systemprompt-models 0.53.0

Foundation data models for systemprompt.io AI governance infrastructure. Shared DTOs, config, and domain types consumed by every layer of the MCP governance pipeline.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138

//! Profile `secrets.vault:` block — Vault / `OpenBao` KV v2 access.
//!
//! There is deliberately no TLS-verification escape hatch:
//! `deny_unknown_fields` turns a `skip_verify:` key into a parse error rather
//! than a silently downgraded connection. A private CA is configured through
//! `ca_cert_path`.
//!
//! The document at `mount`/`path` holds the whole `secrets.json` shape; `keys`
//! redirects individual entries at a different KV path or field, for identity
//! material shared across instances.
//!
//! Copyright (c) systemprompt.io — Business Source License 1.1.
//! See <https://systemprompt.io> for licensing details.

use std::collections::BTreeMap;

use serde::{Deserialize, Serialize};

pub const DEFAULT_VAULT_TIMEOUT_SECS: u64 = 10;
pub const DEFAULT_VAULT_RETRIES: u8 = 3;
pub const MAX_VAULT_TIMEOUT_SECS: u64 = 120;
pub const MAX_VAULT_RETRIES: u8 = 10;

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
#[serde(deny_unknown_fields)]
pub struct VaultSecretsConfig {
    pub address: String,

    #[serde(default = "default_mount")]
    pub mount: String,

    pub path: String,

    #[serde(default)]
    pub namespace: Option<String>,

    pub auth: VaultAuth,

    #[serde(default)]
    pub keys: BTreeMap<String, VaultKeyRef>,

    #[serde(default)]
    pub ca_cert_path: Option<String>,

    #[serde(default = "default_timeout_secs")]
    pub timeout_secs: u64,

    #[serde(default = "default_retries")]
    pub retries: u8,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
#[serde(deny_unknown_fields)]
pub struct VaultKeyRef {
    pub path: String,

    pub field: String,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, schemars::JsonSchema)]
#[serde(tag = "method", rename_all = "lowercase", deny_unknown_fields)]
pub enum VaultAuth {
    Token {
        #[serde(default = "default_token_env")]
        token_env: String,

        #[serde(default)]
        token_file: Option<String>,
    },

    AppRole {
        #[serde(default = "default_role_id_env")]
        role_id_env: String,

        #[serde(default = "default_secret_id_env")]
        secret_id_env: String,

        #[serde(default = "default_approle_mount")]
        mount: String,
    },

    Kubernetes {
        role: String,

        #[serde(default = "default_jwt_path")]
        jwt_path: String,

        #[serde(default = "default_kubernetes_mount")]
        mount: String,
    },
}

impl VaultAuth {
    #[must_use]
    pub const fn method_name(&self) -> &'static str {
        match self {
            Self::Token { .. } => "token",
            Self::AppRole { .. } => "approle",
            Self::Kubernetes { .. } => "kubernetes",
        }
    }
}

fn default_mount() -> String {
    "secret".to_owned()
}

const fn default_timeout_secs() -> u64 {
    DEFAULT_VAULT_TIMEOUT_SECS
}

const fn default_retries() -> u8 {
    DEFAULT_VAULT_RETRIES
}

fn default_token_env() -> String {
    "VAULT_TOKEN".to_owned()
}

fn default_role_id_env() -> String {
    "VAULT_ROLE_ID".to_owned()
}

fn default_secret_id_env() -> String {
    "VAULT_SECRET_ID".to_owned()
}

fn default_approle_mount() -> String {
    "approle".to_owned()
}

fn default_kubernetes_mount() -> String {
    "kubernetes".to_owned()
}

fn default_jwt_path() -> String {
    "/var/run/secrets/kubernetes.io/serviceaccount/token".to_owned()
}