Use safer approach for passphrase handling
-
Use a dedicated
Passphrasetype which wrapssecrecy::SecretString, so that passphrases can be handled safely and only be passed as plainStringwhen really required. -
Introduce a
Credentialstype which carries a user ID and passphrase for API connections. -
Defer the creation of the connection
Configurationto right before when it is used, so thatCredentialsare only ever passed in at that point in time. This prevents thePassphrasefrom being turned into aStringfor the lifetime of theNetHsm. Consequently we are now storing all availableCredentialsin aHashMapand refer to the currentCredentialsbyString(matching a key in theHashMap). The requiredAgentandUrlare now also members of theNetHsmstruct and the latter can be set using theNetHsm::set_urlfunction. -
As a drive-by change the
NetHsm::set_urlfunction now takes anethsm::Urlinstead of aString. -
Instead of using stacked fixtures for the containers and accompanying
NetHsminstances, use dedicated fixtures. This prevents containers hanging during tests, as theNetHsmreuses the same connection properties if more than one container is used per test.