Struct JwtSecretManager 

pub struct JwtSecretManager { /* private fields */ }

Manages the API daemon’s JWT signing secret.

Use JwtSecretManager::with_base_dir alongside KeyManager during daemon startup so both keys live in the same directory.

Implementations

impl JwtSecretManager

pub fn with_base_dir(base_dir: impl AsRef<Path>) -> Self

Creates a manager rooted at base_dir.

pub fn cluster_secret_file_path(&self) -> PathBuf

Returns the path to the cluster-wide JWT secret file.

This file holds the literal signing string the whole cluster shares (propagated from the leader during a node join), as opposed to the per-node random jwt_secret_{deployment}.key. When present, daemon startup prefers it over get_or_create, so a session cookie minted on any node validates cluster-wide.

pub fn load_cluster_secret(&self) -> Result<Option<SecretString>>

Load the cluster-wide JWT secret if one was propagated to this node by the leader during a join.

Returns Ok(None) when the file is absent (the standalone / never-joined case) so the caller can fall back to Self::get_or_create. The file holds the secret verbatim (UTF-8, trailing newline tolerated).

Errors

Returns SecretsError::Encryption if the file exists but cannot be read or is empty.

pub fn import_cluster_secret(&self, secret: &str) -> Result<()>

Persist the cluster-wide JWT secret propagated by the leader, writing the literal signing string to Self::cluster_secret_file_path with mode 0600 on Unix.

Idempotent in effect: an existing file is overwritten with the leader-supplied value (the leader is the source of truth).

Errors

Returns SecretsError::Encryption if secret is empty or the file cannot be written.

pub fn get_or_create(&self, deployment: &str) -> Result<SecretString>

Resolves the JWT secret, generating + persisting a fresh one when neither the env var nor a saved file is present.

Errors

Returns SecretsError::Encryption if the file system cannot be read or written, or if the loaded file is empty.

Trait Implementations

impl Clone for JwtSecretManager

fn clone(&self) -> JwtSecretManager

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for JwtSecretManager

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.