Struct Redacted 

pub struct Redacted<T: Zeroize = String>(/* private fields */);

A secret value whose Debug/Display output is always ***, and whose backing memory is zeroized when it is dropped.

Wrap any credential that must never reach a log line, a panic message, or a future #[derive(Debug)] added to a struct embedding it. T defaults to String, the shape every current call site needs; a caller that needs a different backing type must supply one that implements [Zeroize] (e.g. secret bytes as Vec<u8>).

Examples

use deps_core::secret::Redacted;

let token = Redacted::new("super-secret-value".to_string());
assert_eq!(token.expose_secret(), "super-secret-value");
assert_eq!(format!("{token:?}"), "Redacted(***)");
assert_eq!(format!("{token}"), "***");

Implementations

impl<T: Zeroize> Redacted<T>

pub fn new(value: T) -> Self

Wraps value. The only way to recover it is Self::expose_secret (for T: AsRef<str>).

impl<T: Zeroize + AsRef<str>> Redacted<T>

pub fn expose_secret(&self) -> &str

The raw secret value. Never pass this to anything but the one call site that needs it (e.g. attaching a header value to a request) — never to a log, error message, or anything Debug/Display-formatted downstream.

Named expose_secret() rather than as_str() deliberately, mirroring the secrecy crate’s ExposeSecret::expose_secret() convention: a name shared with hundreds of ordinary string-conversion methods across the workspace cannot be grepped for in isolation, while a distinctive name lets a reviewer or a future automated lint find every place a secret’s plaintext crosses its wrapper boundary with a single search.

Trait Implementations

impl<T: Clone + Zeroize> Clone for Redacted<T>

fn clone(&self) -> Redacted<T>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T: Zeroize> Debug for Redacted<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T: Zeroize> Display for Redacted<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T: Zeroize + Eq> Eq for Redacted<T>

impl<T: Zeroize + Hash> Hash for Redacted<T>

Hashes the wrapped value, not the redaction wrapper — so Redacted<T> can be used as (or inside) a hash-map/set key exactly when T itself could be. Opt-in via T: Hash, same shape as the PartialEq/Eq impls above: a caller that needs this must ask for it by bounding on Hash, so embedding a secret in a hash key stays a deliberate choice at each call site rather than something a blanket impl would make automatic.

fn hash<H: Hasher>(&self, state: &mut H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl<T: Zeroize + PartialEq> PartialEq for Redacted<T>

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<T: Zeroize> ZeroizeOnDrop for Redacted<T>

Marker confirming Redacted<T> zeroizes its backing memory on drop — the actual zeroing is performed by the wrapped [Zeroizing<T>] field’s own Drop impl.