Trait SecretProvider 

pub trait SecretProvider: Send + Sync {
    // Required method
    fn get<'a>(
        &'a self,
        name: &'a str,
    ) -> Pin<Box<dyn Future<Output = Result<Option<String>, String>> + Send + 'a>>;

    // Provided methods
    fn get_encrypted<'a>(
        &'a self,
        _name: &'a str,
    ) -> Pin<Box<dyn Future<Output = Result<Option<EncryptedSecret>, String>> + Send + 'a>> { ... }
    fn decrypt(
        &self,
        _name: &str,
        _secret: &EncryptedSecret,
    ) -> Result<String, String> { ... }
}

Host-provided resolver for blueprint-declared secrets.

Ok(None) means the secret is not available to the script: undeclared, declared but missing, or otherwise absent. Infrastructure/configuration failures should be returned as Err so scripts cannot confuse them with ordinary absence.

Required Methods

fn get<'a>( &'a self, name: &'a str, ) -> Pin<Box<dyn Future<Output = Result<Option<String>, String>> + Send + 'a>>

Provided Methods

fn get_encrypted<'a>( &'a self, _name: &'a str, ) -> Pin<Box<dyn Future<Output = Result<Option<EncryptedSecret>, String>> + Send + 'a>>

Retrieve and encrypt before returning to the effect recorder. Implementations must not include plaintext credentials in either the value or an error. Direct-only providers fail closed when used with recorded execution.

fn decrypt( &self, _name: &str, _secret: &EncryptedSecret, ) -> Result<String, String>

Decrypt outside effect recording, selecting the key by the envelope’s ID. A missing key is an error, never a reason to retrieve a different credential. Errors must not include plaintext credentials.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl SecretProvider for NoopSecretProvider