ref: make api_client the single source of truth for the auth token

Token state used to live in two places: the api_client carried it for
GraphQL Authorization headers, while OrchestratorConfig.token (and its
clone in ExecutorConfig.token) carried it for upload Authorization
headers. The two were filled from different paths and could drift —
notably in CI with OIDC, where set_oidc_token mutated config but the
api_client kept its original token.

Centralize on the api_client:
- CodSpeedAPIClient now exposes token() and set_token() and is the
  single mutation point for the credentials.
- RunEnvironmentProvider::set_oidc_token(&mut ExecutorConfig) becomes
  refresh_token(&mut CodSpeedAPIClient). GHA implements it; other
  providers inherit the no-op default.
- The Buildkite "token required" check moves from try_from(config) to
  check_oidc_configuration(api_client) — token presence is the
  api_client's authority now.
- Token resolution happens once at CLI entry in build_api_client(&cli):
  --token / CODSPEED_TOKEN takes precedence; the persisted CLI config is
  only loaded as fallback.
- token field deleted from OrchestratorConfig and ExecutorConfig. The
  uploader's Authorization header and the tokenless metadata flag both
  read from api_client.token().
- &mut CodSpeedAPIClient is plumbed through cli/run/exec → Orchestrator
  → upload_all so refresh_token can mutate in place.

Refs COD-2628
Co-Authored-By: Claude <noreply@anthropic.com>

Author: GuillaumeLagrange

src/api_client.rs

@@ -3,7 +3,6 @@ use std::fmt::Display;
 use crate::executor::ExecutorName;
 use crate::prelude::*;
 use crate::run_environment::RepositoryProvider;
-use crate::{cli::Cli, config::CodSpeedConfig};
 use console::style;
 use gql_client::{Client as GQLClient, ClientConfig};
 use nestify::nest;
@@ -12,36 +11,56 @@ use serde::{Deserialize, Serialize};
 pub struct CodSpeedAPIClient {
     gql_client: GQLClient,
     unauthenticated_gql_client: GQLClient,
+    api_url: String,
+    /// The token this client authenticates with. Exposed so downstream
+    /// consumers (the uploader's `Authorization` header, the executor's
+    /// `CODSPEED_OAUTH_TOKEN` env injection) don't have to thread the
+    /// token separately from the client.
+    token: Option<String>,
 }
 
-impl TryFrom<(&Cli, &CodSpeedConfig)> for CodSpeedAPIClient {
-    type Error = Error;
-    fn try_from((args, codspeed_config): (&Cli, &CodSpeedConfig)) -> Result<Self> {
-        Ok(Self {
-            gql_client: build_gql_api_client(codspeed_config, args.api_url.clone(), true),
-            unauthenticated_gql_client: build_gql_api_client(
-                codspeed_config,
-                args.api_url.clone(),
-                false,
-            ),
-        })
+impl CodSpeedAPIClient {
+    /// Build a client authenticated with `token` (when `Some`).
+    ///
+    /// The CLI resolves the effective token at construction time, so
+    /// callers downstream (the uploader, the executor's env injection,
+    /// every GraphQL caller) just consume it from the client through
+    /// [`Self::token`] and don't have to thread the token separately.
+    pub fn new(token: Option<String>, api_url: String) -> Self {
+        Self {
+            gql_client: build_gql_api_client(token.as_deref(), api_url.clone()),
+            unauthenticated_gql_client: build_gql_api_client(None, api_url.clone()),
+            api_url,
+            token,
+        }
+    }
+
+    /// The token this client currently authenticates with, if any.
+    ///
+    /// Note: this is not necessarily the token the client was built with —
+    /// in CI with OIDC, [`Self::set_token`] is called before each upload to
+    /// rotate the credentials. See [`crate::run_environment::RunEnvironmentProvider::refresh_token`].
+    pub fn token(&self) -> Option<&str> {
+        self.token.as_deref()
+    }
+
+    /// Replace the token this client uses for authenticated GraphQL
+    /// requests and that the uploader pulls for its `Authorization`
+    /// header. The single mutation point for the credentials.
+    pub fn set_token(&mut self, token: Option<String>) {
+        self.gql_client = build_gql_api_client(token.as_deref(), self.api_url.clone());
+        self.token = token;
     }
 }
 
-fn build_gql_api_client(
-    codspeed_config: &CodSpeedConfig,
-    api_url: String,
-    with_auth: bool,
-) -> GQLClient {
-    let headers = if with_auth && codspeed_config.auth.token.is_some() {
-        let mut headers = std::collections::HashMap::new();
-        headers.insert(
-            "Authorization".to_string(),
-            codspeed_config.auth.token.clone().unwrap(),
-        );
-        headers
-    } else {
-        Default::default()
+fn build_gql_api_client(token: Option<&str>, api_url: String) -> GQLClient {
+    let headers = match token {
+        Some(token) => {
+            let mut headers = std::collections::HashMap::new();
+            headers.insert("Authorization".to_string(), token.to_owned());
+            headers
+        }
+        None => Default::default(),
     };
 
     GQLClient::new_with_config(ClientConfig {
@@ -467,7 +486,6 @@ impl CodSpeedAPIClient {
     /// Create a test API client with a custom URL for use in tests
     #[cfg(test)]
     pub fn create_test_client_with_url(api_url: String) -> Self {
-        let codspeed_config = CodSpeedConfig::default();
-        Self::try_from((&Cli::test_with_url(api_url), &codspeed_config)).unwrap()
+        Self::new(None, api_url)
     }
 }

src/cli/exec/mod.rs

@@ -1,6 +1,5 @@
 use super::ExecAndRunSharedArgs;
 use crate::api_client::CodSpeedAPIClient;
-use crate::config::CodSpeedConfig;
 use crate::executor;
 use crate::executor::config::{self, OrchestratorConfig, RepositoryOverride};
 use crate::instruments::Instruments;
@@ -67,7 +66,6 @@ fn build_orchestrator_config(
 
     Ok(OrchestratorConfig {
         upload_url,
-        token: args.shared.token,
         repository_override: args
             .shared
             .repository
@@ -95,8 +93,7 @@ fn build_orchestrator_config(
 
 pub async fn run(
     args: ExecArgs,
-    api_client: &CodSpeedAPIClient,
-    codspeed_config: &CodSpeedConfig,
+    api_client: &mut CodSpeedAPIClient,
     project_config: Option<&ProjectConfig>,
     setup_cache_dir: Option<&Path>,
 ) -> Result<()> {
@@ -113,7 +110,7 @@ pub async fn run(
         PollResultsOptions::new(false, base_run_id),
     )?;
 
-    execute_config(config, api_client, codspeed_config, setup_cache_dir).await
+    execute_config(config, api_client, setup_cache_dir).await
 }
 
 /// Core execution logic shared by `codspeed exec` and `codspeed run` with config targets.
@@ -122,8 +119,7 @@ pub async fn run(
 /// by the orchestrator when exec targets are present.
 pub async fn execute_config(
     mut config: OrchestratorConfig,
-    api_client: &CodSpeedAPIClient,
-    codspeed_config: &CodSpeedConfig,
+    api_client: &mut CodSpeedAPIClient,
     setup_cache_dir: Option<&Path>,
 ) -> Result<()> {
     // Resolve exec target binary paths so memtrack can discover statically linked
@@ -160,7 +156,7 @@ pub async fn execute_config(
         );
     }
 
-    let orchestrator = executor::Orchestrator::new(config, codspeed_config, api_client).await?;
+    let orchestrator = executor::Orchestrator::new(config, api_client).await?;
 
     if !orchestrator.is_local() {
         super::show_banner();

src/cli/mod.rs

@@ -123,9 +123,8 @@ pub async fn run() -> Result<()> {
     let cli = Cli::parse();
     // Important: keep this after the Cli::parse() because the function can exit the process by itself, skipping the drop of the CursorGuard
     let _cursor_guard = CursorGuard::new();
-    let codspeed_config =
-        CodSpeedConfig::load_with_override(cli.config_name.as_deref(), cli.oauth_token.as_deref())?;
-    let api_client = CodSpeedAPIClient::try_from((&cli, &codspeed_config))?;
+
+    let mut api_client = build_api_client(&cli)?;
 
     // Discover project configuration file
     let discovered_config = DiscoveredProjectConfig::discover_and_load(
@@ -152,8 +151,7 @@ pub async fn run() -> Result<()> {
             args.shared.experimental.warn_if_active();
             run::run(
                 *args,
-                &api_client,
-                &codspeed_config,
+                &mut api_client,
                 discovered_config.as_ref(),
                 setup_cache_dir,
             )
@@ -163,8 +161,7 @@ pub async fn run() -> Result<()> {
             args.shared.experimental.warn_if_active();
             exec::run(
                 *args,
-                &api_client,
-                &codspeed_config,
+                &mut api_client,
                 discovered_config.as_ref().map(|d| &d.config),
                 setup_cache_dir,
             )
@@ -180,17 +177,37 @@ pub async fn run() -> Result<()> {
     Ok(())
 }
 
-impl Cli {
-    /// Create a test CLI instance with a custom API URL for use in tests
-    #[cfg(test)]
-    pub fn test_with_url(api_url: String) -> Self {
-        Self {
-            api_url,
-            oauth_token: None,
-            config_name: None,
-            config: None,
-            setup_cache_dir: None,
-            command: Commands::Setup(setup::SetupArgs::default()),
+/// Build the api client for this invocation, resolving the auth token
+/// from the most specific source available. This is the single source
+/// of truth for token resolution; the result lives on the returned
+/// client and every downstream consumer (GraphQL queries, upload
+/// `Authorization` header, executor env injection) reads it from there.
+///
+/// Priority (most specific first):
+///   1. `--token` / `CODSPEED_TOKEN`           — run/exec-level override
+///   2. `--oauth-token` / `CODSPEED_OAUTH_TOKEN` and the persisted CLI
+///      token — both live on disk and are loaded together by
+///      [`CodSpeedConfig::load_with_override`].
+///
+/// The CLI config file is only read when no explicit token was passed,
+/// so an invocation like `codspeed run --token <X>` never touches the
+/// user's `~/.config/codspeed/`.
+fn build_api_client(cli: &Cli) -> Result<CodSpeedAPIClient> {
+    let explicit = match &cli.command {
+        Commands::Run(args) => args.shared.token.clone(),
+        Commands::Exec(args) => args.shared.token.clone(),
+        _ => None,
+    };
+    let token = match explicit {
+        Some(token) => Some(token),
+        None => {
+            CodSpeedConfig::load_with_override(
+                cli.config_name.as_deref(),
+                cli.oauth_token.as_deref(),
+            )?
+            .auth
+            .token
         }
-    }
+    };
+    Ok(CodSpeedAPIClient::new(token, cli.api_url.clone()))
 }

src/cli/run/mod.rs

@@ -1,6 +1,5 @@
 use super::ExecAndRunSharedArgs;
 use crate::api_client::CodSpeedAPIClient;
-use crate::config::CodSpeedConfig;
 use crate::executor;
 use crate::executor::config::{self, OrchestratorConfig, RepositoryOverride};
 use crate::instruments::Instruments;
@@ -101,7 +100,6 @@ fn build_orchestrator_config(
 
     Ok(OrchestratorConfig {
         upload_url,
-        token: args.shared.token,
         repository_override: args
             .shared
             .repository
@@ -142,8 +140,7 @@ enum RunTarget<'a> {
 
 pub async fn run(
     args: RunArgs,
-    api_client: &CodSpeedAPIClient,
-    codspeed_config: &CodSpeedConfig,
+    api_client: &mut CodSpeedAPIClient,
     discovered_config: Option<&DiscoveredProjectConfig>,
     setup_cache_dir: Option<&Path>,
 ) -> Result<()> {
@@ -188,8 +185,7 @@ pub async fn run(
                 poll_opts,
             )?;
 
-            let orchestrator =
-                executor::Orchestrator::new(config, codspeed_config, api_client).await?;
+            let orchestrator = executor::Orchestrator::new(config, api_client).await?;
 
             if !orchestrator.is_local() {
                 super::show_banner();
@@ -244,8 +240,7 @@ pub async fn run(
                 PollResultsOptions::new(false, base_run_id),
             )?;
             config.working_directory = resolved_working_directory;
-            super::exec::execute_config(config, api_client, codspeed_config, setup_cache_dir)
-                .await?;
+            super::exec::execute_config(config, api_client, setup_cache_dir).await?;
         }
     }
 

src/executor/config.rs

@@ -51,7 +51,6 @@ pub enum SimulationTool {
 #[derive(Debug, Clone)]
 pub struct OrchestratorConfig {
     pub upload_url: Url,
-    pub token: Option<String>,
     pub repository_override: Option<RepositoryOverride>,
     pub working_directory: Option<String>,
 
@@ -91,7 +90,6 @@ pub struct OrchestratorConfig {
 /// `skip_upload`, `repository_override`) live on [`OrchestratorConfig`].
 #[derive(Debug, Clone)]
 pub struct ExecutorConfig {
-    pub token: Option<String>,
     pub working_directory: Option<String>,
     pub command: String,
 
@@ -144,10 +142,6 @@ impl RepositoryOverride {
 pub const DEFAULT_UPLOAD_URL: &str = "https://api.codspeed.io/upload";
 
 impl OrchestratorConfig {
-    pub fn set_token(&mut self, token: Option<String>) {
-        self.token = token;
-    }
-
     /// Compute the total number of executor runs that will be performed.
     ///
     /// All `Exec` targets are combined into a single invocation, while each
@@ -177,7 +171,6 @@ impl OrchestratorConfig {
         enable_introspection: bool,
     ) -> ExecutorConfig {
         ExecutorConfig {
-            token: self.token.clone(),
             working_directory: self.working_directory.clone(),
             command,
             instruments: self.instruments.clone(),
@@ -195,19 +188,12 @@ impl OrchestratorConfig {
     }
 }
 
-impl ExecutorConfig {
-    pub fn set_token(&mut self, token: Option<String>) {
-        self.token = token;
-    }
-}
-
 #[cfg(test)]
 impl OrchestratorConfig {
     /// Constructs a new `OrchestratorConfig` with default values for testing purposes
     pub fn test() -> Self {
         Self {
             upload_url: Url::parse(DEFAULT_UPLOAD_URL).unwrap(),
-            token: None,
             repository_override: None,
             working_directory: None,
             targets: vec![BenchmarkTarget::Entrypoint {

src/executor/mod.rs

@@ -17,7 +17,7 @@ use crate::prelude::*;
 use crate::runner_mode::RunnerMode;
 use crate::system::SystemInfo;
 use async_trait::async_trait;
-pub use config::{BenchmarkTarget, ExecutorConfig, OrchestratorConfig};
+pub use config::{BenchmarkTarget, ExecutorConfig};
 pub use execution_context::ExecutionContext;
 pub use interfaces::ExecutorName;
 pub use orchestrator::Orchestrator;