gateway

Module: gateway

Contents

Modules

• client - Client for the firma-run secret resolution gateway.

Structs

• PushRequest
• ResolveRequest - Request to resolve a batch of placeholders back to plaintext, scoped to

Enums

• GatewayRequest - A gateway call, tagged by action in its wire representation (e.g.
• PlaceholderResult - Per-placeholder outcome of a [ResolveRequest]. One placeholder failing
• PushResponse - Outcome of a [PushRequest].

---

firma_secret_provider::gateway::GatewayRequest

Enum

A gateway call, tagged by action in its wire representation (e.g. {"action": "secret.push", ...}) so the broker can dispatch without a second parse pass.

Generic Parameters:

• ‘a

Variants:

• Resolve(ResolveRequest<'a>) - Look up previously pushed placeholders and return their plaintext
• Push(PushRequest<'a>) - Register a newly minted placeholder and the secret value it stands

Trait Implementations:

• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>

firma_secret_provider::gateway::PlaceholderResult

Enum

Per-placeholder outcome of a [ResolveRequest]. One placeholder failing to resolve (unknown token, wrong domain scope) does not fail the whole batch — each entry reports its own success or error.

Generic Parameters:

• ‘a

Variants:

• Ok{ secret_b64: firma_http::Str<'a> } - Base64-encoded plaintext secret value.
• Err{ error: firma_http::Str<'a> } - Resolution failed, e.g. the placeholder is unknown or out of domain

Trait Implementations:

• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>

firma_secret_provider::gateway::PushRequest

Struct

Generic Parameters:

• ‘a

Fields:

• placeholder: firma_http::Str<'a> - Already-minted placeholder token (the Sidecar mints locally so it can
• value_b64: firma_http::Str<'a> - Base64-encoded plaintext secret value.
• domain: std::collections::HashSet<firma_http::Authority> - Hosts the secret is scoped to, mirroring a CLI intercept’s

Trait Implementations:

• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>

firma_secret_provider::gateway::PushResponse

Enum

Outcome of a [PushRequest].

Generic Parameters:

• ‘a

Variants:

• Ok{ placeholder: crate::SecretPlaceholder } - Echoes back the stored placeholder token.
• Err{ error: firma_http::Str<'a> } - The broker rejected or failed to persist the mapping.

Trait Implementations:

• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>

firma_secret_provider::gateway::ResolveRequest

Struct

Request to resolve a batch of placeholders back to plaintext, scoped to the request’s target host.

Generic Parameters:

• ‘a

Fields:

• placeholders: Vec<firma_http::Str<'a>> - Placeholder tokens to resolve, in the order the response’s
• domain: firma_http::Authority - Target host of the outbound request. Used to filter domain-scoped

Trait Implementations:

• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>

Module: client

Client for the firma-run secret resolution gateway.

When the Sidecar MITM pipeline processes an outbound request body containing placeholder tokens, it calls [GatewayClient::resolve_batch] with all tokens at once to obtain the raw secret bytes from firma-run in a single round-trip. firma-run remains the single source of truth; the Sidecar never caches secrets across requests.

The gateway address is advertised via the [GATEWAY_ADDR_ENV] environment variable, set by the orchestrator after firma-run binds the socket. The address uses a unix:///path or tcp://host:port scheme:

unix:///run/firma/secret-shims/gateway.sock   (Linux/macOS)
tcp://127.0.0.1:51234                          (Windows)

Parse it with [EndpointInner::parse_client] and pass it to [GatewayClient::resolve_batch].