Documentation
¶
Overview ¶
Package secretstore backs the secret broker with SQLite.
It is a type-converting adapter, in the same shape and for the same reasons as pkg/executorstore: pkg/statedb owns the rows and the SQL, pkg/secretbroker owns the policy and the crypto, and this package joins them. Keeping the broker free of a SQLite dependency is what lets its constraint-enforcement logic — the part worth testing exhaustively — be tested against an in-memory store with no database file in sight.
The payload crosses this boundary sealed in both directions. Nothing here holds a key or decrypts anything.
Index ¶
- type Auditor
- type EgressStore
- type Store
- func (s *Store) CountSealedByKey() (map[string]int, error)
- func (s *Store) DeleteSecret(id string) error
- func (s *Store) GetGrant(id string) (secretbroker.Grant, error)
- func (s *Store) GetSecret(id string) (secretbroker.Secret, error)
- func (s *Store) ListGrants() ([]secretbroker.Grant, error)
- func (s *Store) ListKEKs() ([]secretbroker.KEKRecord, error)
- func (s *Store) ListRotations(limit int) ([]secretbroker.RotationRecord, error)
- func (s *Store) ListSealedNotUnder(keyID string, limit int) ([]secretbroker.SealedRow, error)
- func (s *Store) ListSecrets() ([]secretbroker.Secret, error)
- func (s *Store) Meta(key string) (string, bool, error)
- func (s *Store) PrimaryKEK() (secretbroker.KEKRecord, bool, error)
- func (s *Store) PromoteKEK(id string, at time.Time) error
- func (s *Store) PutGrant(g secretbroker.Grant) error
- func (s *Store) PutKEK(k secretbroker.KEKRecord) error
- func (s *Store) PutRotation(r secretbroker.RotationRecord) error
- func (s *Store) PutSecret(sec secretbroker.Secret) error
- func (s *Store) ReplaceSealed(id string, expect, next secretbroker.Envelope) (bool, error)
- func (s *Store) RetireKEK(id string, at time.Time) error
- func (s *Store) RevokeGrant(id string, at time.Time) error
- func (s *Store) SealedSetName() string
- func (s *Store) SetMeta(key, value string) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Auditor ¶
type Auditor struct {
// contains filtered or unexported fields
}
Auditor writes broker decisions into the hash-chained audit_events table.
Every mint, grant, lease, renew, revoke, and denial lands here with the subject, the secret ID, and the reason. Payloads never do — see the redaction note on Audit.
func NewAuditor ¶
NewAuditor wraps a database handle as a broker audit sink. A nil db yields a sink that drops events, so a caller that could not open the database still gets a working broker rather than a nil-pointer panic on the first decision.
func (*Auditor) Audit ¶
func (a *Auditor) Audit(ev secretbroker.Event)
Audit persists one brokered-operation event.
Redact is called again here even though the broker already redacts on emission. That is not redundancy for its own sake: this is the last function before a credential-shaped string would become a permanent, hash-chained, deliberately-immutable row. An audit log is the worst place in the system to discover a leak, because the tamper-evidence that makes it valuable is also what makes it awkward to clean up. Redacting at the boundary means a future caller who constructs an Event by hand, or a broker change that adds a new emission path, cannot write plaintext here by omission.
Best-effort, matching pkg/statedb's other audit emitters: a full or read-only database must not stop a workload from getting its credentials. The chain verifier surfaces the resulting gap.
type EgressStore ¶
type EgressStore struct {
// contains filtered or unexported fields
}
EgressStore implements egressbroker.Store over a *statedb.DB.
func NewEgressStore ¶
func NewEgressStore(db *statedb.DB) (*EgressStore, error)
NewEgressStore wraps a database handle.
func (*EgressStore) GetGrant ¶
func (s *EgressStore) GetGrant(id string) (egressbroker.Grant, error)
GetGrant returns one grant by ID.
func (*EgressStore) ListGrants ¶
func (s *EgressStore) ListGrants() ([]egressbroker.Grant, error)
ListGrants returns every grant.
A row whose policy or subject cannot be decoded is skipped, and skipped in the deny direction: a grant the broker cannot read is a grant it will not honour, so a corrupt row silently loses access rather than silently keeping it. This mirrors Store.ListGrants exactly, and for the same reason.
func (*EgressStore) PutGrant ¶
func (s *EgressStore) PutGrant(g egressbroker.Grant) error
PutGrant persists an egress grant.
func (*EgressStore) RevokeGrant ¶
func (s *EgressStore) RevokeGrant(id string, at time.Time) error
RevokeGrant stamps a grant revoked.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store implements secretbroker.Store over a *statedb.DB.
func (*Store) CountSealedByKey ¶
CountSealedByKey groups stored secrets by the key sealing them.
func (*Store) DeleteSecret ¶
DeleteSecret removes a secret.
func (*Store) GetGrant ¶
func (s *Store) GetGrant(id string) (secretbroker.Grant, error)
GetGrant returns one grant by ID.
func (*Store) GetSecret ¶
func (s *Store) GetSecret(id string) (secretbroker.Secret, error)
GetSecret returns one secret by ID, translating the storage sentinel into the broker's so callers can use a single errors.Is target.
func (*Store) ListGrants ¶
func (s *Store) ListGrants() ([]secretbroker.Grant, error)
ListGrants returns every grant.
A row whose constraints or subject cannot be decoded is skipped rather than failing the whole listing, but it is skipped in the deny direction: a grant the broker cannot read is a grant the broker will not honour, so a corrupt row silently loses access rather than silently keeping it.
func (*Store) ListKEKs ¶
func (s *Store) ListKEKs() ([]secretbroker.KEKRecord, error)
ListKEKs returns every KEK, retired ones included.
func (*Store) ListRotations ¶
func (s *Store) ListRotations(limit int) ([]secretbroker.RotationRecord, error)
ListRotations returns rotation history, newest first.
func (*Store) ListSealedNotUnder ¶
ListSealedNotUnder returns secrets still sealed under some other key.
A secret's associated data is its own ID, matching what Broker.Mint sealed it with. Getting this wrong would not silently weaken anything — the rewrap would fail authentication and the row would be reported as stuck — which is the property AAD binding is supposed to have.
func (*Store) ListSecrets ¶
func (s *Store) ListSecrets() ([]secretbroker.Secret, error)
ListSecrets returns every stored secret.
func (*Store) PrimaryKEK ¶
func (s *Store) PrimaryKEK() (secretbroker.KEKRecord, bool, error)
PrimaryKEK returns the current primary, if any.
func (*Store) PromoteKEK ¶
PromoteKEK makes a key the sole primary.
func (*Store) PutGrant ¶
func (s *Store) PutGrant(g secretbroker.Grant) error
PutGrant persists a grant.
func (*Store) PutKEK ¶
func (s *Store) PutKEK(k secretbroker.KEKRecord) error
PutKEK persists a key-encryption key record.
func (*Store) PutRotation ¶
func (s *Store) PutRotation(r secretbroker.RotationRecord) error
PutRotation records rotation progress.
func (*Store) PutSecret ¶
func (s *Store) PutSecret(sec secretbroker.Secret) error
PutSecret persists a sealed secret.
func (*Store) ReplaceSealed ¶
ReplaceSealed swaps a secret's envelope under compare-and-swap.
func (*Store) RevokeGrant ¶
RevokeGrant stamps a grant revoked.
func (*Store) SealedSetName ¶
SealedSetName identifies this population in rotation reports and, more importantly, namespaces every envelope's associated data.
Source Files