systemprompt_models/
secrets.rs

1//! Secrets document model.
2//!
3//! [`Secrets`] is the deserialized on-disk secrets file: OAuth at-rest
4//! pepper, database URLs, and provider credentials.
5//! [`OAUTH_AT_REST_PEPPER_MIN_LENGTH`] is the enforced minimum.
6//! Validation returns [`crate::errors::SecretsError`].
7//!
8//! Secret hygiene is enforced by the type, not by convention: the hand-written
9//! [`fmt::Debug`] redacts every credential so a stray `{:?}` or `?secrets`
10//! cannot leak into logs, and the [`Drop`] impl wipes the plaintext fields from
11//! memory via `zeroize`. `Serialize` is retained deliberately — operator
12//! tooling round-trips the document back to the on-disk secrets file, the one
13//! legitimate sink.
14//!
15//! Copyright (c) systemprompt.io — Business Source License 1.1.
16//! See <https://systemprompt.io> for licensing details.
17
18use serde::{Deserialize, Serialize};
19use std::collections::HashMap;
20use std::fmt;
21use zeroize::Zeroize;
22
23use crate::errors::SecretsError;
24
25pub const OAUTH_AT_REST_PEPPER_MIN_LENGTH: usize = 32;
26
27#[derive(Clone, Serialize, Deserialize)]
28pub struct Secrets {
29    pub oauth_at_rest_pepper: String,
30
31    #[serde(default, skip_serializing_if = "Option::is_none")]
32    pub manifest_signing_secret_seed: Option<String>,
33
34    #[serde(default, skip_serializing_if = "Option::is_none")]
35    pub signing_key_pem: Option<String>,
36
37    pub database_url: String,
38
39    #[serde(default, skip_serializing_if = "Option::is_none")]
40    pub database_write_url: Option<String>,
41
42    #[serde(default, skip_serializing_if = "Option::is_none")]
43    pub external_database_url: Option<String>,
44
45    #[serde(default, skip_serializing_if = "Option::is_none")]
46    pub internal_database_url: Option<String>,
47
48    #[serde(default, skip_serializing_if = "Option::is_none")]
49    pub gemini: Option<String>,
50
51    #[serde(default, skip_serializing_if = "Option::is_none")]
52    pub anthropic: Option<String>,
53
54    #[serde(default, skip_serializing_if = "Option::is_none")]
55    pub openai: Option<String>,
56
57    #[serde(default, skip_serializing_if = "Option::is_none")]
58    pub github: Option<String>,
59
60    #[serde(default, skip_serializing_if = "Option::is_none")]
61    pub moonshot: Option<String>,
62
63    #[serde(default, skip_serializing_if = "Option::is_none")]
64    pub qwen: Option<String>,
65
66    #[serde(default, flatten)]
67    pub custom: HashMap<String, String>,
68}
69
70impl fmt::Debug for Secrets {
71    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
72        f.debug_struct("Secrets")
73            .field("ai_providers", &self.has_ai_provider())
74            .field("custom_keys", &self.custom.keys().collect::<Vec<_>>())
75            .finish_non_exhaustive()
76    }
77}
78
79impl Drop for Secrets {
80    fn drop(&mut self) {
81        self.oauth_at_rest_pepper.zeroize();
82        self.manifest_signing_secret_seed.zeroize();
83        self.signing_key_pem.zeroize();
84        self.database_url.zeroize();
85        self.database_write_url.zeroize();
86        self.external_database_url.zeroize();
87        self.internal_database_url.zeroize();
88        self.gemini.zeroize();
89        self.anthropic.zeroize();
90        self.openai.zeroize();
91        self.github.zeroize();
92        self.moonshot.zeroize();
93        self.qwen.zeroize();
94        for value in self.custom.values_mut() {
95            value.zeroize();
96        }
97    }
98}
99
100impl Secrets {
101    pub fn parse(content: &str) -> Result<Self, SecretsError> {
102        let mut value: serde_json::Value =
103            serde_json::from_str(content).map_err(|source| SecretsError::Parse {
104                context: "Failed to parse secrets JSON",
105                source,
106            })?;
107        // Null and blank entries are both "absent": setup wizards and container
108        // platforms have historically persisted "" for unset provider keys, and
109        // a blank key must not enable a provider.
110        if let Some(obj) = value.as_object_mut() {
111            obj.retain(|_, v| !v.is_null() && v.as_str().is_none_or(|s| !s.trim().is_empty()));
112        }
113        let secrets: Self =
114            serde_json::from_value(value).map_err(|source| SecretsError::Parse {
115                context: "Failed to deserialize secrets after null stripping",
116                source,
117            })?;
118        secrets.validate()?;
119        Ok(secrets)
120    }
121
122    pub fn validate(&self) -> Result<(), SecretsError> {
123        if self.oauth_at_rest_pepper.len() < OAUTH_AT_REST_PEPPER_MIN_LENGTH {
124            return Err(SecretsError::Invalid(format!(
125                "oauth_at_rest_pepper must be at least {} characters (got {})",
126                OAUTH_AT_REST_PEPPER_MIN_LENGTH,
127                self.oauth_at_rest_pepper.len()
128            )));
129        }
130        Ok(())
131    }
132
133    pub fn effective_database_url(&self, external_db_access: bool) -> &str {
134        if external_db_access && let Some(url) = &self.external_database_url {
135            return url;
136        }
137        &self.database_url
138    }
139
140    pub const fn has_ai_provider(&self) -> bool {
141        self.gemini.is_some()
142            || self.anthropic.is_some()
143            || self.openai.is_some()
144            || self.moonshot.is_some()
145            || self.qwen.is_some()
146    }
147
148    pub fn get(&self, key: &str) -> Option<&String> {
149        match key {
150            "oauth_at_rest_pepper" | "OAUTH_AT_REST_PEPPER" => Some(&self.oauth_at_rest_pepper),
151            "signing_key_pem" | "SIGNING_KEY_PEM" => self.signing_key_pem.as_ref(),
152            "database_url" | "DATABASE_URL" => Some(&self.database_url),
153            "database_write_url" | "DATABASE_WRITE_URL" => self.database_write_url.as_ref(),
154            "external_database_url" | "EXTERNAL_DATABASE_URL" => {
155                self.external_database_url.as_ref()
156            },
157            "internal_database_url" | "INTERNAL_DATABASE_URL" => {
158                self.internal_database_url.as_ref()
159            },
160            "gemini" | "GEMINI_API_KEY" => self.gemini.as_ref(),
161            "anthropic" | "ANTHROPIC_API_KEY" => self.anthropic.as_ref(),
162            "openai" | "OPENAI_API_KEY" => self.openai.as_ref(),
163            "github" | "GITHUB_TOKEN" => self.github.as_ref(),
164            "moonshot" | "MOONSHOT_API_KEY" | "kimi" | "KIMI_API_KEY" => self.moonshot.as_ref(),
165            "qwen" | "QWEN_API_KEY" | "dashscope" | "DASHSCOPE_API_KEY" => self.qwen.as_ref(),
166            other => self.custom.get(other).or_else(|| {
167                let alternate = if other.chars().any(char::is_uppercase) {
168                    other.to_lowercase()
169                } else {
170                    other.to_uppercase()
171                };
172                self.custom.get(&alternate)
173            }),
174        }
175    }
176
177    pub fn to_subprocess_env(&self) -> Vec<(String, String)> {
178        let mut pairs: Vec<(String, String)> = Vec::new();
179
180        pairs.push((
181            "OAUTH_AT_REST_PEPPER".to_owned(),
182            self.oauth_at_rest_pepper.clone(),
183        ));
184        pairs.push(("DATABASE_URL".to_owned(), self.database_url.clone()));
185
186        let optionals: &[(&str, &Option<String>)] = &[
187            (
188                "MANIFEST_SIGNING_SECRET_SEED",
189                &self.manifest_signing_secret_seed,
190            ),
191            ("SIGNING_KEY_PEM", &self.signing_key_pem),
192            ("DATABASE_WRITE_URL", &self.database_write_url),
193            ("EXTERNAL_DATABASE_URL", &self.external_database_url),
194            ("INTERNAL_DATABASE_URL", &self.internal_database_url),
195            ("GEMINI_API_KEY", &self.gemini),
196            ("ANTHROPIC_API_KEY", &self.anthropic),
197            ("OPENAI_API_KEY", &self.openai),
198            ("GITHUB_TOKEN", &self.github),
199            ("MOONSHOT_API_KEY", &self.moonshot),
200            ("QWEN_API_KEY", &self.qwen),
201        ];
202        for (name, value) in optionals {
203            if let Some(v) = value
204                && !v.is_empty()
205            {
206                pairs.push(((*name).to_owned(), v.clone()));
207            }
208        }
209
210        if !self.custom.is_empty() {
211            let mut names: Vec<String> = Vec::with_capacity(self.custom.len());
212            for (key, value) in &self.custom {
213                let upper = key.to_uppercase();
214                names.push(upper.clone());
215                pairs.push((upper.clone(), value.clone()));
216                if upper != *key {
217                    pairs.push((key.clone(), value.clone()));
218                }
219            }
220            pairs.push(("SYSTEMPROMPT_CUSTOM_SECRETS".to_owned(), names.join(",")));
221        }
222
223        pairs
224    }
225}
systemprompt_models/secrets.rs

systemprompt_models/
secrets.rs
