Manage your AWS sessionsin less time

// Credentials own their data — the compiler
// guarantees they can't outlive the session.
#[derive(Serialize)]
pub struct Credentials {
    pub access_key_id:     String,
    pub secret_access_key: String,
    pub session_token:     String,
    pub expires_at: Option<String>,
}

// ? propagates errors — no try/catch,
// no uncaught exceptions, no silent failures.
pub async fn assume_role(…) -> Result<Credentials, String> {
    let token = read_cached_token(&start_url)
        .ok_or("Not logged in")?;
    let resp  = sso.get_role_credentials()
        .send().await
        .map_err(|e| e.to_string())?;
    Ok(Credentials { … })
}