envseal 0.3.13

Write-only secret vault with process-level access control — post-agent secret management
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

//! Scenario: revoking secrets while other threads are storing.
use envseal::keychain::MasterKey;
use envseal::vault::Vault;
use std::sync::Arc;

#[test]
fn concurrent_revoke() {
    let dir = crate::common::vault_tempdir();
    let key = MasterKey::from_test_bytes([0x66; 32]);
    let vault = Arc::new(Vault::open_with_key(dir.path(), key).unwrap());

    // Pre-populate
    for i in 0..10 {
        vault.store(&format!("revoke-{i}"), b"val", false).unwrap();
    }

    let mut handles = Vec::new();
    for i in 0..10 {
        let v = Arc::clone(&vault);
        handles.push(std::thread::spawn(move || {
            let _ = v.revoke(&format!("revoke-{i}"));
        }));
    }

    for h in handles {
        h.join().unwrap();
    }

    let remaining = vault.list().unwrap();
    assert!(
        remaining.is_empty(),
        "Fix: all revoked secrets must be gone"
    );
}