Struct AppConfig 

pub struct AppConfig {
    pub snapshot_hmac_key: Option<[u8; 32]>,
    pub snapshot_require_signature: bool,
}

Top-level configuration knobs read from the process environment at server startup.

Today this only carries snapshot-related knobs that don’t have a natural home in any of the middleware-scoped config structs. As the API surface grows, additional cross-cutting knobs land here so the env-var schema stays discoverable.

The snapshot_hmac_key field is a raw [u8; 32] rather than a tensor_wasm_snapshot::HmacKey (or similar) so this crate does NOT take a hard dependency on tensor-wasm-snapshot. When the snapshot route handlers land they can hand the bytes to SnapshotWriter::with_hmac_sha256_key(key) / SnapshotReader::with_hmac_sha256_key(key) directly.

Debug is implemented manually so that snapshot_hmac_key renders as a redacted placeholder. A derived Debug would print all 32 key bytes any time a caller writes tracing::debug!(?cfg) or similar.

Fields

snapshot_hmac_key: Option<[u8; 32]>

Optional HMAC-SHA256 signing key for snapshot save/restore.

None means snapshots are written in the v2 (unsigned) format and restore accepts both signed and unsigned blobs. Some(key) means snapshots are written in the signed v3 format and restore verifies any signature present (rejecting tampered blobs).

See Self::snapshot_require_signature for the strict-restore knob that additionally rejects unsigned v2 blobs.

snapshot_require_signature: bool

When true, snapshot restore refuses v2 (unsigned) blobs even if a key is configured. Defaults to false so existing v2 archives keep working through the migration window.

Implementations

impl AppConfig

pub fn from_env() -> Result<Self, ConfigError>

Load from the process environment.

Reads ENV_SNAPSHOT_HMAC_KEY (hex, 64 chars) and ENV_SNAPSHOT_REQUIRE_SIGNATURE (true/false, case-insensitive).

Returns ConfigError when:

• TENSOR_WASM_API_SNAPSHOT_HMAC_KEY is set but is not exactly 64 hex characters (each character must be 0-9, a-f, or A-F).
• TENSOR_WASM_API_SNAPSHOT_REQUIRE_SIGNATURE is set to a value that is neither true nor false (case-insensitive).

An unset variable in either case is not an error: the resulting AppConfig carries None / false for the corresponding fields. This matches the silent-default behaviour every other *Config::from_env in this crate exhibits for unset variables — we deliberately diverge from that pattern only for malformed values, where a typo in a secret would otherwise be silently swallowed.

Trait Implementations

impl Clone for AppConfig

fn clone(&self) -> AppConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AppConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AppConfig

fn default() -> AppConfig

Returns the “default value” for a type.

impl Eq for AppConfig

impl PartialEq for AppConfig

fn eq(&self, other: &AppConfig) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for AppConfig