Summary
Migrates user authentication state storage (access tokens, refresh tokens, and profile data) from plaintext YAML on disk (auth.yaml) to the operating system's secure credential store using the keyring crate. Intermediate sensitive memory allocations are scrubbed via zeroize.
Context & Motivation
Previously, tokens and session data were serialized as plaintext YAML inside ~/.config/veyak/auth.yaml via DataDir. Storing credentials unencrypted on disk poses security risks (token extraction by unprivileged background processes, local file inspection, and accidental repository commits).
Summary
Migrates user authentication state storage (access tokens, refresh tokens, and profile data) from plaintext YAML on disk (
auth.yaml) to the operating system's secure credential store using thekeyringcrate. Intermediate sensitive memory allocations are scrubbed viazeroize.Context & Motivation
Previously, tokens and session data were serialized as plaintext YAML inside
~/.config/veyak/auth.yamlviaDataDir. Storing credentials unencrypted on disk poses security risks (token extraction by unprivileged background processes, local file inspection, and accidental repository commits).