Struct SecretStore 

pub struct SecretStore { /* private fields */ }

File-backed secret store using AES-256-GCM encryption.

Secrets are stored as JSON with restrictive file permissions (0600). Values are encrypted with a 32-byte master key. Legacy XOR-encrypted values are auto-migrated to AES-256-GCM on first open.

Implementations

impl SecretStore

pub fn open(path: impl AsRef<Path>) -> Result<Self>

Open an existing secrets file or create a new empty one.

pub fn open_with_key(path: impl AsRef<Path>, key_path: &Path) -> Result<Self>

Open with a specific master key path (useful for testing).

pub fn set( &mut self, key: impl Into<String>, value: impl Into<String>, ) -> Result<()>

Add or update a secret.

pub fn get(&self, key: &str) -> Option<&str>

Retrieve a secret by key.

pub fn remove(&mut self, key: &str) -> Result<bool>

Remove a secret by key. Returns whether the key existed.

pub fn list(&self) -> Vec<String>

List all secret key names (values are not exposed).

pub fn resolve_env( &self, env: &HashMap<String, String>, ) -> HashMap<String, String>

Replace ${secrets.KEY} patterns in env-var values with actual secret values.

Trait Implementations

impl Debug for SecretStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretStore

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecretStore

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.