secrets_core/
seed.rs

1use crate::SecretsBackend;
2use crate::broker::SecretsBroker;
3use crate::crypto::envelope::EnvelopeService;
4use crate::errors::{Error, Result};
5use crate::key_provider::KeyProvider;
6use crate::spec_compat::{ContentType, SecretMeta, Visibility};
7use crate::uri::SecretUri;
8use async_trait::async_trait;
9use base64::{Engine, engine::general_purpose::STANDARD};
10use greentic_secrets_spec::{SeedDoc, SeedEntry, SeedValue};
11use greentic_types::secrets::{SecretFormat, SecretRequirement, SecretScope};
12#[cfg(feature = "schema-validate")]
13use jsonschema::JSONSchema;
14use reqwest::Client;
15use std::sync::{Arc, Mutex};
16
17/// Minimal dev context used for resolving requirement keys into URIs.
18#[derive(Debug, Clone, PartialEq, Eq)]
19pub struct DevContext {
20    pub env: String,
21    pub tenant: String,
22    pub team: Option<String>,
23}
24
25impl DevContext {
26    pub fn new(env: impl Into<String>, tenant: impl Into<String>, team: Option<String>) -> Self {
27        Self {
28            env: env.into(),
29            tenant: tenant.into(),
30            team,
31        }
32    }
33}
34
35/// Resolve a requirement into a concrete URI for dev flows.
36pub fn resolve_uri(ctx: &DevContext, req: &SecretRequirement) -> String {
37    let team = ctx.team.as_deref().unwrap_or("_");
38    format!(
39        "secrets://{}/{}/{}/{}",
40        ctx.env,
41        ctx.tenant,
42        team,
43        req.key.as_str()
44    )
45}
46
47/// Normalized seed entry with bytes payload.
48#[derive(Debug, Clone, PartialEq, Eq)]
49pub struct NormalizedSeedEntry {
50    pub uri: String,
51    pub format: SecretFormat,
52    pub bytes: Vec<u8>,
53    pub description: Option<String>,
54}
55
56/// Errors encountered while applying a seed entry.
57#[derive(Debug, Clone, PartialEq, Eq)]
58pub struct ApplyFailure {
59    pub uri: String,
60    pub error: String,
61}
62
63/// Summary report from seed application.
64#[derive(Debug, Clone, PartialEq, Eq, Default)]
65pub struct ApplyReport {
66    pub ok: usize,
67    pub failed: Vec<ApplyFailure>,
68}
69
70/// Options for applying seeds.
71#[derive(Default)]
72pub struct ApplyOptions<'a> {
73    pub requirements: Option<&'a [SecretRequirement]>,
74    pub validate_schema: bool,
75}
76
77#[async_trait]
78pub trait SecretsStore: Send + Sync {
79    async fn put(&self, uri: &str, format: SecretFormat, bytes: &[u8]) -> Result<()>;
80    async fn get(&self, uri: &str) -> Result<Vec<u8>>;
81}
82
83/// Apply all entries in a seed document to the provided store.
84pub async fn apply_seed<S: SecretsStore + ?Sized>(
85    store: &S,
86    seed: &SeedDoc,
87    options: ApplyOptions<'_>,
88) -> ApplyReport {
89    let mut ok = 0usize;
90    let mut failed = Vec::new();
91
92    for entry in &seed.entries {
93        if let Err(err) = validate_entry(entry, &options) {
94            failed.push(ApplyFailure {
95                uri: entry.uri.clone(),
96                error: err.to_string(),
97            });
98            continue;
99        }
100
101        match normalize_seed_entry(entry) {
102            Ok(normalized) => {
103                if let Err(err) = store
104                    .put(&normalized.uri, normalized.format, &normalized.bytes)
105                    .await
106                {
107                    failed.push(ApplyFailure {
108                        uri: normalized.uri,
109                        error: err.to_string(),
110                    });
111                } else {
112                    ok += 1;
113                }
114            }
115            Err(err) => failed.push(ApplyFailure {
116                uri: entry.uri.clone(),
117                error: err.to_string(),
118            }),
119        }
120    }
121
122    ApplyReport { ok, failed }
123}
124
125fn normalize_seed_entry(entry: &SeedEntry) -> Result<NormalizedSeedEntry> {
126    let bytes = match (&entry.format, &entry.value) {
127        (SecretFormat::Text, SeedValue::Text { text }) => Ok(text.as_bytes().to_vec()),
128        (SecretFormat::Json, SeedValue::Json { json }) => {
129            serde_json::to_vec(json).map_err(|err| Error::Invalid("json".into(), err.to_string()))
130        }
131        (SecretFormat::Bytes, SeedValue::BytesB64 { bytes_b64 }) => STANDARD
132            .decode(bytes_b64.as_bytes())
133            .map_err(|err| Error::Invalid("bytes_b64".into(), err.to_string())),
134        _ => Err(Error::Invalid(
135            "seed".into(),
136            "format/value mismatch".into(),
137        )),
138    }?;
139
140    Ok(NormalizedSeedEntry {
141        uri: entry.uri.clone(),
142        format: entry.format.clone(),
143        bytes,
144        description: entry.description.clone(),
145    })
146}
147
148fn validate_entry(entry: &SeedEntry, options: &ApplyOptions<'_>) -> Result<()> {
149    let uri = SecretUri::parse(&entry.uri)?;
150
151    if let Some(reqs) = options.requirements {
152        #[cfg(feature = "schema-validate")]
153        if options.validate_schema
154            && let Some(req) = find_requirement(&uri, reqs)
155            && let (SecretFormat::Json, Some(schema), SeedValue::Json { json }) =
156                (&entry.format, &req.schema, &entry.value)
157        {
158            validate_json_schema(json, schema)?;
159        }
160        #[cfg(not(feature = "schema-validate"))]
161        let _ = find_requirement(&uri, reqs);
162    }
163
164    Ok(())
165}
166
167fn find_requirement<'a>(
168    uri: &SecretUri,
169    requirements: &'a [SecretRequirement],
170) -> Option<&'a SecretRequirement> {
171    let key = format!("{}/{}", uri.category(), uri.name());
172    requirements
173        .iter()
174        .find(|req| req.key.as_str() == key && scopes_match(uri.scope(), req.scope.as_ref()))
175}
176
177fn scopes_match(uri_scope: &greentic_secrets_spec::Scope, req_scope: Option<&SecretScope>) -> bool {
178    let Some(req_scope) = req_scope else {
179        return true;
180    };
181    uri_scope.env() == req_scope.env
182        && uri_scope.tenant() == req_scope.tenant
183        && uri_scope.team().map(|t| t.to_string()) == req_scope.team
184}
185
186#[cfg(feature = "schema-validate")]
187fn validate_json_schema(value: &serde_json::Value, schema: &serde_json::Value) -> Result<()> {
188    let compiled = JSONSchema::compile(schema)
189        .map_err(|err| Error::Invalid("schema".into(), err.to_string()))?;
190
191    if let Err(errors) = compiled.validate(value) {
192        let messages: Vec<String> = errors.map(|err| err.to_string()).collect();
193        return Err(Error::Invalid("json".into(), messages.join("; ")));
194    }
195    Ok(())
196}
197
198fn format_to_content_type(format: SecretFormat) -> ContentType {
199    match format {
200        SecretFormat::Text => ContentType::Text,
201        SecretFormat::Json => ContentType::Json,
202        SecretFormat::Bytes => ContentType::Binary,
203    }
204}
205
206/// Adapter that applies seeds against a broker-backed store.
207pub struct BrokerStore<B, P>
208where
209    B: SecretsBackend,
210    P: KeyProvider,
211{
212    broker: Arc<Mutex<SecretsBroker<B, P>>>,
213}
214
215impl<B, P> BrokerStore<B, P>
216where
217    B: SecretsBackend,
218    P: KeyProvider,
219{
220    pub fn new(broker: SecretsBroker<B, P>) -> Self {
221        Self {
222            broker: Arc::new(Mutex::new(broker)),
223        }
224    }
225}
226
227#[async_trait]
228impl<B, P> SecretsStore for BrokerStore<B, P>
229where
230    B: SecretsBackend + Send + Sync + 'static,
231    P: KeyProvider + Send + Sync + 'static,
232{
233    async fn put(&self, uri: &str, format: SecretFormat, bytes: &[u8]) -> Result<()> {
234        let uri = SecretUri::parse(uri)?;
235        let mut broker = self.broker.lock().unwrap();
236        let mut meta = SecretMeta::new(
237            uri.clone(),
238            Visibility::Team,
239            format_to_content_type(format),
240        );
241        meta.description = None;
242        broker.put_secret(meta, bytes)?;
243        Ok(())
244    }
245
246    async fn get(&self, uri: &str) -> Result<Vec<u8>> {
247        let uri = SecretUri::parse(uri)?;
248        let mut broker = self.broker.lock().unwrap();
249        let secret = broker
250            .get_secret(&uri)
251            .map_err(|err| Error::Backend(err.to_string()))?
252            .ok_or_else(|| Error::NotFound {
253                entity: uri.to_string(),
254            })?;
255        Ok(secret.payload)
256    }
257}
258
259/// HTTP store adapter for talking to the broker service.
260pub struct HttpStore {
261    client: Client,
262    base_url: String,
263    token: Option<String>,
264}
265
266impl HttpStore {
267    pub fn new(base_url: impl Into<String>, token: Option<String>) -> Self {
268        Self::with_client(Client::new(), base_url, token)
269    }
270
271    pub fn with_client(client: Client, base_url: impl Into<String>, token: Option<String>) -> Self {
272        Self {
273            client,
274            base_url: base_url.into().trim_end_matches('/').to_string(),
275            token,
276        }
277    }
278}
279
280#[derive(serde::Serialize)]
281struct PutBody {
282    visibility: Visibility,
283    content_type: ContentType,
284    #[serde(default)]
285    encoding: ValueEncoding,
286    #[serde(default)]
287    description: Option<String>,
288    value: String,
289}
290
291#[derive(serde::Serialize, serde::Deserialize, Debug, Clone)]
292#[serde(rename_all = "lowercase")]
293enum ValueEncoding {
294    Utf8,
295    Base64,
296}
297
298#[derive(serde::Deserialize)]
299struct GetResponse {
300    encoding: ValueEncoding,
301    value: String,
302}
303
304#[async_trait]
305impl SecretsStore for HttpStore {
306    async fn put(&self, uri: &str, format: SecretFormat, bytes: &[u8]) -> Result<()> {
307        let uri = SecretUri::parse(uri)?;
308        let path = match uri.scope().team() {
309            Some(team) => format!(
310                "{}/v1/{}/{}/{}/{}/{}",
311                self.base_url,
312                uri.scope().env(),
313                uri.scope().tenant(),
314                team,
315                uri.category(),
316                uri.name()
317            ),
318            None => format!(
319                "{}/v1/{}/{}/{}/{}",
320                self.base_url,
321                uri.scope().env(),
322                uri.scope().tenant(),
323                uri.category(),
324                uri.name()
325            ),
326        };
327
328        let encoding = match format {
329            SecretFormat::Text | SecretFormat::Json => ValueEncoding::Utf8,
330            SecretFormat::Bytes => ValueEncoding::Base64,
331        };
332        let payload = PutBody {
333            visibility: Visibility::Team,
334            content_type: format_to_content_type(format),
335            encoding: encoding.clone(),
336            description: None,
337            value: match encoding {
338                ValueEncoding::Utf8 => String::from_utf8(bytes.to_vec())
339                    .map_err(|err| Error::Invalid("utf8".into(), err.to_string()))?,
340                ValueEncoding::Base64 => STANDARD.encode(bytes),
341            },
342        };
343
344        let mut req = self.client.put(path).json(&payload);
345        if let Some(token) = &self.token {
346            req = req.bearer_auth(token);
347        }
348        let resp = req
349            .send()
350            .await
351            .map_err(|err| Error::Backend(err.to_string()))?;
352        if !resp.status().is_success() {
353            return Err(Error::Backend(format!("broker returned {}", resp.status())));
354        }
355        Ok(())
356    }
357
358    async fn get(&self, uri: &str) -> Result<Vec<u8>> {
359        let uri = SecretUri::parse(uri)?;
360        let path = match uri.scope().team() {
361            Some(team) => format!(
362                "{}/v1/{}/{}/{}/{}/{}",
363                self.base_url,
364                uri.scope().env(),
365                uri.scope().tenant(),
366                team,
367                uri.category(),
368                uri.name()
369            ),
370            None => format!(
371                "{}/v1/{}/{}/{}/{}",
372                self.base_url,
373                uri.scope().env(),
374                uri.scope().tenant(),
375                uri.category(),
376                uri.name()
377            ),
378        };
379
380        let mut req = self.client.get(path);
381        if let Some(token) = &self.token {
382            req = req.bearer_auth(token);
383        }
384        let resp = req
385            .send()
386            .await
387            .map_err(|err| Error::Backend(err.to_string()))?;
388        if !resp.status().is_success() {
389            return Err(Error::Backend(format!("broker returned {}", resp.status())));
390        }
391        let body: GetResponse = resp
392            .json()
393            .await
394            .map_err(|err| Error::Backend(err.to_string()))?;
395        let bytes = match body.encoding {
396            ValueEncoding::Utf8 => Ok(body.value.into_bytes()),
397            ValueEncoding::Base64 => STANDARD
398                .decode(body.value.as_bytes())
399                .map_err(|err| Error::Invalid("base64".into(), err.to_string())),
400        }?;
401        Ok(bytes)
402    }
403}
404
405/// Convenience dev store backed by the dev provider.
406#[cfg(feature = "dev-store")]
407pub struct DevStore {
408    inner: BrokerStore<Box<dyn SecretsBackend>, Box<dyn KeyProvider>>,
409}
410
411#[cfg(feature = "dev-store")]
412impl DevStore {
413    /// Open the default dev store using the dev provider's environment/path resolution.
414    pub fn open_default() -> Result<Self> {
415        use greentic_secrets_provider_dev::{DevBackend, DevKeyProvider};
416
417        let backend = DevBackend::from_env().map_err(|err| Error::Backend(err.to_string()))?;
418        let key_provider: Box<dyn KeyProvider> = Box::new(DevKeyProvider::from_env());
419        let crypto = EnvelopeService::from_env(key_provider)?;
420        let broker = SecretsBroker::new(Box::new(backend) as Box<dyn SecretsBackend>, crypto);
421        Ok(Self {
422            inner: BrokerStore::new(broker),
423        })
424    }
425
426    /// Open a dev store with a specific persistence path.
427    pub fn with_path(path: impl Into<std::path::PathBuf>) -> Result<Self> {
428        use greentic_secrets_provider_dev::{DevBackend, DevKeyProvider};
429
430        let backend = DevBackend::with_persistence(path.into())
431            .map_err(|err| Error::Backend(err.to_string()))?;
432        let key_provider: Box<dyn KeyProvider> = Box::new(DevKeyProvider::from_env());
433        let crypto = EnvelopeService::from_env(key_provider)?;
434        let broker = SecretsBroker::new(Box::new(backend) as Box<dyn SecretsBackend>, crypto);
435        Ok(Self {
436            inner: BrokerStore::new(broker),
437        })
438    }
439}
440
441#[cfg(feature = "dev-store")]
442#[async_trait]
443impl SecretsStore for DevStore {
444    async fn put(&self, uri: &str, format: SecretFormat, bytes: &[u8]) -> Result<()> {
445        self.inner.put(uri, format, bytes).await
446    }
447
448    async fn get(&self, uri: &str) -> Result<Vec<u8>> {
449        self.inner.get(uri).await
450    }
451}
452
453#[cfg(test)]
454mod tests {
455    use super::*;
456    use greentic_secrets_spec::SeedValue;
457    use tempfile::tempdir;
458
459    #[test]
460    fn resolve_uri_formats_placeholder() {
461        let ctx = DevContext::new("dev", "acme", None);
462        let mut req = SecretRequirement::default();
463        req.key = greentic_types::secrets::SecretKey::parse("configs/db").unwrap();
464        req.required = true;
465        req.scope = Some(SecretScope {
466            env: "dev".into(),
467            tenant: "acme".into(),
468            team: None,
469        });
470        req.format = Some(SecretFormat::Text);
471        let uri = resolve_uri(&ctx, &req);
472        assert_eq!(uri, "secrets://dev/acme/_/configs/db");
473    }
474
475    #[tokio::test]
476    #[cfg(feature = "dev-store")]
477    async fn apply_seed_roundtrip_dev_store() {
478        let dir = tempdir().unwrap();
479        let path = dir.path().join(".dev.secrets.env");
480        let store = DevStore::with_path(path).unwrap();
481
482        let seed = SeedDoc {
483            entries: vec![SeedEntry {
484                uri: "secrets://dev/acme/_/configs/db".into(),
485                format: SecretFormat::Text,
486                description: Some("db".into()),
487                value: SeedValue::Text {
488                    text: "secret".into(),
489                },
490            }],
491        };
492
493        let report = apply_seed(&store, &seed, ApplyOptions::default()).await;
494        assert_eq!(report.ok, 1);
495        assert!(report.failed.is_empty());
496
497        let fetched = store.get("secrets://dev/acme/_/configs/db").await.unwrap();
498        assert_eq!(fetched, b"secret".to_vec());
499    }
500}
secrets_core/seed.rs

secrets_core/
seed.rs
