Struct AuthorizingSecretService 

pub struct AuthorizingSecretService { /* private fields */ }

Wraps a SecretService with declarative per-tool grants and an audit record.

A request whose tool has no grant, or whose grant does not cover the name, is refused before the inner service is called, so a denied name never reaches the provider.

Example

use adk_auth::secrets::{AuthorizingSecretService, SecretGrant};
use std::sync::Arc;

let service = AuthorizingSecretService::new(inner)
    .grant("weather_lookup", SecretGrant::none().name("weather-api-key"))
    .grant("charge_card", SecretGrant::none().prefix("billing/"));

Implementations

impl AuthorizingSecretService

pub fn new(inner: Arc<dyn SecretService>) -> Self

Wrap inner, denying everything until grants are added.

pub fn grant(self, tool_name: impl Into<String>, grant: SecretGrant) -> Self

Grant tool_name access to the secrets described by grant.

pub fn grant_untooled(self, grant: SecretGrant) -> Self

Grant access for requests that carry no tool identity.

These are accesses made by the agent itself rather than by a dispatched tool. They are denied by default, because a request with no identity cannot be attributed.

pub fn with_audit_sink(self, sink: Arc<dyn SecretAuditSink>) -> Self

Record every decision to sink.

Trait Implementations

impl Debug for AuthorizingSecretService

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl SecretService for AuthorizingSecretService

fn get_secret<'life0, 'life1, 'async_trait>( &'life0 self, name: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<String>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Denies unconditionally.

Errors

A bare name carries no identity, so there is nothing to authorize against. Callers reach this service through SecretService::get_secret_for, which the framework uses.

fn get_secret_for<'life0, 'life1, 'async_trait>( &'life0 self, request: &'life1 SecretRequest, ) -> Pin<Box<dyn Future<Output = Result<String>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Retrieve a secret for a described access.