Struct Keyring 

pub struct Keyring {
    pub ephemeral: bool,
    /* private fields */
}

Holds decrypted API keys in memory. Keys are mlock’d and zeroized on drop.

Fields

ephemeral: bool

Whether keys were loaded from a sealed source (one-shot key). When true, credential files should be wiped after each use.

Implementations

impl Keyring

pub fn load(keyring_path: &Path) -> Result<Self, KeyringError>

Load the keyring: read sealed key file, decrypt keyring.enc, mlock memory.

The session key file is deleted immediately after reading.

pub fn load_with_key( keyring_path: &Path, session_key: &[u8; 32], ) -> Result<Self, KeyringError>

Load from an already-known session key (for testing or orchestrator use).

pub fn get(&self, key_name: &str) -> Option<&str>

Get a key by name (e.g. “parallel_api_key”).

pub fn contains(&self, key_name: &str) -> bool

Check if the keyring contains a specific key.

pub fn key_names(&self) -> Vec<&str>

List all key names (not values).

pub fn load_credentials(path: &Path) -> Result<Self, KeyringError>

Load from a plaintext credentials file (JSON object: {“key_name”: “value”, …}).

Used in local mode where ~/.ati/credentials stores keys as plaintext JSON with 0600 permissions (same approach as AWS CLI, gh, Docker, Stripe).

pub fn load_local( keyring_path: &Path, ati_dir: &Path, ) -> Result<Self, KeyringError>

Load keyring.enc using a persistent key stored alongside the ATI directory.

Looks for <ati_dir>/.keyring-key (base64-encoded 32-byte key). Unlike the sealed key in /run/ati/.key, this key is NOT deleted after reading — it’s for proxy servers with persistent storage.

pub fn from_env() -> Self

Create a keyring from environment variables with ATI_KEY_ prefix.

Scans all env vars matching ATI_KEY_*, strips the prefix, lowercases the name. Example: ATI_KEY_FINNHUB_API_KEY=abc123 → key name finnhub_api_key.

pub fn empty() -> Self

Create an empty keyring (for tools with auth_type = none).

pub fn merge(&mut self, other: &Keyring)

Merge another keyring’s keys into this one (other’s keys take precedence).

pub fn len(&self) -> usize

Number of keys in the keyring.

pub fn is_empty(&self) -> bool

Whether the keyring has no keys.

Trait Implementations

impl Drop for Keyring

fn drop(&mut self)

Executes the destructor for this type.