Complete the end-to-end CLI parity audit

crates/storage/src/write.rs

@@ -8,6 +8,7 @@ use crate::{
     recipient::{RecipientPolicyError, RecipientPolicyManager, SigningPolicy},
     repository::{EncryptedEntry, EntryPath, Repository, RepositoryError, SecretBytes},
 };
+use zeroize::Zeroize;
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum OverwriteDecision {
@@ -21,23 +22,38 @@ pub struct InsertContent {
 }
 
 impl InsertContent {
-    pub fn hidden(first: Vec<u8>, confirmation: Vec<u8>) -> Result<Self, WriteError> {
-        validate_single_line(&first)?;
-        validate_single_line(&confirmation)?;
+    pub fn hidden(mut first: Vec<u8>, mut confirmation: Vec<u8>) -> Result<Self, WriteError> {
+        if let Err(error) = validate_single_line(&first) {
+            first.zeroize();
+            confirmation.zeroize();
+            return Err(error);
+        }
+        if let Err(error) = validate_single_line(&confirmation) {
+            first.zeroize();
+            confirmation.zeroize();
+            return Err(error);
+        }
         if first != confirmation {
+            first.zeroize();
+            confirmation.zeroize();
             return Err(WriteError::ConfirmationMismatch);
         }
         if first.is_empty() {
+            confirmation.zeroize();
             return Err(WriteError::EmptySingleLine);
         }
+        confirmation.zeroize();
         Ok(Self {
             mode: InsertInput::HiddenConfirmed,
             secret: SecretBytes::new(first),
         })
     }
 
-    pub fn echoed(line: Vec<u8>) -> Result<Self, WriteError> {
-        validate_single_line(&line)?;
+    pub fn echoed(mut line: Vec<u8>) -> Result<Self, WriteError> {
+        if let Err(error) = validate_single_line(&line) {
+            line.zeroize();
+            return Err(error);
+        }
         if line.is_empty() {
             return Err(WriteError::EmptySingleLine);
         }
@@ -186,6 +202,17 @@ impl<'a> VaultWriter<'a> {
         Self { repository, keys }
     }
 
+    /// Report whether a logical entry already exists so a frontend can ask for
+    /// confirmation without inspecting the password-store filesystem itself.
+    pub fn entry_exists(&self, entry: &str) -> Result<bool, WriteError> {
+        let path = EntryPath::parse(entry)?;
+        match self.repository.read_entry(&path) {
+            Ok(_) => Ok(true),
+            Err(RepositoryError::NotFound { .. }) => Ok(false),
+            Err(error) => Err(error.into()),
+        }
+    }
+
     #[allow(clippy::too_many_arguments)]
     pub fn insert(
         &self,