store the forge webhook secret and grafana's secret key in bao, seeded from the existing files

swarm-secret-client/src/lib.rs

@@ -120,6 +120,20 @@ impl From<vaultrs::error::ClientError> for Error {
     }
 }
 
+impl Error {
+    /// Whether the store answered 403: the principal's policy does not cover
+    /// the path. A policy the store's host has not written yet looks the same
+    /// as one that never will, so a caller that can do without the path
+    /// checks this before treating the failure as an outage.
+    #[must_use]
+    pub fn is_denied(&self) -> bool {
+        matches!(
+            self,
+            Self::Vault(e) if matches!(**e, vaultrs::error::ClientError::APIError { code: 403, .. })
+        )
+    }
+}
+
 /// Install `aws-lc-rs` as the process-wide rustls crypto provider. Call it
 /// first thing in `main` of every binary that dials the queue or reaches the
 /// secret store over TLS.
@@ -138,6 +152,21 @@ pub fn install_crypto_provider() {
 mod tests {
     use super::*;
 
+    #[test]
+    fn only_a_403_is_a_denial() {
+        let api = |code| {
+            Error::from(vaultrs::error::ClientError::APIError {
+                code,
+                errors: Vec::new(),
+            })
+        };
+        assert!(api(403).is_denied());
+        // The controls: a miss and an outage are not denials.
+        assert!(!api(404).is_denied());
+        assert!(!api(503).is_denied());
+        assert!(!Error::MissingEnv("BAO_ADDR").is_denied());
+    }
+
     #[test]
     fn a_tls_client_config_builds_once_the_provider_is_installed() {
         install_crypto_provider();