Struct CachedPassphraseProvider 

pub struct CachedPassphraseProvider { /* private fields */ }

A PassphraseProvider that caches passphrases from an inner provider.

Cached values are stored in Zeroizing<String> for automatic zeroing on drop and expire after the configured TTL (time-to-live).

This is useful for agent sessions where prompting for every signing operation would be disruptive, but credentials shouldn’t persist indefinitely.

Security Considerations

• Cached passphrases are wrapped in Zeroizing<String> for secure memory cleanup
• TTL prevents stale credentials from persisting
• Call clear_cache() on logout or lock events

Implementations

impl CachedPassphraseProvider

pub fn new( inner: Arc<dyn PassphraseProvider + Send + Sync>, ttl: Duration, ) -> Self

Creates a new CachedPassphraseProvider wrapping the given provider.

Arguments

• inner - The underlying provider to fetch passphrases from on cache miss
• ttl - How long cached passphrases remain valid before expiring

pub fn unlock(&self, passphrase: &str)

Pre-fill the cache with a passphrase for session-based unlock.

This allows callers to unlock once and re-use the passphrase for the configured TTL without re-prompting. The passphrase is stored only in Rust memory (never crosses FFI boundary after this call).

The default prompt key is used so all subsequent signing operations that use the same prompt will hit the cache.

pub fn remaining_ttl(&self) -> Option<Duration>

Returns the remaining TTL in seconds, or None if no cached passphrase.

pub fn clear_cache(&self)

Clears all cached passphrases.

Call this on logout, lock, or when the session ends to ensure cached credentials don’t persist in memory.

Trait Implementations

impl PassphraseProvider for CachedPassphraseProvider

fn get_passphrase( &self, prompt_message: &str, ) -> Result<Zeroizing<String>, AgentError>

Securely obtains a passphrase, potentially by prompting the user.

fn on_incorrect_passphrase(&self, prompt_message: &str)

Notifies the provider that the passphrase returned for prompt_message was wrong.