lade 0.17.2

Automatically load secrets from your preferred vault as environment variables, and clear them once your shell command is over.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

use std::{collections::HashMap, path::PathBuf};

use anyhow::Result;

use crate::{
    config::{Config, LadeRule, NetworkBinding, saved_user},
    files::{remove_files, split_env_files, write_files},
    network::{self, AcquiredNetwork},
    provider_progress::{
        ProviderProgressRenderer, start_provider_progress, stop_provider_progress,
    },
};

/// Command-scoped access state. Network guards and temporary files are owned
/// here so every caller gets the same cleanup behavior.
pub struct AttachedAccess {
    pub env: HashMap<String, String>,
    pub warnings: Vec<String>,
    files: HashMap<PathBuf, HashMap<String, String>>,
    _network: AcquiredNetwork,
}

impl AttachedAccess {
    pub fn cleanup(&mut self) -> Result<()> {
        remove_files(&mut self.files.keys())?;
        self.files.clear();
        Ok(())
    }
}

impl Drop for AttachedAccess {
    fn drop(&mut self) {
        let _ = self.cleanup();
    }
}

pub async fn acquire_attached(
    config: &Config,
    rules: &[(PathBuf, LadeRule)],
    rich_progress: bool,
) -> Result<AttachedAccess> {
    let saved_user = saved_user().await?;
    let network_bindings: Vec<NetworkBinding> =
        Config::network_bindings_from_rules(rules, &saved_user)?;
    let (vars, _sources, _maskable, warnings) = config.hydrate_rules(rules, &saved_user).await?;
    let mut progress: Option<ProviderProgressRenderer> =
        Some(start_provider_progress(rich_progress));
    let network_sink = progress.as_ref().expect("progress renderer").sink();
    let network = tokio::task::spawn_blocking(move || {
        network::start_attached_network_session(&network_bindings, network_sink)
    });
    let network = network
        .await
        .map_err(|error| anyhow::anyhow!("network task join error: {error}"));
    stop_provider_progress(&mut progress);
    let network = network??;
    let (mut env, files) = split_env_files(vars);
    for (key, value) in &network.env {
        match env.get(key) {
            Some(existing) if existing != value => {
                anyhow::bail!("conflicting binding '{key}' between secret and network providers")
            }
            Some(_) => {}
            None => {
                env.insert(key.clone(), value.clone());
            }
        }
    }
    write_files(&files)?;
    Ok(AttachedAccess {
        env,
        warnings,
        files,
        _network: network,
    })
}