Struct Secrets 

pub struct Secrets { /* private fields */ }

Owns the KMS and the audit sink; hands out per-store handles.

Implementations

impl Secrets

pub fn new(kms: Arc<dyn Kms>) -> Self

Wires the KMS. The default audit sink logs one line per access through tracing; #41 replaces it with the append-only log.

pub fn with_audit(self, audit: Arc<dyn Audit>) -> Self

pub fn global(&self, db: Arc<dyn Database>, _proof: HarnessOnly) -> SecretStore

The control database’s store: connection strings and platform keys. Needs a HarnessOnly, which module code cannot build.

The proof is the whole gate, so the call is unreachable without one — a module holding a Secrets and a Database still cannot open the global store:

fn reach_the_control_database(secrets: &Secrets, db: Arc<dyn Database>) {
    // No second argument can be constructed here.
    let _global = secrets.global(db);
}

The tenant store, which is what a module is actually given, needs no proof at all:

fn a_module_reaches_its_own_store(secrets: &Secrets, db: Arc<dyn Database>) {
    let _mine = secrets.tenant("acme", db).expect("an ordinary tenant id");
}

pub fn tenant( &self, tenant: &str, db: Arc<dyn Database>, ) -> Result<SecretStore, SecretsError>

One tenant’s store, in that tenant’s own database. This is what a module is given.

The id becomes the row stamp and the AAD verbatim, so it is checked here rather than taken on trust.

Errors

SecretsError::Invalid when the id is "global": that names the control plane’s store, which only Secrets::global’s proof may open — a tenant store stamped global would be indistinguishable from it, and the proof would gate nothing. Also when the id is empty or whitespace: a store stamped with nothing is nobody’s, invisible to every store. Surrounding whitespace is preserved, not trimmed — " acme " is stamped verbatim and names a different store than acme.