4343#[ cfg( windows) ]
4444use anyhow:: { Context , Result } ;
4545#[ cfg( windows) ]
46+ use std:: { ptr, slice} ;
47+ #[ cfg( windows) ]
4648use winapi:: shared:: minwindef:: DWORD ;
4749#[ cfg( windows) ]
4850use winapi:: um:: dpapi:: { CryptProtectData , CryptUnprotectData } ;
4951#[ cfg( windows) ]
5052use winapi:: um:: wincrypt:: DATA_BLOB ;
51- #[ cfg( windows) ]
52- use std:: { ptr, slice} ;
5353
5454/// Defines the encryption scope: user or machine
5555#[ cfg( windows) ]
5656#[ derive( Clone , Copy , Debug ) ]
5757pub enum Scope {
5858 /// Tied to current user account. Data can only be decrypted by the same user
5959 /// on the same machine. This is the most secure option for user-specific data.
60- ///
60+ ///
6161 /// # Security
62- ///
62+ ///
6363 /// - Data is encrypted using the current user's credentials
6464 /// - Only the same user on the same machine can decrypt the data
6565 /// - If the user's password changes, the data can still be decrypted
@@ -68,11 +68,11 @@ pub enum Scope {
6868 /// Scope::User by the same user. The scope flag is used during encryption
6969 /// to determine which key to use.
7070 User ,
71-
71+
7272 /// Tied to local machine. Data can be decrypted by any user on the same machine.
73- ///
73+ ///
7474 /// # Security
75- ///
75+ ///
7676 /// - Data is encrypted using the machine's credentials
7777 /// - Any user on the same machine can decrypt the data
7878 /// - Useful for shared secrets that need to be accessible to all users
@@ -125,13 +125,16 @@ pub fn encrypt_data(data: &[u8], scope: Scope) -> Result<Vec<u8>> {
125125 log:: debug!( "Encrypting with DPAPI ({:?} scope)" , scope) ;
126126
127127 let flags = match scope {
128- Scope :: User => 0 , // default = user + UI prompt (but no entropy = silent)
129- Scope :: Machine => 0x4 , // CRYPTPROTECT_LOCAL_MACHINE
128+ Scope :: User => 0 , // default = user + UI prompt (but no entropy = silent)
129+ Scope :: Machine => 0x4 , // CRYPTPROTECT_LOCAL_MACHINE
130130 } ;
131131
132132 unsafe {
133133 let mut input = to_blob ( data) ;
134- let mut output = DATA_BLOB { cbData : 0 , pbData : ptr:: null_mut ( ) } ;
134+ let mut output = DATA_BLOB {
135+ cbData : 0 ,
136+ pbData : ptr:: null_mut ( ) ,
137+ } ;
135138
136139 let success = CryptProtectData (
137140 & mut input,
@@ -144,8 +147,7 @@ pub fn encrypt_data(data: &[u8], scope: Scope) -> Result<Vec<u8>> {
144147 ) ;
145148
146149 if success == 0 {
147- return Err ( std:: io:: Error :: last_os_error ( ) )
148- . context ( "CryptProtectData failed" ) ;
150+ return Err ( std:: io:: Error :: last_os_error ( ) ) . context ( "CryptProtectData failed" ) ;
149151 }
150152
151153 let encrypted = slice:: from_raw_parts ( output. pbData , output. cbData as usize ) . to_vec ( ) ;
@@ -201,7 +203,10 @@ pub fn decrypt_data(data: &[u8], scope: Scope) -> Result<Vec<u8>> {
201203
202204 unsafe {
203205 let mut input = to_blob ( data) ;
204- let mut output = DATA_BLOB { cbData : 0 , pbData : ptr:: null_mut ( ) } ;
206+ let mut output = DATA_BLOB {
207+ cbData : 0 ,
208+ pbData : ptr:: null_mut ( ) ,
209+ } ;
205210
206211 let success = CryptUnprotectData (
207212 & mut input,
@@ -214,8 +219,7 @@ pub fn decrypt_data(data: &[u8], scope: Scope) -> Result<Vec<u8>> {
214219 ) ;
215220
216221 if success == 0 {
217- return Err ( std:: io:: Error :: last_os_error ( ) )
218- . context ( "CryptUnprotectData failed" ) ;
222+ return Err ( std:: io:: Error :: last_os_error ( ) ) . context ( "CryptUnprotectData failed" ) ;
219223 }
220224
221225 let decrypted = slice:: from_raw_parts ( output. pbData , output. cbData as usize ) . to_vec ( ) ;
@@ -243,7 +247,8 @@ mod tests {
243247 let original = b"machine secret" ;
244248 let encrypted = encrypt_data ( original, Scope :: Machine ) . expect ( "Machine encryption failed" ) ;
245249 assert_ne ! ( original. to_vec( ) , encrypted) ;
246- let decrypted = decrypt_data ( & encrypted, Scope :: Machine ) . expect ( "Machine decryption failed" ) ;
250+ let decrypted =
251+ decrypt_data ( & encrypted, Scope :: Machine ) . expect ( "Machine decryption failed" ) ;
247252 assert_eq ! ( original. to_vec( ) , decrypted) ;
248253 }
249254
0 commit comments