git_policy_cli/
service_review_key.rs

1//! What:
2//!  The gateway credential of the standards review as it travels from the wrapper to the service: a value that prints as
3//!  redacted, is read from the wrapper's own environment, and is carried only in the in-memory `work` message over the
4//!  user-only socket.
5//! Why:
6//!  The credential must not reach the on-disk work item, a unit file or the manager's environment, and must not appear in
7//!  a log line by accident. A type whose `Debug` output hides the value keeps it out of every `{:?}` the code or a test
8//!  prints; reading it takes the explicit `expose`. Nothing here depends on the network client, so the wrapper's client
9//!  path may use it.
10//!
11//! In TS you'd write (pseudocode):
12//! ```ts
13//! const key = reviewKeyFrom(process.env); // sent in the message, never written to disk
14//! ```
15
16/// The credential variable, and the stop-hook credential used when it is unset.
17pub const KEY_VARIABLES: [&str; 2] = ["SHADOW_REVIEW_LLMGATEWAY_API_KEY", "STOP_REMINDER_LLMGATEWAY_API_KEY"];
18
19/// What:
20///  A non-empty credential. `Debug` prints a placeholder; only `expose` returns the text.
21/// Why:
22///   An empty value is the same as no value (the script fails with "no key" on `''`), so one type states both.
23///
24/// In TS you'd write (pseudocode):
25/// ```ts
26/// class ReviewKey { toString() { return '<redacted>' } }
27/// ```
28#[derive(Clone, Eq, PartialEq)]
29pub struct ReviewKey(String);
30
31/// Methods over a key.
32impl ReviewKey {
33    /// The key for this text, or nothing when the text is empty.
34    pub fn new(text: &str) -> Option<ReviewKey> {
35        if text.is_empty() {
36            return None;
37        }
38        return Some(ReviewKey(text.to_string()));
39    }
40
41    /// The credential text, for the one place that sends it.
42    pub fn expose(&self) -> &str {
43        return self.0.as_str();
44    }
45}
46
47/// Debug output never carries the value.
48impl std::fmt::Debug for ReviewKey {
49    /// Writes a placeholder.
50    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
51        return formatter.write_str("ReviewKey(<redacted>)");
52    }
53}
54
55/// What:
56///  The credential the script would use: the first variable that is set, even to an empty text, else the second.
57/// Why:
58///   `??` in the script falls back only for an unset variable, so an empty first value means "no key", not the second.
59///
60/// In TS you'd write (pseudocode):
61/// ```ts
62/// process.env.SHADOW_REVIEW_LLMGATEWAY_API_KEY ?? process.env.STOP_REMINDER_LLMGATEWAY_API_KEY ?? ''
63/// ```
64pub fn key_from_environment(variable: &dyn Fn(&str) -> Option<String>) -> Option<ReviewKey> {
65    let chosen: Option<String> = variable(KEY_VARIABLES[0]).or_else(|| { return variable(KEY_VARIABLES[1]); });
66    return chosen.and_then(|text| { return ReviewKey::new(text.as_str()); });
67}
68
69/// Key controls stay out of the release executable.
70#[cfg(test)]
71#[path = "service_review_key_tests.rs"]
72mod tests;
git_policy_cli/service_review_key.rs

git_policy_cli/
service_review_key.rs
