gloves 0.5.11

seamless secret manager and handoff
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

use chrono::Utc;

use crate::{
    audit::{AuditEvent, AuditLog},
    error::Result,
    fs_secure::{create_private_file_if_missing, ensure_private_dir},
    paths::SecretsPaths,
};

use super::{
    gocryptfs::FsEncryptionDriver,
    session::{load_sessions, save_sessions},
};

pub(crate) fn reap_expired_sessions<D>(
    driver: &D,
    paths: &SecretsPaths,
    audit_log: &AuditLog,
) -> Result<()>
where
    D: FsEncryptionDriver,
{
    ensure_private_dir(paths.root())?;
    ensure_private_dir(&paths.vaults_dir())?;
    create_private_file_if_missing(&paths.vault_sessions_file(), b"[]")?;

    let now = Utc::now();
    let mut retained = Vec::new();
    for session in load_sessions(&paths.vault_sessions_file())? {
        if session.is_expired(now) {
            if driver.is_mounted(&session.mountpoint)? {
                driver.unmount(&session.mountpoint)?;
                audit_log.log(AuditEvent::VaultUnmounted {
                    vault: session.vault_name.clone(),
                    reason: "session_expired".to_owned(),
                    agent: session.mounted_by.clone(),
                })?;
            }
            audit_log.log(AuditEvent::VaultSessionExpired {
                vault: session.vault_name,
            })?;
            continue;
        }
        retained.push(session);
    }
    save_sessions(&paths.vault_sessions_file(), &retained)?;
    Ok(())
}