Struct SessionSecret 

pub struct SessionSecret(/* private fields */);

Server-held signing key. Wrap Vec<u8> so callers can’t accidentally print it. Clone is opt-in so the same secret can be shared across layers that use distinct cookie names + payload shapes (e.g. tenancy operator + tenancy tenant + bare admin — three layers, one key, three independent cookies).

Implementations

impl SessionSecret

pub fn from_env_or_random() -> Self

Read the secret from RUSTANGO_SESSION_SECRET (base64-encoded 32+ bytes). Falls back to a randomly generated secret with a tracing::warn when the var is unset — sessions are then invalidated on every server restart.

When the var IS set but unparseable (bad base64, fewer than 32 bytes), we ALSO print a loud eprintln! to stderr in addition to the tracing::warn (history: operators who set the var and forgot to run it through base64 quietly lost session persistence on every redeploy).

pub fn from_env_or_disk(disk_path: &Path) -> Self

Dev-friendly variant of Self::from_env_or_random that persists the generated key to disk so sessions survive server restarts even without RUSTANGO_SESSION_SECRET set.

Resolution order:

1. RUSTANGO_SESSION_SECRET env var — production path.
2. Read disk_path if it exists and contains ≥ 32 bytes.
3. Generate a random key, atomically write it to disk_path (creating parent directories as needed), and return it.
4. If the write fails, fall back to ephemeral random + a tracing::warn!.

Used by the runserver boot path so dev cargo run cycles don’t sign every operator out on every reload (#69). Production deployments should still set RUSTANGO_SESSION_SECRET so the secret lives in env / a secret-manager rather than the filesystem.

pub fn try_from_env() -> Result<Self, SessionSecretError>

Strict variant of Self::from_env_or_random: returns Err(...) when the env var is set but unparseable or too short. Use this from production boot paths where a malformed secret should fail loudly instead of silently downgrading to a random ephemeral key.

Errors

SessionSecretError::BadBase64 when decode fails; SessionSecretError::TooShort when the decoded bytes are fewer than 32.

pub fn require_from_env() -> Result<Self, SessionSecretError>

Strict variant for production boot: requires RUSTANGO_SESSION_SECRET to be present, valid base64, and ≥ 32 bytes. Unlike Self::try_from_env, an unset var is an error (SessionSecretError::Missing) rather than a silent random key — an ephemeral key breaks multi-instance deployments and masks a missing-secret misconfiguration. Used by load_session_secret_for_tier on the prod tier.

Errors

SessionSecretError::Missing when unset; BadBase64 / TooShort per Self::try_from_env.

pub fn from_bytes(bytes: Vec<u8>) -> Self

Construct from raw bytes — useful for tests + callers that load the key from a custom source.

Trait Implementations

impl Clone for SessionSecret

fn clone(&self) -> SessionSecret

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.