Struct SecretRef 

pub struct SecretRef {
    pub env: Option<String>,
    pub file: Option<String>,
    pub cmd: Option<String>,
}

A reference to a secret — never the secret itself.

Exactly one of the three sources is set per entry:

[agent-identity.tokens]
from_env  = { env  = "SOME_TOKEN" }                 # read $SOME_TOKEN
from_file = { file = "~/.secrets/tok" }             # first non-empty line
from_cmd  = { cmd  = "pass show ci/token" }         # stdout of the command

This is the same secret-by-reference shape as crate::config::BackendConfig::resolve_api_key (env-or-file), extended with a cmd source for secret managers (pass, vault, op, …).

Fields

env: Option<String>

Environment variable to read the secret from.

file: Option<String>

File whose first non-empty line is the secret (tilde-expanded).

cmd: Option<String>

Shell command whose trimmed stdout is the secret.

Implementations

impl SecretRef

pub fn resolve(&self) -> Result<Option<Secret>>

Resolve this reference to its Secret value.

Source precedence when more than one is set: env → file → cmd. Returns Ok(None) when the configured source resolves to nothing (missing env var / empty file) and Err only when a configured cmd fails to execute or exits non-zero — a misconfiguration the caller should see rather than silently treat as “no token”.

Trait Implementations

impl Clone for SecretRef

fn clone(&self) -> SecretRef

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretRef

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecretRef

fn default() -> SecretRef

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecretRef

where SecretRef: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SecretRef

impl PartialEq for SecretRef

fn eq(&self, other: &SecretRef) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for SecretRef

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SecretRef