secretconn

package
v1.0.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 13, 2026 License: Apache-2.0 Imports: 17 Imported by: 0

Documentation

Overview

Package secretconn manages named secret connections and adapts the Vault resolver and the Doppler, Infisical and 1Password providers to secretsource.Provider. The legacy single Vault row appears as the connection "vault" and legacy providers keep their names.

Index

Constants

View Source 
const (
	TypeVault       = "vault"
	TypeDoppler     = secretprovider.TypeDoppler
	TypeInfisical   = secretprovider.TypeInfisical
	TypeOnePassword = secretprovider.TypeOnePassword
)

Connection types.

View Source 
const LegacyVaultName = "vault"

LegacyVaultName is the implicit connection backed by the single Vault settings row.

View Source 
const SecretsOwner = "secretconnections" //nolint:gosec // namespace name, not a credential

SecretsOwner is the internal/secrets namespace holding stored connection credentials.

Variables

View Source 
var (
	ErrInvalid  = errors.New("secretconn: invalid connection")
	ErrConflict = errors.New("secretconn: connection name already in use")
	ErrNotFound = errors.New("secretconn: connection not found")
	ErrLegacy   = errors.New("secretconn: legacy connection is managed through its own settings")
)

Errors the API maps to status codes.

Functions

This section is empty.

Types

type Config 

type Config struct {
	Address     string `json:"address,omitempty"`
	Namespace   string `json:"namespace,omitempty"`
	Mount       string `json:"mount,omitempty"`
	AuthMethod  string `json:"auth_method,omitempty"`
	RoleID      string `json:"role_id,omitempty"`
	Project     string `json:"project,omitempty"`
	Environment string `json:"environment,omitempty"`
	Path        string `json:"path,omitempty"`
	BaseURL     string `json:"base_url,omitempty"`
}

Config holds the non-secret settings; which fields apply depends on Type.

type Connection 

type Connection struct {
	Name          string
	Type          string
	Legacy        bool
	Config        Config
	HasCredential bool
	CredentialRef string
	Policy        Policy
	CreatedBy     string
	CreatedAt     time.Time
	UpdatedAt     time.Time
}

Connection is one named source; it never carries a credential value.

type EnvIndex 

type EnvIndex interface {
	GetEnvironment(ctx context.Context, id string) (store.Environment, error)
	EnvironmentIDsByName(ctx context.Context, name string) ([]string, error)
}

EnvIndex looks environments up by id or name.

type Input 

type Input struct {
	Type          string
	Config        Config
	Credential    string
	CredentialRef string
	// A non nil list replaces that allow list; nil keeps it on update.
	AllowedPrefixes *[]string
	AllowedEnvs     *[]string
}

Input creates or updates a connection. Credential is write-only; empty keeps the stored one on update.

type PathProber 

type PathProber interface {
	ProbePath(ctx context.Context, path string) error
}

PathProber is the optional read-only check that a credential can reach one path.

type Policy 

type Policy struct {
	AllowedPrefixes []string `json:"allowed_prefixes,omitempty"`
	AllowedEnvs     []string `json:"allowed_envs,omitempty"`
	AllowedEnvIDs   []string `json:"allowed_env_ids,omitempty"`
}

Policy narrows what a connection serves. Prefixes are path prefixes on whole segments; Envs are the names or ids an operator typed, and EnvIDs are what they resolved to at save. Only ids are compared, since names are not unique. Both empty means no restriction.

func NormalizePolicy 

func NormalizePolicy(p Policy) (Policy, error)

NormalizePolicy validates and canonicalizes the lists: trimmed, deduplicated, sorted, prefixes without edge slashes. Invalid entries are rejected rather than repaired.

func (Policy) Delegable 

func (p Policy) Delegable() bool

Delegable reports whether the lists are complete enough to let a non root writer use the connection.

func (Policy) EnvAllowed 

func (p Policy) EnvAllowed(envID string) bool

EnvAllowed matches an environment id against the resolved ids; an unrestricted policy allows any.

func (Policy) IsZero 

func (p Policy) IsZero() bool

IsZero reports whether no allow list is set.

func (Policy) PathAllowed 

func (p Policy) PathAllowed(path string) bool

PathAllowed reports whether path equals a prefix or sits below it on a segment boundary, so "team-a" never admits "team-ab". An empty list allows any path.

type Prober 

type Prober interface {
	Probe(ctx context.Context) error
}

Prober is the optional read-only health check of a provider. It must not read a secret value and must not return one.

type Rows 

type Rows interface {
	ListSecretConnections(ctx context.Context) ([]store.SecretConnection, error)
	GetSecretConnection(ctx context.Context, name string) (store.SecretConnection, error)
	CreateSecretConnection(ctx context.Context, c store.SecretConnection) error
	UpdateSecretConnection(ctx context.Context, c store.SecretConnection) error
	DeleteSecretConnection(ctx context.Context, name string) error
}

Rows is the connection table.

type Service 

type Service struct {
	Rows     Rows
	Secrets  secretprovider.Secrets
	Vault    VaultSettings
	Sources  *secretsource.Resolver
	VaultRes *vault.Resolver
	ProvRes  *secretprovider.Resolver
	ProvTun  func(context.Context) secretprovider.Tunables
	// Envs resolves allowed_envs to environment ids; without it an env list cannot be saved or served.
	Envs EnvIndex
	Now  func() time.Time
	// Build overrides adapter construction, for tests only.
	Build func(Connection) secretsource.Provider
	// contains filtered or unexported fields
}

Service owns the connection set and keeps a secretsource.Resolver in step with it.

func (*Service) CheckResolve 

func (s *Service) CheckResolve(ctx context.Context, conn, envID, path string) error

CheckResolve is the resolve-time gate. A connection without a policy is unrestricted; one with a policy serves only listed environments and paths, and any lookup failure denies.

func (*Service) CheckUnvettedRef 

func (s *Service) CheckUnvettedRef(ctx context.Context, conn, envID, path string) error

CheckUnvettedRef gates a reference no actor vetted: only a delegating connection serves it.

func (*Service) Create 

func (s *Service) Create(ctx context.Context, actor, name string, in Input) (Connection, error)

Create stores a new named connection and registers it.

func (*Service) DelegatedRefAllowed 

func (s *Service) DelegatedRefAllowed(ctx context.Context, conn, envID, path string) bool

DelegatedRefAllowed is the set-time check for a writer without root: the connection must carry both lists, the environment id must be listed and the path must sit inside a prefix.

func (*Service) Delete 

func (s *Service) Delete(ctx context.Context, name string) error

Delete removes a stored connection, its stored credential and its registration.

func (*Service) Get 

func (s *Service) Get(ctx context.Context, name string) (Connection, error)

Get returns one connection by name.

func (*Service) List 

func (s *Service) List(ctx context.Context) ([]Connection, error)

List returns legacy connections first, then stored ones, each group sorted by name.

func (*Service) Sync 

func (s *Service) Sync(ctx context.Context) error

Sync makes the secretsource.Resolver match the current connections. Adapters read their config live, so a re-registration is only needed when a name appears or disappears.

func (*Service) Test 

func (s *Service) Test(ctx context.Context, name, path string) (TestResult, error)

Test runs the provider's read-only probe and reports a class, never provider output. Without a path it proves login only; a path adds a read-only access check.

func (*Service) Update 

func (s *Service) Update(ctx context.Context, name string, in Input) (Connection, error)

Update replaces config and optionally the credential; the type never changes.

type TestResult 

type TestResult struct {
	OK     bool
	Class  string
	Reason string
}

TestResult is the outcome of a health probe. Reason is a class, never provider output.

type VaultSettings 

type VaultSettings interface {
	GetVaultSettings(ctx context.Context) (store.VaultSettings, error)
}

VaultSettings reads the legacy single Vault row.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.