Struct CredentialStore 

pub struct CredentialStore {
    using_keyring: bool,
    credentials_path: PathBuf,
    encryption_key: [u8; 32],
}

Credential storage manager

Fields

using_keyring: bool

Whether we’re using keyring (true) or encrypted file (false)

credentials_path: PathBuf

Path to the encrypted credentials file (fallback)

encryption_key: [u8; 32]

Encryption key for file fallback (derived from machine ID)

Implementations

impl CredentialStore

pub fn new() -> Self

Create a new credential store, detecting the best available backend

pub fn is_using_keyring(&self) -> bool

Check if we’re using the secure keyring backend

pub fn save_token( &self, user_id: &str, token: &str, ) -> Result<CredentialResult, CredentialError>

Save an access token for a user

pub fn get_token(&self, user_id: &str) -> Result<String, CredentialError>

Get an access token for a user

pub fn delete_token(&self, user_id: &str) -> Result<(), CredentialError>

Delete an access token for a user

fn test_keyring_available() -> bool

fn test_keyring_inner() -> bool

fn save_to_keyring( &self, user_id: &str, token: &str, ) -> Result<(), CredentialError>

fn get_from_keyring(&self, user_id: &str) -> Result<String, CredentialError>

fn delete_from_keyring(&self, user_id: &str) -> Result<(), CredentialError>

fn get_credentials_path() -> PathBuf

fn derive_encryption_key() -> [u8; 32]

fn load_credentials_file(&self) -> Result<Value, CredentialError>

Load and decrypt the credential map.

A file that is present but undecryptable is deliberately reported as an empty credential set rather than as an error. The key never leaves the device it was derived on (Android Keystore keys are never backed up, and the file fallback’s key is derived from machine identifiers), so a restored/transferred install gets ciphertext with no key and every read would fail permanently. Surfacing that as an error made session restore throw instead of falling back to the login screen: an unrecoverable app rather than a clean logged-out one. The next successful login re-encrypts the file with the current key, so the state self-heals.

TRACES: UR-012 | IR-014

fn save_credentials_file(&self, data: &Value) -> Result<(), CredentialError>

fn encrypt(&self, plaintext: &str) -> Result<String, CredentialError>

fn decrypt(&self, encrypted: &str) -> Result<String, CredentialError>

fn save_to_file( &self, user_id: &str, token: &str, ) -> Result<(), CredentialError>

fn get_from_file(&self, user_id: &str) -> Result<String, CredentialError>

fn delete_from_file(&self, user_id: &str) -> Result<(), CredentialError>

Trait Implementations

impl Default for CredentialStore

fn default() -> Self

Returns the “default value” for a type.