secrethandle

package
v0.2.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 4, 2026 License: MIT Imports: 8 Imported by: 0

Documentation

Overview

Package secrethandle implements the local-only plugin secret reference boundary. Server configuration carries only secret://<name> handles; plaintext is resolved on the target Edge for one tenant/instance and is never logged or persisted by this package.

Index

Constants

View Source 
const (
	Scheme          = "secret://"
	DefaultMaxBytes = 64 << 10
)

Variables

View Source 
var (
	ErrInvalidHandle      = errors.New("secrethandle: invalid handle")
	ErrUndeclaredSecret   = errors.New("secrethandle: secret is not declared by plugin")
	ErrUnsafeSecretPath   = errors.New("secrethandle: unsafe secret path")
	ErrInsecurePermission = errors.New("secrethandle: insecure secret file permission")
	ErrSecretTooLarge     = errors.New("secrethandle: secret exceeds size limit")
)

Functions

func ValidateDeclared 

func ValidateDeclared(h Handle, declared []string) error

ValidateDeclared requires a matching manifest permissions.secrets entry.

Types

type FileProvider 

type FileProvider struct {
	Root     string
	MaxBytes int64
}

FileProvider resolves secrets from Root/<tenant>/<instance>/<name>. It does not cache plaintext. Callers should zero/discard the returned bytes promptly.

func (FileProvider) Resolve 

func (p FileProvider) Resolve(tenant, instance, rawHandle string, declared []string) ([]byte, error)

type Handle 

type Handle struct {
	// contains filtered or unexported fields
}

Handle is a validated secret://<name> reference. It never contains a value or path.

func Parse 

func Parse(raw string) (Handle, error)

Parse validates a stable secret name. Names are deliberately stricter than filesystem names so a handle can never encode a path or platform-specific trick.

func (Handle) Name 

func (h Handle) Name() string

func (Handle) String 

func (h Handle) String() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.