kleos_cred/
lib.rs

1//! Engram credential management with encrypted storage and YubiKey support.
2//!
3//! This crate provides:
4//! - Structured secret types (Login, ApiKey, OAuthApp, SshKey, Note, Environment)
5//! - AES-256-GCM encryption for secrets at rest
6//! - YubiKey HMAC-SHA1 challenge-response for key derivation
7//! - Agent keys with permission scoping and revocation
8//! - Audit logging for all secret access
9//! - Recovery key system for lost YubiKey scenarios
10
11pub mod agent_keys;
12pub mod agent_keys_file;
13pub mod audit;
14pub mod crypto;
15pub mod encryption;
16pub mod net;
17pub mod piv;
18pub mod recovery;
19pub mod storage;
20pub mod types;
21pub mod yubikey;
22
23pub use agent_keys::{AgentKey, AgentKeyPermissions};
24#[allow(deprecated)]
25pub use crypto::{
26    decrypt, decrypt_recovery, decrypt_secret, derive_key, derive_key_from_passphrase,
27    derive_key_legacy, encrypt, encrypt_recovery, encrypt_secret, generate_hmac_secret,
28};
29pub use storage::{
30    delete_secret, get_secret, list_secrets, store_secret, update_secret, SecretRow,
31};
32pub use types::{SecretData, SecretType};
33
34use thiserror::Error;
35
36#[derive(Debug, Error)]
37pub enum CredError {
38    #[error("secret not found: {0}")]
39    NotFound(String),
40
41    #[error("authentication failed: {0}")]
42    AuthFailed(String),
43
44    #[error("permission denied: {0}")]
45    PermissionDenied(String),
46
47    #[error("encryption error: {0}")]
48    Encryption(String),
49
50    #[error("decryption error: {0}")]
51    Decryption(String),
52
53    #[error("yubikey error: {0}")]
54    YubiKey(String),
55
56    #[error("database error: {0}")]
57    Database(String),
58
59    #[error("invalid input: {0}")]
60    InvalidInput(String),
61
62    #[error("agent key revoked: {0}")]
63    KeyRevoked(String),
64}
65
66pub type Result<T> = std::result::Result<T, CredError>;
67
68impl From<rusqlite::Error> for CredError {
69    fn from(e: rusqlite::Error) -> Self {
70        CredError::Database(e.to_string())
71    }
72}
kleos_cred/lib.rs

kleos_cred/
lib.rs
