Enum VaultSecret 

pub enum VaultSecret {
    Password {
        username: Option<String>,
        password: String,
        totp: Option<TotpSeed>,
        login_config: Option<PasswordLoginConfig>,
        secure_notes: Option<String>,
        custom_fields: Vec<CustomField>,
    },
    Passkey {
        credential_id: String,
        private_key: String,
        algorithm: Option<String>,
        rp_id: String,
        user_handle: Option<String>,
        secure_notes: Option<String>,
    },
    OauthTokens {
        provider: String,
        refresh_token: String,
        access_token: Option<String>,
        access_token_expires_at: Option<String>,
        scopes: Vec<String>,
        secure_notes: Option<String>,
    },
    DidSelfIssued {
        did: String,
        signing_key_id: String,
        secure_notes: Option<String>,
    },
    DidcommPeer {
        peer_did: String,
        signing_key_id: String,
        secure_notes: Option<String>,
    },
    BearerToken {
        token: String,
        header_name: Option<String>,
        header_prefix: Option<String>,
        secure_notes: Option<String>,
    },
    SshKey {
        private_key: String,
        public_key: Option<String>,
        comment: Option<String>,
        passphrase: Option<String>,
        secure_notes: Option<String>,
    },
    Custom {
        fields: Vec<CustomField>,
        secure_notes: Option<String>,
    },
}

Cleartext secret material. Field-for-field mirror of vault/_shared/0.2/vault-secret#/$defs/VaultSecret. Discriminated by kind. This secret rides inside the opaque authcrypt JWE (vault/upsert’s sealedSecret), so the vault/*/0.2 edge transform cannot reach it — the discriminator is parsed verbatim here. To accept both a 0.1 producer (kebab did-self-issued) and a spec-0.2 producer (camelCase didSelfIssued) without a breaking wire change, each multi-word variant carries a camelCase alias; the emitted form stays kebab for backwards compatibility (Postel’s law). This is the fix for the half-completed migration in issue #517 — the variant fields were camelCased in 76287a5, the discriminator was not.

Sensitive fields (password, private_key, refresh_token, secure_notes, token, etc.) MUST be zeroised by handlers as soon as their use is complete; this enum derives Debug for diagnostic convenience but production logs MUST NOT format VaultSecret via {:?} — the strings would leak straight in.

Variants

Password

Fields

username: Option<String>

password: String

totp: Option<TotpSeed>

login_config: Option<PasswordLoginConfig>

Optional driver config for vault/proxy-login/0.1 against this entry. When present, the maintainer performs an HTTP POST against loginConfig.loginUrl with the entry’s credentials. When absent, proxy-login returns not_proxyable and the consumer falls back to vault/release for browser-fill. See vault/_shared/0.1/vault-secret#/$defs/PasswordLoginConfig.

secure_notes: Option<String>

custom_fields: Vec<CustomField>

Passkey

Fields

credential_id: String

private_key: String

algorithm: Option<String>

rp_id: String

user_handle: Option<String>

secure_notes: Option<String>

OauthTokens

Fields

provider: String

refresh_token: String

access_token: Option<String>

access_token_expires_at: Option<String>

scopes: Vec<String>

secure_notes: Option<String>

DidSelfIssued

Fields

did: String

signing_key_id: String

secure_notes: Option<String>

DidcommPeer

Fields

peer_did: String

signing_key_id: String

secure_notes: Option<String>

BearerToken

Fields

token: String

header_name: Option<String>

header_prefix: Option<String>

secure_notes: Option<String>

SshKey

Fields

private_key: String

public_key: Option<String>

comment: Option<String>

passphrase: Option<String>

secure_notes: Option<String>

Custom

Fields

fields: Vec<CustomField>

secure_notes: Option<String>

Implementations

impl VaultSecret

pub fn kind(&self) -> SecretKind

Returns the SecretKind that matches this variant. The metadata view’s secret_kind field MUST equal this on every persisted StoredVaultEntry; an inconsistency is a programming error and callers can use VaultSecret::matches_kind to assert at the upsert / release boundary.

pub fn matches_kind(&self, expected: SecretKind) -> bool

Convenience: assert that this secret’s variant matches expected. Used by handler code to fail loudly when the metadata view’s secret_kind disagrees with the unsealed secret’s discriminator.

Trait Implementations

impl Clone for VaultSecret

fn clone(&self) -> VaultSecret

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VaultSecret

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for VaultSecret

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for VaultSecret

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.