Struct CredentialStore 

pub struct CredentialStore<S: SecretsStore> { /* private fields */ }

Credential store for API key authentication.

Wraps a SecretsStore implementation and stores credentials as encrypted JSON blobs keyed by API key name under the credentials scope.

Implementations

impl<S: SecretsStore> CredentialStore<S>

pub fn new(store: S) -> Self

Create a new credential store backed by the provided secrets store.

pub fn store(&self) -> &S

Borrow the underlying secrets store.

Useful for constructing sibling typed stores (e.g. crate::RegistryCredentialStore / crate::GitCredentialStore) that share the same concrete backing store without re-opening it. When S is an Arc<_> (the common case), call .clone() on the returned reference for a cheap refcount bump.

pub async fn validate( &self, api_key: &str, api_secret: &str, ) -> Result<Option<Vec<String>>>

Validate an API key and secret pair.

Returns Some(roles) if the credentials are valid, None if invalid.

Arguments

• api_key - The API key (used as the secret name in the store)
• api_secret - The password/secret to verify against the stored hash

Errors

Returns a SecretsError if there is a storage or decryption error (NOT for invalid credentials – that returns Ok(None)).

pub async fn create_api_key( &self, api_key: &str, password: &str, roles: &[&str], ) -> Result<()>

Create a new API key credential.

The password is hashed with Argon2id before storage. If a credential with the same key already exists, it will be overwritten.

Arguments

• api_key - The API key identifier
• password - The password/secret to hash and store
• roles - Roles assigned to this credential

Errors

Returns a SecretsError if hashing or storage fails.

pub async fn delete_api_key(&self, api_key: &str) -> Result<()>

Delete an API key credential.

Arguments

• api_key - The API key to delete

Errors

Returns SecretsError::NotFound if the credential doesn’t exist.

pub async fn exists(&self, api_key: &str) -> Result<bool>

Check if an API key credential exists.

Errors

Returns a SecretsError if there is a storage or decryption error.

pub async fn set_roles(&self, api_key: &str, roles: &[&str]) -> Result<()>

Overwrite the roles array on an existing credential, preserving the password hash. Use this to keep credential roles in sync with the authoritative user-store role when an admin changes a user’s role.

Arguments

• api_key - The API key whose roles should be updated
• roles - The new role list (replaces existing)

Errors

Returns SecretsError::NotFound if the credential doesn’t exist, or a SecretsError if the storage or (de)serialisation fails.

pub async fn ensure_admin(&self, api_key: &str, password: &str) -> Result<bool>

Ensure a default admin credential exists.

If no credential with the given api_key exists, one is created with the provided password and ["admin"] role. Returns the password that was set (either the provided one or the existing one if already present).

Arguments

• api_key - The admin API key name (e.g. “admin”)
• password - The password to use if the credential doesn’t exist

Returns

true if a new credential was created, false if one already existed.

Errors

Returns a SecretsError if hashing or storage fails during creation.

Trait Implementations

impl<S: SecretsStore> Debug for CredentialStore<S>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.