rtb-credentials 0.6.6

OS keychain credential storage. Part of the phpboyscout Rust toolkit.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

//! OS-keychain-backed credential store, with precedence-aware
//! resolution via [`Resolver`].
//!
//! # Precedence
//!
//! Downstream tools declare credentials via [`CredentialRef`] and
//! call [`Resolver::resolve`] to fetch the underlying secret. The
//! canonical chain is `env > keychain > literal > fallback_env`:
//!
//! 1. **Environment variable** — `cref.env` points at the var name.
//! 2. **OS keychain** — `cref.keychain` holds service/account.
//! 3. **Literal** — `cref.literal` is the secret itself. Rejected
//!    under `CI=true` to avoid secrets landing in CI logs.
//! 4. **Fallback env** — `cref.fallback_env` is an
//!    ecosystem-default (`ANTHROPIC_API_KEY`, etc.).
//!
//! # Secrets never cross untyped boundaries
//!
//! Every public function that touches a secret uses
//! [`secrecy::SecretString`]: `Debug` renders `[REDACTED]`; memory is
//! zeroed on drop.
//!
//! # Backends
//!
//! [`KeyringStore`] uses the platform's own credential store, chosen at
//! compile time for the target:
//!
//! | Platform | Backend | Persistence |
//! | :--- | :--- | :--- |
//! | macOS | Keychain | Cross-session |
//! | Windows | Credential Manager | Cross-session |
//! | Linux and other Unix | freedesktop Secret Service (D-Bus) | Cross-session |
//!
//! The Secret Service needs a D-Bus session bus and a running provider
//! such as GNOME Keyring or KDE Wallet; without them every keychain call
//! returns [`CredentialError::Keychain`]. The client library, libdbus,
//! is compiled from source and linked statically, so the build host
//! needs a C compiler for the target but no D-Bus packages. The
//! `linux-persistent` feature is retained for compatibility and has no
//! effect.
//!
//! See the [rtb-credentials v0.1 spec](https://gitlab.com/phpboyscout/rust-tool-base/-/wikis/specs/0005-rtb-credentials-v0.1)
//! for the authoritative contract.

#![forbid(unsafe_code)]

pub mod bearing;
pub mod error;
pub mod reference;
pub mod resolver;
pub mod store;

pub use bearing::CredentialBearing;
pub use error::CredentialError;
pub use reference::{CredentialRef, KeychainRef};
pub use resolver::{ResolutionOutcome, ResolutionSource, Resolver};
pub use secrecy::{ExposeSecret, SecretString};
pub use store::{CredentialStore, EnvStore, KeyringStore, LiteralStore, MemoryStore};