Struct SecretFile 

pub struct SecretFile;

Write secret data with platform-appropriate restrictive permissions.

Unix: creates with mode 0o600 (owner rw only) — no world-readable window. Windows: applies per-user DACL via icacls (inheritance disabled, owner-only). %APPDATA% already restricts to the user by default, so the icacls call is defense-in-depth matching chmod 0600 semantics.

Upgrade note: the Windows path uses icacls for pragmatic zero-dependency delivery. A future iteration should switch to SetNamedSecurityInfoW via the windows crate for a locale-safe, shell-free API call.

Implementations

impl SecretFile

pub fn write(path: impl AsRef<Path>, data: &[u8]) -> Result<()>

Write data to path, creating parent directories as needed. On success, the file is readable only by the current user.

pub fn write_str(path: impl AsRef<Path>, s: &str) -> Result<()>

Write a string as UTF-8.

pub fn restrict(path: impl AsRef<Path>) -> Result<()>

Restrict an existing file to owner-only access. For files created by external processes (e.g. ssh-keygen).