From b4da87231da504ba4539a13fa0dbfd19a2262ee8 Mon Sep 17 00:00:00 2001
From: Ethan Girouard <ethan@girouard.com>
Date: Tue, 14 Jul 2026 20:32:25 -0400
Subject: [PATCH] Use SecretString in config where appropriate

---
 src/server/config.rs | 37 ++++++++++++++++++++++---------------
 1 file changed, 22 insertions(+), 15 deletions(-)

diff --git a/src/server/config.rs b/src/server/config.rs
index 2aa1690..97f4753 100644
--- a/src/server/config.rs
+++ b/src/server/config.rs
@@ -44,11 +44,11 @@ pub struct AuthConfig {
 /// Build a connection URI from parts
 fn format_uri(
     scheme: &str,
-    username: &Option<String>,
-    password: &Option<String>,
+    username: Option<&String>,
+    password: Option<&String>,
     host: &str,
-    port: &Option<u16>,
-    path: &Option<String>,
+    port: Option<u16>,
+    path: Option<&String>,
 ) -> String {
     let mut url = format!("{scheme}://");
 
@@ -92,14 +92,14 @@ impl DatabaseConfig {
 #[serde(untagged)]
 enum DatabaseConnectionConfig {
     FromUrl {
-        url: String,
+        url: SecretString,
     },
     FromParts {
         host: String,
         port: Option<u16>,
         database: Option<String>,
         username: Option<String>,
-        password: Option<String>,
+        password: Option<SecretString>,
     },
 }
 
@@ -107,14 +107,21 @@ impl DatabaseConnectionConfig {
     /// Convert this configuration into the Postgres connection URI
     pub fn as_uri(&self) -> String {
         match self {
-            Self::FromUrl { url } => url.clone(),
+            Self::FromUrl { url } => url.expose().clone(),
             Self::FromParts {
                 host,
                 port,
                 database,
                 username,
                 password,
-            } => format_uri("postgres", username, password, host, port, database),
+            } => format_uri(
+                "postgres",
+                username.as_ref(),
+                password.as_ref().map(|s| s.expose()),
+                host,
+                *port,
+                database.as_ref(),
+            ),
         }
     }
 }
@@ -123,7 +130,7 @@ impl DatabaseConnectionConfig {
 #[serde(untagged)]
 enum KeyValStoreConnectionConfig {
     FromUrl {
-        url: String,
+        url: SecretString,
     },
     FromParts {
         scheme: Option<String>,
@@ -131,7 +138,7 @@ enum KeyValStoreConnectionConfig {
         port: Option<u16>,
         database: Option<String>,
         username: Option<String>,
-        password: Option<String>,
+        password: Option<SecretString>,
     },
 }
 
@@ -139,7 +146,7 @@ impl KeyValStoreConnectionConfig {
     /// Convert this configuration into the Redis connection URI
     pub fn as_uri(&self) -> String {
         match self {
-            Self::FromUrl { url } => url.clone(),
+            Self::FromUrl { url } => url.expose().clone(),
             Self::FromParts {
                 scheme,
                 host,
@@ -149,11 +156,11 @@ impl KeyValStoreConnectionConfig {
                 password,
             } => format_uri(
                 scheme.as_deref().unwrap_or("redis"),
-                username,
-                password,
+                username.as_ref(),
+                password.as_ref().map(|s| s.expose().clone()).as_ref(),
                 host,
-                port,
-                database,
+                *port,
+                database.as_ref(),
             ),
         }
     }