credentials

func BuildAzureFederatedCredential ¶

func BuildAzureFederatedCredential(
	signer oidc.Signer,
	issuerURL string,
	tenantID string,
	clientID string,
) (azcore.TokenCredential, error)

BuildAzureFederatedCredential returns an azcore.TokenCredential that authenticates to Azure AD using a federated identity credential. On each call it mints a fresh JWT using the provided Signer, sets its issuer to the CUDly deployment URL, and hands it to azidentity.NewClientAssertionCredential which handles the actual exchange with the Azure token endpoint.

The target Azure AD app registration must have a federated identity credential configured with:

issuer   = <issuerURL>
subject  = cudly-controller
audience = api://AzureADTokenExchange

— all three are checked by Azure AD when validating the assertion.

No private key, cert, or client secret is stored anywhere — the signing happens inside the cloud KMS the Signer wraps.

func BuildGCPFederatedCredential ¶

func BuildGCPFederatedCredential(
	ctx context.Context,
	signer oidc.Signer,
	issuerURL string,
	audience string,
	serviceAccountEmail string,
) (oauth2.TokenSource, error)

BuildGCPFederatedCredential returns an oauth2.TokenSource that authenticates to GCP using a federated Workload Identity Pool provider bound to CUDly's OIDC issuer. Each call to Token() mints a fresh KMS-signed JWT, exchanges it at sts.googleapis.com for a GCP federated token, then impersonates the target service account via iamcredentials.googleapis.com to get an access token scoped to cloud-platform.

No service-account key JSON or any other long-lived secret is stored or read by this path — the signing happens inside the cloud KMS the Signer wraps.

func Decrypt ¶

func Decrypt(key []byte, blob string) ([]byte, error)

Decrypt reverses Encrypt. Returns the original plaintext.

func DevKey ¶

func DevKey() []byte

DevKey returns the all-zero 32-byte dev key. Exposed for the rekey migration command (cmd/rekey) which needs to detect rows encrypted under it without going through the LoadKey env-var path.

func Encrypt ¶

func Encrypt(key, plaintext []byte) (string, error)

Encrypt encrypts plaintext using AES-256-GCM. Returns a string in the format "<base64url(nonce)>.<base64url(ciphertext)>".

func LoadKey ¶

func LoadKey(ctx context.Context, resolver secrets.Resolver) (key []byte, source string, err error)

LoadKey loads the 32-byte AES-256 key for tenant credential encryption. First non-empty wins, in this order:

1. CREDENTIAL_ENCRYPTION_KEY_SECRET_ARN → resolver.GetSecret(arn) (AWS)
2. CREDENTIAL_ENCRYPTION_KEY_SECRET_NAME → resolver.GetSecret(name) (Azure)
3. CREDENTIAL_ENCRYPTION_KEY_SECRET_ID → resolver.GetSecret(id) (GCP)
4. CREDENTIAL_ENCRYPTION_KEY → raw 64-char hex

If none are set, returns ErrNoKey unless CREDENTIAL_ENCRYPTION_ALLOW_DEV_KEY=1 is set (in which case the all-zero dev key is returned with a loud warning).

The returned source string is the env var name that resolved (for logging). Callers MUST NOT log the key value.

Result is memoized via sync.Once for the process lifetime; tests reset the cache via resetKeyCacheForTest() in this package's test files.

func ResolveAWSCredentialProvider ¶

func ResolveAWSCredentialProvider(
	ctx context.Context,
	account *config.CloudAccount,
	store CredentialStore,
	stsClient STSClient,
) (aws.CredentialsProvider, error)

ResolveAWSCredentialProvider is a back-compat wrapper that calls ResolveAWSCredentialProviderWithOpts with empty options. New callers should use the WithOpts variant so bastion mode can self-resolve.

func ResolveAWSCredentialProviderWithOpts ¶

func ResolveAWSCredentialProviderWithOpts(
	ctx context.Context,
	account *config.CloudAccount,
	store CredentialStore,
	stsClient STSClient,
	opts AWSResolveOptions,
) (aws.CredentialsProvider, error)

ResolveAWSCredentialProviderWithOpts returns an aws.CredentialsProvider for the account.

Logic per auth mode:

• access_keys: load stored key pair → static credentials provider
• role_arn: use ambient (instance role / env) → STS AssumeRole
• bastion: load bastion account creds → STS AssumeRole into target (requires opts.AccountLookup + opts.STSClientFactory)
• workload_identity_federation: token file → STS AssumeRoleWithWebIdentity

func ResolveAzureTokenCredential ¶

func ResolveAzureTokenCredential(
	ctx context.Context,
	account *config.CloudAccount,
	store CredentialStore,
) (azcore.TokenCredential, error)

ResolveAzureTokenCredential is a convenience wrapper that passes zero-valued options to ResolveAzureTokenCredentialWithOpts. Since the legacy cert-based WIF path has been removed, this entry point can only resolve client_secret and managed_identity accounts — WIF accounts require opts.Signer + IssuerURL via the With-opts variant.

func ResolveAzureTokenCredentialWithOpts ¶

func ResolveAzureTokenCredentialWithOpts(
	ctx context.Context,
	account *config.CloudAccount,
	store CredentialStore,
	opts AzureResolveOptions,
) (azcore.TokenCredential, error)

ResolveAzureTokenCredentialWithOpts is like ResolveAzureTokenCredential but accepts per-deployment options. For workload_identity_federation accounts, AzureResolveOptions.Signer and .IssuerURL must both be set so BuildAzureFederatedCredential can mint the KMS-signed client assertion Azure AD expects — there is no fallback path.

Routes by AzureAuthMode:

• managed_identity → ManagedIdentityCredential (no stored cred needed)
• workload_identity_federation → federated credential via opts.Signer
• client_secret (default) → loads stored secret and returns ClientSecretCredential

func ResolveGCPCredentials ¶

func ResolveGCPCredentials(ctx context.Context, account *config.CloudAccount, store CredentialStore) ([]byte, error)

ResolveGCPCredentials decrypts and returns the GCP service account JSON for the account.

func ResolveGCPTokenSource ¶

func ResolveGCPTokenSource(ctx context.Context, account *config.CloudAccount, store CredentialStore) (oauth2.TokenSource, error)

ResolveGCPTokenSource is the legacy entry point — calls ResolveGCPTokenSourceWithOpts with zero-valued options so existing cert-based / stored-JSON accounts keep working.

func ResolveGCPTokenSourceWithOpts ¶

func ResolveGCPTokenSourceWithOpts(
	ctx context.Context,
	account *config.CloudAccount,
	store CredentialStore,
	opts GCPResolveOptions,
) (oauth2.TokenSource, error)

ResolveGCPTokenSourceWithOpts is like ResolveGCPTokenSource but accepts per-deployment options. When opts.Signer and opts.IssuerURL are both set, accounts in workload_identity_federation mode with a gcp_wif_audience field and no stored JSON config are routed through BuildGCPFederatedCredential (the secret-free path). Existing stored-JSON accounts keep working.

Routes by GCPAuthMode:

• application_default → returns (nil, nil); caller uses ADC.
• workload_identity_federation → federated (if no stored cred and signer+issuer+audience present) or legacy stored-JSON.
• service_account_key (or empty) → stored-JSON path.

func VerifyHostAccount ¶

func VerifyHostAccount(ctx context.Context, account *config.CloudAccount, hostSTS CallerIdentityClient) error

VerifyHostAccount confirms account.ExternalID is the AWS account that hostSTS, an STS client signed with the host's ambient credentials, runs as. Every failure returns ErrNotHostAccount unwrapped; the detail goes to the log only.