feat: wireup secret_gateway_addr

Author: Marco Napetti

crates/firma-config-schema/src/run.rs

@@ -119,6 +119,7 @@ pub struct ProfilePatch {
     /// How the sandbox CA trust store is assembled. `None` resolves to the
     /// default `CaTrustMode::Sole`.
     pub ca_trust_mode: Option<CaTrustMode>,
+    pub secret_gateway_addr: Option<String>,
     /// Secret providers to activate: bare strings reference a built-in
     /// integration, tables define a custom one. Additive across
     /// `[run.defaults]` and the active profile (like `env_passthrough`);

crates/firma-run/src/config.rs

@@ -9,6 +9,7 @@ use firma_config_schema::secret_provider::SecretProviderPatch;
 use firma_core::SecretMatcher;
 use firma_runtime_state::RuntimeLayout;
 use firma_secret_provider::IntegrationSpec;
+use firma_secret_provider::gateway::client::GATEWAY_ADDR_ENV;
 use serde::Serialize;
 
 pub use firma_config_schema::run::SandboxIdentityMode;
@@ -69,6 +70,7 @@ pub struct ResolvedProfile {
     pub capability: CapabilityLeaseConfig,
     pub(crate) sidecar_local_exec: Option<CommandMediatorConfig>,
     pub(crate) executable_policies: BTreeMap<String, ExecutableLaunchPolicy>,
+    pub(crate) secret_gateway_addr: Option<String>,
     /// Resolved secret-provider integrations: CLI vault tools keyed by binary
     /// basename, HTTP vaults keyed by `provider_id`. A CLI entry activates a
     /// secret-mediation shim for that binary (stdio routed through the
@@ -498,6 +500,7 @@ impl Merge for ProfilePatch {
             allow_non_structural: higher.allow_non_structural.or(self.allow_non_structural),
             mask_home_paths: higher.mask_home_paths.or(self.mask_home_paths),
             ca_trust_mode: higher.ca_trust_mode.or(self.ca_trust_mode),
+            secret_gateway_addr: higher.secret_gateway_addr.or(self.secret_gateway_addr),
             secret_providers: match (self.secret_providers, higher.secret_providers) {
                 // Additive across layers (like `env_passthrough`); the later
                 // (higher) entries come last so they win on name collision in
@@ -640,6 +643,12 @@ pub(crate) fn resolve_profile_with_layout(
         .map(|(executable, policy)| (executable, resolve_executable_policy(policy)))
         .collect();
 
+    let secret_gateway_addr = patch.secret_gateway_addr.clone().or_else(|| {
+        std::env::var(GATEWAY_ADDR_ENV)
+            .ok()
+            .filter(|value| !value.trim().is_empty())
+    });
+
     let seccomp_policy = patch
         .seccomp_policy
         .map(seccomp_policy_from_patch)
@@ -664,6 +673,7 @@ pub(crate) fn resolve_profile_with_layout(
         sidecar_local_exec,
         executable_policies,
         secret_providers,
+        secret_gateway_addr,
         use_http_proxy_sidecar: patch.use_http_proxy_sidecar.unwrap_or(false),
         allow_non_structural: patch.allow_non_structural.unwrap_or(false),
         ca_trust_mode: patch.ca_trust_mode.unwrap_or_default(),
@@ -762,7 +772,8 @@ fn cli_profile_patch(args: &RunInput) -> ProfilePatch {
             }),
         sidecar_local_exec: None,
         executable_policies: None,
-        secret_providers: Vec::new(),
+        secret_gateway_addr: None,
+        secret_providers: None,
         use_http_proxy_sidecar: None,
         allow_non_structural: args.allow_non_structural.then_some(true),
         mask_home_paths: None,
@@ -817,24 +828,6 @@ fn resolve_secret_providers(
     Ok(resolved)
 }
 
-fn resolve_executable_policies(
-    patch: BTreeMap<String, ExecutableLaunchPolicyPatch>,
-    legacy_codex: Option<ExecutableLaunchPolicyPatch>,
-) -> BTreeMap<String, ExecutableLaunchPolicy> {
-    let mut resolved = patch
-        .into_iter()
-        .map(|(executable, policy)| (executable, resolve_executable_policy(policy)))
-        .collect::<BTreeMap<_, _>>();
-
-    if let Some(codex_policy) = legacy_codex {
-        resolved
-            .entry("codex".to_string())
-            .or_insert_with(|| resolve_executable_policy(codex_policy));
-    }
-
-    resolved
-}
-
 fn resolve_executable_policy(policy: ExecutableLaunchPolicyPatch) -> ExecutableLaunchPolicy {
     ExecutableLaunchPolicy {
         enforce_wrapper_defaults: policy.enforce_wrapper_defaults.unwrap_or(true),
@@ -2195,11 +2188,12 @@ approval_policy = "never"
             capability,
             sidecar_local_exec,
             executable_policies,
-            use_http_proxy_sidecar,
-            allow_non_structural,
-            mask_home_paths,
-            ca_trust_mode,
-            secret_providers,
+            use_http_proxy_sidecar: _,
+            allow_non_structural: _,
+            mask_home_paths: _,
+            ca_trust_mode: _,
+            secret_gateway_addr: _,
+            secret_providers: _,
         } = patch;
 
         for MountPatch {

crates/firma-run/src/profile.rs

@@ -83,7 +83,8 @@ fn generic_profile() -> ProfilePatch {
         }),
         sidecar_local_exec: None,
         executable_policies: Some(BTreeMap::new()),
-        secret_providers: Vec::new(),
+        secret_gateway_addr: None,
+        secret_providers: None,
         use_http_proxy_sidecar: Some(true),
         allow_non_structural: Some(false),
         mask_home_paths: None,

crates/firma-run/src/runtime/mod.rs

@@ -210,6 +210,7 @@ pub fn execute_run(args: &RunInput, hooks: &LaunchHooks<'_>) -> Result<i32, RunE
             }),
             use_http_proxy_sidecar: profile.use_http_proxy_sidecar,
             monitor_mode: args.monitor_mode,
+            secret_gateway_addr: profile.secret_gateway_addr.clone(),
             http_secret_providers: profile
                 .secret_providers
                 .values()
@@ -904,6 +905,7 @@ mod tests {
                 requested_actions: CapabilityLeaseConfig::default_requested_actions(),
             },
             sidecar_local_exec: None,
+            secret_gateway_addr: None,
             secret_providers: BTreeMap::new(),
             executable_policies: BTreeMap::new(),
             use_http_proxy_sidecar: false,
@@ -973,6 +975,7 @@ mod tests {
                 requested_actions: CapabilityLeaseConfig::default_requested_actions(),
             },
             sidecar_local_exec: None,
+            secret_gateway_addr: None,
             secret_providers: BTreeMap::new(),
             executable_policies: BTreeMap::new(),
             use_http_proxy_sidecar: false,
@@ -1027,6 +1030,7 @@ mod tests {
                 requested_actions: CapabilityLeaseConfig::default_requested_actions(),
             },
             sidecar_local_exec: None,
+            secret_gateway_addr: None,
             secret_providers: BTreeMap::new(),
             executable_policies: BTreeMap::new(),
             use_http_proxy_sidecar: false,
@@ -1096,6 +1100,7 @@ mod tests {
                 requested_actions: CapabilityLeaseConfig::default_requested_actions(),
             },
             sidecar_local_exec: None,
+            secret_gateway_addr: None,
             secret_providers: BTreeMap::new(),
             executable_policies: BTreeMap::new(),
             use_http_proxy_sidecar: false,
@@ -1196,6 +1201,7 @@ mod tests {
                 requested_actions: CapabilityLeaseConfig::default_requested_actions(),
             },
             sidecar_local_exec: None,
+            secret_gateway_addr: None,
             secret_providers: BTreeMap::new(),
             use_http_proxy_sidecar: true,
             allow_non_structural: false,
@@ -1266,6 +1272,7 @@ mod tests {
                 requested_actions: CapabilityLeaseConfig::default_requested_actions(),
             },
             sidecar_local_exec: None,
+            secret_gateway_addr: None,
             secret_providers: BTreeMap::new(),
             executable_policies: BTreeMap::new(),
             use_http_proxy_sidecar: true,
@@ -1367,6 +1374,7 @@ mod tests {
                 requested_actions: CapabilityLeaseConfig::default_requested_actions(),
             },
             sidecar_local_exec: None,
+            secret_gateway_addr: None,
             secret_providers: BTreeMap::new(),
             use_http_proxy_sidecar: true,
             allow_non_structural: false,
@@ -1440,6 +1448,7 @@ mod tests {
                 requested_actions: CapabilityLeaseConfig::default_requested_actions(),
             },
             sidecar_local_exec: None,
+            secret_gateway_addr: None,
             secret_providers: BTreeMap::new(),
             use_http_proxy_sidecar: true,
             allow_non_structural: false,

crates/firma-run/src/sidecar/prepare.rs

@@ -8,6 +8,7 @@ use firma_config_loader::AgentProfile;
 use firma_core::SecretMatcher;
 use firma_identifiers::{AgentId, SandboxId};
 use firma_runtime_state::RunEntryLayout;
+use firma_secret_provider::gateway::client::GATEWAY_ADDR_ENV;
 use firma_secret_provider::spec::http::HttpIntegrationSpec;
 use firma_sidecar::authority_credentials::SidecarCredentialsConfig;
 
@@ -174,7 +175,9 @@ pub fn prepare(req: PrepareRequest<'_>) -> Result<PreparedSidecarLaunch, RunErro
         command.env("FIRMA_ALLOW_MONITOR_MODE", "1");
     }
     if let Some(ref addr) = req.secret_gateway_addr {
-        command.env("FIRMA_SECRET_GATEWAY_ADDR", addr);
+        command.env(GATEWAY_ADDR_ENV, addr);
+    } else {
+        command.env_remove(GATEWAY_ADDR_ENV);
     }
 
     Ok(PreparedSidecarLaunch {

crates/firma/tests/integration/sidecar_startup_contract.rs

@@ -20,6 +20,8 @@ use std::io::{BufRead, BufReader};
 use std::process::Command;
 use std::time::{Duration, Instant};
 
+use firma_secret_provider::gateway::client::GATEWAY_ADDR_ENV;
+
 use super::CONFIG_FILE_NAME;
 
 const CONTRACT_PREFIXES: &[&str] = &[
@@ -196,7 +198,7 @@ pattern = "no_named_groups_here"
         .args(["sidecar", "--config"])
         .arg(&fixture.config_path)
         .args(["--health-bind-addr", "127.0.0.1:0"])
-        .env("FIRMA_SECRET_GATEWAY_ADDR", "tcp://127.0.0.1:1")
+        .env(GATEWAY_ADDR_ENV, "tcp://127.0.0.1:1")
         .output()
         .expect("spawn firma sidecar");
     let stderr = String::from_utf8_lossy(&output.stderr);