add Secret<T> to CredentialCacheValue

Author: kylematsuda

src/cargo/util/auth.rs

@@ -384,7 +384,7 @@ pub fn cache_token(config: &Config, sid: &SourceId, token: &str) {
         CredentialCacheValue {
             from_commandline: true,
             independent_of_endpoint: true,
-            token_value: token.to_string(),
+            token_value: Secret::from(token.to_string()),
         },
     );
 }
@@ -425,7 +425,7 @@ fn auth_token_optional(
             || cache_token_value.independent_of_endpoint
             || mutation.is_none()
         {
-            return Ok(Some(cache_token_value.token_value.clone()));
+            return Ok(Some(cache_token_value.token_value.clone().expose()));
         }
     }
 
@@ -518,7 +518,7 @@ fn auth_token_optional(
             CredentialCacheValue {
                 from_commandline: false,
                 independent_of_endpoint,
-                token_value: token.to_string(),
+                token_value: Secret::from(token.to_string()),
             },
         );
     }

src/cargo/util/config/mod.rs

@@ -70,6 +70,7 @@ use crate::core::compiler::rustdoc::RustdocExternMap;
 use crate::core::shell::Verbosity;
 use crate::core::{features, CliUnstable, Shell, SourceId, Workspace, WorkspaceRootConfig};
 use crate::ops::{self, RegistryCredentialConfig};
+use crate::util::auth::Secret;
 use crate::util::errors::CargoResult;
 use crate::util::validate_package_name;
 use crate::util::CanonicalUrl;
@@ -137,24 +138,15 @@ enum WhyLoad {
 }
 
 /// A previously generated authentication token and the data needed to determine if it can be reused.
+#[derive(Debug)]
 pub struct CredentialCacheValue {
     /// If the command line was used to override the token then it must always be reused,
     /// even if reading the configuration files would lead to a different value.
     pub from_commandline: bool,
     /// If nothing depends on which endpoint is being hit, then we can reuse the token
     /// for any future request even if some of the requests involve mutations.
     pub independent_of_endpoint: bool,
-    pub token_value: String,
-}
-
-impl fmt::Debug for CredentialCacheValue {
-    /// This manual implementation helps ensure that the token value is redacted from all logs.
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("CredentialCacheValue")
-            .field("from_commandline", &self.from_commandline)
-            .field("token_value", &"REDACTED")
-            .finish()
-    }
+    pub token_value: Secret<String>,
 }
 
 /// Configuration information for cargo. This is not specific to a build, it is information