Struct SecretResolver 

pub(crate) struct SecretResolver {
    providers: BTreeMap<String, Box<dyn SecretProvider>>,
}

Resolves client-side secret provider functions in SQL expressions.

Known providers (like env_var) are resolved to string literals. Unknown functions and other expressions pass through unchanged to Materialize.

Fields

providers: BTreeMap<String, Box<dyn SecretProvider>>

Implementations

impl SecretResolver

pub(crate) fn new(config: &SecurityConfig) -> Self

Creates a new resolver with providers configured from the given security config.

Always registers env_var. For AWS, registers the real Secrets Manager provider when aws_profile is set, or a placeholder that errors clearly when it isn’t. All credentials are loaded lazily.

fn register(&mut self, provider: Box<dyn SecretProvider>)

pub(crate) async fn resolve_expr( &self, expr: Expr<Raw>, ) -> Result<Expr<Raw>, SecretResolveError>

Resolve client-side provider functions in an expression.

• Expr::Function matching a registered provider: validate and resolve to Expr::Value(Value::String(...))
• Everything else: pass through unchanged

pub(crate) async fn resolve_create_secret( &self, stmt: &CreateSecretStatement<Raw>, ) -> Result<CreateSecretStatement<Raw>, SecretResolveError>

Resolves client-side provider functions in a CREATE SECRET statement.

Returns a new statement with the value field resolved.

pub(crate) async fn resolve_secret_for_cli( &self, stmt: &CreateSecretStatement<Raw>, ) -> Result<CreateSecretStatement<Raw>, CliError>

Resolves a CREATE SECRET statement and maps errors to CliError.

pub(crate) async fn resolve_statement_for_cli( &self, stmt: &Statement, ) -> Result<Statement, CliError>

Resolves a Statement, returning the resolved version.

Secret statements have their provider functions resolved; all other statements are returned unchanged.