Documentation
¶
Overview ¶
Package secrets provides SecretStore implementations for local profile secrets.
Index ¶
- Constants
- Variables
- func ReadLease(_ context.Context, handle LeaseHandle) ([]byte, error)
- func SetTestEndpoints(openAI, anthropic, xai string) func()
- func ValidateSecretName(name string) error
- type AuditAppender
- type Broker
- func (b *Broker) DenyCredentialedRedirect(ctx context.Context, runID, policyRuleID, destination, method string) error
- func (b *Broker) IsRevoked(credentialID string) bool
- func (b *Broker) RequestCredential(ctx context.Context, runID, policyRuleID, destination, method string) (CredentialInjection, error)
- func (b *Broker) RestartAffectedAgents(_ context.Context, credentialID string) ([]string, error)
- func (b *Broker) Revoke(_ context.Context, credentialID string) error
- func (b *Broker) ValidateEgress(ctx context.Context, runID, destination, method string) error
- type BrokerConfig
- type CredentialInjection
- type CredentialResolver
- type DirectLease
- type DirectLeaseConfig
- type FakeKeyStore
- func (f *FakeKeyStore) Delete(_ context.Context, name string) error
- func (f *FakeKeyStore) Get(_ context.Context, name string) ([]byte, error)
- func (f *FakeKeyStore) List(_ context.Context) ([]SecretMeta, error)
- func (f *FakeKeyStore) Set(_ context.Context, name string, value []byte) error
- func (f *FakeKeyStore) TouchLastUsed(_ context.Context, name string) error
- type Gateway
- type GatewayRequest
- type KeychainStore
- func (k *KeychainStore) Delete(ctx context.Context, name string) error
- func (k *KeychainStore) Get(ctx context.Context, name string) ([]byte, error)
- func (k *KeychainStore) List(ctx context.Context) ([]SecretMeta, error)
- func (k *KeychainStore) Set(ctx context.Context, name string, value []byte) error
- func (k *KeychainStore) TouchLastUsed(ctx context.Context, name string) error
- type LeaseHandle
- type MapCredentialResolver
- type ProviderTestResult
- type SecretMeta
- type SecretStore
Constants ¶
const MaxSecretValueSize = 64 * 1024
Variables ¶
var ( ErrInvalidSecretName = errors.New("invalid secret name") ErrSecretTooLarge = errors.New("secret value too large") ErrSecretNotFound = errors.New("secret not found") // ErrCredentialUnmapped is returned when a declared brokered credential has no install-time map entry. ErrCredentialUnmapped = errors.New("credential unmapped") )
Functions ¶
func SetTestEndpoints ¶
func SetTestEndpoints(openAI, anthropic, xai string) func()
SetTestEndpoints overrides provider endpoints for testing. Returns a restore function.
func ValidateSecretName ¶
Types ¶
type AuditAppender ¶
type AuditAppender interface {
Append(record audit.AuditRecord) error
}
type Broker ¶
type Broker struct {
// contains filtered or unexported fields
}
Broker is the sole credential access path for agent workloads. SecretStore instances must not be passed to agent code or any package outside the secrets broker; direct store.Get calls bypass revocation checks.
func NewBroker ¶
func NewBroker(cfg BrokerConfig) (*Broker, error)
func (*Broker) DenyCredentialedRedirect ¶
func (*Broker) RequestCredential ¶
func (*Broker) RestartAffectedAgents ¶
RestartAffectedAgents identifies active runs with direct leases for a revoked credential. Direct-lease revocation cannot claw back a secret value already visible to agent code; the daemon must decide how to restart affected runs.
type BrokerConfig ¶
type BrokerConfig struct {
Store SecretStore
Policy *policy.Policy
ActiveRuns []string
ActiveDirectLeases map[string][]string
RuleMethods map[string][]string
Audit AuditAppender
Now func() time.Time
CredentialResolver CredentialResolver
InstallRef string
}
type CredentialInjection ¶
func (CredentialInjection) GoString ¶
func (c CredentialInjection) GoString() string
func (CredentialInjection) String ¶
func (c CredentialInjection) String() string
type CredentialResolver ¶ added in v0.2.0
CredentialResolver maps declared policy credential IDs to local secret store names. When Resolve returns ok=false, the credential is deferred/unmapped at install time.
type DirectLease ¶
type DirectLease struct {
// contains filtered or unexported fields
}
func NewDirectLease ¶
func NewDirectLease(cfg DirectLeaseConfig) (*DirectLease, error)
func (*DirectLease) Lease ¶
func (l *DirectLease) Lease(ctx context.Context, runID, credentialID, policyRuleID string) (LeaseHandle, error)
type DirectLeaseConfig ¶
type DirectLeaseConfig struct {
Store SecretStore
Policy *policy.Policy
ActiveRuns []string
Audit AuditAppender
Now func() time.Time
LeaseDir string
AgentUID int
}
type FakeKeyStore ¶
type FakeKeyStore struct {
// contains filtered or unexported fields
}
func NewFakeKeyStore ¶
func NewFakeKeyStore() *FakeKeyStore
func (*FakeKeyStore) List ¶
func (f *FakeKeyStore) List(_ context.Context) ([]SecretMeta, error)
func (*FakeKeyStore) TouchLastUsed ¶
func (f *FakeKeyStore) TouchLastUsed(_ context.Context, name string) error
type GatewayRequest ¶
type KeychainStore ¶
type KeychainStore struct {
// contains filtered or unexported fields
}
func NewKeychainStore ¶
func NewKeychainStore(service string) (*KeychainStore, error)
func (*KeychainStore) Delete ¶
func (k *KeychainStore) Delete(ctx context.Context, name string) error
func (*KeychainStore) List ¶
func (k *KeychainStore) List(ctx context.Context) ([]SecretMeta, error)
func (*KeychainStore) TouchLastUsed ¶
func (k *KeychainStore) TouchLastUsed(ctx context.Context, name string) error
type LeaseHandle ¶
type LeaseHandle struct {
FilePath string `json:"-"`
// contains filtered or unexported fields
}
func (LeaseHandle) Cleanup ¶
func (h LeaseHandle) Cleanup() error
func (LeaseHandle) GoString ¶
func (h LeaseHandle) GoString() string
func (LeaseHandle) MarshalJSON ¶
func (h LeaseHandle) MarshalJSON() ([]byte, error)
func (LeaseHandle) String ¶
func (h LeaseHandle) String() string
type MapCredentialResolver ¶ added in v0.2.0
MapCredentialResolver resolves using an install manifest credential_map.
type ProviderTestResult ¶
type ProviderTestResult struct {
Provider string `json:"provider"`
Endpoint string `json:"endpoint"`
Status string `json:"status"` // "ok" or "error"
HTTPStatus int `json:"http_status"`
Detail string `json:"detail"`
}
ProviderTestResult holds the result of a provider credential test.
func TestProvider ¶
func TestProvider(ctx context.Context, provider string, secretValue []byte) ProviderTestResult
TestProvider makes a trivial authenticated call to validate a credential. It NEVER includes the secretValue in the result.