Struct Sealed 

pub struct Sealed<T: Zeroize>(/* private fields */);

A value that cannot reach any sink: no Debug, no Display, no serde, no Clone; drop zeroizes (secrecy::SecretBox). Expose call sites are whitelisted by xtask secret (EXPOSE_WHITELIST).

Implementations

impl<T: Zeroize> Sealed<T>

pub fn new(value: Box<T>) -> Sealed<T>

pub fn expose(&self) -> &T

The redemption borrow. Whitelist enforced by xtask secret; the type-level guarantee is that even a leaked borrow cannot be formatted or serialized through Sealed itself.

impl Sealed<String>

pub fn into_vault_value(self) -> Zeroizing<String>

The one exit besides redemption: into the vault that will hold it. Consuming, so a caller cannot keep what it just handed over, and the result is still a type that zeroizes on drop.

It lives here rather than at the enrolment site because that is what keeps the enrolment site off the expose whitelist: plaintext leaves this type in the module that defines the type.