secrets

Source: crates/lvcs/src/secrets/mod.rs.

/// What the secret scan found (design §15): code points `start..end` of
/// the scanned text and the `rule` that flagged them (a known token
/// format's name, or `entropy` for the high-entropy heuristic). The daemon
/// answers with it as `SecretData`. Owner: `M3.secrets`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub(crate) struct SecretHit {
    pub(crate) start: usize,
    pub(crate) end: usize,
    pub(crate) rule: String,
}

/// `lvcs.toml` `[secrets]` (design §15), part of the daemon's `LvcsToml`:
/// `exempt` lists paths the scan skips (`tests/fixtures/**`), and
/// `never_sync` paths never read into documents beyond `DEFAULT_NEVER_SYNC`
/// and `.gitignore`, both gitignore syntax relative to the tree's root. A
/// missing key is empty. Owner: `M3.secrets`.
#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize)]
#[serde(default)]
pub(crate) struct SecretsConfig {
    /// The paths the secret scan skips, in gitignore syntax.
    pub(crate) exempt: Vec<String>,
    /// The paths never read into documents, in gitignore syntax.
    pub(crate) never_sync: Vec<String>,
}

/// The scanner the daemon runs on a request's resulting text before it is
/// committed: `config` from `lvcs.toml`, and `allowed`, the hashes of the
/// strings participants confirmed with `secret.confirm` (the signed allowlist,
/// which is project data, not `lvcs.toml`). Owner: `M3.secrets`.
#[derive(Debug, Clone, Default)]
pub(crate) struct Scanner {
    config: SecretsConfig,
    allowed: BTreeSet<[u8; 32]>,
}