Trait SecretService 

pub trait SecretService: Send + Sync {
    // Required method
    fn get_secret<'life0, 'life1, 'async_trait>(
        &'life0 self,
        name: &'life1 str,
    ) -> Pin<Box<dyn Future<Output = Result<String, AdkError>> + Send + 'async_trait>>
       where 'life0: 'async_trait,
             'life1: 'async_trait,
             Self: 'async_trait;

    // Provided method
    fn get_secret_for<'life0, 'life1, 'async_trait>(
        &'life0 self,
        request: &'life1 SecretRequest,
    ) -> Pin<Box<dyn Future<Output = Result<String, AdkError>> + Send + 'async_trait>>
       where 'life0: 'async_trait,
             'life1: 'async_trait,
             Self: 'async_trait { ... }
}

Trait for retrieving secrets at runtime.

This is the core-level abstraction used by ToolContext::get_secret and InvocationContext::get_secret. Concrete implementations (e.g., AWS Secrets Manager, Azure Key Vault, GCP Secret Manager) live in adk-auth behind feature flags and implement this trait via the SecretProvider adapter.

Example

use adk_core::SecretService;

struct EnvSecretService;

#[async_trait::async_trait]
impl SecretService for EnvSecretService {
    async fn get_secret(&self, name: &str) -> adk_core::Result<String> {
        std::env::var(name).map_err(|_| adk_core::AdkError::not_found(
            format!("secret '{name}' not found in environment"),
        ))
    }
}

Required Methods

fn get_secret<'life0, 'life1, 'async_trait>( &'life0 self, name: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<String, AdkError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, Self: 'async_trait,

Retrieve a secret value by name.

Returns the secret string on success, or an AdkError on failure.

Provided Methods

fn get_secret_for<'life0, 'life1, 'async_trait>( &'life0 self, request: &'life1 SecretRequest, ) -> Pin<Box<dyn Future<Output = Result<String, AdkError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, Self: 'async_trait,

Retrieve a secret for a described access.

This is the form an authorizing service implements: the request carries who is asking and why, so a decision can be made before the value is fetched. The default implementation ignores the context and calls SecretService::get_secret, which is correct for a service that has no policy of its own.

Every field on SecretRequest is set by the framework at the call site, not supplied by the tool, so a tool cannot present another tool’s identity.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors