Struct SecretsResolver 

pub struct SecretsResolver<P: SecretsProvider> { /* private fields */ }

Resolver for secret references in configuration values.

The resolver parses $S: and $secret:// prefixed values and replaces them with actual secret values from the underlying provider. This enables declarative secret references in deployment configurations.

Syntax

• $S:name - Deployment-level secret
• $S:@service/name - Service-level secret
• $S:name/field - Field extraction from structured (JSON) secrets
• $secret://<env>/<KEY> - Environment-scoped secret lookup
• $secret://<env>/<KEY>/<field> - With JSON field extraction

The $secret:// form requires an EnvScopeProvider to be wired up via SecretsResolver::with_env_resolver; otherwise such references fail with a clear error.

Example

use zlayer_secrets::{SecretsResolver, PersistentSecretsStore};
use std::collections::HashMap;

async fn resolve_env_vars(
    store: PersistentSecretsStore,
    env: HashMap<String, String>,
) -> Result<HashMap<String, String>> {
    let resolver = SecretsResolver::new(store, "my-deployment");
    resolver.resolve_env(&env).await
}

Implementations

impl<P: SecretsProvider> SecretsResolver<P>

pub fn new(provider: P, scope: impl Into<String>) -> Self

Create a new secrets resolver.

Arguments

• provider - The secrets provider to use for lookups
• scope - The default scope (deployment name) for resolving secrets

pub fn with_env_resolver(self, env_resolver: Arc<dyn EnvScopeProvider>) -> Self

Attach an EnvScopeProvider to enable resolution of $secret://<env>/<KEY> references.

Without this, any $secret:// reference will fail with a clear error.

pub fn provider(&self) -> &P

Get a reference to the underlying provider.

pub fn scope(&self) -> &str

Get the configured scope.

pub async fn resolve_value(&self, value: &str) -> Result<String>

Resolve a single value that may contain a secret reference.

If the value starts with $S:, it will be parsed and replaced with the actual secret value. Otherwise, the original value is returned.

Arguments

• value - The value to potentially resolve

Errors

Returns an error if the value is a secret reference but:

• The reference syntax is invalid
• The secret doesn’t exist
• Field extraction fails (for JSON secrets)

pub async fn resolve_env( &self, env: &HashMap<String, String>, ) -> Result<HashMap<String, String>>

Resolve all secret references in a map of environment variables.

This method efficiently batches secret lookups by:

1. Scanning all values to identify secret references
2. Grouping references by scope
3. Fetching secrets in batches per scope
4. Resolving all values with the fetched secrets

Arguments

• env - Map of environment variable names to values

Returns

A new map with all secret references replaced by their actual values. Non-secret values are passed through unchanged.

Errors

Returns an error if any secret reference is invalid, or if a referenced secret cannot be found.