Add durable credential registry and secret lifecycle

crates/remora-credentials/tests/redaction.rs

@@ -0,0 +1,65 @@
+use std::collections::BTreeMap;
+
+use remora_credentials::{SecretMaterial, VaultConfig};
+
+#[test]
+fn secret_material_debug_and_display_redact_values() {
+    let material = SecretMaterial::BearerToken {
+        token: "super-secret-token-value".into(),
+    };
+    let debug = format!("{material:?}");
+    let display = format!("{material}");
+    assert!(!debug.contains("super-secret-token-value"));
+    assert!(debug.contains("REDACTED"));
+    assert!(!display.contains("super-secret-token-value"));
+    assert_eq!(display, "SecretMaterial(bearer_token)");
+
+    let headers = SecretMaterial::HttpHeaders {
+        headers: BTreeMap::from([("x-api-key".into(), "header-secret".into())]),
+    };
+    let debug = format!("{headers:?}");
+    assert!(!debug.contains("header-secret"));
+    assert!(debug.contains("REDACTED"));
+}
+
+#[test]
+fn vault_config_debug_redacts_token() {
+    let config = VaultConfig {
+        address: "http://vault:8200".into(),
+        token: "synthetic-vault-token".into(),
+        mount: "secret".into(),
+        path_prefix: "remora/lane-0".into(),
+        timeout: std::time::Duration::from_secs(1),
+    };
+    let debug = format!("{config:?}");
+    assert!(!debug.contains("synthetic-vault-token"));
+    assert!(debug.contains("REDACTED"));
+}
+
+#[test]
+fn error_messages_never_embed_secret_literals() {
+    let material = SecretMaterial::BasicAuth {
+        username: "alice".into(),
+        password: "p@ssw0rd-should-not-leak".into(),
+    };
+    let err = remora_credentials::CredentialError::InvalidInput(format!(
+        "validated kind {}",
+        material.kind().as_str()
+    ));
+    let text = err.to_string();
+    assert!(!text.contains("p@ssw0rd-should-not-leak"));
+    assert!(err.is_safe_for_logs());
+}
+
+#[test]
+fn material_validation_rejects_empty_and_forbidden_headers() {
+    let empty = SecretMaterial::BearerToken {
+        token: String::new(),
+    };
+    assert!(empty.validate().is_err());
+
+    let forbidden = SecretMaterial::HttpHeaders {
+        headers: BTreeMap::from([("authorization".into(), "Bearer x".into())]),
+    };
+    assert!(forbidden.validate().is_err());
+}