Expand description
§Secrets
Values a workflow may read but the engine must never record.
Message.context is both what expressions evaluate against and what the
engine serializes, snapshots into every crate::ExecutionTrace step and
clones per map mapping. For almost every value that is right. For a
signing key it is exactly wrong, and there is no way to say so from inside
the context — TraceOptions::redact_paths prunes named subtrees after the
fact, which is the tool you need when a value should not have been there.
So secrets do not live in the context at all. They live in a Secrets
store held by the crate::Engine and are reached through one door: the
reserved JSONLogic operator {"secret": "name"}, registered on the
engine’s datalogic instance. Because the store is never part of a
Message, a secret cannot appear in Serialize for Message, in a trace
snapshot, in a mapping_contexts clone, or in anything a host derives from
a message — there is nothing to exclude.
The operator is registered on every engine, whether or not secrets were
configured. In templating mode an unregistered name would echo back as
literal data, so {"secret": "k"} on a plain engine would be handed to a
handler as an ordinary object — say, as an Authorization header. Always
registering makes it a loud error instead.
Structs§
- Secrets
- An engine-scoped store of values readable through
{"secret": "name"}.
Constants§
- SECRET_
OPERATOR - The reserved operator name. A host cannot register its own operator under
it —
crate::EngineBuilder::buildrefuses.