From 65533f486ba1afc27dd47738384b6af896f707f0 Mon Sep 17 00:00:00 2001
From: Bryan Helmkamp <bryan@brynary.com>
Date: Thu, 23 Apr 2026 21:03:05 -0400
Subject: [PATCH] refactor(auth): move auth_issue_message to resolve

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../fabro-auth/src/credential_source.rs       | 39 -------------------
 lib/crates/fabro-auth/src/lib.rs              |  4 +-
 lib/crates/fabro-auth/src/resolve.rs          | 31 +++++++++++++++
 3 files changed, 33 insertions(+), 41 deletions(-)

diff --git a/lib/crates/fabro-auth/src/credential_source.rs b/lib/crates/fabro-auth/src/credential_source.rs
index 1f5c3b84a..bba9f4600 100644
--- a/lib/crates/fabro-auth/src/credential_source.rs
+++ b/lib/crates/fabro-auth/src/credential_source.rs
@@ -15,42 +15,3 @@ pub trait CredentialSource: Send + Sync {
 
     async fn configured_providers(&self) -> Vec<Provider>;
 }
-
-#[must_use]
-pub fn auth_issue_message(provider: Provider, err: &ResolveError) -> String {
-    match err {
-        ResolveError::NotConfigured(_) => {
-            format!("{} is not configured", provider.display_name())
-        }
-        ResolveError::RefreshFailed { source, .. } => format!(
-            "{} requires re-authentication: {}",
-            provider.display_name(),
-            source
-        ),
-        ResolveError::RefreshTokenMissing(_) => format!(
-            "{} requires re-authentication: refresh token missing",
-            provider.display_name()
-        ),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use fabro_model::Provider;
-
-    use super::auth_issue_message;
-    use crate::ResolveError;
-
-    #[test]
-    fn auth_issue_message_formats_refresh_token_missing() {
-        let message = auth_issue_message(
-            Provider::OpenAi,
-            &ResolveError::RefreshTokenMissing(Provider::OpenAi),
-        );
-
-        assert_eq!(
-            message,
-            "OpenAI requires re-authentication: refresh token missing"
-        );
-    }
-}
diff --git a/lib/crates/fabro-auth/src/lib.rs b/lib/crates/fabro-auth/src/lib.rs
index 50c0d5ece..c845930da 100644
--- a/lib/crates/fabro-auth/src/lib.rs
+++ b/lib/crates/fabro-auth/src/lib.rs
@@ -15,12 +15,12 @@ pub use credential::{
     ApiKeyHeader, AuthCredential, AuthDetails, OAuthConfig, OAuthTokens, credential_id_for,
     parse_credential_secret,
 };
-pub use credential_source::{CredentialSource, ResolvedCredentials, auth_issue_message};
+pub use credential_source::{CredentialSource, ResolvedCredentials};
 pub use env_source::EnvCredentialSource;
 pub use refresh::refresh_oauth_credential;
 pub use resolve::{
     ApiCredential, CliAgentKind, CliCredential, CredentialResolver, CredentialUsage, EnvLookup,
-    ResolveError, ResolvedCredential, configured_providers_from_process_env,
+    ResolveError, ResolvedCredential, auth_issue_message, configured_providers_from_process_env,
 };
 pub use strategy::{
     AuthMethod, AuthStrategy, CODEX_AUTH_URL, CODEX_CLIENT_ID, CODEX_TOKEN_URL, codex_oauth_config,
diff --git a/lib/crates/fabro-auth/src/resolve.rs b/lib/crates/fabro-auth/src/resolve.rs
index d2b4319f7..84bcf9fe7 100644
--- a/lib/crates/fabro-auth/src/resolve.rs
+++ b/lib/crates/fabro-auth/src/resolve.rs
@@ -63,6 +63,24 @@ pub enum ResolveError {
     RefreshTokenMissing(Provider),
 }
 
+#[must_use]
+pub fn auth_issue_message(provider: Provider, err: &ResolveError) -> String {
+    match err {
+        ResolveError::NotConfigured(_) => {
+            format!("{} is not configured", provider.display_name())
+        }
+        ResolveError::RefreshFailed { source, .. } => format!(
+            "{} requires re-authentication: {}",
+            provider.display_name(),
+            source
+        ),
+        ResolveError::RefreshTokenMissing(_) => format!(
+            "{} requires re-authentication: refresh token missing",
+            provider.display_name()
+        ),
+    }
+}
+
 #[derive(Clone)]
 pub struct CredentialResolver {
     vault:      Arc<AsyncRwLock<Vault>>,
@@ -817,6 +835,19 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn auth_issue_message_formats_refresh_token_missing() {
+        let message = auth_issue_message(
+            Provider::OpenAi,
+            &ResolveError::RefreshTokenMissing(Provider::OpenAi),
+        );
+
+        assert_eq!(
+            message,
+            "OpenAI requires re-authentication: refresh token missing"
+        );
+    }
+
     #[test]
     fn api_credential_debug_redacts_secret_material() {
         let credential = ApiCredential {