Documentation
¶
Overview ¶
Package credentials keeps secret material outside SQLite, JSON, reports, events, and logs. Persistent application state carries only StoreRef values.
The operating-system APIs wrapped by go-keyring are synchronous and cannot be interrupted after a call begins. OSStore therefore checks context before and after every platform call; cancellation may wait for the platform call and a mutating call may have completed even when context cancellation is returned. Resolve a credential to one short-lived Lease at a run boundary, reuse its bytes for that run, then Close it. Do not fetch it repeatedly in a request hot path.
Index ¶
- Variables
- type CleanupQueue
- type FileCleanupQueue
- type Lease
- type MemoryCleanupQueue
- type MemoryStore
- func (store *MemoryStore) Delete(ctx context.Context, ref StoreRef) error
- func (store *MemoryStore) Get(ctx context.Context, ref StoreRef) (*Lease, error)
- func (store *MemoryStore) Replace(ctx context.Context, ref StoreRef, secret []byte) error
- func (store *MemoryStore) Set(ctx context.Context, ref StoreRef, secret []byte) error
- func (store *MemoryStore) Test(ctx context.Context, ref StoreRef) error
- type OSStore
- func (store *OSStore) Delete(ctx context.Context, ref StoreRef) error
- func (store *OSStore) Get(ctx context.Context, ref StoreRef) (*Lease, error)
- func (store *OSStore) Replace(ctx context.Context, ref StoreRef, secret []byte) error
- func (store *OSStore) Set(ctx context.Context, ref StoreRef, secret []byte) error
- func (store *OSStore) Test(ctx context.Context, ref StoreRef) error
- type ScopedStore
- func (store *ScopedStore) Delete(ctx context.Context, ref StoreRef) error
- func (store *ScopedStore) Get(ctx context.Context, ref StoreRef) (*Lease, error)
- func (store *ScopedStore) Replace(ctx context.Context, ref StoreRef, secret []byte) error
- func (store *ScopedStore) Set(ctx context.Context, ref StoreRef, secret []byte) error
- func (store *ScopedStore) Test(ctx context.Context, ref StoreRef) error
- type Store
- type StoreRef
Constants ¶
This section is empty.
Variables ¶
var ErrAlreadyExists = errors.New("credentials: already exists")
ErrAlreadyExists reports that Set would overwrite an existing credential.
var ErrClosed = errors.New("credentials: secret lease closed")
ErrClosed reports an attempt to read a released secret lease.
var ErrInvalid = errors.New("credentials: invalid input")
ErrInvalid reports a malformed credential reference or secret input.
var ErrNotFound = errors.New("credentials: not found")
ErrNotFound reports that a credential is absent.
ErrUnavailable reports that the backing credential service cannot be used.
Functions ¶
This section is empty.
Types ¶
type CleanupQueue ¶
type CleanupQueue interface {
Enqueue(context.Context, ...string) error
List(context.Context) ([]string, error)
Remove(context.Context, ...string) error
}
CleanupQueue is a durable non-secret registry of credential identifiers. Referenced IDs remain registered; an ID is removed only after its keyring entry is confirmed deleted once no authored Channel or immutable Plan binding references it.
type FileCleanupQueue ¶
type FileCleanupQueue struct {
// contains filtered or unexported fields
}
FileCleanupQueue stores only credential IDs. Secrets remain exclusively in the operating-system keyring.
func NewFileCleanupQueue ¶
func NewFileCleanupQueue(path string) (*FileCleanupQueue, error)
func (*FileCleanupQueue) Enqueue ¶
func (queue *FileCleanupQueue) Enqueue(ctx context.Context, ids ...string) error
type Lease ¶
type Lease struct {
// contains filtered or unexported fields
}
Lease gives short-lived access to a defensive copy of a secret. Close must be called as soon as the caller no longer needs the secret.
func NewTemporaryLease ¶
NewTemporaryLease copies a transient credential without creating a keyring entry. The caller retains ownership of its input bytes and must close the returned lease when the operation ends.
func (*Lease) MarshalJSON ¶
MarshalJSON deliberately refuses to turn secret material into a transport value. Domain objects, reports, events, and logs must carry StoreRef only.
type MemoryCleanupQueue ¶
type MemoryCleanupQueue struct {
// contains filtered or unexported fields
}
MemoryCleanupQueue is the process-local implementation used by tests and embedders that do not persist application state.
func NewMemoryCleanupQueue ¶
func NewMemoryCleanupQueue() *MemoryCleanupQueue
func (*MemoryCleanupQueue) Enqueue ¶
func (queue *MemoryCleanupQueue) Enqueue(ctx context.Context, ids ...string) error
type MemoryStore ¶
type MemoryStore struct {
// contains filtered or unexported fields
}
MemoryStore is a concurrent in-memory Store intended for tests and short-lived processes. It never serializes its contents.
func NewMemoryStore ¶
func NewMemoryStore() *MemoryStore
func (*MemoryStore) Delete ¶
func (store *MemoryStore) Delete(ctx context.Context, ref StoreRef) error
type OSStore ¶
type OSStore struct {
// contains filtered or unexported fields
}
OSStore persists credentials in the operating-system credential service. The gate preserves create-only Set and existing-only Replace semantics among callers in this process; operating-system keyrings do not offer a portable atomic create-if-absent primitive across processes.
func NewOSStore ¶
func NewOSStore() *OSStore
type ScopedStore ¶
type ScopedStore struct {
// contains filtered or unexported fields
}
ScopedStore transparently binds otherwise stable credential IDs to one storage root. Sharing a channels.json file or Run database therefore shares only non-secret metadata; each root must have its own keyring entry.
func NewScopedStore ¶
func NewScopedStore(store Store, scope string) (*ScopedStore, error)
func (*ScopedStore) Delete ¶
func (store *ScopedStore) Delete(ctx context.Context, ref StoreRef) error
type Store ¶
type Store interface {
Set(context.Context, StoreRef, []byte) error
Replace(context.Context, StoreRef, []byte) error
Get(context.Context, StoreRef) (*Lease, error)
Delete(context.Context, StoreRef) error
Test(context.Context, StoreRef) error
}
Store persists secrets outside application databases and serialized domain objects. Callers own every input byte slice and every returned Lease.
type StoreRef ¶
type StoreRef struct {
// contains filtered or unexported fields
}
StoreRef is a stable, non-secret identifier for an operating-system credential. Its fields are private so only canonical references can exist.
func NewStoreRef ¶
func NewStoreRef(purpose domain.CredentialPurpose, id string) (StoreRef, error)
func ParseStoreRef ¶
func StoreRefFromCredential ¶
func StoreRefFromCredential(ref domain.CredentialRef) (StoreRef, error)
func (StoreRef) Purpose ¶
func (ref StoreRef) Purpose() domain.CredentialPurpose
Source Files