Build secure Rust watchOS TOTP core (#56)

crates/storage/src/repository.rs

@@ -12,9 +12,9 @@ use std::{
 #[cfg(test)]
 use std::collections::BTreeSet;
 
+pub use crate::secret::SecretBytes;
 use cap_std::{ambient_authority, fs::Dir};
 use cap_tempfile::TempFile;
-use zeroize::Zeroize;
 
 const ENTRY_EXTENSION: &str = "gpg";
 const RECIPIENT_FILE: &str = ".gpg-id";
@@ -132,35 +132,6 @@ impl fmt::Debug for EncryptedEntry {
     }
 }
 
-/// Decrypted bytes that are redacted in diagnostics and zeroed when dropped.
-pub struct SecretBytes(Vec<u8>);
-
-impl SecretBytes {
-    pub fn new(bytes: Vec<u8>) -> Self {
-        Self(bytes)
-    }
-
-    pub fn expose(&self) -> &[u8] {
-        &self.0
-    }
-
-    pub fn expose_mut(&mut self) -> &mut [u8] {
-        &mut self.0
-    }
-}
-
-impl fmt::Debug for SecretBytes {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str("SecretBytes([REDACTED])")
-    }
-}
-
-impl Drop for SecretBytes {
-    fn drop(&mut self) {
-        self.0.zeroize();
-    }
-}
-
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct EntryRecord {
     path: EntryPath,