coven_keys/keys/
cloud_credentials.rs

1//! Cloud-home OAuth credentials: the bearer tokens the key service holds in
2//! custody for a provider session.
3
4use serde::{Deserialize, Serialize};
5
6/// Tokens returned from an OAuth authorization or refresh.
7///
8/// `Debug` is hand-written: `access_token` and `refresh_token` are bearer
9/// credentials and print as `<redacted>` so `{:?}` in an error path cannot
10/// leak them.
11#[derive(Clone, Serialize, Deserialize)]
12pub struct OAuthTokens {
13    pub access_token: String,
14    pub refresh_token: Option<String>,
15    /// Unix timestamp when the access token expires. None if unknown.
16    pub expires_at: Option<i64>,
17}
18
19impl std::fmt::Debug for OAuthTokens {
20    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
21        f.debug_struct("OAuthTokens")
22            .field("access_token", &"<redacted>")
23            // Presence (whether the session can refresh) is observable; the
24            // token itself is redacted.
25            .field(
26                "refresh_token",
27                &self.refresh_token.as_ref().map(|_| "<redacted>"),
28            )
29            .field("expires_at", &self.expires_at)
30            .finish()
31    }
32}
coven_keys/keys/cloud_credentials.rs

coven_keys/keys/
cloud_credentials.rs
