Struct Secret 

pub struct Secret { /* private fields */ }

Secure credential storage and management system.

This structure manages the complete lifecycle of sensitive credentials including user prompting, encryption, file storage, and decryption. It provides a high-level interface for secure credential handling.

Design Principles

• Lazy Loading: Passwords only decrypted when needed
• Immutable State: Credential changes create new instances
• Error Recovery: Graceful handling of encryption/decryption failures
• User Friendly: Clear prompts and error messages

Internal State

The struct maintains both encrypted and decrypted state:

• File-based encrypted storage for persistence
• Memory-based decrypted storage for immediate use
• Cryptographic keys for encryption/decryption operations

Lifecycle

1. Creation: Initialize with file path and user prompt
2. Retrieval: Check for existing encrypted file
3. Prompting: Secure password input when needed
4. Encryption: AES encryption before file storage
5. Decryption: AES decryption when retrieving

Implementations

impl Secret

pub fn new(secret_name: &str, prompt: &str) -> Self

Creates a new Secret instance for credential management.

This constructor initializes a new secret manager with the specified file storage location and user prompt text. It loads encryption keys from compile-time embedded metadata and prepares the file path within the application’s data directory.

Key Management

Encryption keys are loaded from compile-time metadata:

• Keys embedded during build process for security
• Consistent keys across application installations
• No runtime key generation or derivation needed

File Path Resolution

The secret file path is resolved using the application’s data storage:

• Platform-appropriate user data directory
• Service-specific filename for credential isolation
• Automatic directory creation when needed

Arguments

• secret_name - Filename for storing encrypted credentials (e.g., “.jira_secret”)
• prompt - User-facing text for password prompts (e.g., “Enter your Jira password”)

Returns

A new Secret instance ready for credential operations.

Examples

use kasl::libs::secret::Secret;

// Jira password management
let jira_secret = Secret::new(".jira_secret", "Enter your Jira password");

// GitLab token management
let gitlab_secret = Secret::new(".gitlab_token", "Enter your GitLab API token");

// SI Server credentials
let si_secret = Secret::new(".si_credentials", "Enter your SI Server password");

Error Handling

Path resolution errors are handled gracefully by falling back to the current directory if the data storage path cannot be created.

pub fn get_or_prompt(&self) -> Result<String>

Retrieves password from cache or prompts user if not available.

This method implements the primary credential retrieval logic:

1. Check if encrypted file exists and is readable
2. Attempt to decrypt existing credentials
3. Prompt user for new credentials if decryption fails
4. Encrypt and store new credentials for future use

Caching Behavior

• Cache Hit: Return decrypted password from file
• Cache Miss: Prompt user and store new password
• Decryption Error: Re-prompt user (file may be corrupted)

Error Recovery

If decryption fails (corrupted file, wrong keys, etc.), the method gracefully falls back to prompting the user for new credentials. This ensures the application can recover from storage corruption.

Returns

Returns the user’s password, either from cache or fresh input.

Errors

Returns an error if:

• User cancels password prompt
• File system operations fail
• Encryption operations fail

Examples

use kasl::libs::secret::Secret;

let secret = Secret::new(".api_token", "Enter API token");

// First call prompts user and caches result
let token = secret.get_or_prompt()?;

// Subsequent calls use cached value
let same_token = secret.get_or_prompt()?;

pub fn try_get_cached(&self) -> Option<String>

Returns a cached password without prompting the user.

Used by background daemons that must not block on stdin. Returns None when the secret file is missing or cannot be decrypted.

pub fn prompt(&self) -> Result<String>

Prompts user for password and stores it securely.

This method handles the complete password input and storage workflow:

1. Display secure password prompt (no echo)
2. Encrypt the entered password
3. Store encrypted data to file
4. Return the entered password

Security Features

• No Echo: Password characters not displayed on screen
• Immediate Encryption: Password encrypted before file storage
• Memory Clearing: Original password cleared after encryption

User Experience

The prompt uses a colorful theme for better visibility and provides clear instructions to the user. Password input is handled securely without displaying characters.

Returns

Returns the password entered by the user.

Errors

Returns an error if:

• User cancels password input (Ctrl+C)
• Password encryption fails
• File system write operations fail

Examples

use kasl::libs::secret::Secret;

let secret = Secret::new(".password", "Enter your password");

// Force password prompt (ignores cache)
let password = secret.prompt()?;

Trait Implementations

impl Clone for Secret

fn clone(&self) -> Secret

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Secret

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.