iet-config

Defines typed configuration loading and secret handling with no implicit environment access.

How to use it

iet-config loads typed, validated settings from a ConfigSource and returns secrets as a redacted Secret<T>. ConfigLoader calls Configuration::load then validate once at startup; the helpers required, optional, with_default, and secret read individual keys with no implicit environment access.

// crates/core/iet-config/src/lib.rs (inline #[cfg(test)] module)
use iet_config::{ConfigLoader, Configuration, ConfigSource, Secret, required, secret};

struct Source;
impl ConfigSource for Source {
    fn get(&self, key: &str) -> iet_core::AppResult<Option<Secret<String>>> {
        Ok(match key {
            "PORT" => Some(Secret::new("8080".into())),
            _ => None,
        })
    }
}
struct Settings { port: u16, password: Secret<String> }
impl Configuration for Settings {
    fn load<S: ConfigSource>(source: &S) -> iet_core::AppResult<Self> {
        Ok(Self { port: required(source, "PORT")?, password: secret(source, "SECRET")? })
    }
    fn validate(&self) -> iet_core::AppResult<()> {
        // ... reject out-of-range values, self-consistency
        Ok(())
    }
}

let settings: Settings = ConfigLoader::new(Source).load()?;

• Defaults apply only to missing keys; a malformed supplied value is a config.parse error, never a silent fallback.
• Secret<T>'s Debug is always [REDACTED], and parse/lookup errors omit the value.

How it works

ConfigLoader pulls typed fields from a ConfigSource via required, optional, or secret, builds the Configuration, and runs validate once before returning the settings.

flowchart LR
  A["ConfigSource::get key"] --> B["Secret"]
  B --> C["required"]
  B --> D["optional"]
  B --> E["secret"]
  C --> F["Configuration::load"]
  F --> G["validate"]
  G --> H["ConfigLoader::load"]
  H --> I["typed settings"]

What it implements

• Defines the traits other crates implement: ConfigSource, Configuration.

What's inside

Modules

• src/lib.rs

Public API

(root)

• type Result
• trait ConfigSource — Sources return secrets as well as public values. Do not log raw source data. Implementations must omit values from errors, including parse/lookup failures.

pub trait ConfigSource: Send + Sync {
    fn get(&self, key: &str) -> AppResult<Option<Secret<String>>>;
}

• struct Secret — No Display, serialization or deref implementation: exposure must be explicit. This wrapper redacts output; it does not guarantee memory zeroization.
• pub fn new(value: T) -> Self
• pub fn expose(&self) -> &T
• trait Configuration

pub trait Configuration: Sized {
    fn load<S: ConfigSource>(source: &S) -> AppResult<Self>;
    fn validate(&self) -> AppResult<()>;
}

• struct ConfigLoader — Concrete source capability for composition/injection. Load once at startup, then inject the validated settings rather than the source into business code.
• pub fn new(source: S) -> Self
• pub fn load<T: Configuration>(&self) -> AppResult<T>
• pub fn required<T: FromStr>(source: &impl ConfigSource, key: &str) -> AppResult<T>
• pub fn optional<T: FromStr>(source: &impl ConfigSource, key: &str) -> AppResult<Option<T>>
• pub fn with_default<T: FromStr>(source: &impl ConfigSource, key: &str, default: T) -> AppResult<T> — Defaults apply only to missing values, never to malformed supplied values.
• pub fn secret<T: FromStr>(source: &impl ConfigSource, key: &str) -> AppResult<Secret<T>>
• pub fn failure(code: &str) -> AppError

Impl map

• fmt::Debug for Secret<T>

Depends on

• iet-core

Used by

• iet-app
• iet-auth
• iet-auth-basic
• iet-auth-session-jwt
• iet-auth-session-opaque
• iet-config-env
• iet-db-timescale
• iet-http-axum
• iet-telemetry
• iet-telemetry-otel

In this repository

• examples/handbook-notes
• examples/htmx-starter
• examples/skills-only-app
• examples/skills-only-app-task-tracker

Source: crates/core/iet-config