secret provider: removing exceptions

contrib/sxg/filters/http/source/filter_config.h

@@ -40,8 +40,12 @@ class SDSSecretReader : public SecretReader {
   SDSSecretReader(Secret::GenericSecretConfigProviderSharedPtr&& certificate_provider,
                   Secret::GenericSecretConfigProviderSharedPtr&& private_key_provider,
                   ThreadLocal::SlotAllocator& tls, Api::Api& api)
-      : certificate_(std::move(certificate_provider), tls, api),
-        private_key_(std::move(private_key_provider), tls, api) {}
+      : certificate_(THROW_OR_RETURN_VALUE(Secret::ThreadLocalGenericSecretProvider::create(
+                                               std::move(certificate_provider), tls, api),
+                                           Secret::ThreadLocalGenericSecretProvider)),
+        private_key_(THROW_OR_RETURN_VALUE(Secret::ThreadLocalGenericSecretProvider::create(
+                                               std::move(private_key_provider), tls, api),
+                                           Secret::ThreadLocalGenericSecretProvider)) {}
   // SecretReader
   const std::string& certificate() const override { return certificate_.secret(); }
   const std::string& privateKey() const override { return private_key_.secret(); }

source/common/secret/secret_provider_impl.cc

@@ -37,18 +37,26 @@ GenericSecretConfigProviderImpl::GenericSecretConfigProviderImpl(
           std::make_unique<envoy::extensions::transport_sockets::tls::v3::GenericSecret>(
               generic_secret)) {}
 
+absl::StatusOr<ThreadLocalGenericSecretProvider>
+ThreadLocalGenericSecretProvider::create(GenericSecretConfigProviderSharedPtr&& provider,
+                                         ThreadLocal::SlotAllocator& tls, Api::Api& api) {
+  absl::Status creation_status = absl::OkStatus();
+  ThreadLocalGenericSecretProvider ret(std::move(provider), tls, api, creation_status);
+  RETURN_IF_NOT_OK(creation_status);
+  return std::move(ret);
+}
+
 ThreadLocalGenericSecretProvider::ThreadLocalGenericSecretProvider(
-    GenericSecretConfigProviderSharedPtr&& provider, ThreadLocal::SlotAllocator& tls, Api::Api& api)
+    GenericSecretConfigProviderSharedPtr&& provider, ThreadLocal::SlotAllocator& tls, Api::Api& api,
+    absl::Status& creation_status)
     : provider_(provider), api_(api),
       tls_(std::make_unique<ThreadLocal::TypedSlot<ThreadLocalSecret>>(tls)),
-      cb_(provider_->addUpdateCallback([this] {
-        update();
-        return absl::OkStatus();
-      })) {
+      cb_(provider_->addUpdateCallback([this] { return update(); })) {
   std::string value;
   if (const auto* secret = provider_->secret(); secret != nullptr) {
-    value =
-        THROW_OR_RETURN_VALUE(Config::DataSource::read(secret->secret(), true, api_), std::string);
+    auto value_or_error = Config::DataSource::read(secret->secret(), true, api_);
+    SET_AND_RETURN_IF_NOT_OK(value_or_error.status(), creation_status);
+    value = *value_or_error;
   }
   tls_->set([value = std::move(value)](Event::Dispatcher&) {
     return std::make_shared<ThreadLocalSecret>(value);
@@ -58,14 +66,16 @@ ThreadLocalGenericSecretProvider::ThreadLocalGenericSecretProvider(
 const std::string& ThreadLocalGenericSecretProvider::secret() const { return (*tls_)->value_; }
 
 // This function is executed on the main during xDS update and can throw.
-void ThreadLocalGenericSecretProvider::update() {
+absl::Status ThreadLocalGenericSecretProvider::update() {
   std::string value;
   if (const auto* secret = provider_->secret(); secret != nullptr) {
-    value =
-        THROW_OR_RETURN_VALUE(Config::DataSource::read(secret->secret(), true, api_), std::string);
+    auto value_or_error = Config::DataSource::read(secret->secret(), true, api_);
+    RETURN_IF_NOT_OK_REF(value_or_error.status());
+    value = *value_or_error;
   }
   tls_->runOnAllThreads(
       [value = std::move(value)](OptRef<ThreadLocalSecret> tls) { tls->value_ = value; });
+  return absl::OkStatus();
 }
 
 } // namespace Secret

source/common/secret/secret_provider_impl.h

@@ -120,16 +120,22 @@ class GenericSecretConfigProviderImpl : public GenericSecretConfigProvider {
  **/
 class ThreadLocalGenericSecretProvider {
 public:
-  ThreadLocalGenericSecretProvider(GenericSecretConfigProviderSharedPtr&& provider,
-                                   ThreadLocal::SlotAllocator& tls, Api::Api& api);
+  static absl::StatusOr<ThreadLocalGenericSecretProvider>
+  create(GenericSecretConfigProviderSharedPtr&& provider, ThreadLocal::SlotAllocator& tls,
+         Api::Api& api);
   const std::string& secret() const;
 
+protected:
+  ThreadLocalGenericSecretProvider(GenericSecretConfigProviderSharedPtr&& provider,
+                                   ThreadLocal::SlotAllocator& tls, Api::Api& api,
+                                   absl::Status& creation_status);
+
 private:
   struct ThreadLocalSecret : public ThreadLocal::ThreadLocalObject {
     explicit ThreadLocalSecret(const std::string& value) : value_(value) {}
     std::string value_;
   };
-  void update();
+  absl::Status update();
   GenericSecretConfigProviderSharedPtr provider_;
   Api::Api& api_;
   ThreadLocal::TypedSlotPtr<ThreadLocalSecret> tls_;

source/extensions/filters/http/oauth2/filter.h

@@ -48,8 +48,12 @@ class SDSSecretReader : public SecretReader {
   SDSSecretReader(Secret::GenericSecretConfigProviderSharedPtr&& client_secret_provider,
                   Secret::GenericSecretConfigProviderSharedPtr&& token_secret_provider,
                   ThreadLocal::SlotAllocator& tls, Api::Api& api)
-      : client_secret_(std::move(client_secret_provider), tls, api),
-        token_secret_(std::move(token_secret_provider), tls, api) {}
+      : client_secret_(THROW_OR_RETURN_VALUE(Secret::ThreadLocalGenericSecretProvider::create(
+                                                 std::move(client_secret_provider), tls, api),
+                                             Secret::ThreadLocalGenericSecretProvider)),
+        token_secret_(THROW_OR_RETURN_VALUE(Secret::ThreadLocalGenericSecretProvider::create(
+                                                std::move(token_secret_provider), tls, api),
+                                            Secret::ThreadLocalGenericSecretProvider)) {}
   const std::string& clientSecret() const override { return client_secret_.secret(); }
   const std::string& tokenSecret() const override { return token_secret_.secret(); }
 

source/extensions/http/injected_credentials/common/secret_reader.h

@@ -20,7 +20,9 @@ class SDSSecretReader : public SecretReader {
 public:
   SDSSecretReader(Secret::GenericSecretConfigProviderSharedPtr secret_provider,
                   ThreadLocal::SlotAllocator& tls, Api::Api& api)
-      : credential_(std::move(secret_provider), tls, api) {}
+      : credential_(THROW_OR_RETURN_VALUE(
+            Secret::ThreadLocalGenericSecretProvider::create(std::move(secret_provider), tls, api),
+            Secret::ThreadLocalGenericSecretProvider)) {}
   const std::string& credential() const override { return credential_.secret(); }
 
 private:

tools/code_format/config.yaml

@@ -137,7 +137,6 @@ paths:
     - source/common/upstream/health_discovery_service.cc
     - source/common/secret/sds_api.h
     - source/common/secret/sds_api.cc
-    - source/common/secret/secret_provider_impl.cc
     - source/common/router/router.cc
     - source/common/config/config_provider_impl.h
     - source/common/common/logger_delegates.cc