nu_plugin_secret 0.7.0

Production-grade secret handling plugin for Nushell with secure CustomValue types that prevent accidental exposure of sensitive data
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128

//! Implements `secret info` — displays plugin version and metadata.

use nu_plugin::{EngineInterface, EvaluatedCall, Plugin, PluginCommand};
use nu_protocol::{Category, Example, LabeledError, PipelineData, Record, Signature, Type, Value};

#[derive(Clone)]
pub struct SecretInfoCommand;

impl PluginCommand for SecretInfoCommand {
    type Plugin = crate::SecretPlugin;

    fn name(&self) -> &str {
        "secret info"
    }

    fn signature(&self) -> Signature {
        Signature::build(self.name())
            .input_output_types(vec![(Type::Nothing, Type::Record(Box::new([])))])
            .category(Category::System)
    }

    fn description(&self) -> &str {
        "Display plugin information, supported secret types, and security best practices"
    }

    fn examples(&self) -> Vec<Example<'_>> {
        vec![Example {
            example: "secret info",
            description: "Show plugin information and security guidance",
            result: None,
        }]
    }

    fn run(
        &self,
        plugin: &Self::Plugin,
        _engine: &EngineInterface,
        call: &EvaluatedCall,
        _input: PipelineData,
    ) -> Result<PipelineData, LabeledError> {
        let mut record = Record::new();

        record.push("name", Value::string("nu_plugin_secret", call.head));
        record.push("version", Value::string(plugin.version(), call.head));
        record.push(
            "description",
            Value::string(
                "Production-grade secret handling plugin for Nushell with secure CustomValue types",
                call.head,
            ),
        );

        record.push(
            "supported_types",
            Value::list(vec![Value::string("secret_string", call.head)], call.head),
        );

        record.push(
            "commands",
            Value::list(
                vec![
                    Value::string("secret wrap", call.head),
                    Value::string("secret unwrap", call.head),
                    Value::string("secret info", call.head),
                    Value::string("secret validate", call.head),
                    Value::string("secret type-of", call.head),
                ],
                call.head,
            ),
        );

        record.push(
            "security_features",
            Value::list(
                vec![
                    Value::string("Always displays as <redacted>", call.head),
                    Value::string("Secure memory cleanup on drop", call.head),
                    Value::string("Protection against accidental serialization", call.head),
                    Value::string("Constant-time equality comparison", call.head),
                    Value::string("Debug output redaction", call.head),
                ],
                call.head,
            ),
        );

        record.push(
            "best_practices",
            Value::list(
                vec![
                    Value::string(
                        "Use secret types for API keys, passwords, and tokens",
                        call.head,
                    ),
                    Value::string("Minimize unwrap operations", call.head),
                    Value::string(
                        "Store secrets as environment variables when possible",
                        call.head,
                    ),
                    Value::string("Use type-specific wrap commands for clarity", call.head),
                    Value::string("Review code for accidental secret exposure", call.head),
                ],
                call.head,
            ),
        );

        Ok(PipelineData::Value(Value::record(record, call.head), None))
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_command_name() {
        let command = SecretInfoCommand;
        assert_eq!(command.name(), "secret info");
    }

    #[test]
    fn test_signature() {
        let command = SecretInfoCommand;
        let sig = command.signature();
        assert_eq!(sig.name, "secret info");
        assert_eq!(sig.input_output_types.len(), 1);
        assert_eq!(sig.input_output_types[0].0, Type::Nothing);
    }
}