Skip to content

feat(daemon): keep tokens in the secret store - #84

Merged
noctuum merged 1 commit into
mainfrom
feat/secret-store
Oct 15, 2026
Merged

noctuum merged 1 commit into
mainfrom
feat/secret-store

Conversation

@noctuum

@noctuum noctuum commented Oct 15, 2026

Copy link
Copy Markdown
Member

benshi_daemon::secrets keeps the token of a backend: Secrets reads, writes and removes it by a Key. Memory keeps tokens in the process, and SecretService, on Linux, keeps them in the store that answers the Secret Service API on the session bus.

  • A token is an item of the default collection with the attributes application = benshi and backend = <backend>, passed in a plain session.
  • A call made with Asking::Never does not ask the store to unlock and is Error::Locked. A call made with Asking::Within waits that long for the person the store asks.
  • Every call is given up on after the deadline the store is made with. DEADLINE is 5 s, and PROMPT_WAIT, the wait for a person, is 2 minutes.
  • The tests run against a Secret Service of their own over a socket pair, and against a session bus that is not there or does not answer.
  • zbus 5.19.0 is added for Linux, with p2p in the dev-dependencies.

The ignored tests/secret_store_live.rs was run once against ksecretd of kwallet 6.31.0 with the wallet unlocked: the write, read, replace and removal passed and no window was shown. A locked wallet was not tested.

cargo test --workspace passes, 980 tests.

A locked store is unlocked only where a call may ask a person.
@noctuum
noctuum merged commit 67b4bda into main Oct 15, 2026
1 check passed
@noctuum
noctuum deleted the feat/secret-store branch October 15, 2026 16:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant