Struct CredentialStore 

pub struct CredentialStore {}

Credential store abstraction

Implementations

impl CredentialStore

pub fn new() -> Self

Create a new credential store with automatic backend selection

pub fn plaintext() -> Self

Create a store that always uses plaintext (no keyring). Useful for tests and for the explicit --allow-plaintext opt-in when no keyring is available.

pub fn probe_writable(&self) -> Result<()>

Confirm the backend can actually hold a credential, by storing a throwaway value and reading it back.

The keyring availability check only reads, and a backend can answer a read and still refuse a write — a locked macOS keychain, a Windows credential store the session cannot write, keyutils in a container without CONFIG_KEYS. Callers about to create something they cannot recreate — a minted API key, whose secret is returned once — should ask here first.

What this does not establish: on Linux the backend is keyutils (see the keyring features in the workspace Cargo.toml), where the value lives in an in-memory kernel keyring. A write and read-back inside one process succeeds there even when the value will not be visible to the next redisctl run — the same absence Self::get_credential reports after a reboot.

pub fn store_credential(&self, key: &str, value: &str) -> Result<String>

Store a credential value

pub fn get_credential( &self, value: &str, env_var: Option<&str>, ) -> Result<String>

Retrieve a credential value

Resolution order:

1. Check environment variables in order (if env vars provided)
2. If value starts with “keyring:”, retrieve from keyring
3. Otherwise, return the value as-is (plaintext)

pub fn get_credential_with_env_vars( &self, value: &str, env_vars: Vec<&str>, ) -> Result<String>

Retrieve a credential value with support for multiple environment variable aliases.

Environment variables are checked in order, and the first set value wins.

pub fn get_credential_with_environment( &self, value: &str, env_vars: &[&str], environment_overrides: EnvironmentOverrides, ) -> Result<String>

Retrieve a credential with an explicit environment override policy.

This is used by callers that load an explicit configuration file and require its credential values to be isolated from the process environment.

pub fn delete_credential(&self, key: &str) -> Result<()>

Delete a credential from storage

pub fn is_keyring_reference(value: &str) -> bool

Check if a value is a keyring reference

pub fn storage_backend(&self) -> &str

Get the current storage backend

Trait Implementations

impl Default for CredentialStore

fn default() -> Self

Returns the “default value” for a type.