Struct RaftSecretsStore 

pub struct RaftSecretsStore { /* private fields */ }

Cluster-replicated secrets store.

Reads are served from the local Raft-replicated SecretsState. Writes are proposed through the leader via RaftSecretsHandle. The unwrapped cluster DEK is cached in memory and invalidated when the observed dek_generation changes.

Implementations

impl RaftSecretsStore

pub fn new( node_priv: RecipientPrivateKey, node_id: String, raft: Arc<dyn RaftSecretsHandle>, ) -> Self

Construct a new store bound to a running RaftSecretsHandle.

The DEK cache starts empty and is populated on first read.

pub fn make_key(scope: &str, name: &str) -> String

Construct a storage key in the same shape used by crate::PersistentSecretsStore ("{scope}:{name}"), so a secret written via RaftSecretsStore is findable via the same key under the persistent store and vice versa.

pub fn node_allowed(node_id: &str, affinity: Option<&NodeAffinity>) -> bool

Is the local node currently entitled to host this secret’s decryptable form?

• None affinity: any node may host. Returns true.
• NodeAffinity::Nodes: returns true iff node_id is in the allow-list.
• NodeAffinity::Labels: node-label matching is not yet implemented in this layer (the SM doesn’t carry labels). Returns true so the read is permitted; the API gate is the authoritative enforcement point until labels are wired in.

Trait Implementations

impl SecretsProvider for RaftSecretsStore

fn get_secret<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, scope: &'life1 str, name: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<Secret>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Retrieve a single secret by scope and name.

fn get_secrets<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, scope: &'life1 str, names: &'life2 [&'life3 str], ) -> Pin<Box<dyn Future<Output = Result<HashMap<String, Secret>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Retrieve multiple secrets by scope and names.

fn list_secrets<'life0, 'life1, 'async_trait>( &'life0 self, scope: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<Vec<SecretMetadata>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

List metadata for all secrets in a scope.

fn exists<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, scope: &'life1 str, name: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<bool>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Check if a secret exists in the given scope.

impl SecretsStore for RaftSecretsStore

fn set_secret<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, scope: &'life1 str, name: &'life2 str, value: &'life3 Secret, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Store or update a secret.

fn delete_secret<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, scope: &'life1 str, name: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Delete a secret from the store.

fn rotate_secret<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, scope: &'life1 str, name: &'life2 str, value: &'life3 Secret, ) -> Pin<Box<dyn Future<Output = Result<RotationResult>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Rotate a secret: overwrite with a new value and return the version before+after.

fn set_secret_with_affinity<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>( &'life0 self, scope: &'life1 str, name: &'life2 str, value: &'life3 Secret, node_affinity: Option<&'life4 NodeAffinity>, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, 'life4: 'async_trait,

Store a secret along with an optional NodeAffinity selector.

fn rotate_secret_with_affinity<'life0, 'life1, 'life2, 'life3, 'life4, 'async_trait>( &'life0 self, scope: &'life1 str, name: &'life2 str, value: &'life3 Secret, node_affinity: Option<&'life4 NodeAffinity>, ) -> Pin<Box<dyn Future<Output = Result<RotationResult>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, 'life4: 'async_trait,

Rotate a secret, optionally updating its NodeAffinity selector.