Help us shape the future of Go! Take the 2026 Go Developer Survey

azurekeyvault

package
v1.8.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: MIT Imports: 47 Imported by: 0

README

Azure Key Vault

Parity grade: B · SDK azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.5.0 · last audited 2026-10-18 (d52fe4ac6)

Coverage

Metric Value
PARITY entries audited 15 (12 ok, 3 partial)
Feature families 5 (4 ok, 1 partial)
Known gaps 5
Deferred items 0
Resource leaks clean
Known gaps
  • Third-party certificate issuers (DigiCert, GlobalSign) are rejected; AutoRenew of Unknown-issuer certificates (which would open a new pending CSR) is not executed.
  • Key release (ReleaseKey, release_policy), GetKeyAttestation and ES256K/P-256K (no secp256k1 in go.mod) are not implemented.
  • Notify and EmailContacts lifetime actions are recorded only; nothing is delivered.
  • ARM Microsoft.KeyVault: deletedVaults, checkNameAvailability and vault purge are not implemented; ARM vault metadata is not persisted.
  • Backups use an opaque gopherstack blob, not Azure's format.

More

Documentation

Index

Constants

View Source 
const DefaultPort = 10004

DefaultPort is the fixed TCP port for the Key Vault data-plane listener.

View Source 
const DefaultVaultName = "default"

DefaultVaultName is the vault addressed when the request carries neither a vault host label nor a /vaults/<name> path prefix.

Variables

View Source 
var ErrNilAppContext = errors.New("azurekeyvault: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

View Source 
var ErrSnapshotNull = errors.New("azurekeyvault: snapshot contains null entry")

ErrSnapshotNull is returned when a snapshot contains a null entity.

Functions

func RandomBytes 

func RandomBytes(count int) (string, error)

RandomBytes returns count cryptographically random bytes, base64url encoded.

Types

type AdminDetails 

type AdminDetails struct {
	FirstName string `json:"first_name,omitempty"`
	LastName  string `json:"last_name,omitempty"`
	Email     string `json:"email_address,omitempty"`
	Phone     string `json:"phone,omitempty"`
}

AdminDetails is an issuer organisation administrator.

type Attributes 

type Attributes struct {
	Enabled         *bool  `json:"enabled,omitempty"`
	NBF             *int64 `json:"nbf,omitempty"`
	Exp             *int64 `json:"exp,omitempty"`
	Created         *int64 `json:"created,omitempty"`
	Updated         *int64 `json:"updated,omitempty"`
	RecoverableDays *int   `json:"recoverableDays,omitempty"`
	RecoveryLevel   string `json:"recoveryLevel,omitempty"`
}

Attributes is the common attributes object (epoch-second timestamps).

func (*Attributes) Created0 

func (a *Attributes) Created0(fallback int64) int64

Created0 returns the created timestamp or fallback.

type BackupResult 

type BackupResult struct {
	Value string `json:"value"`
}

BackupResult is the backup response; Value is an opaque blob.

type CertLifetimeAction 

type CertLifetimeAction struct {
	Action  LifetimeActionType `json:"action"`
	Trigger LifetimeTrigger    `json:"trigger"`
}

CertLifetimeAction pairs a trigger with an action.

type CertOperation 

type CertOperation struct {
	Issuer                *IssuerRef `json:"issuer,omitempty"`
	ID                    string     `json:"id,omitempty"`
	Status                string     `json:"status"`
	StatusDetails         string     `json:"status_details,omitempty"`
	Target                string     `json:"target,omitempty"`
	RequestID             string     `json:"request_id,omitempty"`
	CSR                   []byte     `json:"csr,omitempty"`
	CancellationRequested bool       `json:"cancellation_requested"`
}

CertOperation is the pending certificate operation.

type CertPolicy 

type CertPolicy struct {
	KeyProps        *KeyProps            `json:"key_props,omitempty"`
	SecretProps     *SecretProps         `json:"secret_props,omitempty"`
	X509Props       *X509Props           `json:"x509_props,omitempty"`
	Issuer          *IssuerRef           `json:"issuer,omitempty"`
	Attributes      *Attributes          `json:"attributes,omitempty"`
	ID              string               `json:"id,omitempty"`
	LifetimeActions []CertLifetimeAction `json:"lifetime_actions,omitempty"`
}

CertPolicy is a certificate policy.

type CertVersion 

type CertVersion struct {
	Tags  map[string]string `json:"tags,omitempty"`
	ID    string            `json:"id"`
	X5T   string            `json:"x5t"`
	Attrs Attributes        `json:"attrs"`
	Cer   []byte            `json:"cer"`
	Chain [][]byte          `json:"chain,omitempty"`
}

CertVersion is one stored version of a certificate.

func (*CertVersion) Attr 

func (c *CertVersion) Attr() *Attributes

Attr implements Versioned.

func (*CertVersion) VersionID 

func (c *CertVersion) VersionID() string

VersionID implements Versioned.

type CertWire 

type CertWire struct {
	Attributes         *Attributes       `json:"attributes,omitempty"`
	Tags               map[string]string `json:"tags,omitempty"`
	Policy             *CertPolicy       `json:"policy,omitempty"`
	DeletedDate        *int64            `json:"deletedDate,omitempty"`
	ScheduledPurgeDate *int64            `json:"scheduledPurgeDate,omitempty"`
	ID                 string            `json:"id"`
	KID                string            `json:"kid,omitempty"`
	SID                string            `json:"sid,omitempty"`
	X5T                string            `json:"x5t,omitempty"`
	RecoveryID         string            `json:"recoveryId,omitempty"`
	Cer                []byte            `json:"cer,omitempty"`
}

CertWire is the certificate bundle/item/deleted-bundle wire shape.

type Collection 

type Collection[P Versioned] map[string]*Entity[P]

Collection is a vault's name-keyed set of entities of one kind.

type ConfigProvider 

type ConfigProvider interface {
	GetAzureKeyVaultSettings() Settings
}

ConfigProvider extracts Key Vault configuration from the abstract AppContext Config.

type Contact 

type Contact struct {
	Email string `json:"email,omitempty"`
	Name  string `json:"name,omitempty"`
	Phone string `json:"phone,omitempty"`
}

Contact is a certificate contact.

type Contacts 

type Contacts struct {
	ID       string    `json:"id,omitempty"`
	Contacts []Contact `json:"contacts"`
}

Contacts is the vault's certificate contact list.

type CreateCertRequest 

type CreateCertRequest struct {
	Policy     *CertPolicy       `json:"policy"`
	Attributes *Attributes       `json:"attributes"`
	Tags       map[string]string `json:"tags"`
}

CreateCertRequest is the POST /certificates/{name}/create body.

type CreateKeyRequest 

type CreateKeyRequest struct {
	Attributes *Attributes       `json:"attributes"`
	Tags       map[string]string `json:"tags"`
	Kty        string            `json:"kty"`
	Crv        string            `json:"crv"`
	KeyOps     []string          `json:"key_ops"`
	KeySize    int               `json:"key_size"`
}

CreateKeyRequest is the POST /keys/{name}/create body.

type DeletedInfo 

type DeletedInfo struct {
	DeletedDate        int64 `json:"deletedDate"`
	ScheduledPurgeDate int64 `json:"scheduledPurgeDate"`
}

DeletedInfo marks an entity as soft-deleted.

type Entity 

type Entity[P Versioned] struct {
	Deleted    *DeletedInfo    `json:"deleted,omitempty"`
	Rotation   *RotationPolicy `json:"rotation,omitempty"`
	CertPolicy *CertPolicy     `json:"certPolicy,omitempty"`
	CertOp     *CertOperation  `json:"certOp,omitempty"`
	Name       string          `json:"name"`
	Versions   []P             `json:"versions"`
}

Entity is a named, versioned object (secret, key or certificate).

type Handler 

type Handler struct {
	Backend *InMemoryBackend

	Settings Settings
	Port     int
	// contains filtered or unexported fields
}

Handler serves the Key Vault data plane on its own HTTPS listener.

func NewHandler 

func NewHandler(backend *InMemoryBackend, settings Settings) *Handler

NewHandler creates a Handler.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation returns the operation name for metrics.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the request path for metrics.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the supported operation names.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler for Key Vault operations.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority is irrelevant since RouteMatcher never matches.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher never matches: Key Vault runs on its own listener.

func (*Handler) Shutdown 

func (h *Handler) Shutdown(ctx context.Context)

Shutdown stops the listener and the lifetime-action janitor.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker binds the fixed port and serves HTTPS, failing fast if the port is taken.

type ImportCertRequest 

type ImportCertRequest struct {
	Policy     *CertPolicy       `json:"policy"`
	Attributes *Attributes       `json:"attributes"`
	Tags       map[string]string `json:"tags"`
	Value      string            `json:"value"`
	Password   string            `json:"pwd"`
}

ImportCertRequest is the POST /certificates/{name}/import body.

type ImportKeyRequest 

type ImportKeyRequest struct {
	Key        *JWK              `json:"key"`
	Attributes *Attributes       `json:"attributes"`
	Tags       map[string]string `json:"tags"`
}

ImportKeyRequest is the PUT /keys/{name} body.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend holds every vault's state under one coarse lock.

func NewInMemoryBackend 

func NewInMemoryBackend(autoCreate bool) *InMemoryBackend

NewInMemoryBackend creates an empty backend. autoCreate makes vaults spring into existence on first data-plane write.

func (*InMemoryBackend) BackupCertificate 

func (b *InMemoryBackend) BackupCertificate(vaultName, name string) (BackupResult, error)

BackupCertificate serialises a certificate with its backing key and secret.

func (*InMemoryBackend) BackupKey 

func (b *InMemoryBackend) BackupKey(vaultName, name string) (BackupResult, error)

BackupKey serialises every version of a key.

func (*InMemoryBackend) BackupSecret 

func (b *InMemoryBackend) BackupSecret(vaultName, name string) (BackupResult, error)

BackupSecret serialises every version of a secret.

func (*InMemoryBackend) CreateCertificate 

func (b *InMemoryBackend) CreateCertificate(
	vaultName, base, name string,
	req *CreateCertRequest,
) (CertOperation, error)

CreateCertificate issues a self-signed certificate.

func (*InMemoryBackend) CreateKey 

func (b *InMemoryBackend) CreateKey(vaultName, base, name string, req *CreateKeyRequest) (KeyWire, error)

CreateKey creates a new key (or a new version of an existing one).

func (*InMemoryBackend) CreateVault 

func (b *InMemoryBackend) CreateVault(name string, opts VaultOptions)

CreateVault registers (or updates) a vault, as the ARM resource provider does.

func (*InMemoryBackend) DeleteCertificate 

func (b *InMemoryBackend) DeleteCertificate(vaultName, base, name string) (CertWire, error)

DeleteCertificate soft-deletes a certificate and its backing key/secret.

func (*InMemoryBackend) DeleteContacts 

func (b *InMemoryBackend) DeleteContacts(vaultName, base string) (Contacts, error)

DeleteContacts removes the vault's contacts, returning them.

func (*InMemoryBackend) DeleteIssuer 

func (b *InMemoryBackend) DeleteIssuer(vaultName, base, name string) (Issuer, error)

DeleteIssuer removes an issuer, returning it.

func (*InMemoryBackend) DeleteKey 

func (b *InMemoryBackend) DeleteKey(vaultName, base, name string) (KeyWire, error)

DeleteKey soft-deletes a key.

func (*InMemoryBackend) DeletePendingCertificate 

func (b *InMemoryBackend) DeletePendingCertificate(vaultName, base, name string) (CertOperation, error)

DeletePendingCertificate removes the pending operation record.

func (*InMemoryBackend) DeleteSecret 

func (b *InMemoryBackend) DeleteSecret(vaultName, base, name string) (SecretWire, error)

DeleteSecret soft-deletes a secret.

func (*InMemoryBackend) DeleteVault 

func (b *InMemoryBackend) DeleteVault(name string)

DeleteVault removes a vault and everything in it.

func (*InMemoryBackend) GetCertificate 

func (b *InMemoryBackend) GetCertificate(vaultName, base, name, version string) (CertWire, error)

GetCertificate returns a certificate version (latest when version is empty).

func (*InMemoryBackend) GetCertificatePolicy 

func (b *InMemoryBackend) GetCertificatePolicy(vaultName, base, name string) (CertPolicy, error)

GetCertificatePolicy returns a certificate's policy.

func (*InMemoryBackend) GetContacts 

func (b *InMemoryBackend) GetContacts(vaultName, base string) (Contacts, error)

GetContacts returns the vault's contacts.

func (*InMemoryBackend) GetDeletedCertificate 

func (b *InMemoryBackend) GetDeletedCertificate(vaultName, base, name string) (CertWire, error)

GetDeletedCertificate returns a soft-deleted certificate.

func (*InMemoryBackend) GetDeletedKey 

func (b *InMemoryBackend) GetDeletedKey(vaultName, base, name string) (KeyWire, error)

GetDeletedKey returns a soft-deleted key.

func (*InMemoryBackend) GetDeletedSecret 

func (b *InMemoryBackend) GetDeletedSecret(vaultName, base, name string) (SecretWire, error)

GetDeletedSecret returns a soft-deleted secret.

func (*InMemoryBackend) GetIssuer 

func (b *InMemoryBackend) GetIssuer(vaultName, base, name string) (Issuer, error)

GetIssuer returns an issuer.

func (*InMemoryBackend) GetKey 

func (b *InMemoryBackend) GetKey(vaultName, base, name, version string) (KeyWire, error)

GetKey returns a key version (latest when version is empty).

func (*InMemoryBackend) GetPendingCertificate 

func (b *InMemoryBackend) GetPendingCertificate(vaultName, base, name string) (CertOperation, error)

GetPendingCertificate returns the certificate's pending operation.

func (*InMemoryBackend) GetRotationPolicy 

func (b *InMemoryBackend) GetRotationPolicy(vaultName, base, name string) (RotationPolicy, error)

GetRotationPolicy returns a key's rotation policy.

func (*InMemoryBackend) GetSecret 

func (b *InMemoryBackend) GetSecret(vaultName, base, name, version string) (SecretWire, error)

GetSecret returns a secret version (latest when version is empty).

func (*InMemoryBackend) ImportCertificate 

func (b *InMemoryBackend) ImportCertificate(vaultName, base, name string, req *ImportCertRequest) (CertWire, error)

ImportCertificate imports a PEM or PKCS#12 certificate with its private key.

func (*InMemoryBackend) ImportKey 

func (b *InMemoryBackend) ImportKey(vaultName, base, name string, req *ImportKeyRequest) (KeyWire, error)

ImportKey imports a caller-supplied private key.

func (*InMemoryBackend) KeyOperation 

func (b *InMemoryBackend) KeyOperation(
	vaultName, base, name, version, op string, req *KeyOperationRequest,
) (any, error)

KeyOperation runs one crypto operation against a key version.

func (*InMemoryBackend) ListCertificateVersions 

func (b *InMemoryBackend) ListCertificateVersions(vaultName, base, name string) ([]CertWire, error)

ListCertificateVersions lists every version of a certificate.

func (*InMemoryBackend) ListCertificates 

func (b *InMemoryBackend) ListCertificates(vaultName, base string, deleted bool) ([]CertWire, error)

ListCertificates lists certificates, deleted or active.

func (*InMemoryBackend) ListIssuers 

func (b *InMemoryBackend) ListIssuers(vaultName, base string) ([]IssuerItem, error)

ListIssuers lists issuers by name.

func (*InMemoryBackend) ListKeyVersions 

func (b *InMemoryBackend) ListKeyVersions(vaultName, base, name string) ([]KeyWire, error)

ListKeyVersions lists every version of a key.

func (*InMemoryBackend) ListKeys 

func (b *InMemoryBackend) ListKeys(vaultName, base string, deleted bool) ([]KeyWire, error)

ListKeys lists keys, deleted or active.

func (*InMemoryBackend) ListSecretVersions 

func (b *InMemoryBackend) ListSecretVersions(vaultName, base, name string) ([]SecretWire, error)

ListSecretVersions lists every version of a secret.

func (*InMemoryBackend) ListSecrets 

func (b *InMemoryBackend) ListSecrets(vaultName, base string, deleted bool) ([]SecretWire, error)

ListSecrets lists secrets (latest version identifiers), deleted or active.

func (*InMemoryBackend) ListVaults 

func (b *InMemoryBackend) ListVaults() []string

ListVaults returns the registered vault names in sorted order.

func (*InMemoryBackend) MergeCertificate 

func (b *InMemoryBackend) MergeCertificate(vaultName, base, name string, req *MergeCertRequest) (CertWire, error)

MergeCertificate completes a pending Unknown-issuer certificate with the signed chain.

func (*InMemoryBackend) PurgeCertificate 

func (b *InMemoryBackend) PurgeCertificate(vaultName, name string) error

PurgeCertificate permanently removes a soft-deleted certificate.

func (*InMemoryBackend) PurgeKey 

func (b *InMemoryBackend) PurgeKey(vaultName, name string) error

PurgeKey permanently removes a soft-deleted key.

func (*InMemoryBackend) PurgeSecret 

func (b *InMemoryBackend) PurgeSecret(vaultName, name string) error

PurgeSecret permanently removes a soft-deleted secret.

func (*InMemoryBackend) PurgeVault 

func (b *InMemoryBackend) PurgeVault(name string)

PurgeVault permanently discards a soft-deleted vault.

func (*InMemoryBackend) RecoverCertificate 

func (b *InMemoryBackend) RecoverCertificate(vaultName, base, name string) (CertWire, error)

RecoverCertificate restores a soft-deleted certificate.

func (*InMemoryBackend) RecoverKey 

func (b *InMemoryBackend) RecoverKey(vaultName, base, name string) (KeyWire, error)

RecoverKey restores a soft-deleted key.

func (*InMemoryBackend) RecoverSecret 

func (b *InMemoryBackend) RecoverSecret(vaultName, base, name string) (SecretWire, error)

RecoverSecret restores a soft-deleted secret.

func (*InMemoryBackend) RecoverVault 

func (b *InMemoryBackend) RecoverVault(name string)

RecoverVault restores a soft-deleted vault with its contents.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) RestoreCertificate 

func (b *InMemoryBackend) RestoreCertificate(vaultName, base, value string) (CertWire, error)

RestoreCertificate recreates a certificate from a backup blob.

func (*InMemoryBackend) RestoreKey 

func (b *InMemoryBackend) RestoreKey(vaultName, base, value string) (KeyWire, error)

RestoreKey recreates a key from a backup blob.

func (*InMemoryBackend) RestoreSecret 

func (b *InMemoryBackend) RestoreSecret(vaultName, base, value string) (SecretWire, error)

RestoreSecret recreates a secret from a backup blob.

func (*InMemoryBackend) RotateKey 

func (b *InMemoryBackend) RotateKey(vaultName, base, name string) (KeyWire, error)

RotateKey creates a new version with fresh key material.

func (*InMemoryBackend) SetContacts 

func (b *InMemoryBackend) SetContacts(vaultName, base string, in *Contacts) (Contacts, error)

SetContacts replaces the vault's contacts.

func (*InMemoryBackend) SetIssuer 

func (b *InMemoryBackend) SetIssuer(vaultName, base, name string, in *Issuer) (Issuer, error)

SetIssuer creates or replaces an issuer.

func (*InMemoryBackend) SetRotationPolicy 

func (b *InMemoryBackend) SetRotationPolicy(
	vaultName, base, name string, in *RotationPolicy,
) (RotationPolicy, error)

SetRotationPolicy replaces a key's rotation policy.

func (*InMemoryBackend) SetSecret 

func (b *InMemoryBackend) SetSecret(vaultName, base, name string, req *SetSecretRequest) (SecretWire, error)

SetSecret creates a new version of the named secret.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) SoftDeleteVault 

func (b *InMemoryBackend) SoftDeleteVault(name string)

SoftDeleteVault moves a vault, contents intact, out of service until RecoverVault or PurgeVault.

func (*InMemoryBackend) UpdateCertificate 

func (b *InMemoryBackend) UpdateCertificate(
	vaultName, base, name, version string, req *UpdateCertRequest,
) (CertWire, error)

UpdateCertificate updates a certificate version's mutable properties.

func (*InMemoryBackend) UpdateCertificatePolicy 

func (b *InMemoryBackend) UpdateCertificatePolicy(
	vaultName, base, name string, in *CertPolicy,
) (CertPolicy, error)

UpdateCertificatePolicy replaces a certificate's policy (applies to the next version).

func (*InMemoryBackend) UpdateIssuer 

func (b *InMemoryBackend) UpdateIssuer(vaultName, base, name string, in *Issuer) (Issuer, error)

UpdateIssuer merges the supplied fields into an existing issuer.

func (*InMemoryBackend) UpdateKey 

func (b *InMemoryBackend) UpdateKey(vaultName, base, name, version string, req *UpdateKeyRequest) (KeyWire, error)

UpdateKey updates a key version's mutable properties.

func (*InMemoryBackend) UpdatePendingCertificate 

func (b *InMemoryBackend) UpdatePendingCertificate(
	vaultName, base, name string, req *UpdatePendingRequest,
) (CertOperation, error)

UpdatePendingCertificate records a cancellation request on the pending operation.

func (*InMemoryBackend) UpdateSecret 

func (b *InMemoryBackend) UpdateSecret(
	vaultName, base, name, version string, req *UpdateSecretRequest,
) (SecretWire, error)

UpdateSecret updates a secret version's mutable properties.

func (*InMemoryBackend) VaultExists 

func (b *InMemoryBackend) VaultExists(name string) bool

VaultExists reports whether the vault is registered.

type Issuer 

type Issuer struct {
	Credentials *IssuerCredentials `json:"credentials,omitempty"`
	OrgDetails  *OrgDetails        `json:"org_details,omitempty"`
	Attributes  *Attributes        `json:"attributes,omitempty"`
	ID          string             `json:"id,omitempty"`
	Provider    string             `json:"provider,omitempty"`
}

Issuer is a stored certificate issuer.

type IssuerCredentials 

type IssuerCredentials struct {
	AccountID string `json:"account_id,omitempty"`
	Password  string `json:"pwd,omitempty"`
}

IssuerCredentials are the issuer account credentials.

type IssuerItem 

type IssuerItem struct {
	ID       string `json:"id"`
	Provider string `json:"provider,omitempty"`
}

IssuerItem is a list entry.

type IssuerRef 

type IssuerRef struct {
	CertTransparency *bool  `json:"cert_transparency,omitempty"`
	Name             string `json:"name,omitempty"`
	CertType         string `json:"cty,omitempty"`
}

IssuerRef references a certificate issuer.

type JWK 

type JWK struct {
	KID    string   `json:"kid,omitempty"`
	Kty    string   `json:"kty,omitempty"`
	Crv    string   `json:"crv,omitempty"`
	N      string   `json:"n,omitempty"`
	E      string   `json:"e,omitempty"`
	D      string   `json:"d,omitempty"`
	P      string   `json:"p,omitempty"`
	Q      string   `json:"q,omitempty"`
	DP     string   `json:"dp,omitempty"`
	DQ     string   `json:"dq,omitempty"`
	QI     string   `json:"qi,omitempty"`
	X      string   `json:"x,omitempty"`
	Y      string   `json:"y,omitempty"`
	K      string   `json:"k,omitempty"`
	KeyOps []string `json:"key_ops,omitempty"`
}

JWK is the JSON web key wire/import shape.

type Janitor 

type Janitor struct {
	Backend  *InMemoryBackend
	Interval time.Duration
}

Janitor runs key rotation policies and certificate AutoRenew lifetime actions. Notify and EmailContacts actions are never delivered: there is no Event Grid or mail transport in the emulator.

func NewJanitor 

func NewJanitor(backend *InMemoryBackend, interval time.Duration) *Janitor

NewJanitor creates a Janitor; a zero interval selects the default.

func (*Janitor) Run 

func (j *Janitor) Run(ctx context.Context)

Run blocks until ctx is cancelled, sweeping on every tick.

type KeyOperationRequest 

type KeyOperationRequest struct {
	Alg    string `json:"alg"`
	Value  string `json:"value"`
	Digest string `json:"digest"`
	IV     string `json:"iv"`
	AAD    string `json:"aad"`
	Tag    string `json:"tag"`
}

KeyOperationRequest is the body shared by every key crypto operation.

type KeyOperationResult 

type KeyOperationResult struct {
	KID   string `json:"kid"`
	Value string `json:"value"`
	IV    string `json:"iv,omitempty"`
	Tag   string `json:"authenticationTag,omitempty"`
	AAD   string `json:"aad,omitempty"`
}

KeyOperationResult is the encrypt/decrypt/sign/wrap/unwrap response.

type KeyProps 

type KeyProps struct {
	Exportable *bool  `json:"exportable,omitempty"`
	ReuseKey   *bool  `json:"reuse_key,omitempty"`
	Kty        string `json:"kty,omitempty"`
	Crv        string `json:"crv,omitempty"`
	KeySize    int    `json:"key_size,omitempty"`
}

KeyProps are the certificate policy key properties.

type KeyVersion 

type KeyVersion struct {
	Tags    map[string]string `json:"tags,omitempty"`
	ID      string            `json:"id"`
	Kty     string            `json:"kty"`
	Crv     string            `json:"crv,omitempty"`
	Attrs   Attributes        `json:"attrs"`
	KeyOps  []string          `json:"keyOps"`
	Priv    []byte            `json:"priv"`
	KeySize int               `json:"keySize,omitempty"`
	Managed bool              `json:"managed,omitempty"`
}

KeyVersion is one stored version of a key.

func (*KeyVersion) Attr 

func (k *KeyVersion) Attr() *Attributes

Attr implements Versioned.

func (*KeyVersion) VersionID 

func (k *KeyVersion) VersionID() string

VersionID implements Versioned.

type KeyWire 

type KeyWire struct {
	Key                *JWK              `json:"key,omitempty"`
	Attributes         *Attributes       `json:"attributes,omitempty"`
	Tags               map[string]string `json:"tags,omitempty"`
	DeletedDate        *int64            `json:"deletedDate,omitempty"`
	ScheduledPurgeDate *int64            `json:"scheduledPurgeDate,omitempty"`
	KID                string            `json:"kid,omitempty"`
	RecoveryID         string            `json:"recoveryId,omitempty"`
	Managed            bool              `json:"managed,omitempty"`
}

KeyWire is the key bundle/item/deleted-bundle wire shape.

type LifetimeActionType 

type LifetimeActionType struct {
	ActionType string `json:"action_type"`
}

LifetimeActionType names a lifetime action.

type LifetimeTrigger 

type LifetimeTrigger struct {
	LifetimePercentage int `json:"lifetime_percentage,omitempty"`
	DaysBeforeExpiry   int `json:"days_before_expiry,omitempty"`
}

LifetimeTrigger is a certificate lifetime-action trigger.

type ListResponse 

type ListResponse[T any] struct {
	NextLink string `json:"nextLink,omitempty"`
	Value    []T    `json:"value"`
}

ListResponse is the paged list envelope.

type MergeCertRequest 

type MergeCertRequest struct {
	Attributes *Attributes       `json:"attributes"`
	Tags       map[string]string `json:"tags"`
	X5C        []string          `json:"x5c"`
}

MergeCertRequest is the POST /certificates/{name}/pending/merge body.

type OrgDetails 

type OrgDetails struct {
	ID           string         `json:"id,omitempty"`
	AdminDetails []AdminDetails `json:"admin_details,omitempty"`
}

OrgDetails are the issuer organisation details.

type PendingCert 

type PendingCert struct {
	Policy *CertPolicy       `json:"policy"`
	Tags   map[string]string `json:"tags,omitempty"`
	Attrs  Attributes        `json:"attrs"`
	Key    []byte            `json:"key"`
	ID     string            `json:"id"`
	Op     CertOperation     `json:"op"`
}

PendingCert is a certificate awaiting a signed chain from an external CA.

type Provider 

type Provider struct{}

Provider implements service.Provider for Azure Key Vault. Like the other Azure services it never matches on the shared AWS router; the handler serves its own HTTPS listener from StartWorker.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Key Vault backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the service provider name.

type RandomBytesRequest 

type RandomBytesRequest struct {
	Count int `json:"count"`
}

RandomBytesRequest is the POST /rng body.

type RandomBytesResult 

type RandomBytesResult struct {
	Value string `json:"value"`
}

RandomBytesResult is the POST /rng response.

type RestoreRequest 

type RestoreRequest struct {
	Value string `json:"value"`
}

RestoreRequest is the restore request body.

type RotationAction 

type RotationAction struct {
	Type string `json:"type"`
}

RotationAction is a rotation lifetime-action action.

type RotationAttributes 

type RotationAttributes struct {
	Created    *int64 `json:"created,omitempty"`
	Updated    *int64 `json:"updated,omitempty"`
	ExpiryTime string `json:"expiryTime,omitempty"`
}

RotationAttributes carries the policy's expiry time and timestamps.

type RotationLifetimeAction 

type RotationLifetimeAction struct {
	Trigger RotationTrigger `json:"trigger"`
	Action  RotationAction  `json:"action"`
}

RotationLifetimeAction pairs a trigger with an action.

type RotationPolicy 

type RotationPolicy struct {
	Attributes      RotationAttributes       `json:"attributes"`
	ID              string                   `json:"id,omitempty"`
	LifetimeActions []RotationLifetimeAction `json:"lifetimeActions"`
}

RotationPolicy is a key's rotation policy.

type RotationTrigger 

type RotationTrigger struct {
	TimeAfterCreate  string `json:"timeAfterCreate,omitempty"`
	TimeBeforeExpiry string `json:"timeBeforeExpiry,omitempty"`
}

RotationTrigger is a rotation lifetime-action trigger.

type SANs 

type SANs struct {
	Emails      []string `json:"emails,omitempty"`
	DNSNames    []string `json:"dns_names,omitempty"`
	UPNs        []string `json:"upns,omitempty"`
	URIs        []string `json:"uris,omitempty"`
	IPAddresses []string `json:"ipAddresses,omitempty"`
}

SANs are subject alternative names.

type SecretProps 

type SecretProps struct {
	ContentType string `json:"contentType,omitempty"`
}

SecretProps are the certificate policy secret properties.

type SecretVersion 

type SecretVersion struct {
	Tags        map[string]string `json:"tags,omitempty"`
	ID          string            `json:"id"`
	Value       string            `json:"value"`
	ContentType string            `json:"contentType,omitempty"`
	KID         string            `json:"kid,omitempty"`
	Attrs       Attributes        `json:"attrs"`
	Managed     bool              `json:"managed,omitempty"`
}

SecretVersion is one stored version of a secret.

func (*SecretVersion) Attr 

func (s *SecretVersion) Attr() *Attributes

Attr implements Versioned.

func (*SecretVersion) VersionID 

func (s *SecretVersion) VersionID() string

VersionID implements Versioned.

type SecretWire 

type SecretWire struct {
	Value              *string           `json:"value,omitempty"`
	Attributes         *Attributes       `json:"attributes,omitempty"`
	Tags               map[string]string `json:"tags,omitempty"`
	DeletedDate        *int64            `json:"deletedDate,omitempty"`
	ScheduledPurgeDate *int64            `json:"scheduledPurgeDate,omitempty"`
	ID                 string            `json:"id"`
	ContentType        string            `json:"contentType,omitempty"`
	KID                string            `json:"kid,omitempty"`
	RecoveryID         string            `json:"recoveryId,omitempty"`
	Managed            bool              `json:"managed,omitempty"`
}

SecretWire is the secret bundle/item/deleted-bundle wire shape.

type SetSecretRequest 

type SetSecretRequest struct {
	Value       *string           `json:"value"`
	Attributes  *Attributes       `json:"attributes"`
	Tags        map[string]string `json:"tags"`
	ContentType string            `json:"contentType"`
}

SetSecretRequest is the PUT /secrets/{name} body.

type Settings 

type Settings struct {
	TLSCertFile string `` //nolint:lll // config struct tags are intentionally verbose
	/* 249-byte string literal not displayed */
	TLSKeyFile string `` //nolint:lll // config struct tags are intentionally verbose
	/* 152-byte string literal not displayed */
	Port int `` //nolint:lll // config struct tags are intentionally verbose
	/* 265-byte string literal not displayed */
	ValidateTokens bool `` //nolint:lll // config struct tags are intentionally verbose
	/* 265-byte string literal not displayed */
	AutoCreateVaults bool `` //nolint:lll // config struct tags are intentionally verbose
	/* 264-byte string literal not displayed */
}

Settings holds Key Vault service configuration.

func DefaultSettings 

func DefaultSettings() Settings

DefaultSettings returns the default Settings.

type UpdateCertRequest 

type UpdateCertRequest struct {
	Attributes *Attributes       `json:"attributes"`
	Tags       map[string]string `json:"tags"`
}

UpdateCertRequest is the PATCH /certificates/{name}/{version} body.

type UpdateKeyRequest 

type UpdateKeyRequest struct {
	Attributes *Attributes       `json:"attributes"`
	Tags       map[string]string `json:"tags"`
	KeyOps     []string          `json:"key_ops"`
}

UpdateKeyRequest is the PATCH /keys/{name}/{version} body.

type UpdatePendingRequest 

type UpdatePendingRequest struct {
	CancellationRequested bool `json:"cancellation_requested"`
}

UpdatePendingRequest is the PATCH /certificates/{name}/pending body.

type UpdateSecretRequest 

type UpdateSecretRequest struct {
	Attributes  *Attributes       `json:"attributes"`
	Tags        map[string]string `json:"tags"`
	ContentType *string           `json:"contentType"`
}

UpdateSecretRequest is the PATCH /secrets/{name}/{version} body.

type VaultOptions 

type VaultOptions struct {
	RetentionDays   int
	PurgeProtection bool
}

VaultOptions are the ARM-controlled vault properties.

type VerifyResult 

type VerifyResult struct {
	Value bool `json:"value"`
}

VerifyResult is the verify response.

type Versioned 

type Versioned interface {
	comparable
	VersionID() string
	Attr() *Attributes
}

Versioned is implemented by the per-kind version records.

type X509Props 

type X509Props struct {
	SANs           *SANs    `json:"sans,omitempty"`
	Subject        string   `json:"subject,omitempty"`
	EKUs           []string `json:"ekus,omitempty"`
	KeyUsage       []string `json:"key_usage,omitempty"`
	ValidityMonths int      `json:"validity_months,omitempty"`
}

X509Props are the certificate policy X.509 properties.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.