systemprompt_models/
secrets_bootstrap.rs

1use anyhow::{Context, Result};
2use std::collections::HashMap;
3use std::path::Path;
4
5use crate::paths::constants::env_vars;
6use crate::profile::{SecretsSource, SecretsValidationMode, resolve_with_home};
7use crate::profile_bootstrap::ProfileBootstrap;
8use crate::secrets::{JWT_SECRET_MIN_LENGTH, SECRETS, Secrets};
9
10#[derive(Debug, Clone, Copy)]
11pub struct SecretsBootstrap;
12
13#[derive(Debug, thiserror::Error)]
14pub enum SecretsBootstrapError {
15    #[error(
16        "Secrets not initialized. Call SecretsBootstrap::init() after ProfileBootstrap::init()"
17    )]
18    NotInitialized,
19
20    #[error("Secrets already initialized")]
21    AlreadyInitialized,
22
23    #[error("Profile not initialized. Call ProfileBootstrap::init() first")]
24    ProfileNotInitialized,
25
26    #[error("Secrets file not found: {path}")]
27    FileNotFound { path: String },
28
29    #[error("Invalid secrets file: {message}")]
30    InvalidSecretsFile { message: String },
31
32    #[error("No secrets configured. Create a secrets.json file.")]
33    NoSecretsConfigured,
34
35    #[error(
36        "JWT secret is required. Add 'jwt_secret' to your secrets file or set JWT_SECRET \
37         environment variable."
38    )]
39    JwtSecretRequired,
40
41    #[error(
42        "Database URL is required. Add 'database_url' to your secrets.json or set DATABASE_URL \
43         environment variable."
44    )]
45    DatabaseUrlRequired,
46}
47
48impl SecretsBootstrap {
49    pub fn init() -> Result<&'static Secrets> {
50        if SECRETS.get().is_some() {
51            anyhow::bail!(SecretsBootstrapError::AlreadyInitialized);
52        }
53
54        let secrets = Self::load_from_profile_config()?;
55
56        Self::log_loaded_secrets(&secrets);
57
58        SECRETS
59            .set(secrets)
60            .map_err(|_| anyhow::anyhow!(SecretsBootstrapError::AlreadyInitialized))?;
61
62        SECRETS
63            .get()
64            .ok_or_else(|| anyhow::anyhow!(SecretsBootstrapError::NotInitialized))
65    }
66
67    pub fn jwt_secret() -> Result<&'static str, SecretsBootstrapError> {
68        Ok(&Self::get()?.jwt_secret)
69    }
70
71    pub fn database_url() -> Result<&'static str, SecretsBootstrapError> {
72        Ok(&Self::get()?.database_url)
73    }
74
75    pub fn database_write_url() -> Result<Option<&'static str>, SecretsBootstrapError> {
76        Ok(Self::get()?.database_write_url.as_deref())
77    }
78
79    fn load_from_env() -> Result<Secrets> {
80        let jwt_secret = std::env::var("JWT_SECRET")
81            .ok()
82            .filter(|s| !s.is_empty())
83            .ok_or(SecretsBootstrapError::JwtSecretRequired)?;
84
85        let database_url = std::env::var("DATABASE_URL")
86            .ok()
87            .filter(|s| !s.is_empty())
88            .ok_or(SecretsBootstrapError::DatabaseUrlRequired)?;
89
90        let custom = std::env::var(env_vars::CUSTOM_SECRETS)
91            .ok()
92            .filter(|s| !s.is_empty())
93            .map_or_else(HashMap::new, |keys| {
94                keys.split(',')
95                    .filter_map(|key| {
96                        let key = key.trim();
97                        std::env::var(key)
98                            .ok()
99                            .filter(|v| !v.is_empty())
100                            .map(|v| (key.to_owned(), v))
101                    })
102                    .collect()
103            });
104
105        let secrets = Secrets {
106            jwt_secret,
107            database_url,
108            database_write_url: std::env::var("DATABASE_WRITE_URL")
109                .ok()
110                .filter(|s| !s.is_empty()),
111            external_database_url: std::env::var("EXTERNAL_DATABASE_URL")
112                .ok()
113                .filter(|s| !s.is_empty()),
114            internal_database_url: std::env::var("INTERNAL_DATABASE_URL")
115                .ok()
116                .filter(|s| !s.is_empty()),
117            sync_token: std::env::var("SYNC_TOKEN").ok().filter(|s| !s.is_empty()),
118            gemini: std::env::var("GEMINI_API_KEY")
119                .ok()
120                .filter(|s| !s.is_empty()),
121            anthropic: std::env::var("ANTHROPIC_API_KEY")
122                .ok()
123                .filter(|s| !s.is_empty()),
124            openai: std::env::var("OPENAI_API_KEY")
125                .ok()
126                .filter(|s| !s.is_empty()),
127            github: std::env::var("GITHUB_TOKEN").ok().filter(|s| !s.is_empty()),
128            custom,
129        };
130
131        secrets.validate()?;
132        Ok(secrets)
133    }
134
135    fn load_from_profile_config() -> Result<Secrets> {
136        let is_fly_environment = std::env::var("FLY_APP_NAME").is_ok();
137        let is_subprocess = std::env::var("SYSTEMPROMPT_SUBPROCESS").is_ok();
138
139        if is_subprocess || is_fly_environment {
140            if let Ok(jwt_secret) = std::env::var("JWT_SECRET") {
141                if jwt_secret.len() >= JWT_SECRET_MIN_LENGTH {
142                    tracing::debug!(
143                        "Using JWT_SECRET from environment (subprocess/container mode)"
144                    );
145                    return Self::load_from_env();
146                }
147            }
148        }
149
150        let profile =
151            ProfileBootstrap::get().map_err(|_| SecretsBootstrapError::ProfileNotInitialized)?;
152
153        let secrets_config = profile
154            .secrets
155            .as_ref()
156            .ok_or(SecretsBootstrapError::NoSecretsConfigured)?;
157
158        let is_fly_environment = std::env::var("FLY_APP_NAME").is_ok();
159
160        match secrets_config.source {
161            SecretsSource::Env if is_fly_environment => {
162                tracing::debug!("Loading secrets from environment (Fly.io container)");
163                Self::load_from_env()
164            },
165            SecretsSource::Env => {
166                tracing::debug!(
167                    "Profile source is 'env' but running locally, trying file first..."
168                );
169                Self::resolve_and_load_file(&secrets_config.secrets_path).or_else(|_| {
170                    tracing::debug!("File load failed, falling back to environment");
171                    Self::load_from_env()
172                })
173            },
174            SecretsSource::File => {
175                tracing::debug!("Loading secrets from file (profile source: file)");
176                Self::resolve_and_load_file(&secrets_config.secrets_path)
177                    .or_else(|e| Self::handle_load_error(e, secrets_config.validation))
178            },
179        }
180    }
181
182    fn handle_load_error(e: anyhow::Error, mode: SecretsValidationMode) -> Result<Secrets> {
183        log_secrets_issue(&e, mode);
184        Err(e)
185    }
186
187    pub fn get() -> Result<&'static Secrets, SecretsBootstrapError> {
188        SECRETS.get().ok_or(SecretsBootstrapError::NotInitialized)
189    }
190
191    pub fn require() -> Result<&'static Secrets, SecretsBootstrapError> {
192        Self::get()
193    }
194
195    pub fn is_initialized() -> bool {
196        SECRETS.get().is_some()
197    }
198
199    pub fn try_init() -> Result<&'static Secrets> {
200        if SECRETS.get().is_some() {
201            return Self::get().map_err(Into::into);
202        }
203        Self::init()
204    }
205
206    fn resolve_and_load_file(path_str: &str) -> Result<Secrets> {
207        let profile_path = ProfileBootstrap::get_path()
208            .context("SYSTEMPROMPT_PROFILE not set - cannot resolve secrets path")?;
209
210        let profile_dir = Path::new(profile_path)
211            .parent()
212            .context("Invalid profile path - no parent directory")?;
213
214        let resolved_path = resolve_with_home(profile_dir, path_str);
215        Self::load_from_file(&resolved_path)
216    }
217
218    fn load_from_file(path: &Path) -> Result<Secrets> {
219        if !path.exists() {
220            anyhow::bail!(SecretsBootstrapError::FileNotFound {
221                path: path.display().to_string()
222            });
223        }
224
225        let content = std::fs::read_to_string(path)
226            .with_context(|| format!("Failed to read secrets file: {}", path.display()))?;
227
228        let secrets = Secrets::parse(&content).map_err(|e| {
229            anyhow::anyhow!(SecretsBootstrapError::InvalidSecretsFile {
230                message: e.to_string(),
231            })
232        })?;
233
234        tracing::debug!("Loaded secrets from {}", path.display());
235
236        Ok(secrets)
237    }
238
239    fn log_loaded_secrets(secrets: &Secrets) {
240        let message = build_loaded_secrets_message(secrets);
241        tracing::debug!("{}", message);
242    }
243}
244
245pub fn log_secrets_issue(e: &anyhow::Error, mode: SecretsValidationMode) {
246    match mode {
247        SecretsValidationMode::Warn => log_secrets_warn(e),
248        SecretsValidationMode::Skip => log_secrets_skip(e),
249        SecretsValidationMode::Strict => {},
250    }
251}
252
253pub fn log_secrets_warn(e: &anyhow::Error) {
254    tracing::warn!("Secrets file issue: {}", e);
255}
256
257pub fn log_secrets_skip(e: &anyhow::Error) {
258    tracing::debug!("Skipping secrets file: {}", e);
259}
260
261pub fn build_loaded_secrets_message(secrets: &Secrets) -> String {
262    let base = ["jwt_secret", "database_url"];
263    let optional_providers = [
264        secrets
265            .database_write_url
266            .as_ref()
267            .map(|_| "database_write_url"),
268        secrets
269            .external_database_url
270            .as_ref()
271            .map(|_| "external_database_url"),
272        secrets
273            .internal_database_url
274            .as_ref()
275            .map(|_| "internal_database_url"),
276        secrets.gemini.as_ref().map(|_| "gemini"),
277        secrets.anthropic.as_ref().map(|_| "anthropic"),
278        secrets.openai.as_ref().map(|_| "openai"),
279        secrets.github.as_ref().map(|_| "github"),
280    ];
281
282    let loaded: Vec<&str> = base
283        .into_iter()
284        .chain(optional_providers.into_iter().flatten())
285        .collect();
286
287    if secrets.custom.is_empty() {
288        format!("Loaded secrets: {}", loaded.join(", "))
289    } else {
290        format!(
291            "Loaded secrets: {}, {} custom",
292            loaded.join(", "),
293            secrets.custom.len()
294        )
295    }
296}
systemprompt_models/secrets_bootstrap.rs

systemprompt_models/
secrets_bootstrap.rs
