Will Anderson
52 lines
1.6 KiB
Rust
52 lines
1.6 KiB
Rust
//! el-secrets — Secrets management for el-ui applications.
|
|
//!
|
|
//! Secrets are NEVER in code. They are:
|
|
//! - `EnvVarSource` — environment variables (`EL_SECRET_JWT_KEY=...`)
|
|
//! - `VaultSource` — HashiCorp Vault (stub, ready for HTTP client integration)
|
|
//! - `AwsSecretsSource` — AWS Secrets Manager (stub)
|
|
//! - `InMemorySource` — for testing only
|
|
//!
|
|
//! All secrets are wrapped in `Secret<T>` which:
|
|
//! - Displays as `[REDACTED]` in all logs and debug output
|
|
//! - Serializes as `"[REDACTED]"` in JSON — never the actual value
|
|
//! - Requires explicit `.expose()` to read
|
|
//!
|
|
//! ## Quick start
|
|
//!
|
|
//! ```
|
|
//! use el_secrets::prelude::*;
|
|
//!
|
|
//! // Load secrets at startup — fails early if anything is missing
|
|
//! let mut src = InMemorySource::new();
|
|
//! src.insert("jwt.key", "test-key-for-testing-only");
|
|
//!
|
|
//! let secrets = SecretsResolver::new()
|
|
//! .source(Box::new(src))
|
|
//! .require("jwt.key")
|
|
//! .resolve()
|
|
//! .expect("required secrets must be present at startup");
|
|
//!
|
|
//! let jwt_key = secrets.require("jwt.key");
|
|
//! // jwt_key displays as [REDACTED]
|
|
//! // jwt_key.expose() gives the actual value
|
|
//! assert_eq!(jwt_key.expose(), "test-key-for-testing-only");
|
|
//! ```
|
|
|
|
#![deny(warnings)]
|
|
|
|
pub mod error;
|
|
pub mod resolver;
|
|
pub mod secret;
|
|
pub mod source;
|
|
|
|
pub mod prelude {
|
|
pub use crate::error::SecretsError;
|
|
pub use crate::resolver::{ResolvedSecrets, SecretsResolver};
|
|
pub use crate::secret::{Secret, SecretGuard};
|
|
pub use crate::source::{
|
|
AwsSecretsSource, EnvVarSource, InMemorySource, SecretsSource, VaultSource,
|
|
};
|
|
}
|
|
|
|
pub use prelude::*;
|