Struct CachedSecretProvider 

pub struct CachedSecretProvider<P>
where
    P: SecretProvider,
{ /* private fields */ }

Available on crate feature auth only.

Wraps a SecretProvider with a bounded in-memory cache.

Cached values are returned within the configured TTL. After expiry the inner provider is called again and the cache is refreshed. Expired entries are removed on the next write rather than lingering until their name is requested again, and the cache never holds more than its capacity.

Example

use adk_auth::secrets::{CachedSecretProvider, SecretProvider};
use std::time::Duration;

let cached = CachedSecretProvider::new(inner_provider, Duration::from_secs(300))
    .with_max_entries(32);
let secret = cached.get_secret("my-key").await?;

// A rotated secret can be dropped before its TTL elapses.
cached.invalidate("my-key").await;

Implementations

impl<P> CachedSecretProvider<P>

where P: SecretProvider,

pub fn new(inner: P, ttl: Duration) -> CachedSecretProvider<P>

Create a new cached provider wrapping inner with the given TTL.

pub fn with_max_entries(self, max_entries: usize) -> CachedSecretProvider<P>

Set how many distinct secret names may be cached at once.

When the cache is full the least recently used entry is dropped. A capacity of zero disables caching. Without a bound, code that derives secret names from input can grow the cache for the lifetime of the process.

pub async fn invalidate(&self, name: &str)

Drop a single cached secret, zeroizing its value.

Call this when a secret is rotated or revoked so the old value is not served for the remainder of its TTL.

pub async fn invalidate_all(&self)

Drop every cached secret, zeroizing the values.

pub async fn purge_expired(&self) -> usize

Drop every expired entry and return how many were removed.

Expiry is otherwise noticed only when the same name is read again, so this is what a caller uses to bound residency without waiting for traffic.

pub async fn len(&self) -> usize

Number of entries currently held, expired or not.

pub async fn is_empty(&self) -> bool

Whether the cache holds no entries.

Trait Implementations

impl<P> Debug for CachedSecretProvider<P>

where P: SecretProvider,

Redacts cached values so a debug print cannot leak a secret.

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<P> SecretProvider for CachedSecretProvider<P>

where P: SecretProvider,

fn get_secret<'life0, 'life1, 'async_trait>( &'life0 self, name: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<String, AdkError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, CachedSecretProvider<P>: 'async_trait,

Retrieve a secret value by name.