Struct VapidKeygen 

pub struct VapidKeygen { /* private fields */ }

A generated VAPID key pair.

render never contains the private key: printing it is a separate call (private_key_disclosure), so the default path cannot leak it by getting a boolean the wrong way round.

Implementations

impl VapidKeygen

pub fn public_key(&self) -> &str

The applicationServerKey a browser passes to pushManager.subscribe(): base64url, no padding, of the 65-byte uncompressed P-256 point.

pub fn rotated(&self) -> bool

Whether an existing key was overwritten — a rotation, whose cost is every existing subscription.

pub fn warning(&self) -> Option<String>

The warning a rotation earns, or None when nothing was replaced.

Separate from render because it belongs on stderr: stdout is what the README’s own recipe reads the public key off, and a diagnostic in that stream is a diagnostic in somebody’s applicationServerKey.

pub fn render(&self) -> String

What fz push vapid keygen prints on stdout. Never the private key, and never the rotation warning — see warning.

pub fn private_key_disclosure(&self) -> Zeroizing<String>

The private key, for --print-private only. A separate call so that no default path can print it.

Cleared on drop, like the field it copies from: a plain String here would put the key back in an uncleared heap buffer and undo the Zeroizing the field is deliberately stored in.

Trait Implementations

impl Debug for VapidKeygen

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Never prints the private key — the same rule VapidKeys, Es256Signer and Recipient follow.