cddis: implement bearer-token auth, download validation, and keyring backend

Phase 2 of the project plan. CddisClient (src/cddis/auth.rs) attaches
the bearer token to every request via reqwest's blocking client and
classifies CDDIS's two distinct auth-failure shapes: a missing token
gets a 302 redirect to Earthdata Login, while a present-but-invalid
token gets a direct 401/403. Confirmed against the live archive,
which also caught a bug during development where verify_token() only
checked for the redirect case and silently accepted a garbage token
as valid.

download.rs validates content-type and gzip magic bytes as defense in
depth beyond the auth check. secrets/keyring.rs stores the token in
the OS-native keyring via the keyring crate, saving it only after
CddisClient::verify_token() confirms it actually works
(save-on-first-successful-auth). main.rs now verifies the token on
startup instead of only discovering an auth problem later during
product download.

Unit tests cover the auth/download classification logic against a
local one-shot HTTP server; tests/live_cddis.rs (ignored by default,
run manually) checks the same classification against the real CDDIS
archive.

reqwest and keyring are both MIT OR Apache-2.0, compatible with this
project's GPLv3 license.

Signed-off-by: Oleksandr Suvorov <cryosay@gmail.com>

Author: MrCry0

Cargo.lock

@@ -12,6 +12,8 @@ clap = { version = "4.6", features = ["derive"] }
 hifitime = "4.3"
 thiserror = "2.0"
 rpassword = "7.5"
+reqwest = { version = "0.13", features = ["blocking"] }
+keyring = "4.1"
 
 [package.metadata.deb]
 maintainer = "Oleksandr Suvorov <cryosay@gmail.com>"

Cargo.toml

@@ -2,5 +2,181 @@
 //! `Authorization: Bearer <token>` to CDDIS requests. No cookie jar or
 //! redirect-following login flow is needed — confirmed against the live
 //! archive, CDDIS accepts a URS token directly on the file request itself.
-//!
-//! Phase 2 of the project plan. Not yet implemented.
+
+use reqwest::StatusCode;
+use reqwest::blocking::{Client, Response};
+use reqwest::header::{AUTHORIZATION, LOCATION, RANGE};
+use reqwest::redirect::Policy;
+
+/// A long-archived, permanently stable CDDIS product used only to confirm
+/// a bearer token works, without downloading a whole file (see
+/// `verify_token`).
+const TOKEN_VERIFICATION_URL: &str = "https://cddis.nasa.gov/archive/gnss/data/daily/2020/001/20p/BRDC00IGS_R_20200010000_01D_MN.rnx.gz";
+
+#[derive(Debug, thiserror::Error)]
+pub enum CddisAuthError {
+    /// No `Authorization` header (or a header CDDIS's proxy doesn't even
+    /// look past) gets a redirect back to the Earthdata Login page instead
+    /// of the file.
+    #[error("CDDIS rejected the bearer token (redirected to Earthdata Login: {location})")]
+    Unauthenticated { location: String },
+    /// A present but invalid/expired token gets a direct `401`/`403` from
+    /// CDDIS, not a redirect. Confirmed against the live archive: a
+    /// syntactically-present garbage token gets `401 Unauthorized`.
+    #[error("CDDIS rejected the bearer token (HTTP {status})")]
+    InvalidToken { status: StatusCode },
+    #[error("request to CDDIS failed: {0}")]
+    Request(#[from] reqwest::Error),
+}
+
+/// HTTP client that attaches a URS bearer token to every CDDIS request and
+/// treats a redirect back to Earthdata Login as the auth failure it is,
+/// rather than following it (plan §5).
+pub struct CddisClient {
+    http: Client,
+    token: String,
+}
+
+impl CddisClient {
+    pub fn new(token: String) -> Result<Self, CddisAuthError> {
+        let http = Client::builder().redirect(Policy::none()).build()?;
+        Ok(Self { http, token })
+    }
+
+    /// Issues an authenticated GET against a CDDIS URL.
+    pub fn get(&self, url: &str) -> Result<Response, CddisAuthError> {
+        self.send(url, None)
+    }
+
+    /// Confirms the token works by requesting a single byte of a stable,
+    /// long-archived product, rather than downloading a whole file. Used
+    /// to verify a freshly entered token before it's persisted (see
+    /// `secrets::keyring`) and to fail fast with a clear error on startup
+    /// rather than only discovering an auth problem during Phase 3/4
+    /// product discovery and download.
+    pub fn verify_token(&self) -> Result<(), CddisAuthError> {
+        self.send(TOKEN_VERIFICATION_URL, Some("bytes=0-0"))?;
+        Ok(())
+    }
+
+    fn send(&self, url: &str, range: Option<&str>) -> Result<Response, CddisAuthError> {
+        let mut request = self
+            .http
+            .get(url)
+            .header(AUTHORIZATION, format!("Bearer {}", self.token));
+        if let Some(range) = range {
+            request = request.header(RANGE, range);
+        }
+        let response = request.send()?;
+        let status = response.status();
+
+        if status.is_redirection() {
+            let location = response
+                .headers()
+                .get(LOCATION)
+                .and_then(|value| value.to_str().ok())
+                .unwrap_or("")
+                .to_string();
+            if location.contains("urs.earthdata.nasa.gov") {
+                return Err(CddisAuthError::Unauthenticated { location });
+            }
+        }
+
+        if status == StatusCode::UNAUTHORIZED || status == StatusCode::FORBIDDEN {
+            return Err(CddisAuthError::InvalidToken { status });
+        }
+
+        Ok(response)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::{Read, Write};
+    use std::net::TcpListener;
+    use std::thread;
+
+    /// Starts a one-shot local HTTP server that replies with `response` to
+    /// its single connection, and returns the URL to hit. Keeps the auth
+    /// classification logic testable against real HTTP semantics without
+    /// pulling in a mocking crate or touching the network.
+    fn respond_once(response: &'static [u8]) -> String {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        thread::spawn(move || {
+            if let Ok((mut stream, _)) = listener.accept() {
+                let mut buf = [0u8; 4096];
+                let _ = stream.read(&mut buf);
+                let _ = stream.write_all(response);
+            }
+        });
+        format!("http://{addr}/probe")
+    }
+
+    #[test]
+    fn redirect_to_urs_is_reported_as_unauthenticated() {
+        let url = respond_once(
+            b"HTTP/1.1 302 Found\r\n\
+             Location: https://urs.earthdata.nasa.gov/oauth/authorize?client_id=x\r\n\
+             Content-Length: 0\r\n\
+             Connection: close\r\n\r\n",
+        );
+
+        let client = CddisClient::new("test-token".to_string()).unwrap();
+        let err = client.get(&url).unwrap_err();
+
+        assert!(matches!(err, CddisAuthError::Unauthenticated { location }
+            if location.contains("urs.earthdata.nasa.gov")));
+    }
+
+    #[test]
+    fn success_response_is_returned() {
+        let url = respond_once(
+            b"HTTP/1.1 200 OK\r\n\
+             Content-Type: application/x-gzip\r\n\
+             Content-Length: 4\r\n\
+             Connection: close\r\n\r\n\
+             \x1f\x8b\x08\x00",
+        );
+
+        let client = CddisClient::new("test-token".to_string()).unwrap();
+        let response = client.get(&url).unwrap();
+
+        assert_eq!(response.status(), reqwest::StatusCode::OK);
+    }
+
+    #[test]
+    fn non_urs_redirect_is_passed_through() {
+        let url = respond_once(
+            b"HTTP/1.1 302 Found\r\n\
+             Location: https://cddis.nasa.gov/elsewhere\r\n\
+             Content-Length: 0\r\n\
+             Connection: close\r\n\r\n",
+        );
+
+        let client = CddisClient::new("test-token".to_string()).unwrap();
+        let response = client.get(&url).unwrap();
+
+        assert_eq!(response.status(), reqwest::StatusCode::FOUND);
+    }
+
+    #[test]
+    fn invalid_token_401_is_reported_as_invalid_token() {
+        let url = respond_once(
+            b"HTTP/1.1 401 Unauthorized\r\n\
+             Content-Length: 0\r\n\
+             Connection: close\r\n\r\n",
+        );
+
+        let client = CddisClient::new("garbage-token".to_string()).unwrap();
+        let err = client.get(&url).unwrap_err();
+
+        assert!(matches!(
+            err,
+            CddisAuthError::InvalidToken {
+                status: StatusCode::UNAUTHORIZED
+            }
+        ));
+    }
+}

src/cddis/auth.rs

@@ -1,8 +1,129 @@
-//! Retrying, resumable, checksum-verified downloads. A missing or invalid
-//! bearer token gets a `302` redirect to `urs.earthdata.nasa.gov` rather
-//! than a served file, which is easy to detect on status/`Location` alone;
-//! this module also validates that retrieved content is actually
-//! gzip/RINEX before treating a request as successful, as defense in depth
-//! against any other unexpected response shape.
-//!
-//! Phase 2-3 of the project plan. Not yet implemented.
+//! Downloads a CDDIS product and validates that the response is actually
+//! gzip/RINEX data before treating it as successful, as defense in depth:
+//! the primary auth-failure signal is the redirect `CddisClient` already
+//! detects (plan §5, §8); this guards against any other unexpected
+//! response shape. Retrying and resuming partial downloads is Phase 5.
+
+use reqwest::header::CONTENT_TYPE;
+
+use super::auth::{CddisAuthError, CddisClient};
+
+const GZIP_MAGIC: [u8; 2] = [0x1f, 0x8b];
+
+#[derive(Debug, thiserror::Error)]
+pub enum DownloadError {
+    #[error(transparent)]
+    Auth(#[from] CddisAuthError),
+    #[error("request to CDDIS failed: {0}")]
+    Request(#[from] reqwest::Error),
+    #[error("CDDIS returned an HTML response instead of the requested file")]
+    UnexpectedHtml,
+    #[error("response does not start with the gzip magic bytes")]
+    NotGzip,
+}
+
+/// Downloads `url` via `client`, returning the raw (still gzip-compressed)
+/// bytes once validated.
+pub fn download(client: &CddisClient, url: &str) -> Result<Vec<u8>, DownloadError> {
+    let response = client.get(url)?.error_for_status()?;
+
+    let content_type = response
+        .headers()
+        .get(CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or("")
+        .to_string();
+    if content_type.starts_with("text/html") {
+        return Err(DownloadError::UnexpectedHtml);
+    }
+
+    let bytes = response.bytes()?;
+    if !bytes.starts_with(&GZIP_MAGIC) {
+        return Err(DownloadError::NotGzip);
+    }
+
+    Ok(bytes.to_vec())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::{Read, Write};
+    use std::net::TcpListener;
+    use std::thread;
+
+    fn respond_once(response: &'static [u8]) -> String {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        thread::spawn(move || {
+            if let Ok((mut stream, _)) = listener.accept() {
+                let mut buf = [0u8; 4096];
+                let _ = stream.read(&mut buf);
+                let _ = stream.write_all(response);
+            }
+        });
+        format!("http://{addr}/probe")
+    }
+
+    #[test]
+    fn gzip_response_is_returned() {
+        let url = respond_once(
+            b"HTTP/1.1 200 OK\r\n\
+             Content-Type: application/x-gzip\r\n\
+             Content-Length: 4\r\n\
+             Connection: close\r\n\r\n\
+             \x1f\x8b\x08\x00",
+        );
+
+        let client = CddisClient::new("test-token".to_string()).unwrap();
+        let bytes = download(&client, &url).unwrap();
+
+        assert_eq!(bytes, vec![0x1f, 0x8b, 0x08, 0x00]);
+    }
+
+    #[test]
+    fn html_response_is_rejected() {
+        let url = respond_once(
+            b"HTTP/1.1 200 OK\r\n\
+             Content-Type: text/html; charset=UTF-8\r\n\
+             Content-Length: 13\r\n\
+             Connection: close\r\n\r\n\
+             <html></html>",
+        );
+
+        let client = CddisClient::new("test-token".to_string()).unwrap();
+        let err = download(&client, &url).unwrap_err();
+
+        assert!(matches!(err, DownloadError::UnexpectedHtml));
+    }
+
+    #[test]
+    fn non_gzip_body_is_rejected() {
+        let url = respond_once(
+            b"HTTP/1.1 200 OK\r\n\
+             Content-Type: application/octet-stream\r\n\
+             Content-Length: 4\r\n\
+             Connection: close\r\n\r\n\
+             plai",
+        );
+
+        let client = CddisClient::new("test-token".to_string()).unwrap();
+        let err = download(&client, &url).unwrap_err();
+
+        assert!(matches!(err, DownloadError::NotGzip));
+    }
+
+    #[test]
+    fn not_found_is_reported_as_request_error() {
+        let url = respond_once(
+            b"HTTP/1.1 404 Not Found\r\n\
+             Content-Length: 0\r\n\
+             Connection: close\r\n\r\n",
+        );
+
+        let client = CddisClient::new("test-token".to_string()).unwrap();
+        let err = download(&client, &url).unwrap_err();
+
+        assert!(matches!(err, DownloadError::Request(_)));
+    }
+}

src/cddis/download.rs

@@ -1,16 +1,17 @@
 //! CDDIS access: Earthdata Login, product discovery, and download.
 //!
-//! Phases 2-3 of the project plan. Not yet implemented.
+//! Auth and download are implemented (Phase 2). Discovery is Phase 3.
 
 /// Earthdata Login (URS) bearer-token auth: attaches the token as an
 /// `Authorization` header. Phase 2.
 pub mod auth;
 
 /// Resolves remote CDDIS paths for nav & obs products, including the
-/// `--time now` fallback tiers (final / rapid / ultra-rapid). Phase 3.
+/// `--time now` fallback tiers (final / rapid / ultra-rapid). Phase 3. Not
+/// yet implemented.
 pub mod discovery;
 
-/// Retrying, resumable, checksum-verified downloads, with content-type
-/// validation as defense in depth against an unexpected non-file response.
-/// Phase 2-3.
+/// Downloads a CDDIS product and validates the response, with content-type
+/// and magic-byte checks as defense in depth against an unexpected
+/// non-file response. Retry/resume is Phase 5. Phase 2.
 pub mod download;

src/cddis/mod.rs

@@ -6,6 +6,7 @@
 //! error, an unknown station, or a parse/format problem. Module-specific
 //! error types convert into this one via `#[from]` as each phase lands.
 
+use crate::cddis::auth::CddisAuthError;
 use crate::secrets::CredentialError;
 use crate::time::TimeError;
 
@@ -17,14 +18,12 @@ pub enum RinexFetchError {
     #[error("unsupported --rinex-version {0}: only RINEX 4 output is supported")]
     UnsupportedRinexVersion(u8),
 
-    #[error(
-        "--credential-provider {0} is not implemented yet (see rinexfetch-project-plan.md Phase 2)"
-    )]
-    CredentialBackendNotImplemented(&'static str),
-
     #[error(transparent)]
     Time(#[from] TimeError),
 
     #[error(transparent)]
     Credential(#[from] CredentialError),
+
+    #[error(transparent)]
+    Auth(#[from] CddisAuthError),
 }