Struct SecretsHandler 

pub struct SecretsHandler { /* private fields */ }

Handles secret placeholder substitution in TLS-intercepted plaintext.

Created from SecretsConfig and the destination SNI. Determines which secrets are eligible for this connection based on host matching.

Implementations

impl SecretsHandler

pub fn new(config: &SecretsConfig, sni: &str, tls_intercepted: bool) -> Self

Create a handler for a specific connection.

Filters secrets by host matching against the SNI. Only secrets whose allowed_hosts match sni will be substituted. tls_intercepted indicates whether this is a MITM connection (true) or a bypass/plain connection (false).

pub fn substitute<'a>( &mut self, data: &'a [u8], ) -> Result<Cow<'a, [u8]>, ViolationAction>

Substitute secrets in plaintext data (guest → server direction).

Splits the HTTP message on \r\n\r\n to scope substitution:

• headers: substitutes in the header portion (before boundary)
• basic_auth: substitutes in Authorization headers specifically
• query_params: substitutes in the request line (first line, query portion)
• body: substitutes in the body portion (after boundary)

Returns the violation action if a placeholder is detected going to a disallowed host.

pub fn is_empty(&self) -> bool

Returns true if this connection needs no secret substitution or violation detection.