refactor(auth): Replace module-level lint suppression with field-level attributes and add zeroization tests

[Copilot]

Pull Request

Description

Replaced overly broad module-level #![allow(unused_assignments)] with targeted field-level attributes in SASL authentication structs. Also removed incorrect #[zeroize(skip)] attributes that were preventing proper memory zeroization of sensitive credential data. Added comprehensive test coverage to verify security-critical zeroization behavior.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Performance improvement
• Code refactoring

Changes Made

• Removed module-level #![allow(unused_assignments)] from crates/rustirc-core/src/auth.rs
• Added field-level #[allow(unused_assignments)] to fields in SaslCredentials (username, password, authzid) and SecureString (inner) that derive Zeroize/ZeroizeOnDrop
• Removed #[zeroize(skip)] from SaslCredentials.password and SecureString.inner to enable proper memory clearing
• Added 4 new tests to verify zeroization behavior:
  • test_secure_string_zeroization: Verifies SecureString properly zeroes memory
  • test_sasl_credentials_zeroization: Verifies SaslCredentials properly zeroes all fields
  • test_secure_string_zeroize_on_drop: Compile-time verification of ZeroizeOnDrop trait implementation
  • test_sasl_credentials_zeroize_on_drop: Compile-time verification of ZeroizeOnDrop trait implementation

Before:

#![allow(unused_assignments)] // Suppresses entire module

#[derive(Debug, Clone, Zeroize, ZeroizeOnDrop)]
pub struct SaslCredentials {
    pub username: String,
    #[zeroize(skip)]  // Prevents zeroization
    pub password: SecureString,
    pub authzid: Option<String>,
}

After:

#[derive(Debug, Clone, Zeroize, ZeroizeOnDrop)]
pub struct SaslCredentials {
    #[allow(unused_assignments)]  // Targeted suppression
    pub username: String,
    #[allow(unused_assignments)]  // Targeted suppression
    pub password: SecureString,   // Now properly zeroized
    #[allow(unused_assignments)]  // Targeted suppression
    pub authzid: Option<String>,
}

Testing

• My code follows the project's style guidelines
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Test Details

• Clippy with -D warnings: All checks pass, no warnings generated
• Unit tests: All 14 unit tests pass (4 new tests added)
• Doc tests: All 24 doc tests in rustirc-core pass
• Zeroization tests use ManuallyDrop to safely verify memory is zeroed before deallocation

Screenshots (if applicable)

N/A

Performance Impact

• This change has no performance impact
• This change improves performance
• This change may reduce performance (explain why it's worth it)

Security Considerations

• This change has no security implications
• This change improves security
• This change requires security review (explain)

Removing #[zeroize(skip)] ensures sensitive credential fields are properly cleared from memory on drop. New tests verify this security-critical behavior works correctly.

Breaking Changes

• This PR introduces no breaking changes
• This PR introduces breaking changes (describe migration path)

Checklist

• Cargo fmt has been run
• Cargo clippy shows no warnings
• Documentation has been updated
• CHANGELOG.md has been updated
• All CI checks pass

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

---

Note

Focuses unused_assignments lint suppression to specific fields and enables proper zeroization of sensitive data.

• Removes module-level #![allow(unused_assignments)] from crates/rustirc-core/src/auth.rs
• Adds field-level #[allow(unused_assignments)] to SaslCredentials (username, password, authzid) and SecureString (inner)
• Removes #[zeroize(skip)] from SaslCredentials.password and SecureString.inner, allowing Zeroize/ZeroizeOnDrop to clear memory

^{Written by Cursor Bugbot for commit 5e7be54. This will update automatically on new commits. Configure here.}

[doublegate]

Reviewed / Approved -- DG 1/10

[Copilot]

Pull request overview

This PR refactors lint suppression in the SASL authentication module to replace broad module-level #![allow(unused_assignments)] with targeted field-level attributes. Additionally, it removes incorrect #[zeroize(skip)] attributes that were preventing proper memory zeroization of sensitive credential data.

Changes:

• Removed module-level #![allow(unused_assignments)] from auth.rs
• Added field-level #[allow(unused_assignments)] to fields that trigger the lint due to the Zeroize derive macro
• Removed #[zeroize(skip)] from SaslCredentials.password and SecureString.inner to enable proper security guarantees

[doublegate]

@copilot apply changes based on the comments in this thread

[doublegate]

Reviewed / Approved -- DG 1/10