| 1 |
|
defmodule WalletAuth.Secrets.SecretProvider do |
| 2 |
|
@moduledoc """ |
| 3 |
|
Behaviour for runtime secret retrieval. |
| 4 |
|
|
| 5 |
|
Implementations must never log or return secrets in error tuples. |
| 6 |
|
Per ADR 0006: all production secrets are sourced from a secret manager; |
| 7 |
|
no plaintext secrets in source or config. |
| 8 |
|
""" |
| 9 |
|
|
| 10 |
|
@type secret_name :: String.t() |
| 11 |
|
@type secret_value :: String.t() |
| 12 |
|
|
| 13 |
|
@doc "Fetch a named secret. Returns {:ok, value} or {:error, :not_found | :unavailable}." |
| 14 |
|
@callback get(secret_name()) :: {:ok, secret_value()} | {:error, :not_found | :unavailable} |
| 15 |
|
|
| 16 |
|
@doc "Fetch a secret, raising if unavailable (used at startup fail-fast checks)." |
| 17 |
|
@callback get!(secret_name()) :: secret_value() |
| 18 |
|
|
| 19 |
|
@doc "Returns the configured provider module." |
| 20 |
|
@spec provider() :: module() |
| 21 |
|
def provider do |
| 22 |
26 |
Application.get_env(:wallet_auth, :secret_provider, WalletAuth.Secrets.EnvSecretProvider) |
| 23 |
|
end |
| 24 |
|
|
| 25 |
|
@doc "Delegates to the configured provider." |
| 26 |
|
@spec get(secret_name()) :: {:ok, secret_value()} | {:error, :not_found | :unavailable} |
| 27 |
8 |
def get(name), do: provider().get(name) |
| 28 |
|
|
| 29 |
|
@doc "Delegates to the configured provider, raising if unavailable." |
| 30 |
|
@spec get!(secret_name()) :: secret_value() |
| 31 |
18 |
def get!(name), do: provider().get!(name) |
| 32 |
|
end |