of the configured or registered item to resolve.

  Returns:

  The loaded credential's metadata dictionary.

  Testcases:

  No testcase defined.

  ns_mutex lock ${:mutex}
  try {
      if {$name ni [:names]} {
          error "unknown configured credential name"
      }
      set prepared [:prepare $name]
      foreach other [nsv_array names ${:store}] {
          if {$other ne $name && [dict get [nsv_get ${:store} $other] digest] eq [dict get $prepared digest]} {
              error "configured credentials must use distinct tokens"
          }
      }
      set previous {}
      if {[nsv_exists ${:store} $name]} {
          set previous [dict get [nsv_get ${:store} $name] digest]
      }
      set metadata [:publish $name $prepared]
      if {$previous ne "" && $previous ne [dict get $prepared digest]} {
          ${:authenticator} revoke $previous
      }
      return $metadata
  } finally {
      ns_mutex unlock ${:mutex}
  }

• loadAll (scripted, public)

   <instance of nsmcp::FileCredentials> loadAll

  Load all configured credential files as one validated update. Stage every credential under the mutex before changing active authenticator bindings.

  Returns:

  Credential metadata without bearer-token contents.

  Testcases:

  No testcase defined.

  ns_mutex lock ${:mutex}
  try {
      # Validate every file/policy before changing any existing binding.
      set staged {}
      set digests {}
      foreach name [:names] {
          set prepared [:prepare $name]
          set digest [dict get $prepared digest]
          if {[dict exists $digests $digest]} {
              error "configured credentials must use distinct tokens"
          }
          dict set digests $digest $name
          dict set staged $name $prepared
      }
      foreach name [nsv_array names ${:store}] {
          ${:authenticator} revoke [dict get [nsv_get ${:store} $name] digest]
          nsv_unset ${:store} $name
      }
      dict for {name prepared} $staged {
          :publish $name $prepared
      }
      return [:describeUnlocked]
  } finally {
      ns_mutex unlock ${:mutex}
  }

• revoke (scripted, public)

   <instance of nsmcp::FileCredentials> revoke name

  Revoke the active binding for a loaded credential. Resolve the configured name to its stored digest and revoke that authenticator entry under the mutex.

  Parameters:

  name (required)

  Name of the configured or registered item to resolve.

  Returns:

  The authenticator's revocation result; unknown credentials raise an error.

  Testcases:

  No testcase defined.

  ns_mutex lock ${:mutex}
  try {
      if {![nsv_exists ${:store} $name]} {
          error "unknown loaded credential name"
      }
      ${:authenticator} revoke [dict get [nsv_get ${:store} $name] digest]
  } finally {
      ns_mutex unlock ${:mutex}
  }

---