Crate: vox-secrets · Version: 0.6.0 · Target: Library (lib.rs)
Clavis: central secret resolution and OS-keyring vault, from the Vox project.
Secret resolution + redaction (env, vault, infisical, vox-vault backends).
| Feature | Default / Enables |
|---|
default | — |
secrets-infisical | — |
secrets-vault | — |
| Module | Description |
|---|
backend | — |
errors | — |
policy | — |
redact | — |
resolver | — |
sources | — |
spec | — |
| Struct | Description |
|---|
SecretStatusRow | A redaction-safe summary row for one managed secret. SECURITY: every field here is non-sensitive presence/metadata. The actual secret value is NEVER included — only the head4…tail2 redacted preview from [ResolvedSecret::redacted]. Safe to serialize across an IPC / GUI boundary. |
ImportEnvEntry | One managed secret recognised inside a .env file during import. SECURITY: carries only the source key NAME, the canonical env it maps to, and a head4…tail2 redacted preview of the value — NEVER the raw value. |
ImportEnvResult | Result of an .env import (dry-run or applied). SECURITY: applied == false means a dry-run that only reports recognised key NAMES; applied == true means the values were written to the vault and only a count is returned. No raw value is ever surfaced. |
| Enum | Description |
|---|
BackendMode | — |
| Function | Description |
|---|
from_env | — |
resolve_secret | — |
store_secret | Persist a managed secret to the Clavis vault at runtime (account/profile-scoped). Writes the plaintext into the cloudless vault keyed by the secret’s canonical env name under the active VOX_ACCOUNT_ID. Pass profile to write a profile-scoped override; None writes the account-level canonical record. # Errors Returns [SecretError] if the vault backend cannot be initialized (e.g. the keyring-backed master key is unavailable) or the write fails. |
secret_id_for_canonical_env | Find a managed secret by its canonical environment name. This is the shared lookup used by every user-facing secret writer so the CLI and GUI cannot drift from the registry metadata. |
delete_secret | Delete a managed secret from the active Clavis account. The caller supplies a registry-defined [SecretId], preventing arbitrary vault keys from becoming an alternate secret-management surface. # Errors Returns [SecretError] when the Clavis vault cannot be initialized or the delete operation fails. |
resolve_secret_for_cli | — |
resolve_secret_with_context | — |
resolve_env_only | — |
set_registry_token | — |
get_registry_token | — |
get_registry_username | Read the username (e.g. GitHub login) stored alongside a registry token. |
remove_registry_token | Remove a registry token from both the secure store and auth.json. Returns true if an entry existed. Never returns the token material. |
migrate_auth_store_to_secure_store | — |
list_secret_status | Build a redaction-safe status row for every real (non config-only) managed secret. Iterates [all_specs], filters out operator-tuning config, and resolves each. The returned rows carry only presence + a redacted preview. |
active_resolve_profile | The currently-active secret resolution profile, derived from VOX_SECRETS_PROFILE (mirrors the precedence in [resolve_secret]). Non-sensitive — exposes only the profile selector, never any material. |
backend_unavailable_detail | Probe whether the active secrets backend is reachable. Resolves managed specs until one reports [ResolutionStatus::BackendUnavailable]; returns the first such backend detail (if any). Mirrors the logic behind the CLI vox secrets backend-status command. Never exposes secret material. |
count | Number of managed secrets recognised / imported. |
import_env_from_path | Parse a .env file and either preview (dry-run) or import its managed secrets into the Clavis vault. Single source of truth shared by the CLI vox secrets import-env command and the GUI import_env Tauri command. Lines are simple KEY=VALUE pairs; comments (#) and blanks are skipped, and surrounding quotes are stripped. Only keys matching a managed [SecretSpec] (canonical, alias, or deprecated alias) are considered. When apply is false the values are read but NEVER stored or returned — only key names + a redacted preview. When apply is true the values are written to the vault and the same redaction-safe entries are returned. # Errors Returns [SecretError] if the file cannot be read, or (when apply is true) if the vault backend cannot be initialized or a write fails. |
| Constant | Description |
|---|
OPERATOR_SECRETS_CUTOVER_PHASE | — |
OPERATOR_SECRETS_MIGRATION_PHASE | — |
OPERATOR_SECRETS_HARD_CUT | — |
OPERATOR_SECRETS_AUTO_PREFER_VAULT | — |
OPERATOR_SECRETS_KEK_REF | — |
OPERATOR_SECRETS_KEK_VERSION | — |
OPERATOR_SECRETS_AUTO_VAULT | — |
OPERATOR_SECRETS_VAULT_URL | — |
OPERATOR_SECRETS_VAULT_PATH | — |
OPERATOR_SECRETS_VAULT_TOKEN | — |
OPERATOR_ACCOUNT_ID | — |
OPERATOR_SECRETS_PROFILE | — |
OPERATOR_SECRETS_BACKEND | — |
OPERATOR_INFISICAL_TOKEN | — |
OPERATOR_INFISICAL_SERVICE_TOKEN | — |
OPERATOR_VAULT_ADDR | — |
OPERATOR_VAULT_TOKEN | — |
OPERATOR_TURSO_URL | — |
OPERATOR_TURSO_TOKEN | — |
OPERATOR_SCIENTIA_CROSSREF_MAILTO | — |
OPERATOR_SCHOLARLY_ADAPTER | — |
OPERATOR_SCHOLARLY_JOB_LOCK_OWNER | — |
OPERATOR_ZENODO_HTTP_MAX_ATTEMPTS | — |
OPERATOR_ZENODO_API_BASE | — |
OPERATOR_OPENREVIEW_HTTP_MAX_ATTEMPTS | — |
OPERATOR_ZENODO_STAGING_DIR | — |
OPERATOR_ZENODO_UPLOAD_ALLOWLIST | — |
OPERATOR_SYNDICATION_TEMPLATE_PROFILE | — |
OPERATOR_NEWS_PUBLISH_ARMED | — |
OPERATOR_NEWS_SITE_BASE_URL | — |
OPERATOR_NEWS_RSS_FEED_PATH | — |
OPERATOR_SCIENTIA_RESEARCH_MESH_INTAKE_WRITER | — |
OPERATOR_SCIENTIA_RESEARCH_MESH_CONSUMER_POLL | — |
OPERATOR_SCIENTIA_RESEARCH_MESH_CONSUMER_POLL_INTERVAL_MS | — |
OPERATOR_TUNING_ENVS | Array of system operator tuning environment variables. |