From 8674f8ca7d982ab0223abb9cb2ed68b2a0658d1b Mon Sep 17 00:00:00 2001
From: viyatb-oai <viyatb@openai.com>
Date: Thu, 29 Jan 2026 00:12:29 -0800
Subject: [PATCH] refactor(secrets): add backend trait

---
 codex-rs/secrets/src/lib.rs   | 22 +++++++++++++++-------
 codex-rs/secrets/src/local.rs | 19 +++++++++++++++++++
 2 files changed, 34 insertions(+), 7 deletions(-)

diff --git a/codex-rs/secrets/src/lib.rs b/codex-rs/secrets/src/lib.rs
index 8f28ee1407..3a56f8693e 100644
--- a/codex-rs/secrets/src/lib.rs
+++ b/codex-rs/secrets/src/lib.rs
@@ -88,9 +88,16 @@ impl Default for SecretsBackendKind {
     }
 }
 
-#[derive(Debug, Clone)]
+pub trait SecretsBackend: Send + Sync {
+    fn set(&self, scope: &SecretScope, name: &SecretName, value: &str) -> Result<()>;
+    fn get(&self, scope: &SecretScope, name: &SecretName) -> Result<Option<String>>;
+    fn delete(&self, scope: &SecretScope, name: &SecretName) -> Result<bool>;
+    fn list(&self, scope_filter: Option<&SecretScope>) -> Result<Vec<SecretListEntry>>;
+}
+
+#[derive(Clone)]
 pub struct SecretsManager {
-    backend: Arc<LocalSecretsBackend>,
+    backend: Arc<dyn SecretsBackend>,
 }
 
 impl SecretsManager {
@@ -104,11 +111,12 @@ impl SecretsManager {
         backend_kind: SecretsBackendKind,
         keyring_store: Arc<dyn KeyringStore>,
     ) -> Self {
-        match backend_kind {
-            SecretsBackendKind::Local => Self {
-                backend: Arc::new(LocalSecretsBackend::new(codex_home, keyring_store)),
-            },
-        }
+        let backend: Arc<dyn SecretsBackend> = match backend_kind {
+            SecretsBackendKind::Local => {
+                Arc::new(LocalSecretsBackend::new(codex_home, keyring_store))
+            }
+        };
+        Self { backend }
     }
 
     pub fn set(&self, scope: &SecretScope, name: &SecretName, value: &str) -> Result<()> {
diff --git a/codex-rs/secrets/src/local.rs b/codex-rs/secrets/src/local.rs
index f7b15cdcd0..7cb1587604 100644
--- a/codex-rs/secrets/src/local.rs
+++ b/codex-rs/secrets/src/local.rs
@@ -25,6 +25,7 @@ use tracing::warn;
 use super::SecretListEntry;
 use super::SecretName;
 use super::SecretScope;
+use super::SecretsBackend;
 use super::compute_keyring_account;
 use super::keyring_service;
 
@@ -169,6 +170,24 @@ impl LocalSecretsBackend {
     }
 }
 
+impl SecretsBackend for LocalSecretsBackend {
+    fn set(&self, scope: &SecretScope, name: &SecretName, value: &str) -> Result<()> {
+        LocalSecretsBackend::set(self, scope, name, value)
+    }
+
+    fn get(&self, scope: &SecretScope, name: &SecretName) -> Result<Option<String>> {
+        LocalSecretsBackend::get(self, scope, name)
+    }
+
+    fn delete(&self, scope: &SecretScope, name: &SecretName) -> Result<bool> {
+        LocalSecretsBackend::delete(self, scope, name)
+    }
+
+    fn list(&self, scope_filter: Option<&SecretScope>) -> Result<Vec<SecretListEntry>> {
+        LocalSecretsBackend::list(self, scope_filter)
+    }
+}
+
 fn generate_passphrase() -> Result<SecretString> {
     let mut bytes = [0_u8; 32];
     let mut rng = OsRng;