Enum SecretValue

pub enum SecretValue {
    Plain(SecretString),
    Environment(String),
    HashicorpCloudVault(String),
}

A type that represents a secret value that can be sourced from different places and ensures proper zeroization of sensitive data.

This enum provides different ways to store and retrieve secrets:

• Plain: Direct secret value (wrapped in SecretString for secure memory handling)
• Environment: Environment variable reference
• HashicorpCloudVault: Hashicorp Cloud Vault reference

All variants implement ZeroizeOnDrop to ensure secure memory cleanup.

Variants

Plain(SecretString)

A plain text secret value

Environment(String)

A secret stored in an environment variable

HashicorpCloudVault(String)

A secret stored in Hashicorp Cloud Vault

Implementations

impl SecretValue

pub async fn resolve(&self) -> Result<SecretString, Box<SecurityError>>

Resolves the secret value based on its type.

This method retrieves the actual secret value from its source:

• For Plain, returns the wrapped SecretString
• For Environment, reads the environment variable
• For HashicorpCloudVault, fetches the secret from the vault

Errors

Returns a SecurityError if:

• Environment variable is not set
• Vault access fails
• Any other security-related error occurs

pub fn starts_with(&self, prefix: &str) -> bool

Checks if the secret value starts with a given prefix

pub fn is_empty(&self) -> bool

Checks if the secret value is empty

pub fn trim(&self) -> &str

Trims the secret value

pub fn as_str(&self) -> &str

Returns the secret value as a string

Trait Implementations

impl AsRef<str> for SecretValue

fn as_ref(&self) -> &str

Converts this type into a shared reference of the (usually inferred) input type.

impl Clone for SecretValue

fn clone(&self) -> SecretValue

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretValue

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretValue

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for SecretValue

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for SecretValue

fn drop(&mut self)

Executes the destructor for this type.

impl PartialEq for SecretValue

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for SecretValue

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Zeroize for SecretValue

fn zeroize(&mut self)

Securely zeroizes the secret value.

This implementation ensures that all sensitive data is properly cleared:

• For Plain, zeroizes the underlying SecretString
• For Environment, clears the environment variable name
• For HashicorpCloudVault, clears the secret name