Struct FileBackend 

struct FileBackend {
    path: PathBuf,
    key_bytes: [u8; 32],
    map: BTreeMap<String, StoredSecret>,
    loaded: bool,
}

Passphrase-encrypted file-based fallback for environments where the OS keychain is unavailable.

Secrets are stored in ${path}/secrets.enc as an AES-256-GCM blob whose key is derived from passphrase via Argon2id. The entire map is re-encrypted on every set / delete.

This backend is not exposed directly; callers use FileBackendWithPassphrase which stores the passphrase securely and implements the full KeychainBackend trait.

Fields

path: PathBuf

Directory where secrets.enc lives.

key_bytes: [u8; 32]

Argon2id-derived 32-byte AES-256-GCM key (zero-salt placeholder, overridden on load from the real per-file salt).

map: BTreeMap<String, StoredSecret>

In-memory mirror of the decrypted map; populated lazily.

loaded: bool

True after the file has been loaded (or determined to not exist).

Implementations

impl FileBackend

fn new(dir: impl Into<PathBuf>, passphrase: &str) -> Self

fn file_path(&self) -> PathBuf

fn ensure_loaded(&mut self, passphrase: &str) -> Result<(), AppError>

Load and decrypt the file into self.map. Idempotent after first call.

fn flush(&self, passphrase: &str) -> Result<(), AppError>

Serialize and encrypt self.map, then write secrets.enc.

Trait Implementations

impl Drop for FileBackend

fn drop(&mut self)

Executes the destructor for this type.