Enum SecretScope 

pub enum SecretScope {
    Deployment(String),
    Service {
        deployment: String,
        service: String,
    },
    Environment {
        env_id: String,
    },
    ProjectEnvironment {
        project_id: String,
        env_id: String,
    },
    Custom(String),
}

The scope of a secret — the single owner of the storage-scope grammar.

A secret is stored under the key "{scope}:{name}", where {scope} is the string produced by SecretScope::to_storage_scope. This enum is the one place that knows how each logical scope maps to (and parses back from) that on-disk scope string, so the grammar is not re-implemented per crate.

Storage-scope strings

• Deployment(d) => d
• Service { deployment, service } => deployment/service
• Environment { env_id } => env:{env_id}
• ProjectEnvironment { project_id, env_id }=> project:{project_id}:env:{env_id}
• Custom(s) => s (opaque, verbatim)

Variants

Deployment(String)

Deployment-level secret, accessible by all services in the deployment.

Service

Service-level secret, accessible only by the specified service.

Fields

deployment: String

The deployment this service belongs to.

service: String

The specific service name.

Environment

Global environment-scoped secret (no project).

Storage scope: env:{env_id}.

Fields

env_id: String

The environment identifier.

ProjectEnvironment

Project-scoped environment secret.

Storage scope: project:{project_id}:env:{env_id}.

Fields

project_id: String

The project identifier.

env_id: String

The environment identifier.

Custom(String)

Opaque fallback scope carrying a storage-scope string verbatim.

Produced by SecretScope::from_storage_scope for any scope string that does not match a recognized environment grammar (e.g. the "default" scope, or bare//-containing deployment and service forms).

Implementations

impl SecretScope

pub fn deployment(name: impl Into<String>) -> Self

Create a deployment-scoped secret scope.

pub fn service( deployment: impl Into<String>, service: impl Into<String>, ) -> Self

Create a service-scoped secret scope.

pub fn environment(env_id: impl Into<String>) -> Self

Create a global environment-scoped secret scope (no project).

pub fn project_environment( project_id: impl Into<String>, env_id: impl Into<String>, ) -> Self

Create a project-scoped environment secret scope.

pub fn for_env(project_id: Option<&str>, env_id: &str) -> Self

Build an environment scope from an optional project and an env id.

Returns SecretScope::ProjectEnvironment when project_id is Some, else SecretScope::Environment. Mirrors the env_scope() helper in zlayer-api exactly.

pub fn to_storage_scope(&self) -> String

Render the storage-scope string for this scope.

This is the {scope} half of the "{scope}:{name}" storage key. It is the inverse of SecretScope::from_storage_scope for the environment and custom forms.

pub fn from_storage_scope(scope: &str) -> Self

Parse a storage-scope string back into a SecretScope.

Total parser — never fails. The inverse of SecretScope::to_storage_scope for the environment and custom forms:

• env:{id} (non-empty id) => SecretScope::Environment
• project:{pid}:env:{id} (both non-empty) => SecretScope::ProjectEnvironment
• anything else => SecretScope::Custom

Bare deployment names and deployment/service forms are not distinguished here; they round-trip as SecretScope::Custom. Only the environment and custom forms are guaranteed to round-trip by equality.

pub fn deployment_name(&self) -> &str

Get the deployment name for this scope.

Returns the empty string for environment/project-environment/custom scopes, which have no deployment component.

pub fn service_name(&self) -> Option<&str>

Get the service name if this is a service-scoped secret.

pub fn environment_id(&self) -> Option<&str>

Get the environment id if this is an environment-shaped scope.

Returns Some for SecretScope::Environment and SecretScope::ProjectEnvironment, else None.

pub fn is_environment_shaped(&self) -> bool

Whether this scope is one of the environment-shaped variants.

Trait Implementations

impl Clone for SecretScope

fn clone(&self) -> SecretScope

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretScope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretScope

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SecretScope

impl Hash for SecretScope

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for SecretScope

fn eq(&self, other: &SecretScope) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for SecretScope

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SecretScope