secrets

type Binding struct {
	Scope string
	Owner string
	Key   string
}

type BindingStatus struct {
	Total  int
	Bound  int
	Legacy int
}

type DEKRotateAllResult struct {
	RunID       string
	Resumed     bool
	Total       int
	Rotated     int
	Skipped     int
	FailedCount int
	Failed      []DEKRotateFailure
	// Complete is false when the pass was cancelled before it finished; a
	// rerun resumes it.
	Complete bool
}

type DEKRotateFailure struct {
	Service string
	Reason  string
}

type DEKRotateResult struct {
	Service   string
	Values    int
	RotatedAt time.Time
}

type DEKRotationStore interface {
	ListServiceDEKStatus(ctx context.Context) ([]store.ServiceDEKStatus, error)
	RotateServiceDEK(ctx context.Context, serviceName string, at time.Time,
		rewrite func(wrapped []byte, rows []store.SecretCiphertext) ([]byte, [][]byte, error)) (int, error)
	LatestDEKRotationRun(ctx context.Context) (store.DEKRotationRun, bool, error)
	CreateDEKRotationRun(ctx context.Context, r store.DEKRotationRun) error
	UpdateDEKRotationRun(ctx context.Context, r store.DEKRotationRun) error
}

type DEKRotator struct {
	// contains filtered or unexported fields
}

type DEKStatus struct {
	Services []ServiceKeyStatus
	LastRun  *store.DEKRotationRun
}

type KeyWrapper interface {
	// Name identifies the backend inside the wrapped blob.
	Name() string
	Wrap(ctx context.Context, plaintext []byte) (string, error)
	Unwrap(ctx context.Context, ciphertext string) ([]byte, error)
}

type Manager struct {
	// contains filtered or unexported fields
}

type ManagerOption func(*Manager)

type MasterKey struct {
	// contains filtered or unexported fields
}

type RebindFailure struct {
	Owner  string
	Key    string
	Reason string
}

type RebindResult struct {
	Scanned      int
	Rebound      int
	AlreadyBound int
	// Changed counts rows rewritten by someone else mid-run; a concurrent
	// SetValue always writes the bound format, so nothing is lost.
	Changed     int
	FailedCount int
	Failed      []RebindFailure
	Remaining   int
}

type ServiceKeyStatus struct {
	Service    string
	CreatedAt  time.Time
	RotatedAt  time.Time
	ValueCount int
	AgeDays    int
}

type Store interface {
	GetServiceDEK(ctx context.Context, serviceName string) ([]byte, error)
	SaveServiceDEK(ctx context.Context, serviceName string, wrappedDEK []byte) error
	GetSecretValue(ctx context.Context, serviceName, envKey string) ([]byte, error)
	SaveSecretValue(ctx context.Context, serviceName, envKey string, ciphertext []byte) error
	HasSecretValue(ctx context.Context, serviceName, envKey string) (bool, error)
	HasSecretValueForServices(ctx context.Context, serviceNames []string, envKey string) (map[string]bool, error)
	DeleteServiceSecrets(ctx context.Context, serviceName string) error
	DeleteSecretValue(ctx context.Context, serviceName, envKey string) (bool, error)
	ListSecretKeys(ctx context.Context, serviceName string) ([]store.SecretKeyInfo, error)
	GetSecretKeyLocked(ctx context.Context, serviceName, envKey string) (exists, locked bool, err error)
	SetSecretLocked(ctx context.Context, serviceName, envKey string, locked bool) error
	// RotateServiceDEKs rewraps every stored DEK in one transaction; any
	// rewrap error rolls the whole rotation back.
	RotateServiceDEKs(ctx context.Context, rewrap func(serviceName string, wrapped []byte) ([]byte, error)) error
	GetMasterKeyRotatedAt(ctx context.Context) (rotatedAt time.Time, ok bool, err error)
	CountSecretValuesByPrefix(ctx context.Context, prefix []byte) (total, withPrefix int, err error)
	ListSecretCiphertexts(ctx context.Context, afterService, afterKey string, limit int) ([]store.SecretCiphertext, error)
	// ReplaceSecretCiphertext swaps old for replacement only while the row
	// still holds old, so a concurrent SetValue is never clobbered.
	ReplaceSecretCiphertext(ctx context.Context, serviceName, envKey string, old, replacement []byte) (bool, error)
}

type VaultTransit struct {
	Addr      string
	Token     string
	Key       string
	Mount     string
	Namespace string
	Client    *http.Client
}

type WrappedDEK []byte