Help us shape the future of Go! Take the 2026 Go Developer Survey

ocivault

package
v1.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 27, 2026 License: MIT Imports: 45 Imported by: 0

README

OCI Vault

Parity grade: B · SDK github.com/oracle/oci-go-sdk/v65@v65.126.2 · last audited 2026-10-25 (8533cce14)

Coverage

Metric Value
PARITY entries audited 45 (27 ok, 18 partial)
Feature families 8 (7 ok, 1 partial)
Known gaps 11
Deferred items 0
Resource leaks unknown
Known gaps
  • Backup and restore of vaults and keys (BackupVault, BackupKey, RestoreVaultFromFile/ObjectStore, RestoreKeyFromFile/ObjectStore) are not routed.
  • Vault and key replication (CreateVaultReplica, DeleteVaultReplica, ListVaultReplicas, GetReplicationStatus), HSM clusters, EKMS private endpoints, external vaults and external keys, and UpdateRegisteredVaultForMtls are not implemented.
  • Secret rotation (RotateSecret, CancelSecretRotation, rotationConfig), secret replication, secret generation contexts and auto-generation are not implemented and requests carrying them are rejected.
  • HSM and SOFTWARE protection modes are both in-process software keys; HSM only differs by being non-exportable.
  • Create, schedule, cancel, enable and disable responses report the transitional lifecycle state but every transition completes synchronously; the transitional state is never observable on a later read.
  • The vault wrapping key is RSA 2048; the live service size, the plaintextChecksum algorithm (SHA-256 hex here) and the ECDSA signature encoding (ASN.1 DER here) are unverified.
  • Several error codes and statuses are unverified against the live service: 409 Conflict for a duplicate secret name, 404 for pending-deletion or expired secret retrieval, 409 IncorrectState for a disabled key.
  • opc-retry-token idempotency, service limits (keys per vault, secrets per tenancy) and IAM policy checks are not applied.
  • Per-vault endpoints rely on *.localhost resolving to loopback; hosts without that resolution need an /etc/hosts entry or the /_vault/ path form with a raw HTTP client.
  • Resource principal and instance principal tokens are not understood; only API-key signatures are verified.
  • Tag values and defined-tag namespaces are stored verbatim, not validated against a tag namespace.

More

Documentation

Index

Constants

View Source 
const DefaultPort = 8151

DefaultPort is the dedicated listener's default TCP port.

View Source 
const (
	// Region is the fixed region baked into emulated OCIDs.
	Region = "us-ashburn-1"
)

Variables

View Source 
var ErrNilAppContext = errors.New("ocivault: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

View Source 
var ErrSnapshotNull = errors.New("ocivault: null entry in snapshot")

ErrSnapshotNull is returned when a snapshot contains a null entry.

Functions

This section is empty.

Types

type APIError 

type APIError struct {
	Code    string
	Message string
	Status  int
}

APIError is an OCI error response: HTTP status plus the `code` and `message` body fields.

func (*APIError) Error 

func (e *APIError) Error() string

type BundleSelector 

type BundleSelector struct {
	VersionNumber *int64
	VersionName   string
	Stage         string
}

BundleSelector picks the secret version GetSecretBundle returns.

type ConfigProvider 

type ConfigProvider interface {
	GetOCIVaultSettings() Settings
}

ConfigProvider extracts OCI Vault configuration from the AppContext Config.

type CreateKeyIn 

type CreateKeyIn struct {
	FreeformTags           map[string]string         `json:"freeformTags"`
	DefinedTags            map[string]map[string]any `json:"definedTags"`
	AutoKeyRotationDetails *RotationDetails          `json:"autoKeyRotationDetails"`
	CompartmentID          string                    `json:"compartmentId"`
	DisplayName            string                    `json:"displayName"`
	ProtectionMode         string                    `json:"protectionMode"`
	KeyShape               KeyShape                  `json:"keyShape"`
	IsAutoRotationEnabled  bool                      `json:"isAutoRotationEnabled"`
}

CreateKeyIn is the CreateKey request body.

type CreateSecretIn 

type CreateSecretIn struct {
	FreeformTags            map[string]string         `json:"freeformTags"`
	DefinedTags             map[string]map[string]any `json:"definedTags"`
	Metadata                map[string]any            `json:"metadata"`
	SecretContent           *SecretContent            `json:"secretContent"`
	ReplicationConfig       json.RawMessage           `json:"replicationConfig"`
	RotationConfig          json.RawMessage           `json:"rotationConfig"`
	SecretGenerationContext json.RawMessage           `json:"secretGenerationContext"`
	EnableAutoGeneration    *bool                     `json:"enableAutoGeneration"`
	CompartmentID           string                    `json:"compartmentId"`
	KeyID                   string                    `json:"keyId"`
	SecretName              string                    `json:"secretName"`
	VaultID                 string                    `json:"vaultId"`
	Description             string                    `json:"description"`
	SecretRules             []json.RawMessage         `json:"secretRules"`
}

CreateSecretIn is the CreateSecret request body.

type CreateVaultIn 

type CreateVaultIn struct {
	FreeformTags  map[string]string         `json:"freeformTags"`
	DefinedTags   map[string]map[string]any `json:"definedTags"`
	CompartmentID string                    `json:"compartmentId"`
	DisplayName   string                    `json:"displayName"`
	VaultType     string                    `json:"vaultType"`
}

CreateVaultIn is the CreateVault request body.

type DecryptIn 

type DecryptIn struct {
	AssociatedData map[string]string `json:"associatedData"`
	KeyID          string            `json:"keyId"`
	Ciphertext     string            `json:"ciphertext"`
	KeyVersionID   string            `json:"keyVersionId"`
	Algorithm      string            `json:"encryptionAlgorithm"`
}

DecryptIn is the Decrypt request body.

type EncryptIn 

type EncryptIn struct {
	AssociatedData map[string]string `json:"associatedData"`
	KeyID          string            `json:"keyId"`
	Plaintext      string            `json:"plaintext"`
	KeyVersionID   string            `json:"keyVersionId"`
	Algorithm      string            `json:"encryptionAlgorithm"`
}

EncryptIn is the Encrypt request body.

type ExportIn 

type ExportIn struct {
	KeyID        string `json:"keyId"`
	Algorithm    string `json:"algorithm"`
	PublicKey    string `json:"publicKey"`
	KeyVersionID string `json:"keyVersionId"`
}

ExportIn is the ExportKey request body.

type GenerateDEKIn 

type GenerateDEKIn struct {
	AssociatedData      map[string]string `json:"associatedData"`
	KeyID               string            `json:"keyId"`
	KeyShape            KeyShape          `json:"keyShape"`
	IncludePlaintextKey bool              `json:"includePlaintextKey"`
}

GenerateDEKIn is the GenerateDataEncryptionKey request body.

type Handler 

type Handler struct {
	Backend *InMemoryBackend

	Port        int
	EnforceAuth bool
	// contains filtered or unexported fields
}

Handler serves OCI Vault: KMS vaults, keys and crypto, vault secrets and secret retrieval.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a Handler; callers override Port and EnforceAuth from Settings.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation returns the operation name for metrics.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the addressed resource id for metrics.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations lists the supported operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler for all OCI Vault requests.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority is irrelevant because RouteMatcher never matches.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all in-memory state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher never matches: OCI Vault runs on its own listener.

func (*Handler) Shutdown 

func (h *Handler) Shutdown(ctx context.Context)

Shutdown stops the listener and the sweeper.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker binds the dedicated listener synchronously so a port conflict is returned to the caller.

type ImportKeyIn 

type ImportKeyIn struct {
	WrappedImportKey WrappedImportKey `json:"wrappedImportKey"`
	CreateKeyIn
}

ImportKeyIn is the ImportKey request body.

type ImportKeyVersionIn 

type ImportKeyVersionIn struct {
	WrappedImportKey WrappedImportKey `json:"wrappedImportKey"`
}

ImportKeyVersionIn is the ImportKeyVersion request body.

type InMemoryBackend 

type InMemoryBackend struct {
	Auth *ociauth.Registry
	// contains filtered or unexported fields
}

InMemoryBackend holds every vault, key and secret under one lock.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates an empty backend.

func (*InMemoryBackend) CancelKeyDeletion 

func (b *InMemoryBackend) CancelKeyDeletion(vaultID, keyID, ifMatch string) (keyWire, string, error)

CancelKeyDeletion restores the state a key had before deletion was scheduled.

func (*InMemoryBackend) CancelKeyVersionDeletion 

func (b *InMemoryBackend) CancelKeyVersionDeletion(vaultID, keyID, versionID string) (keyVersionWire, string, error)

CancelKeyVersionDeletion returns a PENDING_DELETION version to ENABLED.

func (*InMemoryBackend) CancelSecretDeletion 

func (b *InMemoryBackend) CancelSecretDeletion(id, ifMatch string) error

CancelSecretDeletion returns a PENDING_DELETION secret to ACTIVE.

func (*InMemoryBackend) CancelSecretVersionDeletion 

func (b *InMemoryBackend) CancelSecretVersionDeletion(id string, n int64, ifMatch string) error

CancelSecretVersionDeletion cancels a scheduled version deletion.

func (*InMemoryBackend) CancelVaultDeletion 

func (b *InMemoryBackend) CancelVaultDeletion(id, ifMatch, hostPort string) (vaultWire, string, error)

CancelVaultDeletion returns a PENDING_DELETION vault to ACTIVE.

func (*InMemoryBackend) ChangeKeyCompartment 

func (b *InMemoryBackend) ChangeKeyCompartment(vaultID, keyID, ifMatch, compartment string) error

ChangeKeyCompartment moves a key.

func (*InMemoryBackend) ChangeSecretCompartment 

func (b *InMemoryBackend) ChangeSecretCompartment(id, ifMatch, compartment string) error

ChangeSecretCompartment moves a secret.

func (*InMemoryBackend) ChangeVaultCompartment 

func (b *InMemoryBackend) ChangeVaultCompartment(id, ifMatch, compartment string) error

ChangeVaultCompartment moves a vault; its keys and secrets follow.

func (*InMemoryBackend) Compartments 

func (b *InMemoryBackend) Compartments() []string

Compartments lists the distinct compartments that hold vaults, keys or secrets.

func (*InMemoryBackend) CreateKey 

func (b *InMemoryBackend) CreateKey(vaultID string, in CreateKeyIn) (keyWire, string, error)

CreateKey creates a key with its first version; the response reports ENABLING like OCI.

func (*InMemoryBackend) CreateKeyVersion 

func (b *InMemoryBackend) CreateKeyVersion(vaultID, keyID string) (keyVersionWire, string, error)

CreateKeyVersion rotates the key: new material becomes the current version.

func (*InMemoryBackend) CreateSecret 

func (b *InMemoryBackend) CreateSecret(in CreateSecretIn) (secretWire, string, error)

CreateSecret creates a secret and, when content is given, version 1.

func (*InMemoryBackend) CreateVault 

func (b *InMemoryBackend) CreateVault(in CreateVaultIn, hostPort string) (vaultWire, string, error)

CreateVault creates an ACTIVE vault; the response reports CREATING like OCI.

func (*InMemoryBackend) Decrypt 

func (b *InMemoryBackend) Decrypt(vaultID string, in DecryptIn) (decryptedWire, error)

Decrypt reverses Encrypt; rotated key versions keep decrypting their own ciphertext.

func (*InMemoryBackend) DisableKey 

func (b *InMemoryBackend) DisableKey(vaultID, keyID, ifMatch string) (keyWire, string, error)

DisableKey moves an ENABLED key to DISABLED.

func (*InMemoryBackend) EnableKey 

func (b *InMemoryBackend) EnableKey(vaultID, keyID, ifMatch string) (keyWire, string, error)

EnableKey moves a DISABLED key to ENABLED.

func (*InMemoryBackend) Encrypt 

func (b *InMemoryBackend) Encrypt(vaultID string, in EncryptIn) (encryptedWire, error)

Encrypt encrypts base64 plaintext with an AES or RSA key.

func (*InMemoryBackend) ExportKey 

func (b *InMemoryBackend) ExportKey(vaultID string, in ExportIn) (exportedWire, error)

ExportKey wraps a SOFTWARE key version's material with the caller's RSA public key.

func (*InMemoryBackend) GenerateDataEncryptionKey 

func (b *InMemoryBackend) GenerateDataEncryptionKey(vaultID string, in GenerateDEKIn) (generatedWire, error)

GenerateDataEncryptionKey returns a fresh data key wrapped by the master key.

func (*InMemoryBackend) GetKey 

func (b *InMemoryBackend) GetKey(vaultID, keyID string) (keyWire, string, error)

GetKey returns one key.

func (*InMemoryBackend) GetKeyVersion 

func (b *InMemoryBackend) GetKeyVersion(vaultID, keyID, versionID string) (keyVersionWire, string, error)

GetKeyVersion returns one key version including its public key.

func (*InMemoryBackend) GetSecret 

func (b *InMemoryBackend) GetSecret(id string) (secretWire, string, error)

GetSecret returns secret metadata.

func (*InMemoryBackend) GetSecretBundle 

func (b *InMemoryBackend) GetSecretBundle(id string, sel BundleSelector) (secretBundleWire, string, error)

GetSecretBundle returns decrypted secret content by id.

func (*InMemoryBackend) GetSecretBundleByName 

func (b *InMemoryBackend) GetSecretBundleByName(vaultID, name string, sel BundleSelector) (secretBundleWire, error)

GetSecretBundleByName returns decrypted secret content by name within a vault.

func (*InMemoryBackend) GetSecretVersion 

func (b *InMemoryBackend) GetSecretVersion(id string, n int64) (secretVersionWire, string, error)

GetSecretVersion returns one version's metadata.

func (*InMemoryBackend) GetVault 

func (b *InMemoryBackend) GetVault(id, hostPort string) (vaultWire, string, error)

GetVault returns one vault.

func (*InMemoryBackend) GetVaultUsage 

func (b *InMemoryBackend) GetVaultUsage(id string) (vaultUsageWire, error)

GetVaultUsage counts the keys and key versions of a vault.

func (*InMemoryBackend) GetWrappingKey 

func (b *InMemoryBackend) GetWrappingKey(vaultID string) (wrappingKeyWire, error)

GetWrappingKey returns the vault's public RSA wrapping key.

func (*InMemoryBackend) ImportKey 

func (b *InMemoryBackend) ImportKey(vaultID string, in ImportKeyIn) (keyWire, string, error)

ImportKey creates a key from wrapped external key material.

func (*InMemoryBackend) ImportKeyVersion 

func (b *InMemoryBackend) ImportKeyVersion(
	vaultID, keyID string,
	in ImportKeyVersionIn,
) (keyVersionWire, string, error)

ImportKeyVersion adds wrapped external key material as a new current version.

func (*InMemoryBackend) KeyState 

func (b *InMemoryBackend) KeyState(keyID string) (string, bool)

KeyState reports the lifecycle state of a key by OCID, for services that reference Vault keys.

func (*InMemoryBackend) ListKeyVersions 

func (b *InMemoryBackend) ListKeyVersions(vaultID, keyID string, o ListOpts) (page.Page[keyVersionSummaryWire], error)

ListKeyVersions lists a key's versions.

func (*InMemoryBackend) ListKeys 

func (b *InMemoryBackend) ListKeys(
	vaultID, compartment string,
	f KeyFilter,
	o ListOpts,
) (page.Page[keySummaryWire], error)

ListKeys lists a vault's keys in a compartment.

func (*InMemoryBackend) ListSecretBundleVersions 

func (b *InMemoryBackend) ListSecretBundleVersions(id string, o ListOpts) (page.Page[bundleVersionSummaryWire], error)

ListSecretBundleVersions lists version summaries without content.

func (*InMemoryBackend) ListSecretVersions 

func (b *InMemoryBackend) ListSecretVersions(id string, o ListOpts) (page.Page[secretVersionSummaryWire], error)

ListSecretVersions lists a secret's versions (oldest first unless DESC).

func (*InMemoryBackend) ListSecrets 

func (b *InMemoryBackend) ListSecrets(f SecretFilter, o ListOpts) (page.Page[secretSummaryWire], error)

ListSecrets lists secrets in a compartment.

func (*InMemoryBackend) ListVaults 

func (b *InMemoryBackend) ListVaults(compartment, hostPort string, o ListOpts) (page.Page[vaultSummaryWire], error)

ListVaults lists the vaults of a compartment.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a snapshot.

func (*InMemoryBackend) ScheduleKeyDeletion 

func (b *InMemoryBackend) ScheduleKeyDeletion(vaultID, keyID, ifMatch string, at *time.Time) (keyWire, string, error)

ScheduleKeyDeletion moves an ENABLED or DISABLED key to PENDING_DELETION.

func (*InMemoryBackend) ScheduleKeyVersionDeletion 

func (b *InMemoryBackend) ScheduleKeyVersionDeletion(
	vaultID, keyID, versionID string,
	at *time.Time,
) (keyVersionWire, string, error)

ScheduleKeyVersionDeletion schedules deletion of a non-current key version.

func (*InMemoryBackend) ScheduleSecretDeletion 

func (b *InMemoryBackend) ScheduleSecretDeletion(id, ifMatch string, at *time.Time) error

ScheduleSecretDeletion moves an ACTIVE secret to PENDING_DELETION.

func (*InMemoryBackend) ScheduleSecretVersionDeletion 

func (b *InMemoryBackend) ScheduleSecretVersionDeletion(id string, n int64, ifMatch string, at *time.Time) error

ScheduleSecretVersionDeletion schedules deletion of a version that is not current.

func (*InMemoryBackend) ScheduleVaultDeletion 

func (b *InMemoryBackend) ScheduleVaultDeletion(
	id, ifMatch, hostPort string,
	at *time.Time,
) (vaultWire, string, error)

ScheduleVaultDeletion moves an ACTIVE vault to PENDING_DELETION.

func (*InMemoryBackend) SetClock 

func (b *InMemoryBackend) SetClock(now func() time.Time)

SetClock injects the time source used for deletion schedules and rotation.

func (*InMemoryBackend) Sign 

func (b *InMemoryBackend) Sign(vaultID string, in SignIn) (signedWire, error)

Sign signs a message or digest with an RSA or ECDSA key version.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state, including registered API keys.

func (*InMemoryBackend) Sweep 

func (b *InMemoryBackend) Sweep()

Sweep applies elapsed deletion schedules and due key auto-rotations against the backend clock.

func (*InMemoryBackend) UpdateKey 

func (b *InMemoryBackend) UpdateKey(vaultID, keyID, ifMatch string, in UpdateKeyIn) (keyWire, string, error)

UpdateKey changes display name, tags and the auto-rotation schedule.

func (*InMemoryBackend) UpdateSecret 

func (b *InMemoryBackend) UpdateSecret(id, ifMatch string, in UpdateSecretIn) (secretWire, string, error)

UpdateSecret edits metadata, adds a version on content change, or promotes a version.

func (*InMemoryBackend) UpdateVault 

func (b *InMemoryBackend) UpdateVault(id, ifMatch, hostPort string, in UpdateVaultIn) (vaultWire, string, error)

UpdateVault changes display name and tags.

func (*InMemoryBackend) VaultIDForHost 

func (b *InMemoryBackend) VaultIDForHost(hint string) (string, *APIError)

VaultIDForHost resolves a per-vault endpoint label ("<prefix>") or OCID to a vault id; with no hint a lone non-deleted vault is used.

func (*InMemoryBackend) Verify 

func (b *InMemoryBackend) Verify(vaultID string, in VerifyIn) (verifiedWire, error)

Verify checks a signature made by Sign.

type Key 

type Key struct {
	TimeCreated    time.Time                 `json:"timeCreated"`
	TimeOfDeletion *time.Time                `json:"timeOfDeletion,omitempty"`
	Rotation       *RotationDetails          `json:"rotation,omitempty"`
	FreeformTags   map[string]string         `json:"freeformTags,omitempty"`
	DefinedTags    map[string]map[string]any `json:"definedTags,omitempty"`
	ID             string                    `json:"id"`
	VaultID        string                    `json:"vaultId"`
	CompartmentID  string                    `json:"compartmentId"`
	DisplayName    string                    `json:"displayName"`
	State          string                    `json:"state"`
	ProtectionMode string                    `json:"protectionMode"`
	CurrentVersion string                    `json:"currentVersion"`
	PrevState      string                    `json:"prevState,omitempty"`
	Etag           string                    `json:"etag"`
	Shape          KeyShape                  `json:"shape"`
	Versions       []*KeyVersion             `json:"versions"`
	Seq            int64                     `json:"seq"`
	AutoRotation   bool                      `json:"autoRotation"`
}

Key is a master encryption key.

type KeyFilter 

type KeyFilter struct {
	ProtectionMode string
	Algorithm      string
	CurveID        string
	Length         int
}

KeyFilter narrows ListKeys.

type KeyShape 

type KeyShape struct {
	Algorithm string `json:"algorithm"`
	CurveID   string `json:"curveId,omitempty"`
	Length    int    `json:"length"`
}

KeyShape is the algorithm/length/curve triple of a key.

type KeyVersion 

type KeyVersion struct {
	TimeCreated    time.Time  `json:"timeCreated"`
	TimeOfDeletion *time.Time `json:"timeOfDeletion,omitempty"`
	ID             string     `json:"id"`
	State          string     `json:"state"`
	Origin         string     `json:"origin"`
	Material       []byte     `json:"material"`
	AutoRotated    bool       `json:"autoRotated,omitempty"`
}

KeyVersion is one version of a key's material.

type ListOpts 

type ListOpts struct {
	SortBy string
	Order  string
	Page   string
	Limit  int
}

ListOpts carries the shared list query parameters.

type Provider 

type Provider struct{}

Provider implements service.Provider for OCI Vault. It runs on its own listener (see Handler.StartWorker) and never matches on the shared AWS router.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init creates the backend and handler; the port is bound in StartWorker.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the service provider name.

type RotationDetails 

type RotationDetails struct {
	ScheduleStart *time.Time `json:"timeOfScheduleStart,omitempty"`
	NextRotation  *time.Time `json:"timeOfNextRotation,omitempty"`
	LastRotation  *time.Time `json:"timeOfLastRotation,omitempty"`
	LastStatus    string     `json:"lastRotationStatus,omitempty"`
	LastMessage   string     `json:"lastRotationMessage,omitempty"`
	IntervalDays  int        `json:"rotationIntervalInDays,omitempty"`
}

RotationDetails is a key's auto-rotation schedule.

type Secret 

type Secret struct {
	TimeCreated    time.Time                 `json:"timeCreated"`
	TimeOfDeletion *time.Time                `json:"timeOfDeletion,omitempty"`
	FreeformTags   map[string]string         `json:"freeformTags,omitempty"`
	DefinedTags    map[string]map[string]any `json:"definedTags,omitempty"`
	Metadata       map[string]any            `json:"metadata,omitempty"`
	ID             string                    `json:"id"`
	VaultID        string                    `json:"vaultId"`
	CompartmentID  string                    `json:"compartmentId"`
	Name           string                    `json:"name"`
	KeyID          string                    `json:"keyId"`
	Description    string                    `json:"description,omitempty"`
	State          string                    `json:"state"`
	Etag           string                    `json:"etag"`
	Rules          []json.RawMessage         `json:"rules,omitempty"`
	Versions       []*SecretVersion          `json:"versions"`
	Seq            int64                     `json:"seq"`
	Current        int64                     `json:"current"`
	Previous       int64                     `json:"previous"`
	Pending        int64                     `json:"pending"`
}

Secret is a vault secret.

type SecretContent 

type SecretContent struct {
	ContentType string `json:"contentType"`
	Name        string `json:"name"`
	Content     string `json:"content"`
	Stage       string `json:"stage"`
}

SecretContent is the polymorphic secretContent body (only BASE64 exists).

type SecretFilter 

type SecretFilter struct {
	Compartment string
	Name        string
	VaultID     string
	State       string
}

SecretFilter narrows ListSecrets.

type SecretVersion 

type SecretVersion struct {
	TimeCreated    time.Time  `json:"timeCreated"`
	TimeOfDeletion *time.Time `json:"timeOfDeletion,omitempty"`
	TimeOfExpiry   *time.Time `json:"timeOfExpiry,omitempty"`
	Name           string     `json:"name,omitempty"`
	Ciphertext     string     `json:"ciphertext"`
	Number         int64      `json:"number"`
}

SecretVersion is one stored (KMS-encrypted) version of a secret.

type Settings 

type Settings struct {
	Port int `` //nolint:lll // config struct tags are intentionally verbose
	/* 217-byte string literal not displayed */
	EnforceAuth bool `` //nolint:lll // config struct tags are intentionally verbose
	/* 221-byte string literal not displayed */
}

Settings holds service-level configuration, embedded in the root CLI command as CLI.OCIVault.

func DefaultSettings 

func DefaultSettings() Settings

DefaultSettings returns the settings used when no ConfigProvider is available.

type SignIn 

type SignIn struct {
	KeyID        string `json:"keyId"`
	Message      string `json:"message"`
	Algorithm    string `json:"signingAlgorithm"`
	KeyVersionID string `json:"keyVersionId"`
	MessageType  string `json:"messageType"`
}

SignIn is the Sign request body.

type UpdateKeyIn 

type UpdateKeyIn struct {
	DisplayName            *string                   `json:"displayName"`
	IsAutoRotationEnabled  *bool                     `json:"isAutoRotationEnabled"`
	AutoKeyRotationDetails *RotationDetails          `json:"autoKeyRotationDetails"`
	FreeformTags           map[string]string         `json:"freeformTags"`
	DefinedTags            map[string]map[string]any `json:"definedTags"`
}

UpdateKeyIn is the UpdateKey request body.

type UpdateSecretIn 

type UpdateSecretIn struct {
	CurrentVersionNumber    *int64                    `json:"currentVersionNumber"`
	Description             *string                   `json:"description"`
	FreeformTags            map[string]string         `json:"freeformTags"`
	DefinedTags             map[string]map[string]any `json:"definedTags"`
	Metadata                map[string]any            `json:"metadata"`
	SecretContent           *SecretContent            `json:"secretContent"`
	ReplicationConfig       json.RawMessage           `json:"replicationConfig"`
	RotationConfig          json.RawMessage           `json:"rotationConfig"`
	SecretGenerationContext json.RawMessage           `json:"secretGenerationContext"`
	EnableAutoGeneration    *bool                     `json:"enableAutoGeneration"`
	SecretRules             []json.RawMessage         `json:"secretRules"`
}

UpdateSecretIn is the UpdateSecret request body.

type UpdateVaultIn 

type UpdateVaultIn struct {
	DisplayName  *string                   `json:"displayName"`
	FreeformTags map[string]string         `json:"freeformTags"`
	DefinedTags  map[string]map[string]any `json:"definedTags"`
}

UpdateVaultIn is the UpdateVault request body.

type Vault 

type Vault struct {
	TimeCreated        time.Time                 `json:"timeCreated"`
	TimeOfDeletion     *time.Time                `json:"timeOfDeletion,omitempty"`
	WrappingKeyCreated *time.Time                `json:"wrappingKeyCreated,omitempty"`
	FreeformTags       map[string]string         `json:"freeformTags,omitempty"`
	DefinedTags        map[string]map[string]any `json:"definedTags,omitempty"`
	ID                 string                    `json:"id"`
	Prefix             string                    `json:"prefix"`
	CompartmentID      string                    `json:"compartmentId"`
	DisplayName        string                    `json:"displayName"`
	VaultType          string                    `json:"vaultType"`
	State              string                    `json:"state"`
	WrappingKeyID      string                    `json:"wrappingKeyId"`
	Etag               string                    `json:"etag"`
	WrappingKeyDER     []byte                    `json:"wrappingKeyDer,omitempty"`
	Seq                int64                     `json:"seq"`
}

Vault is a KMS vault.

type VerifyIn 

type VerifyIn struct {
	KeyID        string `json:"keyId"`
	KeyVersionID string `json:"keyVersionId"`
	Signature    string `json:"signature"`
	Message      string `json:"message"`
	Algorithm    string `json:"signingAlgorithm"`
	MessageType  string `json:"messageType"`
}

VerifyIn is the Verify request body.

type WrappedImportKey 

type WrappedImportKey struct {
	KeyMaterial       string `json:"keyMaterial"`
	WrappingAlgorithm string `json:"wrappingAlgorithm"`
}

WrappedImportKey is the wrapped key material of an import request.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.