Struct SecretSnapshot 

pub struct SecretSnapshot { /* private fields */ }

What a host needs to give the engine its secrets.

A host builds a SecretProviderRegistry holding the backends this build carries and installs it with PolicyEngine::set_secret_providers before initialize(). SecretProviderFactory is what a host implements to add a backend of its own, and SecretRef is the handle a consumer keeps so a later refresh reaches it. A consumer that rebuilds something on rotation reads SecretRef::snapshot, which pairs the value with the generation it belongs to.

env and file are always registered by SecretProviderRegistry::with_builtin_backends. Vault KV v2 is behind the secrets-vault feature: the host constructs VaultSecretProviderFactory with its HttpTransport and registers it (or calls registry_with_vault). Nothing here spawns a Vault session ticker; token renewal is lazy on the next read.

There is no handle here that reads every declared value. A host drives refresh with PolicyEngine::refresh_secrets and watches for staleness with PolicyEngine::secrets_last_success, neither of which yields secret material. One value together with the generation it was read at.

A consumer that has to act on rotation rather than just read the new bytes records the generation beside whatever it built from the value, and rebuilds when the generation moves. That pairing has to come from one load: a value and a generation read separately can straddle a refresh and pair the old bytes with the new generation, and the consumer then holds a resource built from a credential it believes it has already rebuilt against. Nothing moves the generation again until the value changes once more, so that resource is never rebuilt.

Implementations

impl SecretSnapshot

pub fn value(&self) -> &str

The value this snapshot was taken at.

pub fn generation(&self) -> u64

The generation that value belongs to.

Trait Implementations

impl Debug for SecretSnapshot

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.