cli

Module: secret_provider::cli

Contents

Structs

• CliSecretProviderConfig - Deserializable configuration for a CLI secret-provider integration.
• FlagSpec - A command-line option that a CLI integration needs to recognize.

Enums

• CliMatcherRuleConfig - One candidate rule for an [CliSecretProviderConfig].
• CommandMatch - Whether a command pattern permits trailing positional arguments.

---

firma_config_schema::secret_provider::cli::CliMatcherRuleConfig

Enum

One candidate rule for an [CliSecretProviderConfig].

Tagged by type (sensitive_command / safe_command / blocked_command) so it nests as a flat TOML table.

Variants:

• SensitiveCommand{ argv: Vec<String>, match_kind: CommandMatch, matcher: crate::secret_matcher::SecretMatcher, stripped_options: Vec<FlagSpec>, append_options: Vec<String> } - Response whose body must be scanned and redacted using matcher.
• SafeCommand{ argv: Vec<String>, match_kind: CommandMatch } - Known-safe path whose response never carries secrets; forwarded
• BlockedCommand{ argv: Vec<String>, match_kind: CommandMatch } - Path that must always be denied.

Traits: Eq

Trait Implementations:

• PartialEq
  • fn eq(self: &Self, other: &CliMatcherRuleConfig) -> bool
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Clone
  • fn clone(self: &Self) -> CliMatcherRuleConfig

firma_config_schema::secret_provider::cli::CliSecretProviderConfig

Struct

Deserializable configuration for a CLI secret-provider integration.

Fields:

• binary_name: String - Executable basename used to select this integration.
• provider_id: String - Stable identifier recorded for secrets from this integration.
• credential_env_vars: Vec<String> - Environment variables forwarded to authenticate the provider CLI.
• stripped_options: Vec<FlagSpec> - Options ignored while identifying command words. Their value arity is
• forbidden_options: Vec<FlagSpec> - Options that make an otherwise permitted invocation unsafe. An
• matchers: Vec<CliMatcherRuleConfig> - Rules that classify invocations and configure secret extraction.

Traits: Eq

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> CliSecretProviderConfig
• PartialEq
  • fn eq(self: &Self, other: &CliSecretProviderConfig) -> bool
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>

firma_config_schema::secret_provider::cli::CommandMatch

Enum

Whether a command pattern permits trailing positional arguments.

Variants:

• Exact - Only the listed command words may occur. Options may be interspersed.
• Prefix - Additional positional arguments may follow the listed command words.

Traits: Copy, Eq

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> CommandMatch
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Default
  • fn default() -> CommandMatch
• PartialEq
  • fn eq(self: &Self, other: &CommandMatch) -> bool
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>

firma_config_schema::secret_provider::cli::FlagSpec

Struct

A command-line option that a CLI integration needs to recognize.

{ name = "--format", takes_value = true }
{ name = "--offline", takes_value = false }
{ name = "-u", takes_value = true, allow_attached_value = true }

Fields:

• name: String - The option’s spelling, such as --server-url or -u.
• takes_value: bool - Whether the option consumes the following argument as its value.
• allow_attached_value: bool - Whether the spelling accepts an attached value without =, such as

Methods:

• fn value(name: &str) -> Self - Creates a specification for an option whose value is a separate
• fn valueless(name: &str) -> Self - Creates a specification for an option that takes no value.
• fn attached_value(name: &str) -> Self - Creates a specification for an option that also accepts a value

Traits: Eq

Trait Implementations:

• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> FlagSpec
• PartialEq
  • fn eq(self: &Self, other: &FlagSpec) -> bool
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result