Module facade 

The vault family’s facade: the thirteen operations the tools call, every one held for the reader’s approval.

The facade owns no session state: the process-wide VaultSession does. It parks a VaultDraft on the workspace’s registry, awaits one answer, and only then unlocks (when the card asked for the master password) and runs the operation. The card draws only what the draft carries; no secret value is put on it.

Re-exports

use std::path::Path; 🔒

use std::path::PathBuf; 🔒

use std::sync::Arc; 🔒

use std::sync::Weak; 🔒

use async_trait::async_trait; 🔒

use forge_connectors::vault::VaultError; 🔒

use forge_connectors::vault::crypto::Unlocked; 🔒

use forge_connectors::vault::models::Profile; 🔒

use forge_connectors::vault::models::SyncData; 🔒

use forge_primitives::vault::VaultAskDecision; 🔒

use forge_primitives::vault::VaultAskEnding; 🔒

use forge_primitives::vault::VaultAttachmentDraft; 🔒

use forge_primitives::vault::VaultDraft; 🔒

use forge_primitives::vault::VaultTool; 🔒

use serde::Deserialize; 🔒

use serde::Deserialize; 🔒

use serde_json::Value; 🔒

use serde_json::json; 🔒

use zeroize::Zeroize; 🔒

use zeroize::Zeroize; 🔒

use crate::SessionSlot; 🔒

use crate::vault::VaultSession; 🔒

use crate::workspace::Workspace; 🔒

Structs

Approved 🔒

An approved call: the session and keys it runs with, plus the facts its audit line records. Approved::done writes that line from the operation’s own result, never before it has run.

CreateInput

The arguments vault_create accepts.

CustomFieldInput

A custom field as vault_create / vault_update take it.

PatchInput

The fields vault_update may change.

ProdVaultFacade

The production facade: a weak workspace, so it can read the current [vault] session after a reload rather than holding a stale one.

SettleOnDrop 🔒

Settle a held call as abandoned when the blocked tool future is dropped before it answered.

Enums

VaultToolError

Why a vault tool call did not return a result.

Constants

MAX_ATTACHMENT_BYTES 🔒

The server’s attachment ceiling, mirrored so forge refuses before a read or write buffers more than the vault accepts.

SESSION_CHANGED 🔒

What a call settles with when the [vault] section reloaded while it was parked or reading: the account it was drawn against is gone.

Traits

VaultFacade

The thirteen vault operations. Every method parks a hold and awaits the reader’s answer; the mock in tests implements the same contract.

Functions

account_user_id 🔒

The account id a write stamps on encryptedFor. Vaultwarden 1.37 deserializes it as a required field and compares it with the token’s own user, so a sync that omits it cannot produce a valid write.

apply_patch 🔒

attachment_named 🔒

build_new_cipher 🔒

card_field 🔒

check_stored_size 🔒

The server records the ciphertext’s size at upload; a missing size fails closed rather than reading as a match.

check_totp_seed 🔒

A seed that cannot produce a code would store a permanent broken second factor with the card masking the typo, so it is refused before encrypting.

custom_fields 🔒

decrypt_name 🔒

dir_path 🔒

The canonical path of an opened directory, read from the descriptor itself. A platform that cannot answer fails closed.

errno_io 🔒

masked_create_diff 🔒

masked_update_diff 🔒

patch_fields 🔒

read_attachment 🔒

Read an attachment source: the size is checked from metadata before the read, and again after it, because the file can grow between the two.

recheck_destination 🔒

Re-resolve the destination immediately before a write: a parent swapped to a symlink while the card waited must not redirect the write.

replacement_label 🔒

The name a replace card draws for the attachment it would remove: the decrypted file name when the session could read it, else the id.

resolve_destination 🔒

resolve_source 🔒

reveal_value 🔒

validate_reveal 🔒

verify_dir_path 🔒

The opened directory must be the canonical directory the containment check approved, not merely a path that resolved to it a moment later.

write_private 🔒