Documentation
¶
Overview ¶
Package credentials is the management use case over the credential vault (secrets never enter logs): an operator stores per-engagement secrets (write-only) and lists or deletes them by NAME. The secret value is never returned, logged, or audited – only the SandboxRunner resolves plaintext, at execution time. Every mutation is recorded to the append-only audit log WITHOUT the value.
Index ¶
- type Service
- func (s *Service) Delete(ctx context.Context, actor string, engagementID shared.ID, name string) error
- func (s *Service) List(ctx context.Context, engagementID shared.ID) ([]ports.CredentialMeta, error)
- func (s *Service) Set(ctx context.Context, actor string, engagementID shared.ID, name string, ...) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service manages vault credentials (set/list/delete), audited.
func NewService ¶
func NewService(vault ports.CredentialVault, audit ports.AuditLogger, clock ports.Clock) (*Service, error)
NewService validates its dependencies and returns the service.
func (*Service) Delete ¶
func (s *Service) Delete(ctx context.Context, actor string, engagementID shared.ID, name string) error
Delete removes a credential by name. ErrNotFound if it does not exist.
Source Files
Click to show internal directories.
Click to hide internal directories.