feature: atproto-client auth parameter supports multiple types of auth

crates/atproto-client/src/client.rs

···
     pub access_token: String,
 }
 
+/// Authentication method for AT Protocol XRPC requests.
+///
+/// Supports multiple authentication schemes including unauthenticated requests,
+/// DPoP (Demonstration of Proof-of-Possession) tokens, and app password bearer tokens.
+pub enum Auth {
+    /// No authentication - for public endpoints that don't require authentication
+    None,
+    /// DPoP authentication with proof-of-possession tokens and OAuth access token
+    DPoP(DPoPAuth),
+    /// App password authentication using JWT bearer tokens
+    AppPassword(AppPasswordAuth)
+}
+
 /// Performs an unauthenticated HTTP GET request and parses the response as JSON.
 ///
 /// # Arguments

crates/atproto-client/src/com_atproto_identity.rs

···
 use serde::{Deserialize, de::DeserializeOwned};
 
 use crate::{
-    client::{get_dpop_json, get_json, DPoPAuth}, errors::SimpleError, url::URLBuilder
+    client::{get_apppassword_json, get_dpop_json, get_json, Auth},
+    errors::SimpleError,
+    url::URLBuilder
 };
 
 /// Response from the com.atproto.identity.resolveHandle XRPC method.
···
 /// # Arguments
 ///
 /// * `http_client` - The HTTP client to use for the request
-/// * `dpop_auth` - Optional DPoP authentication credentials
+/// * `auth` - Authentication method (None, DPoP, or AppPassword)
 /// * `base_url` - The base URL of the AT Protocol service
 /// * `handle` - The handle to resolve
 ///
···
 /// or an error response from the server.
 pub async fn resolve_handle<T: DeserializeOwned>(
     http_client: &reqwest::Client,
-    dpop_auth: Option<&DPoPAuth>,
+    auth: &Auth,
     base_url: &str,
     handle: String,
 ) -> Result<ResolveHandleResponse> {
···
 
     let url = url_builder.build();
 
-    if let Some(dpop_auth) = dpop_auth {
-        get_dpop_json(http_client, dpop_auth, &url)
+    match auth {
+        Auth::None => get_json(http_client, &url)
             .await
-            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into()))
-    } else {
-        get_json(http_client, &url)
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+        Auth::DPoP(dpop_auth) => get_dpop_json(http_client, dpop_auth, &url)
+            .await
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+        Auth::AppPassword(app_auth) => get_apppassword_json(http_client, app_auth, &url)
             .await
-            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into()))
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
     }
 }

crates/atproto-client/src/com_atproto_repo.rs

···
 use serde::{Deserialize, Serialize, de::DeserializeOwned};
 
 use crate::{
-    client::{DPoPAuth, get_bytes, get_dpop_json, get_json, post_dpop_json},
+    client::{Auth, get_apppassword_json, get_bytes, get_dpop_json, get_json, post_apppassword_json, post_dpop_json, post_json},
     errors::SimpleError,
     url::URLBuilder,
 };
···
 /// # Arguments
 ///
 /// * `http_client` - HTTP client for making requests
-/// * `dpop_auth` - DPoP authentication credentials
+/// * `auth` - Authentication method (None, DPoP, or AppPassword)
 /// * `base_url` - Base URL of the AT Protocol server
 /// * `repo` - Repository identifier (DID)
 /// * `collection` - Collection NSID
···
 /// The record data or an error response
 pub async fn get_record(
     http_client: &reqwest::Client,
-    dpop_auth: Option<&DPoPAuth>,
+    auth: &Auth,
     base_url: &str,
     repo: &str,
     collection: &str,
···
 
     let url = url_builder.build();
 
-    if let Some(dpop_auth) = dpop_auth {
-        get_dpop_json(http_client, dpop_auth, &url)
+    match auth {
+        Auth::None => get_json(http_client, &url)
+            .await
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+        Auth::DPoP(dpop_auth) => get_dpop_json(http_client, dpop_auth, &url)
             .await
-            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into()))
-    } else {
-        get_json(http_client, &url)
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+        Auth::AppPassword(app_auth) => get_apppassword_json(http_client, app_auth, &url)
             .await
-            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into()))
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
     }
 }
 
···
 /// # Arguments
 ///
 /// * `http_client` - HTTP client for making requests
-/// * `dpop_auth` - DPoP authentication credentials
+/// * `auth` - Authentication method (None, DPoP, or AppPassword)
 /// * `base_url` - Base URL of the AT Protocol server
 /// * `repo` - Repository identifier (DID)
 /// * `collection` - Collection NSID to list from
···
 /// A paginated list of records from the collection
 pub async fn list_records<T: DeserializeOwned>(
     http_client: &reqwest::Client,
-    dpop_auth: Option<&DPoPAuth>,
+    auth: &Auth,
     base_url: &str,
     repo: String,
     collection: String,
···
 
     let url = url_builder.build();
 
-    if let Some(dpop_auth) = dpop_auth {
-        get_dpop_json(http_client, dpop_auth, &url)
+    match auth {
+        Auth::None => get_json(http_client, &url)
             .await
-            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into()))
-    } else {
-        get_json(http_client, &url)
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+        Auth::DPoP(dpop_auth) => get_dpop_json(http_client, dpop_auth, &url)
             .await
-            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into()))
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+        Auth::AppPassword(app_auth) => get_apppassword_json(http_client, app_auth, &url)
+            .await
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
     }
 }
 
···
 /// # Arguments
 ///
 /// * `http_client` - HTTP client for making requests
-/// * `dpop_auth` - DPoP authentication credentials
+/// * `auth` - Authentication method (None, DPoP, or AppPassword)
 /// * `base_url` - Base URL of the AT Protocol server
 /// * `record` - Record creation request with content and metadata
 ///
···
 /// The created record reference or an error response
 pub async fn create_record<T: DeserializeOwned + Serialize>(
     http_client: &reqwest::Client,
-    dpop_auth: &DPoPAuth,
+    auth: &Auth,
     base_url: &str,
     record: CreateRecordRequest<T>,
 ) -> Result<CreateRecordResponse> {
···
 
     let value = serde_json::to_value(record)?;
 
-    post_dpop_json(http_client, dpop_auth, &url, value)
-        .await
-        .and_then(|value| serde_json::from_value(value).map_err(|err| err.into()))
+    match auth {
+        Auth::None => post_json(http_client, &url, value)
+            .await
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+        Auth::DPoP(dpop_auth) => post_dpop_json(http_client, dpop_auth, &url, value)
+            .await
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+        Auth::AppPassword(app_auth) => post_apppassword_json(http_client, app_auth, &url, value)
+            .await
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+    }
 }
 
 /// Request to update an existing record in an AT Protocol repository.
···
 /// # Arguments
 ///
 /// * `http_client` - HTTP client for making requests
-/// * `dpop_auth` - DPoP authentication credentials
+/// * `auth` - Authentication method (None, DPoP, or AppPassword)
 /// * `base_url` - Base URL of the AT Protocol server
 /// * `record` - Record update request with new content and metadata
 ///
···
 /// The updated record reference or an error response
 pub async fn put_record<T: DeserializeOwned + Serialize>(
     http_client: &reqwest::Client,
-    dpop_auth: &DPoPAuth,
+    auth: &Auth,
     base_url: &str,
     record: PutRecordRequest<T>,
 ) -> Result<PutRecordResponse> {
···
 
     let value = serde_json::to_value(record)?;
 
-    post_dpop_json(http_client, dpop_auth, &url, value)
-        .await
-        .and_then(|value| serde_json::from_value(value).map_err(|err| err.into()))
+    match auth {
+        Auth::None => post_json(http_client, &url, value)
+            .await
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+        Auth::DPoP(dpop_auth) => post_dpop_json(http_client, dpop_auth, &url, value)
+            .await
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+        Auth::AppPassword(app_auth) => post_apppassword_json(http_client, app_auth, &url, value)
+            .await
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+    }
 }
 
 /// Request to delete a record from an AT Protocol repository.
···
 /// # Arguments
 ///
 /// * `http_client` - HTTP client for making requests
-/// * `dpop_auth` - DPoP authentication credentials
+/// * `auth` - Authentication method (None, DPoP, or AppPassword)
 /// * `base_url` - Base URL of the AT Protocol server
 /// * `record` - Record deletion request with repository, collection, and key
 ///
···
 /// The deletion response with commit information or an error
 pub async fn delete_record(
     http_client: &reqwest::Client,
-    dpop_auth: &DPoPAuth,
+    auth: &Auth,
     base_url: &str,
     record: DeleteRecordRequest,
 ) -> Result<DeleteRecordResponse> {
···
 
     let value = serde_json::to_value(record)?;
 
-    post_dpop_json(http_client, dpop_auth, &url, value)
-        .await
-        .and_then(|value| serde_json::from_value(value).map_err(|err| err.into()))
+    match auth {
+        Auth::None => post_json(http_client, &url, value)
+            .await
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+        Auth::DPoP(dpop_auth) => post_dpop_json(http_client, dpop_auth, &url, value)
+            .await
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+        Auth::AppPassword(app_auth) => post_apppassword_json(http_client, app_auth, &url, value)
+            .await
+            .and_then(|value| serde_json::from_value(value).map_err(|err| err.into())),
+    }
 }

crates/atproto-client/src/com_atproto_server.rs

···
 use crate::{client::post_json, url::URLBuilder};
 
 /// Request to create a new authentication session.
-#[derive(Serialize, Clone)]
+#[cfg_attr(debug_assertions, derive(Debug))]
+#[derive(Serialize, Deserialize, Clone)]
 pub struct CreateSessionRequest {
     /// Handle or other identifier supported by the server for the authenticating user
     pub identifier: String,
···
     pub auth_factor_token: Option<String>,
 }
 
-impl std::fmt::Debug for CreateSessionRequest {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("CreateSessionRequest")
-            .field("identifier", &self.identifier)
-            .field("password", &"[REDACTED]")
-            .field(
-                "auth_factor_token",
-                &self.auth_factor_token.as_ref().map(|_| "[REDACTED]"),
-            )
-            .finish()
-    }
-}
-
 /// App password session data returned from successful authentication.
+#[cfg_attr(debug_assertions, derive(Debug))]
 #[derive(Deserialize, Clone)]
 pub struct AppPasswordSession {
     /// Distributed identifier for the authenticated account
···
     pub refresh_jwt: String,
 }
 
-impl std::fmt::Debug for AppPasswordSession {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("AppPasswordSession")
-            .field("did", &self.did)
-            .field("handle", &self.handle)
-            .field("email", &self.email)
-            .field("access_jwt", &"[REDACTED]")
-            .field("refresh_jwt", &"[REDACTED]")
-            .finish()
-    }
-}
-
 /// Response from refreshing an authentication session.
+#[cfg_attr(debug_assertions, derive(Debug))]
 #[derive(Deserialize, Clone)]
 pub struct RefreshSessionResponse {
     /// Distributed identifier for the authenticated account
···
     pub status: Option<String>,
 }
 
-impl std::fmt::Debug for RefreshSessionResponse {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("RefreshSessionResponse")
-            .field("did", &self.did)
-            .field("handle", &self.handle)
-            .field("access_jwt", &"[REDACTED]")
-            .field("refresh_jwt", &"[REDACTED]")
-            .field("active", &self.active)
-            .field("status", &self.status)
-            .finish()
-    }
-}
-
 /// Response from creating a new app password.
+#[cfg_attr(debug_assertions, derive(Debug))]
 #[derive(Deserialize, Clone)]
 pub struct AppPasswordResponse {
     /// Name of the app password
···
     /// Creation timestamp in ISO 8601 format
     #[serde(rename = "createdAt")]
     pub created_at: String,
-}
-
-impl std::fmt::Debug for AppPasswordResponse {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("AppPasswordResponse")
-            .field("name", &self.name)
-            .field("password", &"[REDACTED]")
-            .field("created_at", &self.created_at)
-            .finish()
-    }
 }
 
 /// Creates a new authentication session using app password credentials.

crates/atproto-oauth-aip/src/workflow.rs

···
     pub handle: String,
 
     /// The OAuth access token for making authenticated requests.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub access_token: String,
 
     /// The type of token (typically "Bearer").
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub token_type: String,
 
     /// The list of OAuth scopes granted to this session.
···
     pub pds_endpoint: String,
 
     /// The DPoP (Demonstration of Proof-of-Possession) key in JWK format.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub dpop_key: String,
 
     /// Unix timestamp indicating when this session expires.

crates/atproto-record/src/bin/atproto-record-sign.rs

···
         &repository,
         &collection,
         signature_object,
-    )
-    .await?;
+    )?;
 
     let pretty_signed_record = serde_json::to_string_pretty(&signed_record);
     println!("{}", pretty_signed_record.unwrap());

crates/atproto-record/src/bin/atproto-record-verify.rs

···
         name: "key".to_string(),
     })?;
 
-    verify(&issuer, &key_data, record, &repository, &collection).await?;
+    verify(&issuer, &key_data, record, &repository, &collection)?;
 
     println!("OK");