kleos-cred 1.7.2

Credential management CLI with encrypted vault and YubiKey support
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

//! Engram credential management with encrypted storage and YubiKey support.
//!
//! This crate provides:
//! - Structured secret types (Login, ApiKey, OAuthApp, SshKey, Note, Environment)
//! - AES-256-GCM encryption for secrets at rest
//! - YubiKey HMAC-SHA1 challenge-response for key derivation
//! - Agent keys with permission scoping and revocation
//! - Audit logging for all secret access
//! - Recovery key system for lost YubiKey scenarios

pub mod agent_keys;
pub mod agent_keys_file;
pub mod audit;
pub mod crypto;
pub mod encryption;
pub mod net;
pub mod piv;
pub mod recovery;
pub mod storage;
pub mod types;
pub mod yubikey;

pub use agent_keys::{AgentKey, AgentKeyPermissions};
#[allow(deprecated)]
pub use crypto::{
    decrypt, decrypt_recovery, decrypt_secret, derive_key, derive_key_from_passphrase,
    derive_key_legacy, encrypt, encrypt_recovery, encrypt_secret, generate_hmac_secret,
};
pub use storage::{
    delete_secret, get_secret, list_secrets, store_secret, update_secret, SecretRow,
};
pub use types::{SecretData, SecretType};

use thiserror::Error;

#[derive(Debug, Error)]
pub enum CredError {
    #[error("secret not found: {0}")]
    NotFound(String),

    #[error("authentication failed: {0}")]
    AuthFailed(String),

    #[error("permission denied: {0}")]
    PermissionDenied(String),

    #[error("encryption error: {0}")]
    Encryption(String),

    #[error("decryption error: {0}")]
    Decryption(String),

    #[error("yubikey error: {0}")]
    YubiKey(String),

    #[error("database error: {0}")]
    Database(String),

    #[error("invalid input: {0}")]
    InvalidInput(String),

    #[error("agent key revoked: {0}")]
    KeyRevoked(String),
}

pub type Result<T> = std::result::Result<T, CredError>;

impl From<rusqlite::Error> for CredError {
    fn from(e: rusqlite::Error) -> Self {
        CredError::Database(e.to_string())
    }
}