Documentation
¶
Overview ¶
Package secrets orchestrates encrypted secret storage, retrieval, and synchronisation with the cloud API.
Index ¶
- type DiffResult
- type EnvManager
- type SecretMetadata
- type Service
- func (s *Service) BatchSet(kv map[string]string, environment string) error
- func (s *Service) BatchSetLocal(kv map[string]string, env string) error
- func (s *Service) Delete(key string) error
- func (s *Service) Diff(fromEnv, toEnv string) (*DiffResult, error)
- func (s *Service) Get(key string) (string, error)
- func (s *Service) List() ([]SecretMetadata, error)
- func (s *Service) ListForEnv(env string) ([]SecretMetadata, error)
- func (s *Service) Pull(targetKeys []string) error
- func (s *Service) Push() error
- func (s *Service) Set(key, value string) error
- func (s *Service) UpdateEnvExample() error
- func (s *Service) UpdateEnvExampleFromLocal() error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type DiffResult ¶
type DiffResult struct {
Added []string // Keys only in .env
Removed []string // Keys only in Cloud
Changed map[string][2]string // Key -> [LocalVal, CloudVal]
Unchanged []string
}
DiffResult holds the differences between local and cloud secrets.
type EnvManager ¶
EnvManager handles reading and writing .env files while preserving comments.
func NewEnvManager ¶
func NewEnvManager() *EnvManager
NewEnvManager creates a manager for the current project using the resolved environment.
func (*EnvManager) Delete ¶
func (m *EnvManager) Delete(key string) error
Delete removes a key from the environment file.
func (*EnvManager) Read ¶
func (m *EnvManager) Read() (map[string]string, error)
Read returns all secrets from the .env file as a map.
func (*EnvManager) Write ¶
func (m *EnvManager) Write(newSecrets map[string]string) error
Write merges the provided secrets into the environment-specific .env file.
func (*EnvManager) WriteEnvExample ¶ added in v1.1.2
func (m *EnvManager) WriteEnvExample(content string) error
WriteEnvExample overwrites the .env.example file with the exact provided content.
type SecretMetadata ¶
type SecretMetadata struct {
Key string `json:"key"`
Value string `json:"value,omitempty"` // Encrypted value
UpdatedAt string `json:"updated_at"`
}
SecretMetadata holds the secret metadata from the API.
type Service ¶
type Service struct {
API *api.Client
Env *EnvManager
}
Service coordinates all secret-related operations.
func NewService ¶
NewService creates a new secrets service.
func (*Service) BatchSet ¶
BatchSet adds or updates multiple secrets in a single API call. If environment is empty, it uses the currently resolved environment.
func (*Service) BatchSetLocal ¶ added in v1.1.2
BatchSetLocal updates local storage (keychain and .env) without calling the API. Used during merge/copy flows if needed, or by Pull.
func (*Service) Diff ¶
func (s *Service) Diff(fromEnv, toEnv string) (*DiffResult, error)
Diff returns the differences between a source and a target. If fromEnv is "", source is local (.env or keychain). If toEnv is "", target is cloud active environment.
func (*Service) List ¶
func (s *Service) List() ([]SecretMetadata, error)
List returns all secret keys for the project in the active environment.
func (*Service) ListForEnv ¶ added in v1.1.2
func (s *Service) ListForEnv(env string) ([]SecretMetadata, error)
ListForEnv returns all secret keys for the project in the specified environment.
func (*Service) Pull ¶
Pull downloads secrets from the cloud and updates .env + Keychain. If targetKeys is nil, all secrets are pulled. If targetKeys is non-nil (even if empty), only those specific keys are pulled.
func (*Service) UpdateEnvExample ¶ added in v1.1.2
UpdateEnvExample fetches secrets across development, staging, and production and regenerates .env.example with correct environment scopes.
func (*Service) UpdateEnvExampleFromLocal ¶ added in v1.2.0
UpdateEnvExampleFromLocal generates .env.example using locally cached key names. It reads from the keyring index, requiring zero API calls.
Source Files