Struct Secrets 

pub struct Secrets { /* private fields */ }

Where a plugin’s named credential is looked up.

Debug redacts

A credential must never reach standard output, an error message, a log line, or a Debug rendering. SecretString already refuses to print itself; the implementation below goes further and prints only the names this resolver can answer, so even a {:#?} of the whole resolver carries nothing to leak.

Implementations

impl Secrets

pub fn load(environment: Environment) -> Result<Self, ConfigError>

Read the credentials file this environment points at.

The path is $ONETASKGRAPH_SECRETS_FILE, or $XDG_CONFIG_HOME/onetaskgraph/secrets.env, or $HOME/.config/onetaskgraph/secrets.env. A file that is not there is not an error: a host with both credentials exported and no file is a configured host.

Errors

Returns ConfigError::Read when the file exists and cannot be read, and ConfigError::Setting when a line of it is not KEY=VALUE.

pub fn report(&self) -> SecretsReport

What the credentials file supplied and which layer each name resolves from.

Names and layers only — never a value. This is what lets a user check that their key was picked up, and which of the two layers is answering, without the key itself ever reaching a terminal or a log.

Trait Implementations

impl Clone for Secrets

fn clone(&self) -> Secrets

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Secrets

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Names only. See the type’s own note: every value here is a credential.

impl SecretResolver for Secrets

fn get(&self, var: &str) -> Option<SecretString>

The process environment wins.

A variable someone exported deliberately for this one command has to beat a file that was written once and forgotten, or the file becomes impossible to override without editing it.