envseal 0.3.9

Write-only secret vault with process-level access control — post-agent secret management
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

//! Scenario: multiple threads storing to the same secret name with force.
use envseal::keychain::MasterKey;
use envseal::vault::Vault;
use std::sync::Arc;

#[test]
fn concurrent_store_same_name() {
    let dir = crate::common::vault_tempdir();
    let key = MasterKey::from_test_bytes([0x77; 32]);
    let vault = Arc::new(Vault::open_with_key(dir.path(), key).unwrap());

    let mut handles = Vec::new();
    for i in 0..20 {
        let v = Arc::clone(&vault);
        handles.push(std::thread::spawn(move || {
            let value = format!("value-{i}");
            v.store("contested", value.as_bytes(), true).unwrap();
        }));
    }

    for h in handles {
        h.join().unwrap();
    }

    // The secret must exist and be decryptable
    let result = vault.decrypt("contested");
    assert!(
        result.is_ok(),
        "Fix: contested secret must be readable after concurrent writes"
    );
}