/ 
DBIO-0.900004
/ DBIO::AccessBroker::Vault

NAME

DBIO::AccessBroker::Vault - Credential rotation with TTL

VERSION

version 0.900004

DESCRIPTION

Vault-backed brokers rotate credentials over time and are therefore not transaction-safe by default. See "TRANSACTION SAFETY" in DBIO::AccessBroker.

METHODS

new

my $broker = DBIO::AccessBroker::Vault->new(
    vault     => $vault_client,
    dsn       => 'dbi:Pg:dbname=myapp;host=db',
    cred_path => 'database/creds/myapp',
    ttl       => 3600,
    refresh_margin => 900,
);

Constructs the broker and fetches the initial credentials from vault immediately. vault, dsn and cred_path are required; ttl defaults to 3600 seconds and refresh_margin to 900.

dbi_attrs (optional, default {}) is a hashref of connect attributes, answered as the fourth element of the connect info. A setting given both there and beside the broker in the connect call must have the same value ("connect_info" in DBIO::Storage::DBI).

vault is any object answering $vault->read_secret($cred_path) with a hash that holds both username and password, defined (an empty string is a value). A secret that is nothing, is no hash, or lacks either of the two croaks, naming cred_path and the shape of the secret or the missing key, never a value of it.

connect_info_for

my ($dsn, $user, $pass, $attrs) = @{ $broker->connect_info_for($mode) };

Returns the legacy DBI-shaped connect info arrayref using the most recently fetched credentials. $mode is ignored (see "The $mode argument" in DBIO::AccessBroker).

needs_refresh

if ($broker->needs_refresh) { ... }

Returns true once the current credentials are within refresh_margin seconds of ttl expiry.

refresh

$broker->refresh;

Re-fetches credentials from vault and resets the expiry clock. Called automatically by "current_connect_info_for" in DBIO::AccessBroker and "current_connect_info_for_storage" in DBIO::AccessBroker when "needs_refresh" is true.

A refresh that fails -- the vault throws, or answers a secret "new" would refuse -- croaks and leaves the credentials and the expiry of before as they were, so the next ask reads the vault again. A storage asking for a connection gets that error and opens none.

has_rotating_credentials

Always true: a Vault broker's credentials rotate over time, which is also why it is not transaction-safe by default (see "TRANSACTION SAFETY" in DBIO::AccessBroker).

AUTHOR

DBIO & DBIx::Class Authors

COPYRIGHT AND LICENSE

Copyright (C) 2026 DBIO Authors Portions Copyright (C) 2005-2025 DBIx::Class Authors Based on DBIx::Class, heavily modified.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.