greentic-secrets-runner 0.4.25

Host bridge for environment-backed secrets with tenant policy enforcement.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

use crate::error::SecretError;
use crate::policy::Policy;
use crate::tenant::TenantCtx;

/// Environment-backed provider enforcing the configured policy.
pub struct EnvProvider {
    policy: Policy,
}

impl EnvProvider {
    pub fn new(policy: Policy) -> Self {
        Self { policy }
    }

    pub fn get(&self, key: &str, tenant: Option<&TenantCtx>) -> Result<String, SecretError> {
        if !self.policy.is_allowed(key, tenant) {
            return Err(SecretError::Denied {
                key: key.to_string(),
            });
        }

        std::env::var(key).map_err(|_| SecretError::NotFound {
            key: key.to_string(),
        })
    }
}