Crate keeper_secrets_manager_core 

Keeper Secrets Manager Rust SDK

Type-safe, zero-knowledge client library for accessing secrets stored in Keeper’s vault.

Features

• Type-Safe API - Leverages Rust’s type system for compile-time safety
• Never Panics - All operations return Result<T, KSMRError> with comprehensive error handling
• Multiple Storage Options - File-based, in-memory, and caching support
• Zero-Knowledge Architecture - All encryption/decryption happens client-side
• Keeper Notation - URI-based field access (keeper://UID/field/password)
• Password Rotation - Transaction-based rotation with commit/rollback
• GraphSync Support - Linked record retrieval for managing relationships
• Disaster Recovery Caching - Automatic fallback to cached data on network failures

Quick Start

use keeper_secrets_manager_core::{SecretsManager, ClientOptions, KSMRError, KvStoreType, FileKeyValueStorage};

fn main() -> Result<(), KSMRError> {
    // Initialize with one-time token
    let storage = FileKeyValueStorage::new(Some("config.json".to_string()))?;
    let config = KvStoreType::File(storage);
    let token = "US:YOUR_ONE_TIME_TOKEN".to_string();
    let options = ClientOptions::new_client_options_with_token(token, config);
    let mut secrets_manager = SecretsManager::new(options)?;

    // Retrieve secrets
    let secrets = secrets_manager.get_secrets(Vec::new())?;
    for secret in secrets {
        println!("Title: {}", secret.title);
    }

    Ok(())
}

Or use the builder:

use keeper_secrets_manager_core::{SecretsManager, ClientOptionsBuilder, KSMRError, KvStoreType, InMemoryKeyValueStorage};

fn main() -> Result<(), KSMRError> {
    let config_b64 = std::env::var("KSM_CONFIG").expect("KSM_CONFIG required");
    let storage = InMemoryKeyValueStorage::new(Some(config_b64))?;
    let options = ClientOptionsBuilder::new(KvStoreType::InMemory(storage))
        .token("US:YOUR_ONE_TIME_TOKEN")
        .build();
    let mut sm = SecretsManager::new(options)?;
    let secrets = sm.get_secrets(Vec::new())?;
    println!("Found {} secrets", secrets.len());
    Ok(())
}

Modules

• core - Main SecretsManager API and client configuration
• storage - Storage backends (File, InMemory)
• cache - Performance caching layer
• caching - Disaster recovery caching with network fallback
• crypto - Cryptographic operations (AES-GCM, ECDH, ECDSA)
• dto - Data transfer objects (Record, Folder, File, Payload types)
• utils - Utilities (password generation, TOTP, Base64 encoding)
• custom_error - Error types (KSMRError enum)
• enums - Type enums (field types, record types, storage types)

Cargo Features

Feature	Default	Description
blocking	yes	Enables reqwest/blocking HTTP client
totp	yes	TOTP code generation (get_totp_code)
password-gen	yes	Password generation (generate_password)
tracing-init	yes	env_logger initializer in the binary

Re-exports

pub use cache::KSMCache;

pub use core::core::ClientOptions;

pub use core::core::ClientOptionsBuilder;

pub use core::core::SecretsManager;

pub use custom_error::KSMRError;

pub use dto::dtos::KeeperRecordLink;

pub use dto::dtos::Record;

pub use enums::DefaultRecordType;

pub use enums::KvStoreType;

pub use enums::StandardFieldTypeEnum;

pub use storage::FileKeyValueStorage;

pub use storage::InMemoryKeyValueStorage;

pub use storage::KeyValueStorage;

Modules

cache

caching

Caching post function for disaster recovery

config_keys

constants

core

crypto

custom_error

dto

enums

keeper_globals

prelude

Convenient glob import for the most common types.

storage

utils