Struct SecretsHandler 

pub struct SecretsHandler { /* private fields */ }

Handles secret placeholder substitution in TLS-intercepted plaintext.

Created from SecretsConfig and the destination SNI. Determines which secrets are eligible for this connection based on host matching.

Implementations

impl SecretsHandler

pub fn new(config: &SecretsConfig, sni: &str, tls_intercepted: bool) -> Self

Create a handler for a specific connection.

Filters secrets by host matching against the SNI. Only secrets whose allowed_hosts match sni will be substituted. tls_intercepted indicates whether this is a MITM connection (true) or a bypass/plain connection (false).

pub fn substitute<'a>(&self, data: &'a [u8]) -> Option<Cow<'a, [u8]>>

Substitute secrets in plaintext data (guest → server direction).

Splits the HTTP message on \r\n\r\n to scope substitution:

• headers: substitutes in the header portion (before boundary)
• basic_auth: substitutes in Authorization headers specifically
• query_params: substitutes in the request line (first line, query portion)
• body: substitutes in the body portion (after boundary)

Returns None if a violation is detected (placeholder going to a disallowed host) or BlockAndTerminate is triggered.

pub fn is_empty(&self) -> bool

Returns true if no secrets are configured.

pub fn terminates_on_violation(&self) -> bool

Returns true if a violation should terminate the sandbox.