feat(types)!: use Mnemonic type from crypto.rs

bindings/core/src/method_handler/utils.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use iota_sdk::{
-    client::{hex_public_key_to_bech32_address, hex_to_bech32, verify_mnemonic, Client},
+    client::{hex_public_key_to_bech32_address, hex_to_bech32, secret::mnemonic::Mnemonic, Client},
     types::block::{
         address::{dto::AddressDto, Address, Ed25519Address},
         output::{AliasId, FoundryId, NftId},
@@ -11,7 +11,6 @@ use iota_sdk::{
         Block,
     },
 };
-use zeroize::Zeroize;
 
 use crate::{method::UtilsMethod, response::Response, Result};
 
@@ -29,11 +28,9 @@ pub(crate) fn call_utils_method_internal(method: UtilsMethod) -> Result<Response
         }
         UtilsMethod::ParseBech32Address { address } => Response::ParsedBech32Address(AddressDto::from(address.inner())),
         UtilsMethod::IsAddressValid { address } => Response::Bool(Address::is_valid_bech32(&address)),
-        UtilsMethod::GenerateMnemonic => Response::GeneratedMnemonic(Client::generate_mnemonic()?),
-        UtilsMethod::MnemonicToHexSeed { mut mnemonic } => {
-            let response = Response::MnemonicHexSeed(Client::mnemonic_to_hex_seed(&mnemonic)?);
-            mnemonic.zeroize();
-            response
+        UtilsMethod::GenerateMnemonic => Response::GeneratedMnemonic(Client::generate_mnemonic()?.as_str().to_owned()),
+        UtilsMethod::MnemonicToHexSeed { mnemonic } => {
+            Response::MnemonicHexSeed(Client::mnemonic_to_hex_seed(&mnemonic.try_into()?))
         }
         UtilsMethod::BlockId { block } => {
             let block = Block::try_from_dto_unverified(&block)?;
@@ -63,9 +60,8 @@ pub(crate) fn call_utils_method_internal(method: UtilsMethod) -> Result<Response
             let address = Ed25519Address::try_from(&address)?;
             Response::Bool(signature.is_valid(&msg, &address).is_ok())
         }
-        UtilsMethod::VerifyMnemonic { mut mnemonic } => {
-            verify_mnemonic(&mnemonic)?;
-            mnemonic.zeroize();
+        UtilsMethod::VerifyMnemonic { mnemonic } => {
+            let _ = Mnemonic::try_from(mnemonic)?;
             Response::Ok
         }
     };

bindings/core/tests/secrets_manager.rs

@@ -7,7 +7,7 @@ use iota_sdk_bindings_core::{CallMethod, Response, Result, SecretManagerMethod};
 #[tokio::test]
 async fn generate_addresses() -> Result<()> {
     let secret_manager = SecretManager::try_from_mnemonic(
-        "endorse answer radar about source reunion marriage tag sausage weekend frost daring base attack because joke dream slender leisure group reason prepare broken river",
+        "endorse answer radar about source reunion marriage tag sausage weekend frost daring base attack because joke dream slender leisure group reason prepare broken river".to_owned(),
     )?;
 
     let method = SecretManagerMethod::GenerateAddresses {

cli/src/helper.rs

@@ -5,7 +5,7 @@ use chrono::{DateTime, NaiveDateTime, Utc};
 use clap::Parser;
 use dialoguer::{console::Term, theme::ColorfulTheme, Input, Password, Select};
 use iota_sdk::{
-    client::verify_mnemonic,
+    client::secret::mnemonic::Mnemonic,
     wallet::{Account, Wallet},
 };
 use tokio::{
@@ -107,7 +107,7 @@ pub async fn bytes_from_hex_or_file(hex: Option<String>, file: Option<String>) -
     })
 }
 
-pub async fn enter_or_generate_mnemonic() -> Result<String, Error> {
+pub async fn enter_or_generate_mnemonic() -> Result<Mnemonic, Error> {
     let choices = ["Generate a new mnemonic", "Enter a mnemonic"];
     let selected_choice = Select::with_theme(&ColorfulTheme::default())
         .with_prompt("Select how to provide a mnemonic")
@@ -124,7 +124,7 @@ pub async fn enter_or_generate_mnemonic() -> Result<String, Error> {
     Ok(mnemnonic)
 }
 
-pub async fn generate_mnemonic() -> Result<String, Error> {
+pub async fn generate_mnemonic() -> Result<Mnemonic, Error> {
     let mnemonic = iota_sdk::client::generate_mnemonic()?;
     println_log_info!("Mnemonic has been generated.");
     let choices = [
@@ -141,7 +141,7 @@ pub async fn generate_mnemonic() -> Result<String, Error> {
 
     if [0, 2].contains(&selected_choice) {
         println!("YOUR MNEMONIC:");
-        println!("{}", mnemonic);
+        println!("{}", mnemonic.as_str());
     }
     if [1, 2].contains(&selected_choice) {
         write_mnemonic_to_file(DEFAULT_MNEMONIC_FILE_PATH, &mnemonic).await?;
@@ -157,20 +157,22 @@ pub async fn generate_mnemonic() -> Result<String, Error> {
     Ok(mnemonic)
 }
 
-pub fn enter_mnemonic() -> Result<String, Error> {
+pub fn enter_mnemonic() -> Result<Mnemonic, Error> {
     loop {
         let input = Input::<String>::new()
             .with_prompt("Enter your mnemonic")
             .interact_text()?;
-        if verify_mnemonic(&input).is_err() {
-            println_log_error!("Invalid mnemonic. Please enter a bip-39 conform mnemonic.");
-        } else {
-            return Ok(input);
+
+        match Mnemonic::try_from(input) {
+            Err(e) => {
+                println_log_error!("Invalid mnemonic: {e:?}\nPlease enter a bip-39 conform mnemonic.");
+            }
+            Ok(mnemonic) => return Ok(mnemonic),
         }
     }
 }
 
-pub async fn import_mnemonic(path: &str) -> Result<String, Error> {
+pub async fn import_mnemonic(path: &str) -> Result<Mnemonic, Error> {
     let mut mnemonics = read_mnemonics_from_file(path).await?;
     if mnemonics.is_empty() {
         println_log_error!("No valid mnemonics found in '{path}'.");
@@ -194,27 +196,26 @@ pub async fn import_mnemonic(path: &str) -> Result<String, Error> {
     }
 }
 
-async fn write_mnemonic_to_file(path: &str, mnemonic: &str) -> Result<(), Error> {
+async fn write_mnemonic_to_file(path: &str, mnemonic: &Mnemonic) -> Result<(), Error> {
     let mut file = OpenOptions::new().create(true).append(true).open(path).await?;
-    file.write_all(format!("{mnemonic}\n").as_bytes()).await?;
+    file.write_all(format!("{}\n", mnemonic.as_str()).as_bytes()).await?;
 
     Ok(())
 }
 
-async fn read_mnemonics_from_file(path: &str) -> Result<Vec<String>, Error> {
+async fn read_mnemonics_from_file(path: &str) -> Result<Vec<Mnemonic>, Error> {
     let file = OpenOptions::new().read(true).open(path).await?;
     let mut lines = BufReader::new(file).lines();
     let mut mnemonics = Vec::new();
     let mut line_index = 1;
     while let Some(line) = lines.next_line().await? {
-        // we allow surrounding whitespace in the file
-        let trimmed = line.trim();
-        if verify_mnemonic(trimmed).is_ok() {
-            mnemonics.push(trimmed.to_string());
-        } else {
-            return Err(Error::Miscellaneous(format!(
-                "Invalid mnemonic in file '{path}' at line '{line_index}'."
-            )));
+        match Mnemonic::try_from(line) {
+            Ok(mnemonic) => mnemonics.push(mnemonic),
+            Err(err) => {
+                return Err(Error::Miscellaneous(format!(
+                    "Invalid mnemonic in file '{path}' at line '{line_index}':\n{err:?}"
+                )));
+            }
         }
         line_index += 1;
     }

sdk/CHANGELOG.md

@@ -32,6 +32,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Storage and Backup migration;
 - `types::block::Error::InvalidFoundryZeroSerialNumber` variant;
 - Added `Hrp` type to represent a valid bech32 human-readable part;
+- Added `Mnemonic` type to handle mnemonic data more securely by implementing `ZeroizeOnDrop`;
 
 ### Changed
 

sdk/examples/client/01_generate_addresses.rs

@@ -28,7 +28,7 @@ async fn main() -> Result<()> {
         .await?;
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     // Generate addresses with default account index and range
     let addresses = client.get_addresses(&secret_manager).finish().await?;

sdk/examples/client/block/output.rs

@@ -23,7 +23,7 @@ async fn main() -> Result<()> {
     let client = Client::builder().with_node(&node_url)?.finish().await?;
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let token_supply = client.get_token_supply().await?;
 

sdk/examples/client/block/transaction.rs

@@ -19,7 +19,7 @@ async fn main() -> Result<()> {
     let client = Client::builder().with_node(&node_url)?.finish().await?;
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let block = client
         .block()

sdk/examples/client/offline_signing/0_address_generation.rs

@@ -26,7 +26,7 @@ async fn main() -> Result<()> {
     // Creates a client instance.
     let offline_client = Client::builder().finish().await?;
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     // Generates an address offline.
     let address = offline_client

sdk/examples/client/offline_signing/2_transaction_signing.rs

@@ -29,7 +29,7 @@ async fn main() -> Result<()> {
     dotenvy::dotenv().ok();
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let prepared_transaction_data = read_prepared_transaction_from_file(PREPARED_TRANSACTION_FILE_NAME)?;
 

sdk/examples/client/output/alias.rs

@@ -31,7 +31,7 @@ async fn main() -> Result<()> {
     let client = Client::builder().with_node(&node_url)?.finish().await?;
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let token_supply = client.get_token_supply().await?;
 

sdk/examples/client/output/all.rs

@@ -42,7 +42,7 @@ async fn main() -> Result<()> {
     let client = Client::builder().with_node(&node_url)?.finish().await?;
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let token_supply = client.get_token_supply().await?;
 

sdk/examples/client/output/all_automatic_input_selection.rs

@@ -39,7 +39,7 @@ async fn main() -> Result<()> {
     let client = Client::builder().with_node(&node_url)?.finish().await?;
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let token_supply = client.get_token_supply().await?;
 

sdk/examples/client/output/basic.rs

@@ -32,7 +32,7 @@ async fn main() -> Result<()> {
     let client = Client::builder().with_node(&node_url)?.finish().await?;
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let token_supply = client.get_token_supply().await?;
 

sdk/examples/client/output/expiration.rs

@@ -33,7 +33,7 @@ async fn main() -> Result<()> {
     let client = Client::builder().with_node(&node_url)?.finish().await?;
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let addresses = client.get_addresses(&secret_manager).with_range(0..2).finish().await?;
     let sender_address = addresses[0];

sdk/examples/client/output/foundry.rs

@@ -41,7 +41,7 @@ async fn main() -> Result<()> {
     let client = Client::builder().with_node(&node_url)?.finish().await?;
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let token_supply = client.get_token_supply().await?;
 

sdk/examples/client/output/micro_transaction.rs

@@ -34,7 +34,7 @@ async fn main() -> Result<()> {
     let client = Client::builder().with_node(&node_url)?.finish().await?;
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let addresses = client.get_addresses(&secret_manager).with_range(0..2).finish().await?;
     let sender_address = addresses[0];

sdk/examples/client/output/native_tokens.rs

@@ -33,7 +33,7 @@ async fn main() -> Result<()> {
     let client = Client::builder().with_node(&node_url)?.finish().await?;
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let addresses = client.get_addresses(&secret_manager).with_range(0..2).finish().await?;
     let sender_address = addresses[0];

sdk/examples/client/output/nft.rs

@@ -34,7 +34,7 @@ async fn main() -> Result<()> {
     let client = Client::builder().with_node(&node_url)?.finish().await?;
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let token_supply = client.get_token_supply().await?;
 

sdk/examples/client/output/recursive_alias.rs

@@ -33,7 +33,7 @@ async fn main() -> Result<()> {
     let client = Client::builder().with_node(&node_url)?.finish().await?;
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let address = client.get_addresses(&secret_manager).with_range(0..1).finish().await?[0];
     println!("{}", request_funds_from_faucet(&faucet_url, &address).await?);

sdk/examples/client/participation.rs

@@ -46,7 +46,7 @@ async fn main() -> Result<()> {
     }
 
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
     let bech32_address = client.get_addresses(&secret_manager).with_range(0..1).finish().await?[0];
 
     let faucet_url = std::env::var("FAUCET_URL").unwrap();
@@ -90,7 +90,7 @@ async fn main() -> Result<()> {
 
 async fn participate(client: &Client, event_id: ParticipationEventId) -> Result<()> {
     let secret_manager =
-        SecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        SecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let token_supply = client.get_token_supply().await?;
     let rent_structure = client.get_rent_structure().await?;

sdk/examples/how_tos/accounts_and_addresses/create_mnemonic.rs

@@ -11,7 +11,7 @@ use iota_sdk::client::{Client, Result};
 async fn main() -> Result<()> {
     let mnemonic = Client::generate_mnemonic()?;
 
-    println!("Mnemonic: {mnemonic}");
+    println!("Mnemonic: {}", mnemonic.as_str());
 
     Ok(())
 }

sdk/examples/wallet/accounts.rs

@@ -24,7 +24,7 @@ async fn main() -> Result<()> {
     let client_options = ClientOptions::new().with_node(&std::env::var("NODE_URL").unwrap())?;
 
     let secret_manager =
-        MnemonicSecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        MnemonicSecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let wallet = Wallet::builder()
         .with_secret_manager(SecretManager::Mnemonic(secret_manager))

sdk/examples/wallet/background_syncing.rs

@@ -22,7 +22,7 @@ async fn main() -> Result<()> {
     let client_options = ClientOptions::new().with_node(&std::env::var("NODE_URL").unwrap())?;
 
     let secret_manager =
-        MnemonicSecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        MnemonicSecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let wallet = Wallet::builder()
         .with_secret_manager(SecretManager::Mnemonic(secret_manager))

sdk/examples/wallet/events.rs

@@ -25,7 +25,7 @@ async fn main() -> Result<()> {
     let client_options = ClientOptions::new().with_node(&std::env::var("NODE_URL").unwrap())?;
 
     let secret_manager =
-        MnemonicSecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        MnemonicSecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let wallet = Wallet::builder()
         .with_secret_manager(SecretManager::Mnemonic(secret_manager))

sdk/examples/wallet/logger.rs

@@ -30,7 +30,7 @@ async fn main() -> Result<()> {
     let client_options = ClientOptions::new().with_node(&std::env::var("NODE_URL").unwrap())?;
 
     let secret_manager =
-        MnemonicSecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        MnemonicSecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let wallet = Wallet::builder()
         .with_secret_manager(SecretManager::Mnemonic(secret_manager))

sdk/examples/wallet/output_consolidation.rs

@@ -20,7 +20,7 @@ async fn main() -> Result<()> {
     // This example uses secrets in environment variables for simplicity which should not be done in production.
     dotenvy::dotenv().ok();
 
-    let mnemonic: &str = &std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap();
+    let mnemonic = std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap();
     let mnemonic_secret_manager = MnemonicSecretManager::try_from_mnemonic(mnemonic).unwrap();
     let secret_manager = SecretManager::Mnemonic(mnemonic_secret_manager);
 

sdk/examples/wallet/participation.rs

@@ -39,7 +39,7 @@ async fn main() -> Result<()> {
         .with_ignore_node_health();
 
     let secret_manager =
-        MnemonicSecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        MnemonicSecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let wallet = Wallet::builder()
         .with_secret_manager(SecretManager::Mnemonic(secret_manager))

sdk/examples/wallet/ping.rs

@@ -24,7 +24,7 @@ async fn main() -> Result<()> {
     let client_options = ClientOptions::new().with_node(&std::env::var("NODE_URL").unwrap())?;
 
     let secret_manager =
-        MnemonicSecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        MnemonicSecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let wallet = Wallet::builder()
         .with_secret_manager(SecretManager::Mnemonic(secret_manager))

sdk/examples/wallet/pong.rs

@@ -24,7 +24,7 @@ async fn main() -> Result<()> {
     let client_options = ClientOptions::new().with_node(&std::env::var("NODE_URL").unwrap())?;
 
     let secret_manager =
-        MnemonicSecretManager::try_from_mnemonic(&std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
+        MnemonicSecretManager::try_from_mnemonic(std::env::var("NON_SECURE_USE_OF_DEVELOPMENT_MNEMONIC_1").unwrap())?;
 
     let wallet = Wallet::builder()
         .with_secret_manager(SecretManager::Mnemonic(secret_manager))