systemprompt-config 0.65.0

Profile-based configuration for systemprompt.io AI governance infrastructure. Bootstraps profiles, secrets, and credentials with zero environment-variable fallback.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123

//! Failure modes of the Vault / `OpenBao` KV v2 secrets provider.
//!
//! No variant carries a response body, a token, or a secret value. The only
//! upstream text that reaches an operator is Vault's own `errors[]` array,
//! truncated to [`MAX_VAULT_ERROR_CHARS`], because that array is documented to
//! hold policy diagnostics rather than secret material.
//!
//! Copyright (c) systemprompt.io — Business Source License 1.1.
//! See <https://systemprompt.io> for licensing details.

use systemprompt_traits::BoxedSource;

pub(super) const MAX_VAULT_ERROR_CHARS: usize = 200;

#[derive(Debug, thiserror::Error)]
#[non_exhaustive]
pub enum VaultError {
    #[error("vault address is not a permitted outbound URL: {0}")]
    Address(#[source] BoxedSource),

    #[error("vault TLS CA certificate at {path} could not be loaded: {source}")]
    CaCertificate {
        path: String,
        #[source]
        source: BoxedSource,
    },

    #[error("vault HTTP client could not be built: {0}")]
    ClientBuild(#[source] reqwest::Error),

    #[error(
        "vault credential is missing: {name}. Provide it in the process environment; never write \
         a token into profile YAML."
    )]
    MissingCredential { name: String },

    #[error("vault credential file {path} could not be read: {source}")]
    CredentialFile {
        path: String,
        #[source]
        source: std::io::Error,
    },

    #[error("vault credential file {path} could not be read: file is empty")]
    EmptyCredentialFile { path: String },

    #[error("vault {method} login was rejected with HTTP {status}{detail}")]
    Auth {
        method: &'static str,
        status: u16,
        detail: String,
    },

    #[error("vault denied access to {mount}/{path} (HTTP 403){detail}")]
    Forbidden {
        mount: String,
        path: String,
        detail: String,
    },

    #[error("vault has no secret at {mount}/{path}")]
    NotFound { mount: String, path: String },

    #[error("vault returned HTTP {status} for {mount}/{path}{detail}")]
    Http {
        status: u16,
        mount: String,
        path: String,
        detail: String,
    },

    #[error("vault response body could not be read: {0}")]
    Body(#[source] reqwest::Error),

    #[error("vault response was not the expected KV v2 shape: {context}: {source}")]
    Malformed {
        context: String,
        #[source]
        source: serde_json::Error,
    },

    #[error(
        "vault response was not the expected KV v2 shape: {location} has no field '{field}' for \
         override key '{key}'"
    )]
    MissingField {
        location: String,
        field: String,
        key: String,
    },

    #[error("vault request failed: {0}")]
    Transport(#[source] reqwest::Error),

    #[error("vault was unreachable after {attempts} attempt(s): {last}")]
    Exhausted {
        attempts: u32,
        last: VaultAttemptFailure,
    },
}

/// Why the final retryable Vault attempt failed.
#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
pub enum VaultAttemptFailure {
    #[error("HTTP {0}")]
    Status(u16),

    #[error("request timed out")]
    Timeout,

    #[error("could not connect")]
    Connect,
}

#[must_use]
pub(super) fn truncate_detail(raw: &str) -> String {
    let trimmed = raw.trim();
    if trimmed.is_empty() {
        return String::new();
    }
    let clipped: String = trimmed.chars().take(MAX_VAULT_ERROR_CHARS).collect();
    format!(": {clipped}")
}