Struct ApiKeyEntry 

#[non_exhaustive]
pub struct ApiKeyEntry {
    pub name: String,
    pub hash: String,
    pub role: String,
    pub expires_at: Option<String>,
}

A single API key entry (stored as Argon2id hash in config).

The Debug impl is manually written to redact the Argon2id hash. Although the hash is not directly reversible, treating it as a secret prevents offline brute-force attempts from leaked logs and matches the defense-in-depth posture used for AuthIdentity.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

name: String

Human-readable key label (used in logs and audit records).

hash: String

Argon2id hash of the token (PHC string format).

role: String

RBAC role granted when this key authenticates successfully.

expires_at: Option<String>

Optional expiry in RFC 3339 format.

Implementations

impl ApiKeyEntry

pub fn new( name: impl Into<String>, hash: impl Into<String>, role: impl Into<String>, ) -> Self

Create a new API key entry (no expiry).

pub fn with_expiry(self, expires_at: impl Into<String>) -> Self

Set an RFC 3339 expiry on this key.

Trait Implementations

impl Clone for ApiKeyEntry

fn clone(&self) -> ApiKeyEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ApiKeyEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Redacts the Argon2id hash to keep it out of logs, panic backtraces, and admin-endpoint responses that might format!("{:?}", …) an entry.

impl<'de> Deserialize<'de> for ApiKeyEntry

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.