Struct AllowlistedSecret 

pub struct AllowlistedSecret<T: SecureSanitize, P> { /* private fields */ }

Clear-on-drop secret gated by an application-controlled storage allow-list.

Unlike Secret<T>, construction and exposure require a policy type that implements SecretStoragePolicy<T> for the exact wrapped type. This lets a high-assurance application centralize accepted storage types and prevents a dependency’s unrelated storage-marker implementation from automatically entering that accepted set.

The policy is defense in depth. Shared and mutable access still require StableSharedSecretStorage and StableMutableSecretStorage respectively. An incorrect policy or storage-contract implementation can invalidate the clearing guarantee, but cannot be relied on for Rust memory safety.

There is intentionally no field-only derive for storage stability. A proc macro cannot inspect later inherent methods, trait implementations, interior mutation, returned guards, callbacks, or deferred cleanup.

An unapproved type cannot be constructed under a policy:

use sanitization::{
    define_secret_storage_policy, AllowlistedSecret, SecretBytes,
};

define_secret_storage_policy! {
    DeploymentStoragePolicy {
        SecretBytes<32> => "reviewed fixed key storage",
    }
}

let _ = AllowlistedSecret::<SecretBytes<16>, DeploymentStoragePolicy>::new(
    SecretBytes::from_array([0; 16]),
);

Implementations

impl<T, P> AllowlistedSecret<T, P>

where T: SecureSanitize, P: SecretStoragePolicy<T>,

pub const fn new(inner: T) -> Self

Wrap a value approved by P.

pub const fn policy_rationale() -> &'static str

Return the policy’s review rationale for this exact storage type.

pub fn into_cleared(self)

Consume the wrapper after first clearing the wrapped value.

impl<T, P> AllowlistedSecret<T, P>

where T: StableSharedSecretStorage, P: SecretStoragePolicy<T>,

pub fn with_secret<R>(&self, inspect: impl FnOnce(&T) -> R) -> R

Run a closure with policy-approved shared-stable storage.

impl<T, P> AllowlistedSecret<T, P>

where T: StableMutableSecretStorage, P: SecretStoragePolicy<T>,

pub fn with_secret_mut<R>(&mut self, edit: impl FnOnce(&mut T) -> R) -> R

Run a closure with policy-approved mutable-stable storage.

Trait Implementations

impl<T: SecureSanitize, P> Debug for AllowlistedSecret<T, P>

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T, P> Default for AllowlistedSecret<T, P>

where T: SecureSanitize + Default, P: SecretStoragePolicy<T>,

fn default() -> Self

Returns the “default value” for a type.

impl<T: SecureSanitize, P> Drop for AllowlistedSecret<T, P>

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl<T: SecureSanitize, P> SecureSanitize for AllowlistedSecret<T, P>

fn secure_sanitize(&mut self)

Clear the sensitive bytes owned by this value.

impl<T, P> StableMutableSecretStorage for AllowlistedSecret<T, P>

where T: StableMutableSecretStorage, P: SecretStoragePolicy<T>,

impl<T, P> StableSharedSecretStorage for AllowlistedSecret<T, P>

where T: StableSharedSecretStorage, P: SecretStoragePolicy<T>,