starpod-vault 0.3.1

Encrypted credential storage for Starpod - AES-256-GCM
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

//! Default allowed-host suggestions for well-known API key names.

/// Returns suggested `allowed_hosts` for well-known secret key names.
///
/// Used by `VaultSet` to auto-suggest host bindings when the user doesn't
/// specify them. Returns `None` for unrecognised keys (meaning unrestricted).
///
/// ```
/// use starpod_vault::known_hosts::default_hosts_for_key;
///
/// let hosts = default_hosts_for_key("OPENAI_API_KEY").unwrap();
/// assert_eq!(hosts, vec!["api.openai.com"]);
///
/// assert!(default_hosts_for_key("MY_CUSTOM_VAR").is_none());
/// ```
pub fn default_hosts_for_key(key: &str) -> Option<Vec<String>> {
    match key.to_uppercase().as_str() {
        // LLM providers
        "ANTHROPIC_API_KEY" => Some(vec!["api.anthropic.com".into()]),
        "OPENAI_API_KEY" => Some(vec!["api.openai.com".into()]),
        "GEMINI_API_KEY" => Some(vec!["generativelanguage.googleapis.com".into()]),
        "GROQ_API_KEY" => Some(vec!["api.groq.com".into()]),
        "DEEPSEEK_API_KEY" => Some(vec!["api.deepseek.com".into()]),
        "OPENROUTER_API_KEY" => Some(vec!["openrouter.ai".into()]),

        // Services
        "BRAVE_API_KEY" => Some(vec!["api.search.brave.com".into()]),
        "TELEGRAM_BOT_TOKEN" => Some(vec!["api.telegram.org".into()]),

        // Developer tools
        "GITHUB_TOKEN" | "GH_TOKEN" => Some(vec!["api.github.com".into()]),
        "STRIPE_SECRET_KEY" | "STRIPE_API_KEY" => Some(vec!["api.stripe.com".into()]),
        "SENDGRID_API_KEY" => Some(vec!["api.sendgrid.com".into()]),
        "SLACK_BOT_TOKEN" | "SLACK_TOKEN" => Some(vec!["slack.com".into()]),
        "AWS_SECRET_ACCESS_KEY" => Some(vec!["*.amazonaws.com".into()]),

        _ => None,
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn known_keys_return_hosts() {
        assert!(default_hosts_for_key("ANTHROPIC_API_KEY").is_some());
        assert!(default_hosts_for_key("OPENAI_API_KEY").is_some());
        assert!(default_hosts_for_key("TELEGRAM_BOT_TOKEN").is_some());
        assert!(default_hosts_for_key("GITHUB_TOKEN").is_some());
        assert!(default_hosts_for_key("GH_TOKEN").is_some());
    }

    #[test]
    fn case_insensitive() {
        assert_eq!(
            default_hosts_for_key("openai_api_key"),
            default_hosts_for_key("OPENAI_API_KEY"),
        );
    }

    #[test]
    fn unknown_keys_return_none() {
        assert!(default_hosts_for_key("MY_VAR").is_none());
        assert!(default_hosts_for_key("DB_PASSWORD").is_none());
    }
}