Documentation
¶
Index ¶
- Constants
- func Decrypt(masterIdentity *age.X25519Identity, encryptedPrivateKey string, ...) (string, error)
- func Encrypt(publicKeyStr string, plaintext string) (string, error)
- func GenerateMasterIdentity() (string, error)
- func GenerateUserKeys(masterRecipient *age.X25519Recipient) (string, string, error)
- func IsAgentScope(scope string) bool
- func ParseMasterIdentity(identityStr string) (*age.X25519Identity, *age.X25519Recipient, error)
- func ValidateName(name string) error
- type DB
- type EntryMeta
- type Service
- func (s *Service) DecryptSystem(ciphertext string) (string, error)
- func (s *Service) Delete(ctx context.Context, userID string, name string) error
- func (s *Service) DeleteScoped(ctx context.Context, scope string, userID string, agentID string, name string) error
- func (s *Service) DeleteSystemScoped(ctx context.Context, scope string, agentID string, name string) error
- func (s *Service) EncryptSystem(plaintext string) (string, error)
- func (s *Service) Get(ctx context.Context, userID string, name string) (string, error)
- func (s *Service) GetMeta(ctx context.Context, userID string, name string) (EntryMeta, error)
- func (s *Service) GetScoped(ctx context.Context, scope string, userID string, agentID string, name string) (string, error)
- func (s *Service) GetScopedMeta(ctx context.Context, scope string, userID string, agentID string, name string) (EntryMeta, error)
- func (s *Service) List(ctx context.Context, userID string) ([]EntryMeta, error)
- func (s *Service) ListScoped(ctx context.Context, scope string, userID string, agentID string) ([]EntryMeta, error)
- func (s *Service) ListSystemScoped(ctx context.Context, scope string, agentID string) ([]EntryMeta, error)
- func (s *Service) LoadEnv(ctx context.Context, userID string) (map[string]string, error)
- func (s *Service) LoadEnvForAgent(ctx context.Context, userID string, agentID string) (map[string]string, error)
- func (s *Service) MasterRecipient() *age.X25519Recipient
- func (s *Service) Set(ctx context.Context, userID string, name string, plaintext string) error
- func (s *Service) SetReserved(ctx context.Context, userID string, name string, plaintext string) error
- func (s *Service) SetScoped(ctx context.Context, scope string, userID string, agentID string, name string, ...) error
- func (s *Service) SetSystemScoped(ctx context.Context, scope string, agentID string, name string, ...) error
Constants ¶
const ( ScopeUser = "user" ScopeUserAgent = "user_agent" ScopeSystem = "system" ScopeSystemAgent = "system_agent" )
const StellaTokenName = "STELLA_TOKEN"
StellaTokenName is the per-user service token exposed to sandbox sessions.
Variables ¶
This section is empty.
Functions ¶
func Decrypt ¶
func Decrypt(masterIdentity *age.X25519Identity, encryptedPrivateKey string, ciphertext string) (string, error)
Decrypt decrypts ciphertext that was encrypted with a user's public key. First decrypts the user's private key using the master identity, then uses that private key to decrypt the ciphertext. masterIdentity: the server's master age identity encryptedPrivateKey: the user's age private key, encrypted with master ciphertext: the age-encrypted secret value
func Encrypt ¶
Encrypt encrypts plaintext using the given public key string. Returns armored ciphertext.
func GenerateMasterIdentity ¶ added in v0.35.2
func GenerateUserKeys ¶
func GenerateUserKeys(masterRecipient *age.X25519Recipient) (string, string, error)
GenerateUserKeys creates a new X25519 keypair for a user. The private key is encrypted with masterRecipient before returning. Returns (publicKeyString, encryptedPrivateKey, error). publicKeyString is the age public key string (age1...). encryptedPrivateKey is the armored age-encrypted private key.
func IsAgentScope ¶ added in v0.48.0
func ParseMasterIdentity ¶
func ParseMasterIdentity(identityStr string) (*age.X25519Identity, *age.X25519Recipient, error)
ParseMasterIdentity parses an age identity string (e.g. "AGE-SECRET-KEY-1...") and returns both the identity (for decryption) and its recipient (for encryption).
func ValidateName ¶
ValidateName checks that a vault entry name is a valid env var name and is not reserved.
Types ¶
type DB ¶
type DB interface {
GetVaultUser(ctx context.Context, id string) (sqlc.VaultUser, error)
GetVaultEntryByScope(ctx context.Context, arg sqlc.GetVaultEntryByScopeParams) (sqlc.VaultEntry, error)
ListVaultEntriesByScope(ctx context.Context, arg sqlc.ListVaultEntriesByScopeParams) ([]sqlc.VaultEntry, error)
ListVaultEntriesForRuntime(ctx context.Context, arg sqlc.ListVaultEntriesForRuntimeParams) ([]sqlc.VaultEntry, error)
UpsertVaultEntryByScope(ctx context.Context, arg sqlc.UpsertVaultEntryByScopeParams) error
DeleteVaultEntryByScope(ctx context.Context, arg sqlc.DeleteVaultEntryByScopeParams) error
}
DB is the minimal database interface the vault Service requires.
type EntryMeta ¶
type EntryMeta struct {
Scope string
UserID string
AgentID string
Name string
CreatedAt string
UpdatedAt string
}
EntryMeta holds non-sensitive metadata for a vault entry.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service provides vault operations: storing, retrieving, and decrypting secrets using user-level or system-level age encryption.
func NewService ¶
NewService creates a vault Service. masterIdentityStr is the raw age secret key string (typically from the STELLA_VAULT_KEY environment variable).
func (*Service) DecryptSystem ¶ added in v0.27.0
DecryptSystem decrypts ciphertext that was produced by EncryptSystem.
func (*Service) DeleteScoped ¶ added in v0.48.0
func (s *Service) DeleteScoped(ctx context.Context, scope string, userID string, agentID string, name string) error
DeleteScoped removes a user-owned vault entry by name and scope.
func (*Service) DeleteSystemScoped ¶ added in v0.48.0
func (s *Service) DeleteSystemScoped(ctx context.Context, scope string, agentID string, name string) error
DeleteSystemScoped removes an admin-managed vault entry by name and scope.
func (*Service) EncryptSystem ¶ added in v0.27.0
EncryptSystem encrypts plaintext with the master key for system-level storage (not tied to any user).
func (*Service) Get ¶
Get decrypts and returns the plaintext value of a single user-level vault entry by name.
func (*Service) GetMeta ¶ added in v0.38.0
GetMeta returns non-sensitive metadata for a single user-level vault entry by name.
func (*Service) GetScoped ¶ added in v0.48.0
func (s *Service) GetScoped(ctx context.Context, scope string, userID string, agentID string, name string) (string, error)
GetScoped decrypts and returns one scoped vault entry by name.
func (*Service) GetScopedMeta ¶ added in v0.48.0
func (s *Service) GetScopedMeta(ctx context.Context, scope string, userID string, agentID string, name string) (EntryMeta, error)
GetScopedMeta returns non-sensitive metadata for a single scoped vault entry by name.
func (*Service) ListScoped ¶ added in v0.48.0
func (s *Service) ListScoped(ctx context.Context, scope string, userID string, agentID string) ([]EntryMeta, error)
ListScoped returns metadata for all user-owned vault entries in one effective scope.
func (*Service) ListSystemScoped ¶ added in v0.48.0
func (s *Service) ListSystemScoped(ctx context.Context, scope string, agentID string) ([]EntryMeta, error)
ListSystemScoped returns metadata for admin-managed vault entries in one effective scope.
func (*Service) LoadEnv ¶
LoadEnv decrypts all user-level vault entries for userID and returns them as a name→plaintext map. Intended for backward-compatible callers.
func (*Service) LoadEnvForAgent ¶ added in v0.48.0
func (s *Service) LoadEnvForAgent(ctx context.Context, userID string, agentID string) (map[string]string, error)
LoadEnvForAgent resolves runtime env in the SQL precedence order; later scopes override earlier scopes.
func (*Service) MasterRecipient ¶
func (s *Service) MasterRecipient() *age.X25519Recipient
MasterRecipient returns the master public key recipient. It is used when generating new user key pairs.
func (*Service) Set ¶
Set validates name, encrypts plaintext with the user's public key, and upserts the user-level vault entry. The user must already have age keys provisioned.
func (*Service) SetReserved ¶ added in v0.36.1
func (s *Service) SetReserved(ctx context.Context, userID string, name string, plaintext string) error
SetReserved stores an internal reserved env var. Callers must not pass user input.
Source Files