Module value_source 

Reading a value that named where it is — an environment variable, an address inside a config file, a stream, a terminal prompt — and the policy that separates a printable value from a credential. The grammar itself is cli_spec::SourceSet; what may be done with the result is carried by the return type, value_source::SecretString. Reading a value that named where it is, and the policy that separates a printable value from a credential.

The grammar — which sources exist, which an argument accepts, how one value is classified — belongs to the CLI core and lives in crate::cli_spec::SourceSet. This is the other half: doing the read, and deciding what may then be done with the result.

Mechanism there, policy here

Nothing about a source is specific to secrets — reading a dot path out of a config file is the same operation whether it yields a password or a port. What differs is what may be done with the result, and that difference is carried by the return type rather than by a flag someone can forget:

• ValueSource::read answers a String. Its errors may quote the file and the parser’s own complaint, because being helpful is the point.
• ValueSource::read_secret answers a SecretString, which cannot be printed, logged, or serialized without saying expose_secret out loud. Its errors are stripped of anything that could echo what was read, and it refuses a non-string value outright — a credential is never a number.

Both cap the read. An unbounded read of a caller-named path is a denial of service regardless of what the bytes turn out to be.

Structs

SecretString

A string that cannot be printed by accident.