Documentation
¶
Overview ¶
Package secretsource defines the single secret reference model (secret://conn/path#key), a Provider interface and a Resolver that routes by connection name. It imports only the standard library so existing providers can adapt to it without import cycles.
Index ¶
- Constants
- Variables
- func IsKind(err error) bool
- func IsRef(s string) bool
- func SetLimitsSource(f func() Limits)
- func ValidConnName(name string, maxLen int) error
- type Capabilities
- type FakeProvider
- func (f *FakeProvider) Calls() int
- func (f *FakeProvider) Capabilities() Capabilities
- func (f *FakeProvider) Deny(path string)
- func (f *FakeProvider) FailWith(err error)
- func (f *FakeProvider) Name() string
- func (f *FakeProvider) Resolve(_ context.Context, ref Ref) (Value, error)
- func (f *FakeProvider) Set(path, key, value string) *FakeProvider
- func (f *FakeProvider) SetVersion(path, key string, version int, value string) *FakeProvider
- type Lease
- type Limits
- type Provider
- type Redactor
- type Ref
- type RefSpec
- type Renewer
- type Resolver
- func (r *Resolver) Connections() []string
- func (r *Resolver) Provider(conn string) (Provider, bool)
- func (r *Resolver) Redactor() *Redactor
- func (r *Resolver) Register(conn string, p Provider) error
- func (r *Resolver) Renew(ctx context.Context, conn string, l Lease) (Lease, error)
- func (r *Resolver) Resolve(ctx context.Context, ref Ref) (Value, error)
- func (r *Resolver) Unregister(conn string)
- type Spec
- type Value
Constants ¶
const Mask = "[redacted]"
Mask replaces every registered value in output.
Variables ¶
var ( ErrInvalidRef = errors.New("secretsource: invalid reference") ErrNotFound = errors.New("secretsource: secret not found") ErrDenied = errors.New("secretsource: access denied") ErrFailClosed = errors.New("secretsource: failing closed, no value released") ErrUnknownConnection = errors.New("secretsource: unknown connection") ErrUnsupported = errors.New("secretsource: operation not supported") )
Sentinels are matched with errors.Is. Resolver wraps provider errors so callers always see one of these kinds.
Functions ¶
func SetLimitsSource ¶
func SetLimitsSource(f func() Limits)
SetLimitsSource makes the runtime settings the limit source; nil goes back to env.
func ValidConnName ¶
ValidConnName enforces [a-z0-9][a-z0-9_-]* up to max bytes.
Types ¶
type Capabilities ¶
type Capabilities struct {
Renew bool // provider implements Renewer
Versions bool // honors Ref.Version
Dynamic bool // returns leased values
}
Capabilities lets callers skip unsupported calls without probing.
type FakeProvider ¶
type FakeProvider struct {
// contains filtered or unexported fields
}
FakeProvider is an in-memory Provider for tests, including other packages.
func (*FakeProvider) Calls ¶
func (f *FakeProvider) Calls() int
Calls reports how many times Resolve ran.
func (*FakeProvider) Capabilities ¶
func (f *FakeProvider) Capabilities() Capabilities
Capabilities implements Provider.
func (*FakeProvider) Deny ¶
func (f *FakeProvider) Deny(path string)
Deny makes path return ErrDenied.
func (*FakeProvider) FailWith ¶
func (f *FakeProvider) FailWith(err error)
FailWith makes every Resolve return err (nil clears it).
func (*FakeProvider) Set ¶
func (f *FakeProvider) Set(path, key, value string) *FakeProvider
Set stores the latest value (version 0) for path and key.
func (*FakeProvider) SetVersion ¶
func (f *FakeProvider) SetVersion(path, key string, version int, value string) *FakeProvider
SetVersion stores a specific version; version 0 is the latest.
type Limits ¶
Limits caps reference parts. Zero fields fall back to env, then defaults.
func CurrentLimits ¶
func CurrentLimits() Limits
CurrentLimits is the live limit set: the runtime source when wired, else env then defaults.
func LimitsFromEnv ¶
func LimitsFromEnv() Limits
LimitsFromEnv reads APP_SECRETREF_MAX_{REF,CONN,PATH,SEGMENTS,KEY}, the seed for the runtime settings.
type Provider ¶
type Provider interface {
Name() string
Capabilities() Capabilities
Resolve(ctx context.Context, ref Ref) (Value, error)
}
Provider adapts one secret backend. Implementations should return the package sentinels (or wrap them) and never include secret values in errors.
type Redactor ¶
type Redactor struct {
// contains filtered or unexported fields
}
Redactor masks known secret values in strings and errors. Safe for concurrent use.
type Ref ¶
Ref points at one secret value in one named connection. It holds no value.
func ParseRefWith ¶
ParseRefWith parses against explicit limits. Errors never echo the input beyond a short reason, since a mistyped value may be a secret itself.
func (Ref) ValidateWith ¶
ValidateWith checks every part. Connection names are lowercase only, so two spellings can never name two connections. Paths and keys keep case.
type RefSpec ¶
type RefSpec struct {
Conn string `json:"conn" yaml:"conn"`
Path string `json:"path" yaml:"path"`
Key string `json:"key" yaml:"key"`
Version int `json:"version,omitempty" yaml:"version,omitempty"`
}
RefSpec carries the parts of the object form.
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver dispatches a Ref to the provider registered under its connection. It fails closed: no provider, an unclassified error or an empty value all yield an error and never a partial or default value.
func NewResolver ¶
func NewResolver() *Resolver
NewResolver returns an empty Resolver with its own Redactor.
func (*Resolver) Connections ¶
Connections lists registered connection names (unordered).
func (*Resolver) Register ¶
Register binds a connection name to a provider. Rebinding is rejected; call Unregister first so a swap is always deliberate.
func (*Resolver) Resolve ¶
Resolve validates ref, calls the provider and registers the value with the redactor. Errors carry the ref (never the value) and one sentinel kind.
func (*Resolver) Unregister ¶
Unregister removes a connection.
type Spec ¶
type Spec struct {
Secret RefSpec `json:"secret" yaml:"secret"`
}
Spec is the YAML/JSON object form: {secret: {conn, path, key, version}}.
Source Files