secrets

package
v0.2.3 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 13, 2026 License: MIT Imports: 22 Imported by: 0

Documentation

Overview

Package secrets provides SecretStore implementations for local profile secrets.

Index

Constants

View Source
const MaxSecretValueSize = 64 * 1024

Variables

View Source
var (
	ErrInvalidSecretName   = errors.New("invalid secret name")
	ErrSecretTooLarge      = errors.New("secret value too large")
	ErrSecretNotFound      = errors.New("secret not found")
	ErrKeychainUnavailable = errors.New("macOS keychain unavailable")
	// ErrCredentialUnmapped is returned when a declared brokered credential has no install-time map entry.
	ErrCredentialUnmapped = errors.New("credential unmapped")
)

Functions

func ReadLease

func ReadLease(_ context.Context, handle LeaseHandle) ([]byte, error)

func SetTestEndpoints

func SetTestEndpoints(openAI, anthropic, xai string) func()

SetTestEndpoints overrides provider endpoints for testing. Returns a restore function.

func ValidateSecretName

func ValidateSecretName(name string) error

Types

type AuditAppender

type AuditAppender interface {
	Append(record audit.AuditRecord) error
}

type Broker

type Broker struct {
	// contains filtered or unexported fields
}

Broker is the sole credential access path for agent workloads. SecretStore instances must not be passed to agent code or any package outside the secrets broker; direct store.Get calls bypass revocation checks.

func NewBroker

func NewBroker(cfg BrokerConfig) (*Broker, error)

func (*Broker) DenyCredentialedRedirect

func (b *Broker) DenyCredentialedRedirect(ctx context.Context, runID, policyRuleID, destination, method string) error

func (*Broker) IsRevoked

func (b *Broker) IsRevoked(credentialID string) bool

func (*Broker) RequestCredential

func (b *Broker) RequestCredential(ctx context.Context, runID, policyRuleID, destination, method string) (CredentialInjection, error)

func (*Broker) RestartAffectedAgents

func (b *Broker) RestartAffectedAgents(_ context.Context, credentialID string) ([]string, error)

RestartAffectedAgents identifies active runs with direct leases for a revoked credential. Direct-lease revocation cannot claw back a secret value already visible to agent code; the daemon must decide how to restart affected runs.

func (*Broker) Revoke

func (b *Broker) Revoke(_ context.Context, credentialID string) error

func (*Broker) ValidateEgress

func (b *Broker) ValidateEgress(ctx context.Context, runID, destination, method string) error

type BrokerConfig

type BrokerConfig struct {
	Store              SecretStore
	Policy             *policy.Policy
	ActiveRuns         []string
	ActiveDirectLeases map[string][]string
	RuleMethods        map[string][]string
	Audit              AuditAppender
	Now                func() time.Time
	CredentialResolver CredentialResolver
	InstallRef         string
}

type CredentialInjection

type CredentialInjection struct {
	HeaderName  string `json:"-"`
	HeaderValue string `json:"-"`
}

func (CredentialInjection) Format

func (c CredentialInjection) Format(s fmt.State, _ rune)

func (CredentialInjection) GoString

func (c CredentialInjection) GoString() string

func (CredentialInjection) String

func (c CredentialInjection) String() string

type CredentialResolver added in v0.2.0

type CredentialResolver interface {
	Resolve(declaredID string) (localName string, ok bool)
}

CredentialResolver maps declared policy credential IDs to local secret store names. When Resolve returns ok=false, the credential is deferred/unmapped at install time.

type DirectLease

type DirectLease struct {
	// contains filtered or unexported fields
}

func NewDirectLease

func NewDirectLease(cfg DirectLeaseConfig) (*DirectLease, error)

func (*DirectLease) Lease

func (l *DirectLease) Lease(ctx context.Context, runID, credentialID, policyRuleID string) (LeaseHandle, error)

type DirectLeaseConfig

type DirectLeaseConfig struct {
	Store      SecretStore
	Policy     *policy.Policy
	ActiveRuns []string
	Audit      AuditAppender
	Now        func() time.Time
	LeaseDir   string
	AgentUID   int
}

type FakeKeyStore

type FakeKeyStore struct {
	// contains filtered or unexported fields
}

func NewFakeKeyStore

func NewFakeKeyStore() *FakeKeyStore

func (*FakeKeyStore) Delete

func (f *FakeKeyStore) Delete(_ context.Context, name string) error

func (*FakeKeyStore) Get

func (f *FakeKeyStore) Get(_ context.Context, name string) ([]byte, error)

func (*FakeKeyStore) List

func (f *FakeKeyStore) List(_ context.Context) ([]SecretMeta, error)

func (*FakeKeyStore) Set

func (f *FakeKeyStore) Set(_ context.Context, name string, value []byte) error

func (*FakeKeyStore) TouchLastUsed

func (f *FakeKeyStore) TouchLastUsed(_ context.Context, name string) error

type Gateway

type Gateway struct {
	// contains filtered or unexported fields
}

func NewGateway

func NewGateway(broker *Broker, client *http.Client) *Gateway

func (*Gateway) Do

func (g *Gateway) Do(ctx context.Context, request GatewayRequest) (*http.Response, error)

type GatewayRequest

type GatewayRequest struct {
	RunID        string
	PolicyRuleID string
	Method       string
	URL          string
	Body         io.Reader
}

type KeychainStore

type KeychainStore struct {
	// contains filtered or unexported fields
}

func NewKeychainStore

func NewKeychainStore(service string) (*KeychainStore, error)

func (*KeychainStore) Delete

func (k *KeychainStore) Delete(ctx context.Context, name string) error

func (*KeychainStore) Get

func (k *KeychainStore) Get(ctx context.Context, name string) ([]byte, error)

func (*KeychainStore) List

func (k *KeychainStore) List(ctx context.Context) ([]SecretMeta, error)

func (*KeychainStore) Set

func (k *KeychainStore) Set(ctx context.Context, name string, value []byte) error

func (*KeychainStore) TouchLastUsed

func (k *KeychainStore) TouchLastUsed(ctx context.Context, name string) error

type LeaseHandle

type LeaseHandle struct {
	FilePath string `json:"-"`
	// contains filtered or unexported fields
}

func (LeaseHandle) Cleanup

func (h LeaseHandle) Cleanup() error

func (LeaseHandle) Format

func (h LeaseHandle) Format(s fmt.State, _ rune)

func (LeaseHandle) GoString

func (h LeaseHandle) GoString() string

func (LeaseHandle) MarshalJSON

func (h LeaseHandle) MarshalJSON() ([]byte, error)

func (LeaseHandle) String

func (h LeaseHandle) String() string

type MapCredentialResolver added in v0.2.0

type MapCredentialResolver struct {
	Map map[string]string
}

MapCredentialResolver resolves using an install manifest credential_map.

func (MapCredentialResolver) Resolve added in v0.2.0

func (m MapCredentialResolver) Resolve(declaredID string) (string, bool)

Resolve implements CredentialResolver.

type ProviderTestResult

type ProviderTestResult struct {
	Provider   string `json:"provider"`
	Endpoint   string `json:"endpoint"`
	Status     string `json:"status"` // "ok" or "error"
	HTTPStatus int    `json:"http_status"`
	Detail     string `json:"detail"`
}

ProviderTestResult holds the result of a provider credential test.

func TestProvider

func TestProvider(ctx context.Context, provider string, secretValue []byte) ProviderTestResult

TestProvider makes a trivial authenticated call to validate a credential. It NEVER includes the secretValue in the result.

type SecretMeta

type SecretMeta struct {
	Name       string
	CreatedAt  time.Time
	UpdatedAt  time.Time
	LastUsedAt time.Time
}

type SecretStore

type SecretStore interface {
	Set(ctx context.Context, name string, value []byte) error
	Get(ctx context.Context, name string) ([]byte, error)
	List(ctx context.Context) ([]SecretMeta, error)
	Delete(ctx context.Context, name string) error
	TouchLastUsed(ctx context.Context, name string) error
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL