Struct mz_secrets::SecretsReader

pub struct SecretsReader {
    pub(crate) config: Arc<SecretsReaderConfig>,
}

Securely reads secrets that are managed by a SecretsController.

Does not provide access to create, update, or delete the secrets within.

Fields

config: Arc<SecretsReaderConfig>

Implementations

impl SecretsReader

pub fn new(config: SecretsReaderConfig) -> Self

pub async fn read(&self, id: GlobalId) -> Result<Vec<u8>, Error>

Returns the contents of a secret identified by GlobalId

This read will return a complete version of the secret. It will not return, e.g., one block from v1 and another from v2.

• On Linux / OSX filesystems, File::open will hold a handle open so that even if the file is deleted, we still continue to read from it. This means a SecretOp::Delete followed by a SecretOp::Ensure can never “swap out” data mid-read_to_end.
• We do not allow editing secrets which would expose us to this issue.

(N.B. Were we ever to run with Windows / NTFS, this would also work properly and mid-read edits would be disallowed)

pub async fn read_string(&self, id: GlobalId) -> Result<String>

pub fn canonical_path(&self, id: GlobalId) -> Result<PathBuf, Error>

Returns the path of the secret consisting of a configured base path and the GlobalId

Trait Implementations

impl Clone for SecretsReader

fn clone(&self) -> SecretsReader

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretsReader

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.