refactor: switch to secrecy::SecretString for secrets

valeratrades · valeratrades · commit 713497fa8151 · 2025-01-22T17:29:26.000Z
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -27,6 +27,7 @@ hmac = "^0.12.1"
 sha2 = "^0.10.8"
 hex = "^0.4.3"
 derive-new = "^0.7.0"
+secrecy = "^0.10.3"
 
 #[dev-dependencies]
 insta = "1.42.0"
diff --git a/README.md b/README.md
@@ -2,7 +2,7 @@
 ![Minimum Supported Rust Version](https://img.shields.io/badge/nightly-1.85+-ab6000.svg)
 [<img alt="crates.io" src="https://img.shields.io/crates/v/v_exchanges.svg?color=fc8d62&logo=rust" height="20" style=flat-square>](https://crates.io/crates/v_exchanges)
 [<img alt="docs.rs" src="https://img.shields.io/badge/docs.rs-66c2a5?style=for-the-badge&labelColor=555555&logo=docs.rs&style=flat-square" height="20">](https://docs.rs/v_exchanges)
-![Lines Of Code](https://img.shields.io/badge/LoC-4619-lightblue)
+![Lines Of Code](https://img.shields.io/badge/LoC-4631-lightblue)
 <br>
 [<img alt="ci errors" src="https://img.shields.io/github/actions/workflow/status/valeratrades/v_exchanges/errors.yml?branch=master&style=for-the-badge&style=flat-square&label=errors&labelColor=420d09" height="20">](https://github.com/valeratrades/v_exchanges/actions?query=branch%3Amaster) <!--NB: Won't find it if repo is private-->
 [<img alt="ci warnings" src="https://img.shields.io/github/actions/workflow/status/valeratrades/v_exchanges/warnings.yml?branch=master&style=for-the-badge&style=flat-square&label=warnings&labelColor=d16002" height="20">](https://github.com/valeratrades/v_exchanges/actions?query=branch%3Amaster) <!--NB: Won't find it if repo is private-->
diff --git a/examples/binance/market_futures.rs b/examples/binance/market_futures.rs
@@ -20,7 +20,7 @@ async fn main() {
 	dbg!(&klines, price);
 
 	if let (Ok(key), Ok(secret)) = (env::var("BINANCE_TIGER_READ_KEY"), env::var("BINANCE_TIGER_READ_SECRET")) {
-		c.auth(key, secret);
+		c.auth(key, secret.into());
 		let balance_usdt = c.asset_balance("USDT".into(), m).await.unwrap();
 		dbg!(&balance_usdt);
 		let balances = c.balances(m).await.unwrap();
diff --git a/examples/bybit/market.rs b/examples/bybit/market.rs
@@ -15,7 +15,7 @@ async fn main() {
 	dbg!(&price);
 
 	if let (Ok(key), Ok(secret)) = (env::var("BYBIT_TIGER_READ_KEY"), env::var("BYBIT_TIGER_READ_SECRET")) {
-		c.auth(key, secret);
+		c.auth(key, secret.into());
 		private(&*c, m).await;
 	} else {
 		eprintln!("BYBIT_TIGER_READ_KEY or BYBIT_TIGER_READ_SECRET is missing, skipping private API methods.");
diff --git a/examples/mexc.rs b/examples/mexc.rs
@@ -8,7 +8,7 @@ async fn main() {
 
 	let m: AbsMarket = "Mexc/Futures".into();
 	let mut c = m.client();
-	c.auth(env::var("MEXC_READ_KEY").unwrap(), env::var("MEXC_READ_SECRET").unwrap());
+	c.auth(env::var("MEXC_READ_KEY").unwrap(), env::var("MEXC_READ_SECRET").unwrap().into());
 
 	let price = c.price(("BTC", "USDT").into(), m).await.unwrap();
 	dbg!(&price);
diff --git a/v_exchanges/Cargo.toml b/v_exchanges/Cargo.toml
@@ -45,6 +45,7 @@ v_exchanges_adapters = { version = "^0.4.0", path = "../v_exchanges_adapters/",
 reqwest = { version = "^0.12.12", optional = true }
 
 insta.workspace = true #dbg (for some reason is not loading in dev-dependencies rn
+secrecy.workspace = true
 
 [dev-dependencies]
 color-eyre = "^0.6.3"
diff --git a/v_exchanges/src/binance/mod.rs b/v_exchanges/src/binance/mod.rs
@@ -6,6 +6,7 @@ mod spot;
 use adapters::binance::BinanceOption;
 use derive_more::{Deref, DerefMut};
 use eyre::Result;
+use secrecy::SecretString;
 use v_exchanges_adapters::Client;
 use v_utils::trades::{Asset, Pair, Timeframe};
 
@@ -26,7 +27,7 @@ impl Exchange for Binance {
 		self.source_market.unwrap()
 	}
 
-	fn auth(&mut self, key: String, secret: String) {
+	fn auth(&mut self, key: String, secret: SecretString) {
 		self.update_default_option(BinanceOption::Key(key));
 		self.update_default_option(BinanceOption::Secret(secret));
 	}
@@ -108,6 +109,7 @@ impl crate::core::MarketTrait for Market {
 			..Default::default()
 		})
 	}
+
 	fn abs_market(&self) -> AbsMarket {
 		AbsMarket::Binance(*self)
 	}
diff --git a/v_exchanges/src/bybit/mod.rs b/v_exchanges/src/bybit/mod.rs
@@ -9,6 +9,7 @@ use derive_more::{
 	derive::{Deref, DerefMut},
 };
 use eyre::Result;
+use secrecy::SecretString;
 use v_exchanges_adapters::Client;
 use v_utils::trades::{Asset, Pair, Timeframe};
 
@@ -32,7 +33,7 @@ impl Exchange for Bybit {
 		self.source_market.unwrap()
 	}
 
-	fn auth(&mut self, key: String, secret: String) {
+	fn auth(&mut self, key: String, secret: SecretString) {
 		self.update_default_option(BybitOption::Key(key));
 		self.update_default_option(BybitOption::Secret(secret));
 	}
diff --git a/v_exchanges/src/core.rs b/v_exchanges/src/core.rs
@@ -3,6 +3,7 @@ use std::collections::{BTreeMap, VecDeque};
 use chrono::{DateTime, TimeDelta, Utc};
 use derive_more::{Deref, DerefMut};
 use eyre::{Report, Result, bail};
+use secrecy::SecretString;
 use serde_json::json;
 use v_utils::{
 	trades::{Asset, Kline, Pair, Timeframe, Usd},
@@ -17,7 +18,7 @@ pub trait Exchange: std::fmt::Debug + Send {
 		self.source_market().exchange_name()
 	}
 
-	fn auth(&mut self, key: String, secret: String);
+	fn auth(&mut self, key: String, secret: SecretString);
 
 	async fn exchange_info(&self, m: AbsMarket) -> Result<ExchangeInfo>;
 
@@ -60,7 +61,7 @@ impl std::fmt::Display for WrongExchangeError {
 
 pub trait MarketTrait {
 	fn client(&self, source_market: AbsMarket) -> Box<dyn Exchange>;
-	fn client_authenticated(&self, key: String, secret: String, source_market: AbsMarket) -> Box<dyn Exchange> {
+	fn client_authenticated(&self, key: String, secret: SecretString, source_market: AbsMarket) -> Box<dyn Exchange> {
 		let mut client = self.client(source_market);
 		client.auth(key, secret);
 		client
@@ -84,7 +85,7 @@ impl AbsMarket {
 	}
 
 	//Q: more I think about it, more this seems redundant / stupid according to Tiger Style
-	pub fn client_authenticated(&self, key: String, secret: String) -> Box<dyn Exchange> {
+	pub fn client_authenticated(&self, key: String, secret: SecretString) -> Box<dyn Exchange> {
 		match self {
 			Self::Binance(m) => m.client_authenticated(key, secret, *self),
 			Self::Bybit(m) => m.client_authenticated(key, secret, *self),
@@ -234,16 +235,17 @@ impl RequestRange {
 			_ => unimplemented!(),
 		}
 	}
+
 	fn serialize_common(&self) -> serde_json::Value {
-				filter_nulls(match self {
-					RequestRange::StartEnd { start, end } => json!({
-						"startTime": start.timestamp_millis(),
-						"endTime": end.map(|dt| dt.timestamp_millis()),
-					}),
-					RequestRange::Limit(limit) => json!({
-						"limit": limit,
-					}),
-				})
+		filter_nulls(match self {
+			RequestRange::StartEnd { start, end } => json!({
+				"startTime": start.timestamp_millis(),
+				"endTime": end.map(|dt| dt.timestamp_millis()),
+			}),
+			RequestRange::Limit(limit) => json!({
+				"limit": limit,
+			}),
+		})
 	}
 }
 impl Default for RequestRange {
diff --git a/v_exchanges/src/lib.rs b/v_exchanges/src/lib.rs
@@ -1,6 +1,6 @@
 #![feature(array_try_map)]
 
-pub(crate) extern crate v_exchanges_adapters as adapters;
+pub extern crate v_exchanges_adapters as adapters;
 
 pub mod core;
 
diff --git a/v_exchanges/src/mexc/mod.rs b/v_exchanges/src/mexc/mod.rs
@@ -9,6 +9,7 @@ use derive_more::{
 	derive::{Deref, DerefMut},
 };
 use eyre::Result;
+use secrecy::SecretString;
 use v_exchanges_adapters::Client;
 use v_utils::trades::{Asset, Pair, Timeframe};
 
@@ -32,7 +33,7 @@ impl Exchange for Mexc {
 		self.source_market.unwrap()
 	}
 
-	fn auth(&mut self, key: String, secret: String) {
+	fn auth(&mut self, key: String, secret: SecretString) {
 		self.update_default_option(MexcOption::Key(key));
 		self.update_default_option(MexcOption::Secret(secret));
 	}
@@ -102,6 +103,7 @@ impl crate::core::MarketTrait for Market {
 			..Default::default()
 		})
 	}
+
 	fn abs_market(&self) -> AbsMarket {
 		AbsMarket::Mexc(*self)
 	}
diff --git a/v_exchanges_adapters/Cargo.toml b/v_exchanges_adapters/Cargo.toml
@@ -24,6 +24,7 @@ derive-new.workspace = true
 derive_more.workspace = true
 hex.workspace = true
 hmac.workspace = true
+secrecy.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 serde_with.workspace = true
diff --git a/v_exchanges_adapters/src/exchanges/binance.rs b/v_exchanges_adapters/src/exchanges/binance.rs
@@ -7,6 +7,7 @@ use std::{
 };
 
 use hmac::{Hmac, Mac};
+use secrecy::{ExposeSecret as _, SecretString};
 use serde::{Deserialize, Serialize, de::DeserializeOwned};
 use sha2::Sha256;
 use v_exchanges_api_generics::{http::*, websocket::*};
@@ -24,7 +25,7 @@ pub enum BinanceOption {
 	/// API key
 	Key(String),
 	/// Api secret
-	Secret(String),
+	Secret(SecretString),
 	/// Base url for HTTP requests
 	HttpUrl(BinanceHttpUrl),
 	/// Authentication type for HTTP requests
@@ -47,7 +48,7 @@ pub struct BinanceOptions {
 	pub key: Option<String>,
 	/// see [BinanceOption::Secret]
 	#[debug("[REDACTED]")]
-	pub secret: Option<String>,
+	pub secret: Option<SecretString>,
 	/// see [BinanceOption::HttpUrl]
 	pub http_url: BinanceHttpUrl,
 	/// see [BinanceOption::HttpAuth]
@@ -191,7 +192,7 @@ where
 
 				builder = builder.query(&[("timestamp", timestamp)]);
 
-				let secret = self.options.secret.as_deref().ok_or("API secret not set")?;
+				let secret = self.options.secret.as_ref().map(|s| s.expose_secret()).ok_or("API secret not set")?;
 				let mut hmac = Hmac::<Sha256>::new_from_slice(secret.as_bytes()).unwrap(); // hmac accepts key of any length
 
 				let mut request = builder.build().or(Err("Failed to build request"))?;
diff --git a/v_exchanges_adapters/src/exchanges/bitflyer.rs b/v_exchanges_adapters/src/exchanges/bitflyer.rs
@@ -5,6 +5,7 @@ use std::{marker::PhantomData, time::SystemTime};
 
 use hmac::{Hmac, Mac};
 use rand::{Rng, distributions::Alphanumeric};
+use secrecy::{ExposeSecret as _, SecretString};
 use serde::{Deserialize, Serialize, de::DeserializeOwned};
 use serde_json::json;
 use sha2::Sha256;
@@ -26,7 +27,7 @@ pub enum BitFlyerOption {
 	/// API key
 	Key(String),
 	/// Api secret
-	Secret(String),
+	Secret(SecretString),
 	/// Base url for HTTP requests
 	HttpUrl(BitFlyerHttpUrl),
 	/// Whether [BitFlyerRequestHandler] should perform authentication
@@ -53,7 +54,7 @@ pub struct BitFlyerOptions {
 	pub key: Option<String>,
 	/// see [BitFlyerOption::Secret]
 	#[debug("[REDACTED]")]
-	pub secret: Option<String>,
+	pub secret: Option<SecretString>,
 	/// see [BitFlyerOption::HttpUrl]
 	pub http_url: BitFlyerHttpUrl,
 	/// see [BitFlyerOption::HttpAuth]
@@ -153,7 +154,7 @@ where
 
 			let sign_contents = format!("{}{}{}{}", timestamp, request.method(), path, body);
 
-			let secret = self.options.secret.as_deref().ok_or("API secret not set")?;
+			let secret = self.options.secret.as_ref().map(|s| s.expose_secret()).ok_or("API secret not set")?;
 			let mut hmac = Hmac::<Sha256>::new_from_slice(secret.as_bytes()).unwrap(); // hmac accepts key of any length
 
 			hmac.update(sign_contents.as_bytes());
@@ -202,7 +203,7 @@ impl WebSocketHandler for BitFlyerWebSocketHandler {
 		if self.options.websocket_auth {
 			// https://bf-lightning-api.readme.io/docs/realtime-api-auth
 			if let Some(key) = self.options.key.as_deref() {
-				if let Some(secret) = self.options.secret.as_deref() {
+				if let Some(secret) = self.options.secret.as_ref().map(|s| s.expose_secret()) {
 					let time = SystemTime::now().duration_since(SystemTime::UNIX_EPOCH).unwrap(); // always after the epoch
 					let timestamp = time.as_millis() as u64;
 					let nonce: String = rand::thread_rng().sample_iter(&Alphanumeric).take(16).map(char::from).collect();
diff --git a/v_exchanges_adapters/src/exchanges/bybit.rs b/v_exchanges_adapters/src/exchanges/bybit.rs
@@ -4,6 +4,7 @@
 use std::{borrow::Cow, marker::PhantomData, time::SystemTime, vec};
 
 use hmac::{Hmac, Mac};
+use secrecy::{ExposeSecret as _, SecretString};
 use serde::{Serialize, de::DeserializeOwned};
 use serde_json::json;
 use sha2::Sha256;
@@ -25,7 +26,7 @@ pub enum BybitOption {
 	/// API key
 	Key(String),
 	/// Api secret
-	Secret(String),
+	Secret(SecretString),
 	/// Base url for HTTP requests
 	HttpUrl(BybitHttpUrl),
 	/// Type of authentication used for HTTP requests.
@@ -54,7 +55,7 @@ pub struct BybitOptions {
 	pub key: Option<String>,
 	/// see [BybitOption::Secret]
 	#[debug("[REDACTED]")]
-	pub secret: Option<String>,
+	pub secret: Option<SecretString>,
 	/// see [BybitOption::HttpUrl]
 	pub http_url: BybitHttpUrl,
 	/// see [BybitOption::HttpAuth]
@@ -162,7 +163,7 @@ where
 		}
 
 		let key = self.options.key.as_deref().ok_or("API key not set")?;
-		let secret = self.options.secret.as_deref().ok_or("API secret not set")?;
+		let secret = self.options.secret.as_ref().map(|s| s.expose_secret()).ok_or("API secret not set")?;
 
 		let time = SystemTime::now().duration_since(SystemTime::UNIX_EPOCH).unwrap(); // always after the epoch
 		let timestamp = time.as_millis();
@@ -375,7 +376,7 @@ impl WebSocketHandler for BybitWebSocketHandler {
 	fn handle_start(&mut self) -> Vec<WebSocketMessage> {
 		if self.options.websocket_auth {
 			if let Some(key) = self.options.key.as_deref() {
-				if let Some(secret) = self.options.secret.as_deref() {
+				if let Some(secret) = self.options.secret.as_ref().map(|s| s.expose_secret()) {
 					let time = SystemTime::now().duration_since(SystemTime::UNIX_EPOCH).unwrap(); // always after the epoch
 					let expires = time.as_millis() as u64 + 1000;
 
diff --git a/v_exchanges_adapters/src/exchanges/coincheck.rs b/v_exchanges_adapters/src/exchanges/coincheck.rs
@@ -4,6 +4,7 @@
 use std::{marker::PhantomData, time::SystemTime};
 
 use hmac::{Hmac, Mac};
+use secrecy::{ExposeSecret as _, SecretString};
 use serde::{Serialize, de::DeserializeOwned};
 use serde_json::json;
 use sha2::Sha256;
@@ -26,7 +27,7 @@ pub enum CoincheckOption {
 	/// API key
 	Key(String),
 	/// Api secret
-	Secret(String),
+	Secret(SecretString),
 	/// Base url for HTTP requests
 	HttpUrl(CoincheckHttpUrl),
 	/// Whether [CoincheckRequestHandler] should perform authentication
@@ -51,7 +52,7 @@ pub struct CoincheckOptions {
 	pub key: Option<String>,
 	/// see [CoincheckOption::Secret]
 	#[debug("[REDACTED]")]
-	pub secret: Option<String>,
+	pub secret: Option<SecretString>,
 	/// see [CoincheckOption::HttpUrl]
 	pub http_url: CoincheckHttpUrl,
 	/// see [CoincheckOption::HttpAuth]
@@ -138,7 +139,7 @@ where
 
 			let sign_contents = format!("{}{}{}", nonce, request.url(), body);
 
-			let secret = self.options.secret.as_deref().ok_or("API secret not set")?;
+			let secret = self.options.secret.as_ref().map(|s| s.expose_secret()).ok_or("API secret not set")?;
 			let mut hmac = Hmac::<Sha256>::new_from_slice(secret.as_bytes()).unwrap(); // hmac accepts key of any length
 
 			hmac.update(sign_contents.as_bytes());
diff --git a/v_exchanges_adapters/src/exchanges/mexc.rs b/v_exchanges_adapters/src/exchanges/mexc.rs

Original file line number	Diff line number	Diff line change
`@@ -6,6 +6,7 @@ mod spot;`
`6`	`6`	`use adapters::binance::BinanceOption;`
`7`	`7`	`use derive_more::{Deref, DerefMut};`
`8`	`8`	`use eyre::Result;`
	`9`	`+use secrecy::SecretString;`
`9`	`10`	`use v_exchanges_adapters::Client;`
`10`	`11`	`use v_utils::trades::{Asset, Pair, Timeframe};`
`11`	`12`
`@@ -26,7 +27,7 @@ impl Exchange for Binance {`
`26`	`27`	`self.source_market.unwrap()`
`27`	`28`	`}`
`28`	`29`
`29`		`- fn auth(&mut self, key: String, secret: String) {`
	`30`	`+ fn auth(&mut self, key: String, secret: SecretString) {`
`30`	`31`	`self.update_default_option(BinanceOption::Key(key));`
`31`	`32`	`self.update_default_option(BinanceOption::Secret(secret));`
`32`	`33`	`}`
`@@ -108,6 +109,7 @@ impl crate::core::MarketTrait for Market {`
`108`	`109`	`..Default::default()`
`109`	`110`	`})`
`110`	`111`	`}`
	`112`	`+`
`111`	`113`	`fn abs_market(&self) -> AbsMarket {`
`112`	`114`	`AbsMarket::Binance(*self)`
`113`	`115`	`}`
Original file line number	Diff line number	Diff line change
`@@ -9,6 +9,7 @@ use derive_more::{`
`9`	`9`	`derive::{Deref, DerefMut},`
`10`	`10`	`};`
`11`	`11`	`use eyre::Result;`
	`12`	`+use secrecy::SecretString;`
`12`	`13`	`use v_exchanges_adapters::Client;`
`13`	`14`	`use v_utils::trades::{Asset, Pair, Timeframe};`
`14`	`15`
`@@ -32,7 +33,7 @@ impl Exchange for Bybit {`
`32`	`33`	`self.source_market.unwrap()`
`33`	`34`	`}`
`34`	`35`
`35`		`- fn auth(&mut self, key: String, secret: String) {`
	`36`	`+ fn auth(&mut self, key: String, secret: SecretString) {`
`36`	`37`	`self.update_default_option(BybitOption::Key(key));`
`37`	`38`	`self.update_default_option(BybitOption::Secret(secret));`
`38`	`39`	`}`