feat: support multiple secrets service

Author: hiimjako

config.yaml

@@ -41,12 +41,16 @@ writer_side:
     # Uncomment to enable secrets fetched from external providers (e.g. AWS Secrets Manager).
     # Secrets are cached in memory with configurable TTL and passed to hooks as a third argument.
     # Key pattern: oramacore_<collection_uuid>_<secretKey>
+    # Multiple providers can be specified as a list; secrets are merged (later entries override).
     # secrets_manager:
-    #     aws:
+    #     - aws:
     #         region: us-east-1
     #         ttl: 5m
     #         access_key_id: test
     #         secret_access_key: test
+    #     - local:
+    #         secrets:
+    #             col1_TOKEN: my-token
 
 
     # Replace the following value with your own API key
@@ -169,12 +173,16 @@ reader_side:
     # Uncomment to enable secrets fetched from external providers (e.g. AWS Secrets Manager).
     # Secrets are cached in memory with configurable TTL and passed to hooks as a third argument.
     # Key pattern: oramacore_<collection_uuid>_<secretKey>
+    # Multiple providers can be specified as a list; secrets are merged (later entries override).
     # secrets_manager:
-    #     aws:
+    #     - aws:
     #         region: us-east-1
     #         ttl: 5m
     #         access_key_id: test
     #         secret_access_key: test
+    #     - local:
+    #         secrets:
+    #             col1_TOKEN: my-token
 
     # Uncomment to enable customer JWT validation for search requests.
     # This allows customers to use their own identity provider (IdP) for authentication.

src/collection_manager/sides/read/mod.rs

@@ -19,7 +19,7 @@ pub use collection::CollectionStats;
 use duration_str::deserialize_duration;
 use notify::NotifierConfig;
 use orama_js_pool::OutputChannel;
-use oramacore_lib::secrets::{SecretsManagerConfig, SecretsService};
+use oramacore_lib::secrets::{SecretsProviderConfig, SecretsService};
 use oramacore_lib::shelves::ShelfId;
 use std::sync::Arc;
 use std::time::Duration;
@@ -83,7 +83,7 @@ pub struct ReadSideConfig {
     #[serde(default)]
     pub hooks: HooksConfig,
     pub jwt: Option<JwtConfig>,
-    pub secrets_manager: Option<SecretsManagerConfig>,
+    pub secrets_manager: Option<Vec<SecretsProviderConfig>>,
 }
 
 #[derive(Debug, Deserialize, Clone, Copy)]
@@ -269,15 +269,14 @@ impl ReadSide {
             .await
             .context("Cannot create JWT manager")?;
 
-        // Initialize secrets service if configured, otherwise use an empty fallback
         let secrets_service = match config.secrets_manager {
-            Some(secrets_config) => {
+            Some(configs) if !configs.is_empty() => {
                 info!("Initializing secrets service");
-                SecretsService::try_new(secrets_config)
+                SecretsService::try_new(configs)
                     .await
                     .context("Cannot create secrets service")?
             }
-            None => SecretsService::empty(),
+            _ => SecretsService::empty(),
         };
 
         let read_side = ReadSide {

src/collection_manager/sides/write/mod.rs

@@ -76,7 +76,7 @@ use crate::{
 use oramacore_lib::fs::BufferedFile;
 use oramacore_lib::generic_kv::{KVConfig, KVWriteOperation, KV};
 use oramacore_lib::pin_rules::PinRulesWriterError;
-use oramacore_lib::secrets::{SecretsManagerConfig, SecretsService};
+use oramacore_lib::secrets::{SecretsProviderConfig, SecretsService};
 
 #[derive(Error, Debug)]
 pub enum WriteError {
@@ -145,7 +145,7 @@ pub struct WriteSideConfig {
     pub output: OutputSideChannelType,
     pub config: CollectionsWriterConfig,
     pub jwt: Option<JwtConfig>,
-    pub secrets_manager: Option<SecretsManagerConfig>,
+    pub secrets_manager: Option<Vec<SecretsProviderConfig>>,
 }
 
 pub struct WriteSide {
@@ -282,15 +282,14 @@ impl WriteSide {
 
         let training_sets = TrainingSetInterface::new(kv.clone());
 
-        // Initialize secrets service if configured, otherwise use an empty fallback
         let secrets_service = match config.secrets_manager {
-            Some(secrets_config) => {
+            Some(configs) if !configs.is_empty() => {
                 info!("Initializing secrets service");
-                SecretsService::try_new(secrets_config)
+                SecretsService::try_new(configs)
                     .await
                     .context("Cannot create secrets service")?
             }
-            None => SecretsService::empty(),
+            _ => SecretsService::empty(),
         };
 
         let write_side = Self {

src/tests/hook_transform_after_search.rs

@@ -4,7 +4,7 @@ use anyhow::Context;
 use futures::FutureExt;
 use oramacore_lib::hook_storage::HookType;
 use oramacore_lib::secrets::local::LocalSecretsConfig;
-use oramacore_lib::secrets::SecretsManagerConfig;
+use oramacore_lib::secrets::SecretsProviderConfig;
 use serde_json::json;
 
 use crate::tests::utils::{create_oramacore_config, init_log, wait_for, TestContext};
@@ -497,15 +497,12 @@ async fn test_transform_after_search_receives_values_and_secrets() {
     let collection_id = TestContext::generate_collection_id();
     let col_id_str = collection_id.to_string();
 
-    let secrets_config = SecretsManagerConfig {
-        aws: None,
-        local: Some(LocalSecretsConfig {
-            secrets: HashMap::from([(
-                format!("{col_id_str}_TOKEN"),
-                "search_token_789".to_string(),
-            )]),
-        }),
-    };
+    let secrets_config = vec![SecretsProviderConfig::Local(LocalSecretsConfig {
+        secrets: HashMap::from([(
+            format!("{col_id_str}_TOKEN"),
+            "search_token_789".to_string(),
+        )]),
+    })];
 
     let mut config = create_oramacore_config();
     config.writer_side.master_api_key = TestContext::generate_api_key();

src/tests/hook_transform_before_save.rs

@@ -4,7 +4,7 @@ use anyhow::Context;
 use futures::FutureExt;
 use oramacore_lib::hook_storage::HookType;
 use oramacore_lib::secrets::local::LocalSecretsConfig;
-use oramacore_lib::secrets::SecretsManagerConfig;
+use oramacore_lib::secrets::SecretsProviderConfig;
 use serde_json::json;
 
 use crate::tests::utils::{create_oramacore_config, init_log, wait_for, TestContext};
@@ -575,15 +575,9 @@ async fn test_transform_before_save_receives_values_and_secrets() {
     let collection_id = TestContext::generate_collection_id();
     let col_id_str = collection_id.to_string();
 
-    let secrets_config = SecretsManagerConfig {
-        aws: None,
-        local: Some(LocalSecretsConfig {
-            secrets: HashMap::from([(
-                format!("{col_id_str}_TOKEN"),
-                "save_token_789".to_string(),
-            )]),
-        }),
-    };
+    let secrets_config = vec![SecretsProviderConfig::Local(LocalSecretsConfig {
+        secrets: HashMap::from([(format!("{col_id_str}_TOKEN"), "save_token_789".to_string())]),
+    })];
 
     let mut config = create_oramacore_config();
     config.writer_side.master_api_key = TestContext::generate_api_key();