Struct SecretString 

pub struct SecretString(/* private fields */);

A decrypted secret whose Debug output and serde form never contain the plaintext.

SQLx encoding/decoding encrypts and decrypts the column value. Serialize emits an authenticated RULLST:v2 envelope under the configured RULLST_ENCRYPTION_KEY (and fails without one); Deserialize decrypts such an envelope and still accepts any other string as plaintext input. Because the envelope binds no model, field or owner, Deserialize is for trusted stores only: deserialize client input with deserialize_plaintext_secret or deserialize_optional_plaintext_secret. Generated ORM audit, event and search projections serialize it as "***". Use SecretString::reveal_audited for deliberate exposure.

Implementations

impl SecretString

pub fn new(val: impl Into<String>) -> Self

pub fn reveal_audited(&self) -> &str

Reveals the real value only when explicitly requested. In a real implementation, this might take an AuditLogToken to log the access.

Trait Implementations

impl Clone for SecretString

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretString

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'r> Decode<'r, Any> for SecretString

Available on neither crate feature strict-mysql nor crate feature strict-postgres nor crate feature strict-sqlite.

fn decode( value: AnyValueRef<'r>, ) -> Result<Self, Box<dyn Error + Send + Sync + 'static>>

Decode a new value of this type using a raw value from the database.

impl<'de> Deserialize<'de> for SecretString

fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error>

Decrypts an envelope written by Serialize (current key or keyring). Any other string is accepted as plaintext input; a malformed or unauthenticated envelope is rejected.

impl<'q> Encode<'q, Any> for SecretString

Available on neither crate feature strict-mysql nor crate feature strict-postgres nor crate feature strict-sqlite.

fn encode_by_ref( &self, buf: &mut <Any as Database>::ArgumentBuffer, ) -> Result<IsNull, Box<dyn Error + Send + Sync>>

Writes the value of self into buf without moving self.

fn encode( self, buf: &mut <DB as Database>::ArgumentBuffer, ) -> Result<IsNull, Box<dyn Error + Sync + Send>>

where Self: Sized,

Writes the value of self into buf in the expected format for the database.

fn produces(&self) -> Option<<DB as Database>::TypeInfo>

fn size_hint(&self) -> usize

impl Eq for SecretString

impl PartialEq for SecretString

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SecretString

fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error>

Emits an encrypted envelope, or "***" inside a redacted projection. Fails when RULLST_ENCRYPTION_KEY is not configured.

impl StructuralPartialEq for SecretString

impl Type<Any> for SecretString

Available on neither crate feature strict-mysql nor crate feature strict-postgres nor crate feature strict-sqlite.

fn type_info() -> AnyTypeInfo

Returns the canonical SQL type for this Rust type.

fn compatible(ty: &<DB as Database>::TypeInfo) -> bool

Determines if this Rust type is compatible with the given SQL type.