mecha10-core 0.7.0

Mecha10 core runtime and foundational types
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

//! HashiCorp Vault Secret Backend

use super::SecretBackend;
use crate::{Mecha10Error, Result};

pub struct VaultBackend {
    client: reqwest::Client,
    addr: String,
    token: String,
    mount_path: String,
}

impl VaultBackend {
    /// Create a new Vault backend
    ///
    /// # Arguments
    ///
    /// * `addr` - Vault server address
    /// * `token` - Authentication token
    /// * `mount_path` - Mount path for secrets (e.g., "secret/mecha10")
    pub fn new(addr: String, token: String, mount_path: String) -> Self {
        Self {
            client: reqwest::Client::new(),
            addr,
            token,
            mount_path,
        }
    }

    /// Create from environment variables
    ///
    /// Reads `VAULT_ADDR` and `VAULT_TOKEN` from environment.
    pub async fn from_env(mount_path: &str) -> Result<Self> {
        let addr = std::env::var("VAULT_ADDR")
            .map_err(|_| Mecha10Error::Configuration("VAULT_ADDR environment variable not set".to_string()))?;

        let token = std::env::var("VAULT_TOKEN")
            .map_err(|_| Mecha10Error::Configuration("VAULT_TOKEN environment variable not set".to_string()))?;

        Ok(Self::new(addr, token, mount_path.to_string()))
    }

    fn make_path(&self, key: &str) -> String {
        format!("/v1/{}/data/{}", self.mount_path, key)
    }

    /// Returns an error if `response`'s status isn't a success, so `get`/`set` don't each
    /// repeat the same status check after sending their request.
    fn check_status(response: &reqwest::Response) -> Result<()> {
        if !response.status().is_success() {
            return Err(Mecha10Error::Other(format!(
                "Vault returned error status: {}",
                response.status()
            )));
        }

        Ok(())
    }
}

#[async_trait::async_trait]
impl SecretBackend for VaultBackend {
    async fn get(&self, key: &str) -> Result<String> {
        let url = format!("{}{}", self.addr, self.make_path(key));

        let response = self
            .client
            .get(&url)
            .header("X-Vault-Token", &self.token)
            .send()
            .await
            .map_err(|e| Mecha10Error::Other(format!("Failed to connect to Vault: {}", e)))?;

        Self::check_status(&response)?;

        let data: serde_json::Value = response
            .json()
            .await
            .map_err(|e| Mecha10Error::Other(format!("Failed to parse Vault response: {}", e)))?;

        let secret = data
            .get("data")
            .and_then(|d| d.get("data"))
            .and_then(|d| d.get("value"))
            .and_then(|v| v.as_str())
            .ok_or_else(|| Mecha10Error::Other(format!("Secret '{}' not found in Vault or invalid format", key)))?;

        Ok(secret.to_string())
    }

    async fn set(&self, key: &str, value: &str) -> Result<()> {
        let url = format!("{}{}", self.addr, self.make_path(key));

        let payload = serde_json::json!({
            "data": {
                "value": value
            }
        });

        let response = self
            .client
            .post(&url)
            .header("X-Vault-Token", &self.token)
            .json(&payload)
            .send()
            .await
            .map_err(|e| Mecha10Error::Other(format!("Failed to connect to Vault: {}", e)))?;

        Self::check_status(&response)?;

        Ok(())
    }
}