docs: publish site from 6c188a2b
This commit is contained in:
gitea-actions
@@ -0,0 +1,21 @@
|
||||
<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta name="generator" content="rustdoc"><meta name="description" content="Secure credential storage module"><title>jellytau_lib::credentials - Rust</title><script>if(window.location.protocol!=="file:")document.head.insertAdjacentHTML("beforeend","SourceSerif4-Regular-6b053e98.ttf.woff2,FiraSans-Italic-81dc35de.woff2,FiraSans-Regular-0fe48ade.woff2,FiraSans-MediumItalic-ccf7e434.woff2,FiraSans-Medium-e1aa3f0a.woff2,SourceCodePro-Regular-8badfe75.ttf.woff2,SourceCodePro-Semibold-aa29a496.ttf.woff2".split(",").map(f=>`<link rel="preload" as="font" type="font/woff2"href="../../static.files/${f}">`).join(""))</script><link rel="stylesheet" href="../../static.files/normalize-9960930a.css"><link rel="stylesheet" href="../../static.files/rustdoc-17e0aaed.css"><meta name="rustdoc-vars" data-root-path="../../" data-static-root-path="../../static.files/" data-current-crate="jellytau_lib" data-themes="" data-resource-suffix="" data-rustdoc-version="1.97.1 (8bab26f4f 2026-07-14)" data-channel="1.97.1" data-search-js="search-fd9372ac.js" data-stringdex-js="stringdex-2da4960a.js" data-settings-js="settings-170eb4bf.js" ><script src="../../static.files/storage-41dd4d93.js"></script><script defer src="../sidebar-items.js"></script><script defer src="../../static.files/main-fcd733ba.js"></script><noscript><link rel="stylesheet" href="../../static.files/noscript-f7c3ffd8.css"></noscript><link rel="alternate icon" type="image/png" href="../../static.files/favicon-32x32-eab170b8.png"><link rel="icon" type="image/svg+xml" href="../../static.files/favicon-044be391.svg"></head><body class="rustdoc mod"><a class="skip-main-content" href="#main-content">Skip to main content</a><!--[if lte IE 11]><div class="warning">This old browser is unsupported and will most likely display funky things.</div><![endif]--><rustdoc-topbar><h2><a href="#">Module credentials</a></h2></rustdoc-topbar><nav class="sidebar"><div class="sidebar-crate"><h2><a href="../../jellytau_lib/index.html">jellytau_<wbr>lib</a><span class="version">0.11.6</span></h2></div><div class="sidebar-elems"><section id="rustdoc-toc"><h2 class="location"><a href="#">Module credentials</a></h2><h3><a href="#structs">Module Items</a></h3><ul class="block"><li><a href="#structs" title="Structs">Structs</a></li><li><a href="#enums" title="Enums">Enums</a></li><li><a href="#constants" title="Constants">Constants</a></li><li><a href="#functions" title="Functions">Functions</a></li></ul></section><div id="rustdoc-modnav"><h2 class="in-crate"><a href="../index.html">In crate jellytau_<wbr>lib</a></h2></div></div></nav><div class="sidebar-resizer" title="Drag to resize sidebar"></div><main><div class="width-limiter"><section id="main-content" class="content" tabindex="-1"><div class="main-heading"><div class="rustdoc-breadcrumbs"><a href="../index.html">jellytau_lib</a></div><h1>Module <span>credentials</span> <button id="copy-path" title="Copy item path to clipboard">Copy item path</button></h1><rustdoc-toolbar></rustdoc-toolbar><span class="sub-heading"><a class="src" href="../../src/jellytau_lib/credentials.rs.html#1-1219">Source</a> </span></div><details class="toggle top-doc" open><summary class="hideme"><span>Expand description</span></summary><div class="docblock"><p>Secure credential storage module</p>
|
||||
<p>Provides secure storage for access tokens using:</p>
|
||||
<ul>
|
||||
<li>Primary: System keyring (Secret Service on Linux, Keychain on macOS)</li>
|
||||
<li>Fallback: AES-256-GCM encrypted file when keyring unavailable</li>
|
||||
</ul>
|
||||
<p>The fallback is <strong>obfuscation at rest, not a secret</strong>: its key sits in a file
|
||||
beside the ciphertext, so anyone who can read one can read the other. It
|
||||
exists so headless systems keep working, and the keyring remains the only
|
||||
place a token is actually protected.</p>
|
||||
<p>The key used to be <em>derived</em> from the hostname, <code>$USER</code> and a hardcoded salt.
|
||||
That was no more secret — those are readable by anyone who can read the file
|
||||
— and it was unstable: renaming the machine, or launching from a context
|
||||
where <code>$USER</code> is unset, changed the key and made every stored token
|
||||
undecryptable. <code>load_credentials_file</code> treats a failed decrypt as “no stored
|
||||
credentials”, so that surfaced as being silently signed out rather than as an
|
||||
error. The key is now random and persisted, and the old derivation is kept
|
||||
only to migrate a file written before this change.</p>
|
||||
<p>TRACES: UR-012 | IR-014</p>
|
||||
</div></details><h2 id="structs" class="section-header">Structs<a href="#structs" class="anchor">§</a></h2><dl class="item-table"><dt><a class="struct" href="struct.CredentialStore.html" title="struct jellytau_lib::credentials::CredentialStore">Credential<wbr>Store</a></dt><dd>Credential storage manager</dd></dl><h2 id="enums" class="section-header">Enums<a href="#enums" class="anchor">§</a></h2><dl class="item-table"><dt><a class="enum" href="enum.CredentialError.html" title="enum jellytau_lib::credentials::CredentialError">Credential<wbr>Error</a></dt><dd>Error types for credential operations</dd><dt><a class="enum" href="enum.CredentialResult.html" title="enum jellytau_lib::credentials::CredentialResult">Credential<wbr>Result</a></dt><dd>Result of a credential storage operation</dd></dl><h2 id="constants" class="section-header">Constants<a href="#constants" class="anchor">§</a></h2><dl class="item-table"><dt><a class="constant" href="constant.CREDENTIALS_FILENAME.html" title="constant jellytau_lib::credentials::CREDENTIALS_FILENAME">CREDENTIALS_<wbr>FILENAME</a><span title="Restricted Visibility"> 🔒</span> </dt><dt><a class="constant" href="constant.KEY_FILENAME.html" title="constant jellytau_lib::credentials::KEY_FILENAME">KEY_<wbr>FILENAME</a><span title="Restricted Visibility"> 🔒</span> </dt><dd>Key file for the encrypted-file fallback, beside the credentials it opens.</dd><dt><a class="constant" href="constant.SERVICE_NAME.html" title="constant jellytau_lib::credentials::SERVICE_NAME">SERVICE_<wbr>NAME</a><span title="Restricted Visibility"> 🔒</span> </dt></dl><h2 id="functions" class="section-header">Functions<a href="#functions" class="anchor">§</a></h2><dl class="item-table"><dt><a class="fn" href="fn.decrypt_with.html" title="fn jellytau_lib::credentials::decrypt_with">decrypt_<wbr>with</a><span title="Restricted Visibility"> 🔒</span> </dt><dd>Decrypt <code>encrypted</code> with <code>key</code>.</dd><dt><a class="fn" href="fn.encrypt_with.html" title="fn jellytau_lib::credentials::encrypt_with">encrypt_<wbr>with</a><span title="Restricted Visibility"> 🔒</span> </dt><dd>Encrypt <code>plaintext</code> with <code>key</code>, prepending a fresh random nonce.</dd><dt><a class="fn" href="fn.load_or_create_key.html" title="fn jellytau_lib::credentials::load_or_create_key">load_<wbr>or_<wbr>create_<wbr>key</a><span title="Restricted Visibility"> 🔒</span> </dt><dd>Load the fallback encryption key, creating it on first use.</dd><dt><a class="fn" href="fn.restrict_to_owner.html" title="fn jellytau_lib::credentials::restrict_to_owner">restrict_<wbr>to_<wbr>owner</a><span title="Restricted Visibility"> 🔒</span> </dt><dd>Make a key file owner-readable only. Best effort — a filesystem without
|
||||
Unix permissions is not a reason to fail.</dd></dl></section></div></main></body></html>
|
||||
Reference in New Issue
Block a user