Struct Secret

Source

pub struct Secret {
    pub account_id: Uuid,
    pub secret: HashedValue,
}

Expand description

A hashed secret bound to a single account identifier.

Secret is the main value object of this crate. It stores only the hashed representation of a credential. Callers create a value from plaintext with Secret::new or reconstruct it from storage with Secret::from_hashed.

§Security notes

Plaintext input is hashed before storage in the returned value.
Verification is delegated to the configured HashingService implementation.
The stored value is self-contained and suitable for persistence.

§Examples

Secrets are typically created during registration and verified during login:

use webgates_core::verification_result::VerificationResult;
use webgates_secrets::hashing::argon2::Argon2Hasher;
use webgates_secrets::Secret;
use uuid::Uuid;

let account_id = Uuid::now_v7();
let hasher = Argon2Hasher::new_recommended().unwrap();
let secret = Secret::new(&account_id, "user_entered_password", hasher.clone())
    .map_err(|e| e.to_string())?;

let verification = secret
    .verify("user_entered_password", hasher)
    .map_err(|e| e.to_string())?;

assert_eq!(verification, VerificationResult::Ok);

§Usage notes

Persist only the hashed value and its associated account_id. Plaintext secrets must never be stored or logged.

Fields§

§account_id: Uuid

The account identifier this secret belongs to.

§secret: HashedValue

The persisted hashed secret value.

Implementations§

Source §

impl Secret

Source

pub fn new<Hasher: HashingService>( account_id: &Uuid, plain_secret: &str, hasher: Hasher, ) -> Result<Self, SecretError>

Creates a new secret by hashing the provided plaintext input.

§Errors

Returns an error when hashing fails because the configured hashing backend cannot produce a valid hash.

§Examples

use webgates_secrets::hashing::argon2::Argon2Hasher;
use webgates_secrets::Secret;
use uuid::Uuid;

let account_id = Uuid::now_v7();
let hasher = Argon2Hasher::new_recommended().unwrap();
let secret = Secret::new(&account_id, "user_password_123", hasher)
    .map_err(|e| e.to_string())?;

assert_eq!(secret.account_id, account_id);

Source

pub fn from_hashed(account_id: &Uuid, hashed_secret: &HashedValue) -> Self

Reconstructs a secret from a previously hashed value.

Use this constructor when loading persisted secrets from storage.

§Examples

use webgates_secrets::hashing::argon2::Argon2Hasher;
use webgates_secrets::hashing::HashedValue;
use webgates_secrets::Secret;
use uuid::Uuid;

let account_id = Uuid::now_v7();
let hasher = Argon2Hasher::new_recommended().unwrap();
let original_secret = Secret::new(&account_id, "password", hasher.clone())
    .map_err(|e| e.to_string())?;
let stored_hash: &HashedValue = &original_secret.secret;

let reconstructed = Secret::from_hashed(&account_id, stored_hash);

assert_eq!(reconstructed.account_id, account_id);

Source

pub fn verify<Hasher: HashingService>( &self, plain_secret: &str, hasher: Hasher, ) -> Result<VerificationResult, SecretError>

Verifies a plaintext secret against the stored hash.

Returns VerificationResult::Ok when the plaintext matches the stored hash and VerificationResult::Unauthorized when it does not match.

§Errors

Returns an error when the stored hash cannot be parsed or verified by the provided hashing backend.

§Examples

use webgates_core::verification_result::VerificationResult;
use webgates_secrets::hashing::argon2::Argon2Hasher;
use webgates_secrets::Secret;
use uuid::Uuid;

let account_id = Uuid::now_v7();
let correct_password = "secure_password_123";
let hasher = Argon2Hasher::new_recommended().unwrap();

let secret = Secret::new(&account_id, correct_password, hasher.clone())
    .map_err(|e| e.to_string())?;

let result = secret
    .verify(correct_password, hasher.clone())
    .map_err(|e| e.to_string())?;
assert_eq!(result, VerificationResult::Ok);

let result = secret
    .verify("wrong_password", hasher)
    .map_err(|e| e.to_string())?;
assert_eq!(result, VerificationResult::Unauthorized);