Wrap credential and credential-holding types to prevent `Debug` leaks.

The following values are considered confidential, and should never be logged, even by accident:

* `Password`, which is a durable bearer token for a specific Login;
* `IdentitySecret`, which is an ephemeral but potentially long-lived bearer token for a specific Login; or
* `IdentityToken`, which may hold cookies containing an `IdentitySecret`.

These values are now wrapped in types whose `Debug` impls output opaque values, so that they can be included in structs that `#[derive(Debug)]` without requiring any additional care. The wrappers also avoid implementing `Display`, to prevent inadvertent `to_string()`s.

We don't bother obfuscating `IdentitySecret`s in memory or in the `.hi` database. There's no point: we'd also need to store the information needed to de-obfuscate them, and they can be freely invalidated and replaced by blanking that table and asking everyone to log in again. Passwords _are_ obfuscated for storage, as they're intended to be durable.

1 files changed, 5 insertions, 4 deletions

diff --git a/src/test/fixtures/login.rs b/src/test/fixtures/login.rs
index f1e4b15..d6a321b 100644
--- a/src/test/fixtures/login.rs
+++ b/src/test/fixtures/login.rs
@@ -3,10 +3,11 @@ use uuid::Uuid;
 
 use crate::{
     app::App,
+    password::Password,
     repo::login::{self, Login},
 };
 
-pub async fn create_with_password(app: &App) -> (String, String) {
+pub async fn create_with_password(app: &App) -> (String, Password) {
     let (name, password) = propose();
     app.logins()
         .create(&name, &password)
@@ -31,7 +32,7 @@ pub fn fictitious() -> Login {
     }
 }
 
-pub fn propose() -> (String, String) {
+pub fn propose() -> (String, Password) {
     (name(), propose_password())
 }
 
@@ -39,6 +40,6 @@ fn name() -> String {
     rand::random::<internet::Username>().to_string()
 }
 
-pub fn propose_password() -> String {
-    Uuid::new_v4().to_string()
+pub fn propose_password() -> Password {
+    Uuid::new_v4().to_string().into()
 }