Documentation
¶
Overview ¶
Package credstore persists secrets for the OpenObserve tools. It prefers the OS keychain and transparently falls back to a protected file under the config directory when no keychain is available.
It lives in pkg/ because the CLI and the o3 desktop app must agree byte for byte on where a credential is kept: they share one keychain service name and one fallback file, so a credential saved by either is found by the other. o3 previously called the keychain directly with no fallback, which let the two diverge on hosts without a usable keychain.
Index ¶
Constants ¶
const ( BackendKeychain = "keychain" BackendFile = "file" )
Backend names reported by Save.
Variables ¶
var ErrSecretNotFound = errors.New("secret not found")
ErrSecretNotFound is returned by a Store when no secret exists for an account.
Functions ¶
This section is empty.
Types ¶
type Backend ¶
type Backend interface {
Get(service, account string) (string, error)
Set(service, account, secret string) error
Delete(service, account string) error
}
Backend is the OS keychain a Store writes to. Exported so callers can supply a stub in tests; NewStore wires the real one.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store persists secrets, preferring the OS keychain over its file fallback. Windows encrypts the fallback with per-user DPAPI; other platforms write a 0600 file.
func NewStoreWithBackend ¶
NewStoreWithBackend returns a Store using the supplied keychain backend.
func (*Store) Delete ¶
Delete removes the secret for account from both backends. Missing entries are not an error.
type StoreAccessError ¶
StoreAccessError means the credential store could not be inspected. It is intentionally distinct from ErrSecretNotFound: a caller must not tell the user to reconfigure credentials when a sandbox merely hid the keychain.
func (*StoreAccessError) Error ¶
func (e *StoreAccessError) Error() string
func (*StoreAccessError) Unwrap ¶
func (e *StoreAccessError) Unwrap() error
Source Files