envseal 0.3.13

Write-only secret vault with process-level access control — post-agent secret management
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

//! Invariant: each error variant's display includes the relevant context string.
use envseal::error::Error;

#[test]
fn display_contains_context() {
    let err = Error::SecretNotFound("my-api-key".to_string());
    assert!(
        err.to_string().contains("my-api-key"),
        "Fix: SecretNotFound must include the secret name"
    );

    let err = Error::SecretAlreadyExists("dup-key".to_string());
    assert!(err.to_string().contains("dup-key"));
    assert!(
        err.to_string().contains("--force"),
        "Fix: SecretAlreadyExists must mention --force as remediation"
    );

    let err = Error::AccessDenied {
        secret_name: "token".to_string(),
        binary_path: "/usr/bin/evil".to_string(),
    };
    let msg = err.to_string();
    assert!(msg.contains("token"));
    assert!(msg.contains("/usr/bin/evil"));

    let err = Error::BinaryResolution("missing-bin".to_string());
    assert!(err.to_string().contains("missing-bin"));
}