Trait SecretStore 

pub trait SecretStore:
    Debug
    + Send
    + Sync {
    // Required methods
    fn scope(&self) -> SecretScope;
    fn location(&self) -> String;
    fn store(&self, secret: &SecretString) -> Result<(), SecretStoreError>;
    fn ensure_writable(&self) -> Result<(), SecretStoreError>;
    fn load(&self) -> Result<Option<SecretString>, SecretStoreError>;
    fn delete(&self) -> Result<Removal, SecretStoreError>;
    fn protection(&self) -> Result<Protection, SecretStoreError>;
}

Store, load, delete — and say where the value lives and what protects it.

Send + Sync because the agent holds one across tokio tasks; Debug because every other port in this workspace is, and because a store that could not be printed in an error context would be replaced by a path that could.

Required Methods

fn scope(&self) -> SecretScope

Which of the two stores this is.

fn location(&self) -> String

Where the value lives, in the platform’s own terms. What host show and service status print, and never the value itself.

fn store(&self, secret: &SecretString) -> Result<(), SecretStoreError>

Writes the value, replacing whatever was there.

Errors

SecretStoreError::Store.

fn ensure_writable(&self) -> Result<(), SecretStoreError>

Refuses when SecretStore::store would, without writing anything.

For a caller about to do something that only a successful write makes safe. Renewal is that caller: GitHub retires a refresh token the moment it is exchanged, so a process that exchanges it and then cannot store the replacement has destroyed the credential for every process sharing this store. On a boot-mode host that is any TUI or CLI command started without the privilege the machine-scoped store needs to be written, even though it can read it.

A permission check, not a promise: a write can still fail for reasons no check can foresee. It answers the question that is stable across a process’s lifetime – whether this account may write here at all.

Errors

SecretStoreError::Store, carrying why a write would be refused.

fn load(&self) -> Result<Option<SecretString>, SecretStoreError>

Reads the value back, or reports that there is none.

Ok(None) is absence and is not an error; see SecretStoreError.

Errors

SecretStoreError::Load when the store cannot be reached, and SecretStoreError::Corrupt when what is there is not a value this store wrote.

fn delete(&self) -> Result<Removal, SecretStoreError>

Removes the value.

Errors

SecretStoreError::Delete.

fn protection(&self) -> Result<Protection, SecretStoreError>

What stands between the stored value and an ordinary local user.

Errors

SecretStoreError::Inspect.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl SecretStore for PlatformSecretStore