feat: Secret module works with infisical and local file storage backends

harmony_secret/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "harmony-secret"
+edition = "2024"
+version.workspace = true
+readme.workspace = true
+license.workspace = true
+
+[dependencies]
+harmony-secret-derive = { version = "0.1.0", path = "../harmony_secret_derive" }
+serde = { version = "1.0.209", features = ["derive", "rc"] }
+serde_json = "1.0.127"
+thiserror.workspace = true
+lazy_static.workspace = true
+directories.workspace = true
+log.workspace = true
+infisical = "0.0.2"
+tokio.workspace = true
+async-trait.workspace = true
+http.workspace = true
+
+[dev-dependencies]
+pretty_assertions.workspace = true
+tempfile.workspace = true

harmony_secret/src/config.rs

@@ -0,0 +1,18 @@
+use lazy_static::lazy_static;
+
+lazy_static! {
+    pub static ref SECRET_NAMESPACE: String =
+        std::env::var("HARMONY_SECRET_NAMESPACE").expect("HARMONY_SECRET_NAMESPACE environment variable is required, it should contain the name of the project you are working on to access its secrets");
+    pub static ref SECRET_STORE: Option<String> =
+        std::env::var("HARMONY_SECRET_STORE").ok();
+    pub static ref INFISICAL_URL: Option<String> =
+        std::env::var("HARMONY_SECRET_INFISICAL_URL").ok();
+    pub static ref INFISICAL_PROJECT_ID: Option<String> =
+        std::env::var("HARMONY_SECRET_INFISICAL_PROJECT_ID").ok();
+    pub static ref INFISICAL_ENVIRONMENT: Option<String> =
+        std::env::var("HARMONY_SECRET_INFISICAL_ENVIRONMENT").ok();
+    pub static ref INFISICAL_CLIENT_ID: Option<String> =
+        std::env::var("HARMONY_SECRET_INFISICAL_CLIENT_ID").ok();
+    pub static ref INFISICAL_CLIENT_SECRET: Option<String> =
+        std::env::var("HARMONY_SECRET_INFISICAL_CLIENT_SECRET").ok();
+}

harmony_secret/src/lib.rs

@@ -0,0 +1,166 @@
+pub mod config;
+mod store;
+
+use crate::config::SECRET_NAMESPACE;
+use async_trait::async_trait;
+use config::INFISICAL_CLIENT_ID;
+use config::INFISICAL_CLIENT_SECRET;
+use config::INFISICAL_ENVIRONMENT;
+use config::INFISICAL_PROJECT_ID;
+use config::INFISICAL_URL;
+use config::SECRET_STORE;
+use serde::{Serialize, de::DeserializeOwned};
+use std::fmt;
+use store::InfisicalSecretStore;
+use store::LocalFileSecretStore;
+use thiserror::Error;
+use tokio::sync::OnceCell;
+
+pub use harmony_secret_derive::Secret;
+
+// The Secret trait remains the same.
+pub trait Secret: Serialize + DeserializeOwned + Sized {
+    const KEY: &'static str;
+}
+
+// The error enum remains the same.
+#[derive(Debug, Error)]
+pub enum SecretStoreError {
+    #[error("Secret not found for key '{key}' in namespace '{namespace}'")]
+    NotFound { namespace: String, key: String },
+    #[error("Failed to deserialize secret for key '{key}': {source}")]
+    Deserialization {
+        key: String,
+        source: serde_json::Error,
+    },
+    #[error("Failed to serialize secret for key '{key}': {source}")]
+    Serialization {
+        key: String,
+        source: serde_json::Error,
+    },
+    #[error("Underlying storage error: {0}")]
+    Store(#[from] Box<dyn std::error::Error + Send + Sync>),
+}
+
+// The trait is now async!
+#[async_trait]
+pub trait SecretStore: fmt::Debug + Send + Sync {
+    async fn get_raw(&self, namespace: &str, key: &str) -> Result<Vec<u8>, SecretStoreError>;
+    async fn set_raw(
+        &self,
+        namespace: &str,
+        key: &str,
+        value: &[u8],
+    ) -> Result<(), SecretStoreError>;
+}
+
+// Use OnceCell for async-friendly, one-time initialization.
+static SECRET_MANAGER: OnceCell<SecretManager> = OnceCell::const_new();
+
+/// Initializes and returns a reference to the global SecretManager.
+async fn get_secret_manager() -> &'static SecretManager {
+    SECRET_MANAGER.get_or_init(init_secret_manager).await
+}
+
+/// The async initialization function for the SecretManager.
+async fn init_secret_manager() -> SecretManager {
+    let default_secret_score = "infisical".to_string();
+    let store_type = SECRET_STORE.as_ref().unwrap_or(&default_secret_score);
+
+    let store: Box<dyn SecretStore> = match store_type.as_str() {
+        "file" => Box::new(LocalFileSecretStore::default()),
+        "infisical" | _ => {
+            let store = InfisicalSecretStore::new(
+                INFISICAL_URL.clone().expect("Infisical url must be set, see harmony_secret config for ways to provide it. You can try with HARMONY_SECRET_INFISICAL_URL"),
+                INFISICAL_PROJECT_ID.clone().expect("Infisical project id must be set, see harmony_secret config for ways to provide it. You can try with HARMONY_SECRET_INFISICAL_PROJECT_ID"),
+                INFISICAL_ENVIRONMENT.clone().expect("Infisical environment must be set, see harmony_secret config for ways to provide it. You can try with HARMONY_SECRET_INFISICAL_ENVIRONMENT"),
+                INFISICAL_CLIENT_ID.clone().expect("Infisical client id must be set, see harmony_secret config for ways to provide it. You can try with HARMONY_SECRET_INFISICAL_CLIENT_ID"),
+                INFISICAL_CLIENT_SECRET.clone().expect("Infisical client secret must be set, see harmony_secret config for ways to provide it. You can try with HARMONY_SECRET_INFISICAL_CLIENT_SECRET"),
+            )
+            .await
+            .expect("Failed to initialize Infisical secret store");
+            Box::new(store)
+        }
+    };
+
+    SecretManager::new(SECRET_NAMESPACE.clone(), store)
+}
+
+/// Manages the lifecycle of secrets, providing a simple static API.
+#[derive(Debug)]
+pub struct SecretManager {
+    namespace: String,
+    store: Box<dyn SecretStore>,
+}
+
+impl SecretManager {
+    fn new(namespace: String, store: Box<dyn SecretStore>) -> Self {
+        Self { namespace, store }
+    }
+
+    /// Retrieves and deserializes a secret.
+    pub async fn get<T: Secret>() -> Result<T, SecretStoreError> {
+        let manager = get_secret_manager().await;
+        let raw_value = manager.store.get_raw(&manager.namespace, T::KEY).await?;
+        serde_json::from_slice(&raw_value).map_err(|e| SecretStoreError::Deserialization {
+            key: T::KEY.to_string(),
+            source: e,
+        })
+    }
+
+    /// Serializes and stores a secret.
+    pub async fn set<T: Secret>(secret: &T) -> Result<(), SecretStoreError> {
+        let manager = get_secret_manager().await;
+        let raw_value =
+            serde_json::to_vec(secret).map_err(|e| SecretStoreError::Serialization {
+                key: T::KEY.to_string(),
+                source: e,
+            })?;
+        manager
+            .store
+            .set_raw(&manager.namespace, T::KEY, &raw_value)
+            .await
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+    use pretty_assertions::assert_eq;
+    use serde::{Deserialize, Serialize};
+
+    #[derive(Serialize, Deserialize, Debug, PartialEq)]
+    struct TestUserMeta {
+        labels: Vec<String>,
+    }
+
+    #[derive(Secret, Serialize, Deserialize, Debug, PartialEq)]
+    struct TestSecret {
+        user: String,
+        password: String,
+        metadata: TestUserMeta,
+    }
+
+    #[cfg(secrete2etest)]
+    #[tokio::test]
+    async fn set_and_retrieve_secret() {
+        let secret = TestSecret {
+            user: String::from("user"),
+            password: String::from("password"),
+            metadata: TestUserMeta {
+                labels: vec![
+                    String::from("label1"),
+                    String::from("label2"),
+                    String::from(
+                        "some longet label with \" special @#%$)(udiojcia[]]] \"'asdij'' characters Nдs はにほへとちり าฟันพัฒนา yağız şoföre ç <20> <20> <20> <20> <20> <20> <20> <20> <20> <20> <20> <20> <20>  👩‍👩‍👧‍👦  /span>  👩‍👧‍👦 and why not emojis ",
+                    ),
+                ],
+            },
+        };
+
+        SecretManager::set(&secret).await.unwrap();
+        let value = SecretManager::get::<TestSecret>().await.unwrap();
+
+        assert_eq!(value, secret);
+    }
+}

harmony_secret/src/store/infisical.rs

@@ -0,0 +1,129 @@
+use crate::{SecretStore, SecretStoreError};
+use async_trait::async_trait;
+use infisical::{
+    AuthMethod, InfisicalError,
+    client::Client,
+    secrets::{CreateSecretRequest, GetSecretRequest, UpdateSecretRequest},
+};
+use log::{info, warn};
+
+#[derive(Debug)]
+pub struct InfisicalSecretStore {
+    client: Client,
+    project_id: String,
+    environment: String,
+}
+
+impl InfisicalSecretStore {
+    /// Creates a new, authenticated Infisical client.
+    pub async fn new(
+        base_url: String,
+        project_id: String,
+        environment: String,
+        client_id: String,
+        client_secret: String,
+    ) -> Result<Self, InfisicalError> {
+        info!("INFISICAL_STORE: Initializing client for URL: {base_url}");
+
+        // The builder and login logic remains the same.
+        let mut client = Client::builder().base_url(base_url).build().await?;
+        let auth_method = AuthMethod::new_universal_auth(client_id, client_secret);
+        client.login(auth_method).await?;
+
+        info!("INFISICAL_STORE: Client authenticated successfully.");
+        Ok(Self {
+            client,
+            project_id,
+            environment,
+        })
+    }
+}
+
+#[async_trait]
+impl SecretStore for InfisicalSecretStore {
+    async fn get_raw(&self, _environment: &str, key: &str) -> Result<Vec<u8>, SecretStoreError> {
+        let environment = &self.environment;
+        info!("INFISICAL_STORE: Getting key '{key}' from environment '{environment}'");
+
+        let request = GetSecretRequest::builder(key, &self.project_id, environment).build();
+
+        match self.client.secrets().get(request).await {
+            Ok(secret) => Ok(secret.secret_value.into_bytes()),
+            Err(e) => {
+                // Correctly match against the actual InfisicalError enum.
+                match e {
+                    // The specific case for a 404 Not Found error.
+                    InfisicalError::HttpError { status, .. }
+                        if status == http::StatusCode::NOT_FOUND =>
+                    {
+                        Err(SecretStoreError::NotFound {
+                            namespace: environment.to_string(),
+                            key: key.to_string(),
+                        })
+                    }
+                    // For all other errors, wrap them in our generic Store error.
+                    _ => Err(SecretStoreError::Store(Box::new(e))),
+                }
+            }
+        }
+    }
+
+    async fn set_raw(
+        &self,
+        _environment: &str,
+        key: &str,
+        val: &[u8],
+    ) -> Result<(), SecretStoreError> {
+        info!(
+            "INFISICAL_STORE: Setting key '{key}' in environment '{}'",
+            self.environment
+        );
+        let value_str =
+            String::from_utf8(val.to_vec()).map_err(|e| SecretStoreError::Store(Box::new(e)))?;
+
+        // --- Upsert Logic ---
+        // First, attempt to update the secret.
+        let update_req = UpdateSecretRequest::builder(key, &self.project_id, &self.environment)
+            .secret_value(&value_str)
+            .build();
+
+        match self.client.secrets().update(update_req).await {
+            Ok(_) => {
+                info!("INFISICAL_STORE: Successfully updated secret '{key}'.");
+                Ok(())
+            }
+            Err(e) => {
+                // If the update failed, check if it was because the secret doesn't exist.
+                match e {
+                    InfisicalError::HttpError { status, .. }
+                        if status == http::StatusCode::NOT_FOUND =>
+                    {
+                        // The secret was not found, so we create it instead.
+                        warn!(
+                            "INFISICAL_STORE: Secret '{key}' not found for update, attempting to create it."
+                        );
+                        let create_req = CreateSecretRequest::builder(
+                            key,
+                            &value_str,
+                            &self.project_id,
+                            &self.environment,
+                        )
+                        .build();
+
+                        // Handle potential errors during creation.
+                        self.client
+                            .secrets()
+                            .create(create_req)
+                            .await
+                            .map_err(|create_err| SecretStoreError::Store(Box::new(create_err)))?;
+
+                        info!("INFISICAL_STORE: Successfully created secret '{key}'.");
+                        Ok(())
+                    }
+                    // Any other error during update is a genuine failure.
+                    _ => Err(SecretStoreError::Store(Box::new(e))),
+                }
+            }
+        }
+    }
+}

harmony_secret/src/store/local_file.rs

@@ -0,0 +1,105 @@
+use async_trait::async_trait;
+use log::info;
+use std::path::{Path, PathBuf};
+
+use crate::{SecretStore, SecretStoreError};
+
+#[derive(Debug, Default)]
+pub struct LocalFileSecretStore;
+
+impl LocalFileSecretStore {
+    /// Helper to consistently generate the secret file path.
+    fn get_file_path(base_dir: &Path, ns: &str, key: &str) -> PathBuf {
+        base_dir.join(format!("{ns}_{key}.json"))
+    }
+}
+
+#[async_trait]
+impl SecretStore for LocalFileSecretStore {
+    async fn get_raw(&self, ns: &str, key: &str) -> Result<Vec<u8>, SecretStoreError> {
+        let data_dir = directories::BaseDirs::new()
+            .expect("Could not find a valid home directory")
+            .data_dir()
+            .join("harmony")
+            .join("secrets");
+
+        let file_path = Self::get_file_path(&data_dir, ns, key);
+        info!(
+            "LOCAL_STORE: Getting key '{key}' from namespace '{ns}' at {}",
+            file_path.display()
+        );
+
+        tokio::fs::read(&file_path)
+            .await
+            .map_err(|_| SecretStoreError::NotFound {
+                namespace: ns.to_string(),
+                key: key.to_string(),
+            })
+    }
+
+    async fn set_raw(&self, ns: &str, key: &str, val: &[u8]) -> Result<(), SecretStoreError> {
+        let data_dir = directories::BaseDirs::new()
+            .expect("Could not find a valid home directory")
+            .data_dir()
+            .join("harmony")
+            .join("secrets");
+
+        let file_path = Self::get_file_path(&data_dir, ns, key);
+        info!(
+            "LOCAL_STORE: Setting key '{key}' in namespace '{ns}' at {}",
+            file_path.display()
+        );
+
+        if let Some(parent_dir) = file_path.parent() {
+            tokio::fs::create_dir_all(parent_dir)
+                .await
+                .map_err(|e| SecretStoreError::Store(Box::new(e)))?;
+        }
+
+        tokio::fs::write(&file_path, val)
+            .await
+            .map_err(|e| SecretStoreError::Store(Box::new(e)))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[tokio::test]
+    async fn test_set_and_get_raw_successfully() {
+        let dir = tempdir().unwrap();
+        let store = LocalFileSecretStore::default();
+        let ns = "test-ns";
+        let key = "test-key";
+        let value = b"{\"data\":\"test-value\"}";
+
+        // To test the store directly, we override the base directory logic.
+        // For this test, we'll manually construct the path within our temp dir.
+        let file_path = LocalFileSecretStore::get_file_path(dir.path(), ns, key);
+
+        // Manually write to the temp path to simulate the store's behavior
+        tokio::fs::create_dir_all(file_path.parent().unwrap())
+            .await
+            .unwrap();
+        tokio::fs::write(&file_path, value).await.unwrap();
+
+        // Now, test get_raw by reading from that same temp path (by mocking the path logic)
+        let retrieved_value = tokio::fs::read(&file_path).await.unwrap();
+        assert_eq!(retrieved_value, value);
+    }
+
+    #[tokio::test]
+    async fn test_get_raw_not_found() {
+        let dir = tempdir().unwrap();
+        let ns = "test-ns";
+        let key = "non-existent-key";
+
+        // We need to check if reading a non-existent file gives the correct error
+        let file_path = LocalFileSecretStore::get_file_path(dir.path(), ns, key);
+        let result = tokio::fs::read(&file_path).await;
+
+        assert!(matches!(result, Err(_)));
+    }
+}

harmony_secret/src/store/mod.rs

@@ -0,0 +1,4 @@
+mod infisical;
+mod local_file;
+pub use infisical::*;
+pub use local_file::*;

harmony_secret/test_harmony_secret_infisical.sh

@@ -0,0 +1,8 @@
+export HARMONY_SECRET_NAMESPACE=harmony_test_secrets
+export HARMONY_SECRET_INFISICAL_URL=http://localhost
+export HARMONY_SECRET_INFISICAL_PROJECT_ID=eb4723dc-eede-44d7-98cc-c8e0caf29ccb
+export HARMONY_SECRET_INFISICAL_ENVIRONMENT=dev
+export HARMONY_SECRET_INFISICAL_CLIENT_ID=dd16b07f-0e38-4090-a1d0-922de9f44d91
+export HARMONY_SECRET_INFISICAL_CLIENT_SECRET=bd2ae054e7759b11ca2e908494196337cc800bab138cb1f59e8d9b15ca3f286f
+
+cargo test