saml_rs/config/
credentials.rs

1use core::fmt;
2
3/// PEM-encoded private key material.
4///
5/// `Debug` is intentionally redacted so key material is not dumped through
6/// public config structs.
7#[derive(Clone, PartialEq, Eq)]
8pub struct PrivateKeyPem(String);
9
10impl PrivateKeyPem {
11    /// Wrap PEM-encoded private key material.
12    pub fn new(value: impl Into<String>) -> Self {
13        Self(value.into())
14    }
15
16    /// Borrow the PEM text.
17    ///
18    /// The value is secret-bearing key material. Prefer passing typed
19    /// credentials through config APIs when possible; this accessor exists for
20    /// migration code and raw compatibility escape hatches.
21    pub fn as_str(&self) -> &str {
22        &self.0
23    }
24}
25
26impl fmt::Debug for PrivateKeyPem {
27    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
28        f.write_str("PrivateKeyPem(<redacted>)")
29    }
30}
31
32/// PEM-encoded X.509 certificate material.
33///
34/// `Debug` avoids printing the certificate body by default because certificate
35/// fields often travel beside private key configuration.
36#[derive(Clone, PartialEq, Eq)]
37pub struct CertificatePem(String);
38
39impl CertificatePem {
40    /// Wrap PEM-encoded certificate material.
41    pub fn new(value: impl Into<String>) -> Self {
42        Self(value.into())
43    }
44
45    /// Borrow the PEM text for internal compatibility mapping.
46    pub fn as_str(&self) -> &str {
47        &self.0
48    }
49}
50
51impl fmt::Debug for CertificatePem {
52    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
53        f.write_str("CertificatePem(<redacted>)")
54    }
55}
56
57/// Passphrase used to decrypt private key material.
58///
59/// `Debug` is intentionally redacted so passphrases are not exposed through
60/// logs or failing assertions.
61#[derive(Clone, PartialEq, Eq)]
62pub struct Passphrase(String);
63
64impl Passphrase {
65    /// Wrap passphrase text.
66    pub fn new(value: impl Into<String>) -> Self {
67        Self(value.into())
68    }
69
70    /// Borrow the passphrase text.
71    ///
72    /// The value is secret-bearing credential material. Prefer passing typed
73    /// credentials through config APIs when possible; this accessor exists for
74    /// migration code and raw compatibility escape hatches.
75    pub fn as_str(&self) -> &str {
76        &self.0
77    }
78}
79
80impl fmt::Debug for Passphrase {
81    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
82        f.write_str("Passphrase(<redacted>)")
83    }
84}
85/// Secret-bearing and certificate material for local SAML operations.
86#[derive(Debug, Clone, Default, PartialEq, Eq)]
87pub struct Credentials {
88    /// Signing private key.
89    pub signing_key: Option<PrivateKeyPem>,
90    /// Passphrase for [`Self::signing_key`].
91    pub signing_key_passphrase: Option<Passphrase>,
92    /// Signing certificate.
93    pub signing_certificate: Option<CertificatePem>,
94    /// Encryption certificate advertised for peers.
95    pub encryption_certificate: Option<CertificatePem>,
96    /// Decryption private key for encrypted assertions.
97    pub decryption_key: Option<PrivateKeyPem>,
98    /// Passphrase for [`Self::decryption_key`].
99    pub decryption_key_passphrase: Option<Passphrase>,
100}
saml_rs/config/credentials.rs

saml_rs/config/
credentials.rs
