secrets_core/
seed.rs

1use crate::SecretsBackend;
2use crate::broker::SecretsBroker;
3use crate::crypto::envelope::EnvelopeService;
4use crate::errors::{Error, Result};
5use crate::key_provider::KeyProvider;
6use crate::spec_compat::{ContentType, SecretMeta, Visibility};
7use crate::uri::SecretUri;
8use async_trait::async_trait;
9use base64::{Engine, engine::general_purpose::STANDARD};
10use greentic_secrets_spec::{SeedDoc, SeedEntry, SeedValue};
11use greentic_types::secrets::{SecretFormat, SecretRequirement, SecretScope};
12#[cfg(feature = "schema-validate")]
13use jsonschema::JSONSchema;
14use reqwest::Client;
15use std::sync::{Arc, Mutex};
16
17/// Minimal dev context used for resolving requirement keys into URIs.
18#[derive(Debug, Clone, PartialEq, Eq)]
19pub struct DevContext {
20    pub env: String,
21    pub tenant: String,
22    pub team: Option<String>,
23}
24
25impl DevContext {
26    pub fn new(env: impl Into<String>, tenant: impl Into<String>, team: Option<String>) -> Self {
27        Self {
28            env: env.into(),
29            tenant: tenant.into(),
30            team,
31        }
32    }
33}
34
35/// Resolve a requirement into a concrete URI for dev flows.
36pub fn resolve_uri(ctx: &DevContext, req: &SecretRequirement) -> String {
37    resolve_uri_with_category(ctx, req, "configs")
38}
39
40pub fn resolve_uri_with_category(
41    ctx: &DevContext,
42    req: &SecretRequirement,
43    default_category: &str,
44) -> String {
45    let team = ctx.team.as_deref().unwrap_or("_");
46    let key = normalize_req_key(req.key.as_str(), default_category);
47    format!("secrets://{}/{}/{}/{}", ctx.env, ctx.tenant, team, key)
48}
49
50/// Normalized seed entry with bytes payload.
51#[derive(Debug, Clone, PartialEq, Eq)]
52pub struct NormalizedSeedEntry {
53    pub uri: String,
54    pub format: SecretFormat,
55    pub bytes: Vec<u8>,
56    pub description: Option<String>,
57}
58
59/// Errors encountered while applying a seed entry.
60#[derive(Debug, Clone, PartialEq, Eq)]
61pub struct ApplyFailure {
62    pub uri: String,
63    pub error: String,
64}
65
66/// Summary report from seed application.
67#[derive(Debug, Clone, PartialEq, Eq, Default)]
68pub struct ApplyReport {
69    pub ok: usize,
70    pub failed: Vec<ApplyFailure>,
71}
72
73/// Options for applying seeds.
74#[derive(Default)]
75pub struct ApplyOptions<'a> {
76    pub requirements: Option<&'a [SecretRequirement]>,
77    pub validate_schema: bool,
78}
79
80#[async_trait]
81pub trait SecretsStore: Send + Sync {
82    async fn put(&self, uri: &str, format: SecretFormat, bytes: &[u8]) -> Result<()>;
83    async fn get(&self, uri: &str) -> Result<Vec<u8>>;
84}
85
86/// Apply all entries in a seed document to the provided store.
87pub async fn apply_seed<S: SecretsStore + ?Sized>(
88    store: &S,
89    seed: &SeedDoc,
90    options: ApplyOptions<'_>,
91) -> ApplyReport {
92    let mut ok = 0usize;
93    let mut failed = Vec::new();
94
95    for entry in &seed.entries {
96        if let Err(err) = validate_entry(entry, &options) {
97            failed.push(ApplyFailure {
98                uri: entry.uri.clone(),
99                error: err.to_string(),
100            });
101            continue;
102        }
103
104        match normalize_seed_entry(entry) {
105            Ok(normalized) => {
106                if let Err(err) = store
107                    .put(&normalized.uri, normalized.format, &normalized.bytes)
108                    .await
109                {
110                    failed.push(ApplyFailure {
111                        uri: normalized.uri,
112                        error: err.to_string(),
113                    });
114                } else {
115                    ok += 1;
116                }
117            }
118            Err(err) => failed.push(ApplyFailure {
119                uri: entry.uri.clone(),
120                error: err.to_string(),
121            }),
122        }
123    }
124
125    ApplyReport { ok, failed }
126}
127
128fn normalize_seed_entry(entry: &SeedEntry) -> Result<NormalizedSeedEntry> {
129    let bytes = match (&entry.format, &entry.value) {
130        (SecretFormat::Text, SeedValue::Text { text }) => Ok(text.as_bytes().to_vec()),
131        (SecretFormat::Json, SeedValue::Json { json }) => {
132            serde_json::to_vec(json).map_err(|err| Error::Invalid("json".into(), err.to_string()))
133        }
134        (SecretFormat::Bytes, SeedValue::BytesB64 { bytes_b64 }) => STANDARD
135            .decode(bytes_b64.as_bytes())
136            .map_err(|err| Error::Invalid("bytes_b64".into(), err.to_string())),
137        _ => Err(Error::Invalid(
138            "seed".into(),
139            "format/value mismatch".into(),
140        )),
141    }?;
142
143    Ok(NormalizedSeedEntry {
144        uri: entry.uri.clone(),
145        format: entry.format.clone(),
146        bytes,
147        description: entry.description.clone(),
148    })
149}
150
151fn validate_entry(entry: &SeedEntry, options: &ApplyOptions<'_>) -> Result<()> {
152    let uri = SecretUri::parse(&entry.uri)?;
153
154    if let Some(reqs) = options.requirements {
155        #[cfg(feature = "schema-validate")]
156        if options.validate_schema
157            && let Some(req) = find_requirement(&uri, reqs)
158            && let (SecretFormat::Json, Some(schema), SeedValue::Json { json }) =
159                (&entry.format, &req.schema, &entry.value)
160        {
161            validate_json_schema(json, schema)?;
162        }
163        #[cfg(not(feature = "schema-validate"))]
164        let _ = find_requirement(&uri, reqs);
165    }
166
167    Ok(())
168}
169
170fn find_requirement<'a>(
171    uri: &SecretUri,
172    requirements: &'a [SecretRequirement],
173) -> Option<&'a SecretRequirement> {
174    let key = format!("{}/{}", uri.category(), uri.name());
175    requirements.iter().find(|req| {
176        normalize_req_key(req.key.as_str(), uri.category()) == key
177            && scopes_match(uri.scope(), req.scope.as_ref())
178    })
179}
180
181fn normalize_req_key(key: &str, default_category: &str) -> String {
182    let normalized = key.to_ascii_lowercase();
183    if normalized.contains('/') {
184        normalized
185    } else {
186        format!("{default_category}/{normalized}")
187    }
188}
189
190fn scopes_match(uri_scope: &greentic_secrets_spec::Scope, req_scope: Option<&SecretScope>) -> bool {
191    let Some(req_scope) = req_scope else {
192        return true;
193    };
194    uri_scope.env() == req_scope.env
195        && uri_scope.tenant() == req_scope.tenant
196        && uri_scope.team().map(|t| t.to_string()) == req_scope.team
197}
198
199#[cfg(feature = "schema-validate")]
200fn validate_json_schema(value: &serde_json::Value, schema: &serde_json::Value) -> Result<()> {
201    let compiled = JSONSchema::compile(schema)
202        .map_err(|err| Error::Invalid("schema".into(), err.to_string()))?;
203
204    if let Err(errors) = compiled.validate(value) {
205        let messages: Vec<String> = errors.map(|err| err.to_string()).collect();
206        return Err(Error::Invalid("json".into(), messages.join("; ")));
207    }
208    Ok(())
209}
210
211fn format_to_content_type(format: SecretFormat) -> ContentType {
212    match format {
213        SecretFormat::Text => ContentType::Text,
214        SecretFormat::Json => ContentType::Json,
215        SecretFormat::Bytes => ContentType::Binary,
216    }
217}
218
219/// Adapter that applies seeds against a broker-backed store.
220pub struct BrokerStore<B, P>
221where
222    B: SecretsBackend,
223    P: KeyProvider,
224{
225    broker: Arc<Mutex<SecretsBroker<B, P>>>,
226}
227
228impl<B, P> BrokerStore<B, P>
229where
230    B: SecretsBackend,
231    P: KeyProvider,
232{
233    pub fn new(broker: SecretsBroker<B, P>) -> Self {
234        Self {
235            broker: Arc::new(Mutex::new(broker)),
236        }
237    }
238}
239
240#[async_trait]
241impl<B, P> SecretsStore for BrokerStore<B, P>
242where
243    B: SecretsBackend + Send + Sync + 'static,
244    P: KeyProvider + Send + Sync + 'static,
245{
246    async fn put(&self, uri: &str, format: SecretFormat, bytes: &[u8]) -> Result<()> {
247        let uri = SecretUri::parse(uri)?;
248        let mut broker = self.broker.lock().unwrap();
249        let mut meta = SecretMeta::new(
250            uri.clone(),
251            Visibility::Team,
252            format_to_content_type(format),
253        );
254        meta.description = None;
255        broker.put_secret(meta, bytes)?;
256        Ok(())
257    }
258
259    async fn get(&self, uri: &str) -> Result<Vec<u8>> {
260        let uri = SecretUri::parse(uri)?;
261        let mut broker = self.broker.lock().unwrap();
262        let secret = broker
263            .get_secret(&uri)
264            .map_err(|err| Error::Backend(err.to_string()))?
265            .ok_or_else(|| Error::NotFound {
266                entity: uri.to_string(),
267            })?;
268        Ok(secret.payload)
269    }
270}
271
272/// HTTP store adapter for talking to the broker service.
273pub struct HttpStore {
274    client: Client,
275    base_url: String,
276    token: Option<String>,
277}
278
279impl HttpStore {
280    pub fn new(base_url: impl Into<String>, token: Option<String>) -> Self {
281        Self::with_client(Client::new(), base_url, token)
282    }
283
284    pub fn with_client(client: Client, base_url: impl Into<String>, token: Option<String>) -> Self {
285        Self {
286            client,
287            base_url: base_url.into().trim_end_matches('/').to_string(),
288            token,
289        }
290    }
291}
292
293#[derive(serde::Serialize)]
294struct PutBody {
295    visibility: Visibility,
296    content_type: ContentType,
297    #[serde(default)]
298    encoding: ValueEncoding,
299    #[serde(default)]
300    description: Option<String>,
301    value: String,
302}
303
304#[derive(serde::Serialize, serde::Deserialize, Debug, Clone)]
305#[serde(rename_all = "lowercase")]
306enum ValueEncoding {
307    Utf8,
308    Base64,
309}
310
311#[derive(serde::Deserialize)]
312struct GetResponse {
313    encoding: ValueEncoding,
314    value: String,
315}
316
317#[async_trait]
318impl SecretsStore for HttpStore {
319    async fn put(&self, uri: &str, format: SecretFormat, bytes: &[u8]) -> Result<()> {
320        let uri = SecretUri::parse(uri)?;
321        let path = match uri.scope().team() {
322            Some(team) => format!(
323                "{}/v1/{}/{}/{}/{}/{}",
324                self.base_url,
325                uri.scope().env(),
326                uri.scope().tenant(),
327                team,
328                uri.category(),
329                uri.name()
330            ),
331            None => format!(
332                "{}/v1/{}/{}/{}/{}",
333                self.base_url,
334                uri.scope().env(),
335                uri.scope().tenant(),
336                uri.category(),
337                uri.name()
338            ),
339        };
340
341        let encoding = match format {
342            SecretFormat::Text | SecretFormat::Json => ValueEncoding::Utf8,
343            SecretFormat::Bytes => ValueEncoding::Base64,
344        };
345        let payload = PutBody {
346            visibility: Visibility::Team,
347            content_type: format_to_content_type(format),
348            encoding: encoding.clone(),
349            description: None,
350            value: match encoding {
351                ValueEncoding::Utf8 => String::from_utf8(bytes.to_vec())
352                    .map_err(|err| Error::Invalid("utf8".into(), err.to_string()))?,
353                ValueEncoding::Base64 => STANDARD.encode(bytes),
354            },
355        };
356
357        let mut req = self.client.put(path).json(&payload);
358        if let Some(token) = &self.token {
359            req = req.bearer_auth(token);
360        }
361        let resp = req
362            .send()
363            .await
364            .map_err(|err| Error::Backend(err.to_string()))?;
365        if !resp.status().is_success() {
366            return Err(Error::Backend(format!("broker returned {}", resp.status())));
367        }
368        Ok(())
369    }
370
371    async fn get(&self, uri: &str) -> Result<Vec<u8>> {
372        let uri = SecretUri::parse(uri)?;
373        let path = match uri.scope().team() {
374            Some(team) => format!(
375                "{}/v1/{}/{}/{}/{}/{}",
376                self.base_url,
377                uri.scope().env(),
378                uri.scope().tenant(),
379                team,
380                uri.category(),
381                uri.name()
382            ),
383            None => format!(
384                "{}/v1/{}/{}/{}/{}",
385                self.base_url,
386                uri.scope().env(),
387                uri.scope().tenant(),
388                uri.category(),
389                uri.name()
390            ),
391        };
392
393        let mut req = self.client.get(path);
394        if let Some(token) = &self.token {
395            req = req.bearer_auth(token);
396        }
397        let resp = req
398            .send()
399            .await
400            .map_err(|err| Error::Backend(err.to_string()))?;
401        if !resp.status().is_success() {
402            return Err(Error::Backend(format!("broker returned {}", resp.status())));
403        }
404        let body: GetResponse = resp
405            .json()
406            .await
407            .map_err(|err| Error::Backend(err.to_string()))?;
408        let bytes = match body.encoding {
409            ValueEncoding::Utf8 => Ok(body.value.into_bytes()),
410            ValueEncoding::Base64 => STANDARD
411                .decode(body.value.as_bytes())
412                .map_err(|err| Error::Invalid("base64".into(), err.to_string())),
413        }?;
414        Ok(bytes)
415    }
416}
417
418/// Convenience dev store backed by the dev provider.
419#[cfg(feature = "dev-store")]
420pub struct DevStore {
421    inner: BrokerStore<Box<dyn SecretsBackend>, Box<dyn KeyProvider>>,
422}
423
424#[cfg(feature = "dev-store")]
425impl DevStore {
426    /// Open the default dev store using the dev provider's environment/path resolution.
427    pub fn open_default() -> Result<Self> {
428        use greentic_secrets_provider_dev::{DevBackend, DevKeyProvider};
429
430        let backend = DevBackend::from_env().map_err(|err| Error::Backend(err.to_string()))?;
431        let key_provider: Box<dyn KeyProvider> = Box::new(DevKeyProvider::from_env());
432        let crypto = EnvelopeService::from_env(key_provider)?;
433        let broker = SecretsBroker::new(Box::new(backend) as Box<dyn SecretsBackend>, crypto);
434        Ok(Self {
435            inner: BrokerStore::new(broker),
436        })
437    }
438
439    /// Open a dev store with a specific persistence path.
440    pub fn with_path(path: impl Into<std::path::PathBuf>) -> Result<Self> {
441        use greentic_secrets_provider_dev::{DevBackend, DevKeyProvider};
442
443        let backend = DevBackend::with_persistence(path.into())
444            .map_err(|err| Error::Backend(err.to_string()))?;
445        let key_provider: Box<dyn KeyProvider> = Box::new(DevKeyProvider::from_env());
446        let crypto = EnvelopeService::from_env(key_provider)?;
447        let broker = SecretsBroker::new(Box::new(backend) as Box<dyn SecretsBackend>, crypto);
448        Ok(Self {
449            inner: BrokerStore::new(broker),
450        })
451    }
452}
453
454#[cfg(feature = "dev-store")]
455#[async_trait]
456impl SecretsStore for DevStore {
457    async fn put(&self, uri: &str, format: SecretFormat, bytes: &[u8]) -> Result<()> {
458        self.inner.put(uri, format, bytes).await
459    }
460
461    async fn get(&self, uri: &str) -> Result<Vec<u8>> {
462        self.inner.get(uri).await
463    }
464}
465
466#[cfg(test)]
467mod tests {
468    use super::*;
469    use greentic_secrets_spec::SeedValue;
470    use tempfile::tempdir;
471
472    #[test]
473    fn resolve_uri_formats_placeholder() {
474        let ctx = DevContext::new("dev", "acme", None);
475        let mut req = SecretRequirement::default();
476        req.key = greentic_types::secrets::SecretKey::parse("configs/db").unwrap();
477        req.required = true;
478        req.scope = Some(SecretScope {
479            env: "dev".into(),
480            tenant: "acme".into(),
481            team: None,
482        });
483        req.format = Some(SecretFormat::Text);
484        let uri = resolve_uri(&ctx, &req);
485        assert_eq!(uri, "secrets://dev/acme/_/configs/db");
486    }
487
488    #[test]
489    fn resolve_uri_respects_custom_category() {
490        let ctx = DevContext::new("dev", "acme", None);
491        let mut req = SecretRequirement::default();
492        req.key = greentic_types::secrets::SecretKey::parse("db").unwrap();
493        let uri = resolve_uri_with_category(&ctx, &req, "greentic.secrets.fixture");
494        assert_eq!(uri, "secrets://dev/acme/_/greentic.secrets.fixture/db");
495    }
496
497    #[tokio::test]
498    #[cfg(feature = "dev-store")]
499    async fn apply_seed_roundtrip_dev_store() {
500        let dir = tempdir().unwrap();
501        let path = dir.path().join(".dev.secrets.env");
502        let store = DevStore::with_path(path).unwrap();
503
504        let seed = SeedDoc {
505            entries: vec![SeedEntry {
506                uri: "secrets://dev/acme/_/configs/db".into(),
507                format: SecretFormat::Text,
508                description: Some("db".into()),
509                value: SeedValue::Text {
510                    text: "secret".into(),
511                },
512            }],
513        };
514
515        let report = apply_seed(&store, &seed, ApplyOptions::default()).await;
516        assert_eq!(report.ok, 1);
517        assert!(report.failed.is_empty());
518
519        let fetched = store.get("secrets://dev/acme/_/configs/db").await.unwrap();
520        assert_eq!(fetched, b"secret".to_vec());
521    }
522}
secrets_core/seed.rs

secrets_core/
seed.rs
