Documentation
¶
Overview ¶
Package credentials owns encrypted provider credentials and their durable repository.
Index ¶
Constants ¶
const ( // ProviderCredentialStorageSchemaVersion identifies the only credential schema. ProviderCredentialStorageSchemaVersion = 1 // ProviderCredentialStoragePrefix is the credential v1 namespace. ProviderCredentialStoragePrefix = "credentials:v1:" )
Variables ¶
var ( // ErrInvalidScope reports an invalid provider-credential owner scope. ErrInvalidScope = errors.New("invalid credential scope") // ErrInvalidProvider reports an empty provider identity. ErrInvalidProvider = errors.New("invalid provider") // ErrMissingCredential reports an empty encrypted credential value. ErrMissingCredential = errors.New("missing encrypted credential") )
var ( // ErrRepositoryRequired reports an absent credential storage adapter. ErrRepositoryRequired = errors.New("credential storage is required") // ErrNotFound reports an absent provider credential. ErrNotFound = errors.New("provider credential not found") // ErrConflict reports a provider-credential revision conflict. ErrConflict = errors.New("provider credential revision conflict") // ErrCorruptRecord reports invalid durable credential data. ErrCorruptRecord = errors.New("provider credential record is invalid") // ErrIdentityImmutable reports an attempted scope or provider change. ErrIdentityImmutable = errors.New("provider credential identity is immutable") )
Functions ¶
func DeriveKeyFromPassword ¶
DeriveKeyFromPassword derives a master key from a password using Argon2
func GenerateMasterKey ¶
GenerateMasterKey generates a new random master key
func ScopePrefix ¶
ScopePrefix returns the canonical scan prefix for one credential scope.
func StorageKey ¶
StorageKey returns the canonical key for one scoped provider credential.
Types ¶
type EncryptionService ¶
type EncryptionService struct {
// contains filtered or unexported fields
}
EncryptionService provides encryption and decryption for sensitive data
func NewEncryptionService ¶
func NewEncryptionService(masterKey []byte) (*EncryptionService, error)
NewEncryptionService creates a new encryption service with the provided master key
func (*EncryptionService) DecryptCredential ¶
func (s *EncryptionService) DecryptCredential(encrypted string) (string, error)
DecryptCredential decrypts a credential encrypted with EncryptCredential
func (*EncryptionService) EncryptCredential ¶
func (s *EncryptionService) EncryptCredential(plaintext string) (string, error)
EncryptCredential encrypts a credential using AES-256-GCM with Argon2 key derivation
type ProviderKey ¶
type ProviderKey struct {
Scope string `json:"scope"`
Provider string `json:"provider"`
EncryptedCredential string `json:"encrypted_credential"`
Config map[string]any `json:"config,omitempty"`
IsFallback bool `json:"is_fallback"`
Priority int `json:"priority"`
RateLimit *RateLimitConfig `json:"rate_limit,omitempty"`
CreatedAt time.Time `json:"created_at"`
LastUsed *time.Time `json:"last_used,omitempty"`
UsageCount int64 `json:"usage_count"`
UpdatedAt time.Time `json:"updated_at"`
}
ProviderKey is one encrypted external provider credential.
func (ProviderKey) IsGlobal ¶
func (k ProviderKey) IsGlobal() bool
IsGlobal reports whether the credential is gateway-wide.
func (ProviderKey) Validate ¶
func (k ProviderKey) Validate() error
Validate checks provider-credential invariants.
type RateLimitConfig ¶
type RateLimitConfig struct {
RequestsPerMinute int `json:"requests_per_minute"`
TokensPerMinute int `json:"tokens_per_minute"`
}
RateLimitConfig defines optional provider-credential limits.
type Record ¶
type Record struct {
Revision uint64
Key ProviderKey
}
Record is one versioned provider-credential repository value.
type Repository ¶
type Repository interface {
Create(context.Context, ProviderKey) (Record, error)
Get(context.Context, string, string) (Record, error)
ListScope(context.Context, string, int) ([]Record, error)
ListAll(context.Context, int) ([]Record, error)
Update(context.Context, ProviderKey, uint64) (Record, error)
Delete(context.Context, string, string, uint64) error
}
Repository is the durable provider-credential contract.
Source Files