bitwarden_access_token_crypto/
purpose.rs

1//! The HKDF `info` that separates key-derivation purposes.
2
3/// The purpose a key is derived for from an [`crate::AccessTokenSeed`].
4///
5/// Each purpose maps to an HKDF `info` string. The strings must be unique (colliding purposes
6/// derive the same key) and must never change once credentials are issued under them (they would
7/// derive a different key). Adding a purpose is a deliberate change that requires review by this
8/// crate's owners.
9#[derive(Debug, Clone, Copy, PartialEq, Eq)]
10pub enum KeyPurpose {
11    /// The PAM access connector.
12    AccessConnector,
13    /// Secrets Manager access tokens.
14    SecretsManager,
15}
16
17impl KeyPurpose {
18    pub(crate) fn as_str(&self) -> &'static str {
19        match self {
20            Self::AccessConnector => "access-connector",
21            Self::SecretsManager => "sm-access-token",
22        }
23    }
24}
25
26#[cfg(test)]
27mod tests {
28    use super::*;
29
30    /// Changing either string would change the key already-issued tokens derive.
31    #[test]
32    fn key_purposes_are_pinned() {
33        assert_eq!(KeyPurpose::AccessConnector.as_str(), "access-connector");
34        assert_eq!(KeyPurpose::SecretsManager.as_str(), "sm-access-token");
35    }
36}
bitwarden_access_token_crypto/purpose.rs

bitwarden_access_token_crypto/
purpose.rs
