Struct TokenSecret 

pub struct TokenSecret(/* private fields */);

Zeroizing wrapper for HMAC token secrets.

Security Properties

• Memory is zeroed on drop via zeroize (through secrecy::SecretBox)
• Explicitly does NOT implement: Debug, Display, Clone, PartialEq, Serialize, Deserialize – preventing accidental logging, serialization, or copying
• Secret bytes accessed only via expose_secret() which returns &[u8]

Threat Model

Protects against: accidental logging, memory dumps after drop, clone-and-forget patterns, comparison side channels, JSON serialization leakage. Does NOT protect against: active memory forensics while the secret is in use, side-channel attacks on the HMAC computation itself.

Usage in Structs

When embedding TokenSecret in a struct that derives Serialize:

#[derive(serde::Serialize)]
struct MyServer {
    #[serde(skip)]  // REQUIRED -- TokenSecret does not implement Serialize
    token_secret: TokenSecret,
    // ... other fields
}

Implementations

impl TokenSecret

pub fn new(secret: impl Into<Vec<u8>>) -> Self

Create from raw bytes. The input Vec is consumed and its contents copied into a SecretBox. The original Vec is NOT zeroed – callers should use from_env() for maximum security.

pub fn from_env(var: &str) -> Result<Self, VarError>

Read from an environment variable. The string value is converted to bytes and wrapped immediately.

pub fn expose_secret(&self) -> &[u8]

Expose the secret bytes for cryptographic operations. Callers MUST NOT log or persist the returned slice.