feat(sdk): add AccessToken accessor to SDK

sdk/access_token_test.go

@@ -0,0 +1,26 @@
+package sdk
+
+import (
+	"context"
+	"testing"
+
+	"github.com/opentdf/platform/sdk/auth"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAccessToken_ReturnsTokenFromSource(t *testing.T) {
+	s := &SDK{tokenSource: FakeAccessTokenSource{accessToken: "test-token"}}
+
+	tok, err := s.AccessToken(context.Background())
+	require.NoError(t, err)
+	assert.Equal(t, auth.AccessToken("test-token"), tok)
+}
+
+func TestAccessToken_NoTokenSource(t *testing.T) {
+	s := &SDK{}
+
+	tok, err := s.AccessToken(context.Background())
+	require.ErrorIs(t, err, ErrNoAccessTokenSource)
+	assert.Empty(t, tok)
+}

sdk/sdk.go

@@ -45,6 +45,7 @@ const (
 	ErrPlatformTokenEndpointNotFound = Error("token_endpoint not found in well-known idp configuration")
 	ErrPlatformEndpointNotFound      = Error("platform_endpoint not found in well-known configuration")
 	ErrAccessTokenInvalid            = Error("access token is invalid")
+	ErrNoAccessTokenSource           = Error("no access token source configured; SDK was created without credentials")
 	ErrWellKnowConfigEmpty           = Error("well-known configuration is empty")
 	ErrAttributeNotFound             = Error("attribute not found")
 )
@@ -305,6 +306,15 @@ func (s SDK) Close() error {
 	return nil
 }
 
+// AccessToken returns a valid access token for the SDK's configured credentials.
+// It returns ErrNoAccessTokenSource if the SDK was constructed without credentials.
+func (s *SDK) AccessToken(ctx context.Context) (auth.AccessToken, error) {
+	if s.tokenSource == nil {
+		return "", ErrNoAccessTokenSource
+	}
+	return s.tokenSource.AccessToken(ctx, s.httpClient)
+}
+
 // Logger returns the configured slog.Logger for this SDK instance
 func (s SDK) Logger() *slog.Logger {
 	return s.logger