Source: arsenal/crates/arsenal-core/src/secret.rs. SHA-256: b680d13ed794de37fa2a5d6719c3b4051d95e8019669cc69eb38a5f340187c34.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

secret::SecretId

Secret identifier

#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(transparent)]
pub struct SecretId(Uuid);

Source line: 24.

secret::SecretId::generate

Generate a new secret ID

#[must_use]
pub fn generate() -> Self;

Source line: 29.

secret::SecretId::from_uuid

Create from an existing UUID

#[must_use]
pub const fn from_uuid(uuid: Uuid) -> Self;

Source line: 35.

secret::SecretId::as_uuid

Get the inner UUID

#[must_use]
pub const fn as_uuid(&self) -> &Uuid;

Source line: 41.

secret::SecretVersion

Secret version identifier

#[derive(Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
#[serde(transparent)]
pub struct SecretVersion(u64);

Source line: 61.

secret::SecretVersion::initial

Create version 1 (initial version)

#[must_use]
pub const fn initial() -> Self;

Source line: 66.

secret::SecretVersion::new

Create from a version number

#[must_use]
pub const fn new(version: u64) -> Self;

Source line: 72.

secret::SecretVersion::as_u64

Get the version number

#[must_use]
pub const fn as_u64(&self) -> u64;

Source line: 78.

secret::SecretVersion::next

Get the next version

#[must_use]
pub const fn next(&self) -> Self;

Source line: 84.

secret::SecretVersion::is_initial

Check if this is the initial version

#[must_use]
pub const fn is_initial(&self) -> bool;

Source line: 90.

secret::SecretType

Secret type classification

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum SecretType {
    /// API key (e.g., `OpenAI`, Stripe)
    ApiKey,
    /// `OAuth2` client credentials
    OAuthClientCredentials,
    /// `OAuth2` access token
    OAuthAccessToken,
    /// `OAuth2` refresh token
    OAuthRefreshToken,
    /// Database connection string
    DatabaseCredentials,
    /// SSH private key
    SshKey,
    /// TLS/SSL private key and certificate
    TlsCertificate,
    /// Signing key (e.g., JWT, webhook)
    SigningKey,
    /// Encryption key
    EncryptionKey,
    /// Generic secret
    Generic,
}

Source line: 110.

secret::SecretType::should_auto_rotate

Check if this secret type should be automatically rotated

#[must_use]
pub const fn should_auto_rotate(&self) -> bool;

Source line: 136.

secret::SecretType::recommended_rotation_days

Get recommended rotation period in days

#[must_use]
pub const fn recommended_rotation_days(&self) -> Option<u32>;

Source line: 145.

secret::SecretMetadata

Secret metadata (does not contain the actual secret value)

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SecretMetadata {
/// Secret ID

pub id: SecretId,
/// Tenant this secret belongs to

pub tenant_id: TenantId,
/// Human-readable name

pub name: String,
/// Description

#[serde(skip_serializing_if = "Option::is_none")]
pub description: Option<String>,
/// Secret type

pub secret_type: SecretType,
/// Current version

pub current_version: SecretVersion,
/// All versions

pub versions: Vec<SecretVersionInfo>,
/// When the secret was created

pub created_at: chrono::DateTime<chrono::Utc>,
/// When the secret was last modified

pub updated_at: chrono::DateTime<chrono::Utc>,
/// When the secret expires (if ever)

#[serde(skip_serializing_if = "Option::is_none")]
pub expires_at: Option<chrono::DateTime<chrono::Utc>>,
/// When the secret was last rotated

#[serde(skip_serializing_if = "Option::is_none")]
pub last_rotated_at: Option<chrono::DateTime<chrono::Utc>>,
/// Next scheduled rotation

#[serde(skip_serializing_if = "Option::is_none")]
pub next_rotation_at: Option<chrono::DateTime<chrono::Utc>>,
/// Whether the secret is currently active

pub is_active: bool,
/// Custom labels

#[serde(default)]
pub labels: HashMap<String, String>,
/// Associated service (e.g., "stripe", "openai")

#[serde(skip_serializing_if = "Option::is_none")]
pub service: Option<String>,
/// Destination binding restricting where this credential can be used

#[serde(default, skip_serializing_if = "Option::is_none")]
pub destination_binding: Option<crate::proxy::DestinationBinding>
}

Source line: 158.

secret::SecretMetadata::new

Create new secret metadata

Errors

Returns an error if validation fails

pub fn new(
        tenant_id: TenantId,
        name: impl Into<String>,
        secret_type: SecretType,
    ) -> ArsenalResult<Self>;

Source line: 205.

secret::SecretMetadata::is_expired

Check if secret is expired

#[must_use]
pub fn is_expired(&self) -> bool;

Source line: 243.

secret::SecretMetadata::needs_rotation

Check if the secret needs rotation

#[must_use]
pub fn needs_rotation(&self) -> bool;

Source line: 253.

secret::SecretMetadata::add_version

Add a new version

pub fn add_version(&mut self, created_by: Option<String>) -> SecretVersion;

Source line: 262.

secret::SecretMetadata::disable_version

Disable a specific version

pub fn disable_version(&mut self, version: SecretVersion);

Source line: 288.

secret::SecretMetadata::deactivate

Deactivate the entire secret

pub fn deactivate(&mut self);

Source line: 298.

secret::SecretMetadata::set_label

Set a label

pub fn set_label(&mut self, key: impl Into<String>, value: impl Into<String>);

Source line: 304.

secret::SecretVersionInfo

Information about a specific secret version

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SecretVersionInfo {
/// Version number

pub version: SecretVersion,
/// When this version was created

pub created_at: chrono::DateTime<chrono::Utc>,
/// Who created this version

#[serde(skip_serializing_if = "Option::is_none")]
pub created_by: Option<String>,
/// Current state of this version

pub state: SecretVersionState
}

Source line: 312.

secret::SecretVersionState

State of a secret version

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum SecretVersionState {
    /// Currently active version
    Active,
    /// Previous version (still valid for grace period)
    Previous,
    /// Disabled (cannot be used)
    Disabled,
    /// Scheduled for deletion
    PendingDeletion,
}

Source line: 327.

secret::SecretRef

Secret reference - used to reference a secret without containing it

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SecretRef {
/// Secret ID

pub id: SecretId,
/// Specific version (None = latest)

#[serde(skip_serializing_if = "Option::is_none")]
pub version: Option<SecretVersion>
}

Source line: 340.

secret::SecretRef::latest

Create a reference to the latest version

#[must_use]
pub fn latest(id: SecretId) -> Self;

Source line: 351.

secret::SecretRef::specific

Create a reference to a specific version

#[must_use]
pub fn specific(id: SecretId, version: SecretVersion) -> Self;

Source line: 357.

secret::WrappedSecret

Wrapped secret - encrypted secret value for transport

#[derive(Clone, Serialize, Deserialize)]
pub struct WrappedSecret {
/// Secret ID

pub id: SecretId,
/// Version

pub version: SecretVersion,
/// Encrypted secret bytes

pub ciphertext: Vec<u8>,
/// Nonce used for encryption

pub nonce: [u8; 12],
/// Key ID used for wrapping

pub wrap_key_id: String,
/// Algorithm used

pub algorithm: String,
/// When this wrapped secret expires

pub expires_at: chrono::DateTime<chrono::Utc>
}

Source line: 367.

secret::WrappedSecret::is_expired

Check if this wrapped secret has expired

#[must_use]
pub fn is_expired(&self) -> bool;

Source line: 387.

secret::SecretValue

Secret value - holds the actual decrypted secret

This type is zeroized on drop for security.

#[derive(Clone, zeroize::Zeroize, zeroize::ZeroizeOnDrop)]
pub struct SecretValue {

}

Source line: 409.

secret::SecretValue::new

Create from bytes

Errors

Returns an error if the secret is too large

pub fn new(bytes: Vec<u8>) -> ArsenalResult<Self>;

Source line: 419.

secret::SecretValue::from_string

Create from a string

Errors

Returns an error if the secret is too large

pub fn from_string(s: impl Into<String>) -> ArsenalResult<Self>;

Source line: 433.

secret::SecretValue::as_bytes

Get the secret bytes

#[must_use]
pub fn as_bytes(&self) -> &[u8];

Source line: 439.

secret::SecretValue::as_str

Get as UTF-8 string if valid

#[must_use]
pub fn as_str(&self) -> Option<&str>;

Source line: 445.

secret::SecretValue::len

Get the length

#[must_use]
pub fn len(&self) -> usize;

Source line: 451.

secret::SecretValue::is_empty

Check if empty

#[must_use]
pub fn is_empty(&self) -> bool;

Source line: 457.

secret::RotationPolicy

Rotation policy for secrets

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RotationPolicy {
/// Enable automatic rotation

pub auto_rotate: bool,
/// Rotation interval in days

pub rotation_days: u32,
/// Grace period for old versions in hours

pub grace_period_hours: u32,
/// Maximum number of versions to keep

pub max_versions: u32,
/// Notification settings

#[serde(skip_serializing_if = "Option::is_none")]
pub notification: Option<RotationNotification>
}

Source line: 470.

secret::RotationNotification

Rotation notification settings

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RotationNotification {
/// Days before rotation to send warning

pub warn_days_before: Vec<u32>,
/// Webhook URL for notifications

#[serde(skip_serializing_if = "Option::is_none")]
pub webhook_url: Option<String>,
/// Email addresses for notifications

#[serde(default)]
pub email_addresses: Vec<String>
}

Source line: 498.

arsenal-core · secret

On this page