Add Secret Store Support

Start with the WIT bindings in stubs/wit_world/imports/secret_store.py and compare the requested SecretStore and Secret APIs with the documented Fastly Secret Store behavior. Add Viceroy coverage using @on_viceroy and inline test.toml secret-store data. Done means the resource wrappers, dict-like access, plaintext methods, and non-leaking string representations are covered.

Overview

Add support for Fastly's Secret Store, providing secure access to sensitive credentials and secrets at the edge.

WIT Interface

interface secret-store {
  resource secret {
    from-bytes: static func(bytes: list<u8>) -> result<secret, error>;
    plaintext: func(max-len: u64) -> result<list<u8>, error>;
  }

  resource store {
    open: static func(name: string) -> result<store, open-error>;
    get: func(key: string) -> result<option<secret>, error>;
  }
}

WIT bindings: stubs/wit_world/imports/secret_store.py

API Design

• Implement SecretStore resource wrapper
• Implement Secret resource with plaintext() and plaintext_str() methods
• Override __str__ and __repr__ to return "<Secret>" to prevent accidental exposure in logs
• Provide dict-like interface: __getitem__, __contains__
• from_bytes() available but discouraged (for API compatibility when secrets come from non-store sources)

Cross-SDK Comparison:

• Rust: SecretStore::open() with get() (panics), try_get() (fallible), contains(). Secret has plaintext() returning Bytes with lazy decryption/caching. Warns against bringing secrets into memory unnecessarily.

• Go: Open() returns *Store, Get() returns *Secret. Plaintext() decrypts to []byte. Includes SecretFromBytes() for non-store secrets and convenience Plaintext(storeName, secretName) one-liner.

• JS: new SecretStore(name), async get() returns SecretStoreEntry | null. Entry has plaintext() (UTF-8 string) and rawBytes() (Uint8Array). Static fromBytes() for creating entry from raw data.

Recommended Python approach:

• Dict-like access: store[key] raises if not found, store.get(key, default=None) returns None if missing
• Secret object with lazy plaintext() returning bytes, optional plaintext_str() for UTF-8 text
• Consider context manager for secrets to encourage memory cleanup
• Security warnings in docstrings about keeping secrets in memory

Viceroy Testing

Viceroy supports Secret Store with inline or file-based test data via test.toml:

[local_server]
# Inline secrets
secret_stores.my_secrets = [
  {key = "api_key", data = "secret-value-123"},
  {key = "cert", file = "path/to/cert.pem"},
  {key = "from_env", env = "MY_ENV_VAR"}
]

# Or JSON file format
secret_stores.json_secrets = { file = "data/secrets.json", format = "json" }

Secrets can be provided inline, from files, or from environment variables. Tests can use @on_viceroy with inline TOML configuration.

Reference

• Fastly Secret Store API Documentation