1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
//! Secret store (provider API key values) kept outside the main config.
//!
//! The file `config/secrets.toml` (in `.gitignore`, mode `0600`) is a map of
//! `env_name -> value`. Key resolution order: store entry > environment variable.
//! This allows setting keys directly from the admin panel without a restart,
//! without writing secrets into `gateway.toml`. Values are never exposed via the
//! API — only their presence status is returned (see `source`).
use std::collections::BTreeMap;
use std::sync::RwLock;
pub struct SecretStore {
path: String,
values: RwLock<BTreeMap<String, String>>,
}
impl SecretStore {
/// Load the store from a file (missing file or parse error → empty store).
pub fn load(path: &str) -> Self {
let values = std::fs::read_to_string(path)
.ok()
.and_then(|raw| toml::from_str::<BTreeMap<String, String>>(&raw).ok())
.unwrap_or_default();
Self {
path: path.to_string(),
values: RwLock::new(values),
}
}
/// Secret value by env name: store first, then environment variable.
pub fn resolve(&self, env_name: &str) -> Option<String> {
if let Some(v) = self.values.read().unwrap().get(env_name) {
if !v.is_empty() {
return Some(v.clone());
}
}
std::env::var(env_name).ok().filter(|v| !v.is_empty())
}
/// Value source for display in the UI: `store` | `env` | `missing`.
pub fn source(&self, env_name: &str) -> &'static str {
let in_store = self
.values
.read()
.unwrap()
.get(env_name)
.map(|v| !v.is_empty())
.unwrap_or(false);
if in_store {
"store"
} else if std::env::var(env_name)
.ok()
.filter(|v| !v.is_empty())
.is_some()
{
"env"
} else {
"missing"
}
}
/// Set a secret (persisted to file with mode 0600).
pub fn set(&self, env_name: &str, value: &str) -> anyhow::Result<()> {
self.values
.write()
.unwrap()
.insert(env_name.to_string(), value.to_string());
self.persist()
}
/// Remove a secret from the store (an environment variable value, if present, remains).
pub fn clear(&self, env_name: &str) -> anyhow::Result<()> {
self.values.write().unwrap().remove(env_name);
self.persist()
}
fn persist(&self) -> anyhow::Result<()> {
let data = {
let map = self.values.read().unwrap();
toml::to_string(&*map)?
};
let p = std::path::Path::new(&self.path);
if let Some(dir) = p.parent() {
std::fs::create_dir_all(dir).ok();
}
let tmp = p.with_extension("toml.tmp");
std::fs::write(&tmp, data.as_bytes())?;
std::fs::rename(&tmp, p)?;
#[cfg(unix)]
{
use std::os::unix::fs::PermissionsExt;
let _ = std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o600));
}
Ok(())
}
}