secretenv 0.13.0

SecretEnv CLI — resolves aliases to secrets and runs commands with them injected
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

// Copyright (C) 2026 Mandeep Patel
// SPDX-License-Identifier: AGPL-3.0-only

//! Build a [`BackendRegistry`] pre-populated with every shipped backend
//! factory + instances loaded from `config`.
//!
//! Shared between `main.rs` (startup wiring) and `setup.rs` (post-write
//! verification with the freshly-written config). Factored out so
//! the factory-registration list is the single source of truth.
//!
//! **Keychain registration is unconditional across platforms.** The
//! `KeychainFactory` compiles on every target; it bails at
//! `create()` time on non-macOS with a clear error. This keeps the
//! workspace buildable on Linux / Windows CI without cfg-gating the
//! registration list.
//!
//! v0.6 adds `doppler` (Doppler secrets-manager CLI wrapper).
//! v0.7 adds `infisical` (Infisical `SaaS` + self-hostable CLI wrapper).
//! v0.8 adds `keeper` (Keeper Commander CLI wrapper; requires persistent
//! login set up via `this-device register` + `persistent-login on`).
//! v0.9 adds `cf-kv` (Cloudflare Workers KV via `wrangler` CLI wrapper).
//! v0.10 adds `openbao` (Linux Foundation MPL-2.0 fork of Vault — KV
//! v1/v2 via the `bao` CLI, tap-less brew install).
//! v0.11 adds `conjur` (`CyberArk` Conjur OSS / Enterprise via the
//! Go-based `conjur` v8 CLI).
//! v0.12 adds `bitwarden-sm` (`Bitwarden` Secrets Manager via the
//! `bws` CLI v2.x; project-scoped secrets, machine-account access
//! tokens). Distinct from a future `bitwarden` (Password Manager)
//! backend.

use anyhow::{Context, Result};
use secretenv_core::{BackendRegistry, Config};

/// Register every compiled-in backend factory (`local`, `aws-ssm`,
/// `1password`, `vault`, `aws-secrets`, `gcp`, `azure`, `keychain`,
/// `doppler`, `infisical`, `keeper`, `cf-kv`, `openbao`, `conjur`,
/// `bitwarden-sm`) and instantiate the backends declared in `config`.
///
/// # Errors
/// Returns an error if any `[backends.<name>]` block references a
/// backend type with no registered factory, or if a factory's
/// `create()` fails validation of its config fields.
pub fn build_registry(config: &Config) -> Result<BackendRegistry> {
    let mut registry = BackendRegistry::new();
    registry.register_factory(Box::new(secretenv_backend_local::LocalFactory::new()));
    registry.register_factory(Box::new(secretenv_backend_aws_ssm::AwsSsmFactory::new()));
    registry.register_factory(Box::new(secretenv_backend_1password::OnePasswordFactory::new()));
    registry.register_factory(Box::new(secretenv_backend_vault::VaultFactory::new()));
    registry.register_factory(Box::new(secretenv_backend_aws_secrets::AwsSecretsFactory::new()));
    registry.register_factory(Box::new(secretenv_backend_gcp::GcpFactory::new()));
    registry.register_factory(Box::new(secretenv_backend_azure::AzureFactory::new()));
    registry.register_factory(Box::new(secretenv_backend_keychain::KeychainFactory::new()));
    registry.register_factory(Box::new(secretenv_backend_doppler::DopplerFactory::new()));
    registry.register_factory(Box::new(secretenv_backend_infisical::InfisicalFactory::new()));
    registry.register_factory(Box::new(secretenv_backend_keeper::KeeperFactory::new()));
    registry.register_factory(Box::new(secretenv_backend_cf_kv::CfKvFactory::new()));
    registry.register_factory(Box::new(secretenv_backend_openbao::OpenBaoFactory::new()));
    registry.register_factory(Box::new(secretenv_backend_conjur::ConjurFactory::new()));
    registry.register_factory(Box::new(secretenv_backend_bitwarden_sm::BitwardenSmFactory::new()));
    registry.load_from_config(config).context("loading backend instances from config.toml")?;
    Ok(registry)
}