vtcode_desktop_protocol/
secret.rs

1//! In-app API-key storage (`config/secret/store`) types.
2//!
3//! The desktop client collects a provider API key through a masked input and
4//! sends it to the local service over the supervised stdio channel. The
5//! service persists it through the shared secure-storage boundary (OS keyring
6//! or encrypted file) and never echoes it back: responses and errors carry
7//! provider labels only.
8
9use serde::{Deserialize, Serialize};
10
11use super::ConfigurationSnapshot;
12
13/// Parameters for storing a provider API key from the desktop client.
14///
15/// The secret travels the local stdio channel only. Callers must never log,
16/// persist, or re-render the key; the service stores it via the platform
17/// secure-storage backend and reports provider labels on failure.
18#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
19#[serde(rename_all = "camelCase")]
20pub struct SecretStoreParams {
21    /// Provider identifier, such as `meta`.
22    pub provider: String,
23    /// API key to persist in secure storage. Never echoed back.
24    pub api_key: String,
25}
26
27impl std::fmt::Debug for SecretStoreParams {
28    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
29        f.debug_struct("SecretStoreParams")
30            .field("provider", &self.provider)
31            .field("api_key", &"<redacted>")
32            .finish()
33    }
34}
35
36/// Outcome of `config/secret/store`: the refreshed configuration plus whether
37/// the service restarted the session runtime to pick up repaired credentials.
38#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
39#[serde(rename_all = "camelCase")]
40pub struct SecretStoreResult {
41    /// Configuration snapshot reflecting post-save authentication state.
42    pub configuration: ConfigurationSnapshot,
43    /// True when the save repaired the active provider and the previous
44    /// session runtime was discarded; the client must clear its selection.
45    pub session_reset: bool,
46}
47
48/// In-app secret-form support advertised by the service for the active provider.
49///
50/// Present only when the provider takes a static API key (`vtcode secret add`
51/// route). Absent for login-flow providers (OAuth/managed auth), local
52/// providers, and older services that predate in-app secret storage.
53#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
54#[serde(rename_all = "camelCase")]
55pub struct SecretStoreInfo {
56    /// Provider the form stores a key for.
57    pub provider: String,
58    /// Expected environment variable, shown so users paste the right key.
59    pub env_var: String,
60}
vtcode_desktop_protocol/secret.rs

vtcode_desktop_protocol/
secret.rs
