Crate secrets_engine_dropbox 

Dropbox access tokens, brokered from a stored refresh token.

Dropbox offers no API that mints a sub-credential, so this engine cannot be anything but a broker: it holds the one long-lived refresh token per authorisation and hands out four-hour access tokens. The consumer never sees the durable secret, which is the whole of the benefit.

The consequence worth internalising before reading further: because nothing is mintable, isolation between consumers comes from separate OAuth authorisations, not from this engine. One config document per consumer. Share one authorisation across several consumers and you lose the ability to revoke any of them independently — there is no server-side trick that recovers it.

See docs/delegation/dropbox.md for the mechanism and docs/delegation/setup/dropbox.md for the operator walkthrough.

Structs

DropboxConfig

One consumer’s OAuth authorisation. All three fields are durable secrets: the refresh token never expires and never rotates on use, so this document is the blast radius of the mount and is never read back out (see ConfigRoleStore).

DropboxEngine

RoleConfig

What one consumer may ask for. Nothing here can widen the authorisation — scopes only ever narrows it, and the select_* fields merely name whom to act as, which is not the same as being limited to them.