Documentation
¶
Overview ¶
Package secretstore backs the secret broker with SQLite.
It is a type-converting adapter, in the same shape and for the same reasons as pkg/executorstore: pkg/statedb owns the rows and the SQL, pkg/secretbroker owns the policy and the crypto, and this package joins them. Keeping the broker free of a SQLite dependency is what lets its constraint-enforcement logic — the part worth testing exhaustively — be tested against an in-memory store with no database file in sight.
The payload crosses this boundary sealed in both directions. Nothing here holds a key or decrypts anything.
Index ¶
- type Auditor
- type EgressStore
- type Store
- func (s *Store) AttributeKEK(id, root string) (bool, error)
- func (s *Store) CountSealedByKey() (map[string]int, error)
- func (s *Store) DeleteAppSlot(leaseID, grantID, holder string) (bool, error)
- func (s *Store) DeleteAppSlots(leaseID, holder string) (int, error)
- func (s *Store) DeleteLease(id, holder string) (bool, error)
- func (s *Store) DeleteSecret(id string) error
- func (s *Store) DeleteSecretTombstoned(id string, t secretbroker.Tombstone) error
- func (s *Store) ExpireAccessRequests(now time.Time) ([]secretbroker.AccessRequest, error)
- func (s *Store) ExtendLease(id, holder string, expiresAt time.Time) (bool, error)
- func (s *Store) GetAccessRequest(id string) (secretbroker.AccessRequest, error)
- func (s *Store) GetGrant(id string) (secretbroker.Grant, error)
- func (s *Store) GetLease(id string) (secretbroker.LeaseRecord, error)
- func (s *Store) GetSecret(id string) (secretbroker.Secret, error)
- func (s *Store) GetTombstone(secretID string) (secretbroker.Tombstone, error)
- func (s *Store) LeaseRevocations(leaseID string) ([]secretbroker.LeaseRevocation, error)
- func (s *Store) ListAccessRequests() ([]secretbroker.AccessRequest, error)
- func (s *Store) ListAppSlots(leaseID string) ([]secretbroker.AppSlotRecord, error)
- func (s *Store) ListGrants() ([]secretbroker.Grant, error)
- func (s *Store) ListKEKs() ([]secretbroker.KEKRecord, error)
- func (s *Store) ListLeaseRevocations(pendingOnly bool) ([]secretbroker.LeaseRevocation, error)
- func (s *Store) ListLeases() ([]secretbroker.LeaseRecord, error)
- func (s *Store) ListRequestUses(requestID string) ([]secretbroker.RequestUse, error)
- func (s *Store) ListRotations(limit int) ([]secretbroker.RotationRecord, error)
- func (s *Store) ListSealedNotUnder(keyID string, limit int) ([]secretbroker.SealedRow, error)
- func (s *Store) ListSecrets() ([]secretbroker.Secret, error)
- func (s *Store) Location() string
- func (s *Store) Meta(key string) (string, bool, error)
- func (s *Store) NoteLeaseRevocation(leaseID, grantID, detail string) error
- func (s *Store) PrimaryKEK() (secretbroker.KEKRecord, bool, error)
- func (s *Store) PromoteKEK(id string, at time.Time) error
- func (s *Store) PutAccessRequest(r secretbroker.AccessRequest) error
- func (s *Store) PutAppSlot(r secretbroker.AppSlotRecord) error
- func (s *Store) PutGrant(g secretbroker.Grant) error
- func (s *Store) PutKEK(k secretbroker.KEKRecord) error
- func (s *Store) PutLease(r secretbroker.LeaseRecord) error
- func (s *Store) PutLeaseRevocation(r secretbroker.LeaseRevocation) error
- func (s *Store) PutRotation(r secretbroker.RotationRecord) error
- func (s *Store) PutSecret(sec secretbroker.Secret) error
- func (s *Store) RecordRequestUse(u secretbroker.RequestUse) error
- func (s *Store) ReplaceSealed(id string, expect, next secretbroker.Envelope) (bool, error)
- func (s *Store) RetireKEK(id string, at time.Time) error
- func (s *Store) RevokeGrant(id string, at time.Time) error
- func (s *Store) RevokeGrantSuperseded(id string, at time.Time, successorID string) error
- func (s *Store) RevokeGrantWithCause(id string, at time.Time, cause secretbroker.RevocationCause) error
- func (s *Store) SealedSetName() string
- func (s *Store) SetLeaseGrants(id, holder string, grantIDs []string) (bool, error)
- func (s *Store) SetMeta(key, value string) error
- func (s *Store) SetUnguardedAck(id string, ack secretbroker.UnguardedAck) error
- func (s *Store) SettleLeaseRevocation(leaseID, grantID, by, detail string, at time.Time) (bool, error)
- func (s *Store) TakeAppSlots(leaseID, from, holder string) (int, error)
- func (s *Store) TakeLease(id, from, holder string) (bool, error)
- func (s *Store) UpdateAppSlot(r secretbroker.AppSlotRecord) (bool, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Auditor ¶
type Auditor struct {
// contains filtered or unexported fields
}
Auditor writes broker decisions into the hash-chained audit_events table.
Every mint, grant, lease, renew, revoke, and denial lands here with the subject, the secret ID, and the reason. Payloads never do — see the redaction note on Audit.
func NewAuditor ¶
NewAuditor wraps a database handle as a broker audit sink. A nil db yields a sink that drops events, so a caller that could not open the database still gets a working broker rather than a nil-pointer panic on the first decision.
func (*Auditor) Audit ¶
func (a *Auditor) Audit(ev secretbroker.Event)
Audit persists one brokered-operation event.
Redact is called again here even though the broker already redacts on emission. That is not redundancy for its own sake: this is the last function before a credential-shaped string would become a permanent, hash-chained, deliberately-immutable row. An audit log is the worst place in the system to discover a leak, because the tamper-evidence that makes it valuable is also what makes it awkward to clean up. Redacting at the boundary means a future caller who constructs an Event by hand, or a broker change that adds a new emission path, cannot write plaintext here by omission.
Best-effort, matching pkg/statedb's other audit emitters: a full or read-only database must not stop a workload from getting its credentials. The chain verifier surfaces the resulting gap.
type EgressStore ¶
type EgressStore struct {
// contains filtered or unexported fields
}
EgressStore implements egressbroker.Store over a *statedb.DB.
func NewEgressStore ¶
func NewEgressStore(db *statedb.DB) (*EgressStore, error)
NewEgressStore wraps a database handle.
func (*EgressStore) GetGrant ¶
func (s *EgressStore) GetGrant(id string) (egressbroker.Grant, error)
GetGrant returns one grant by ID.
func (*EgressStore) ListGrants ¶
func (s *EgressStore) ListGrants() ([]egressbroker.Grant, error)
ListGrants returns every grant.
A row whose policy or subject cannot be decoded is skipped, and skipped in the deny direction: a grant the broker cannot read is a grant it will not honour, so a corrupt row silently loses access rather than silently keeping it. This mirrors Store.ListGrants exactly, and for the same reason.
func (*EgressStore) PutGrant ¶
func (s *EgressStore) PutGrant(g egressbroker.Grant) error
PutGrant persists an egress grant.
func (*EgressStore) RevokeGrant ¶
func (s *EgressStore) RevokeGrant(id string, at time.Time) error
RevokeGrant stamps a grant revoked.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store implements secretbroker.Store over a *statedb.DB.
func (*Store) AttributeKEK ¶ added in v0.0.6
AttributeKEK records the root a key derives from, once (Task 20425).
func (*Store) CountSealedByKey ¶
CountSealedByKey groups stored secrets by the key sealing them.
func (*Store) DeleteAppSlot ¶ added in v0.0.5
DeleteAppSlot forgets one slot if holder holds it.
func (*Store) DeleteAppSlots ¶ added in v0.0.5
DeleteAppSlots forgets the slots of leaseID that holder holds.
func (*Store) DeleteLease ¶ added in v0.0.5
DeleteLease removes a record if holder holds it.
func (*Store) DeleteSecret ¶
DeleteSecret removes a secret.
func (*Store) DeleteSecretTombstoned ¶ added in v0.0.5
func (s *Store) DeleteSecretTombstoned(id string, t secretbroker.Tombstone) error
DeleteSecretTombstoned removes a secret and records what it was, in one transaction.
func (*Store) ExpireAccessRequests ¶ added in v0.0.2
func (s *Store) ExpireAccessRequests(now time.Time) ([]secretbroker.AccessRequest, error)
ExpireAccessRequests moves lapsed pending requests to expired.
A row that cannot be decoded is still expired — the UPDATE ran against it — but is dropped from the returned slice, so it produces no audit event. That is the honest outcome: the broker cannot say what lapsed if it cannot read the request, and inventing a partial event would put a subject the store could not parse into the permanent trail.
func (*Store) ExtendLease ¶ added in v0.0.5
ExtendLease moves a record's deadline if holder holds it.
func (*Store) GetAccessRequest ¶ added in v0.0.2
func (s *Store) GetAccessRequest(id string) (secretbroker.AccessRequest, error)
GetAccessRequest returns one request by ID.
func (*Store) GetGrant ¶
func (s *Store) GetGrant(id string) (secretbroker.Grant, error)
GetGrant returns one grant by ID.
func (*Store) GetLease ¶ added in v0.0.5
func (s *Store) GetLease(id string) (secretbroker.LeaseRecord, error)
GetLease returns one record, or a wrapped secretbroker.ErrLeaseNotFound.
func (*Store) GetSecret ¶
func (s *Store) GetSecret(id string) (secretbroker.Secret, error)
GetSecret returns one secret by ID, translating the storage sentinel into the broker's so callers can use a single errors.Is target.
func (*Store) GetTombstone ¶ added in v0.0.5
func (s *Store) GetTombstone(secretID string) (secretbroker.Tombstone, error)
GetTombstone returns what a deleted secret was.
func (*Store) LeaseRevocations ¶ added in v0.0.5
func (s *Store) LeaseRevocations(leaseID string) ([]secretbroker.LeaseRevocation, error)
LeaseRevocations returns every revocation of one lease.
func (*Store) ListAccessRequests ¶ added in v0.0.2
func (s *Store) ListAccessRequests() ([]secretbroker.AccessRequest, error)
ListAccessRequests returns every request.
A row whose subject or constraints cannot be decoded is skipped, matching ListGrants — and skipped in the same direction, which here means the request becomes invisible and therefore unapprovable. That is the safe failure: a corrupt row cannot be turned into a grant whose scope nobody can read.
func (*Store) ListAppSlots ¶ added in v0.0.5
func (s *Store) ListAppSlots(leaseID string) ([]secretbroker.AppSlotRecord, error)
ListAppSlots returns the slots of leaseID. One whose scope cannot be read is skipped: a restore that cannot know a token's scope must not mint one.
func (*Store) ListGrants ¶
func (s *Store) ListGrants() ([]secretbroker.Grant, error)
ListGrants returns every grant.
A row whose constraints or subject cannot be decoded is skipped rather than failing the whole listing, but it is skipped in the deny direction: a grant the broker cannot read is a grant the broker will not honour, so a corrupt row silently loses access rather than silently keeping it.
func (*Store) ListKEKs ¶
func (s *Store) ListKEKs() ([]secretbroker.KEKRecord, error)
ListKEKs returns every KEK, retired ones included.
func (*Store) ListLeaseRevocations ¶ added in v0.0.5
func (s *Store) ListLeaseRevocations(pendingOnly bool) ([]secretbroker.LeaseRevocation, error)
ListLeaseRevocations returns every revocation, or only the pending ones.
func (*Store) ListLeases ¶ added in v0.0.5
func (s *Store) ListLeases() ([]secretbroker.LeaseRecord, error)
ListLeases returns every record. One that cannot be read is skipped rather than failing the list: the sweep that reads it must not be stopped by one bad row from reaching the others.
func (*Store) ListRequestUses ¶ added in v0.0.2
func (s *Store) ListRequestUses(requestID string) ([]secretbroker.RequestUse, error)
ListRequestUses returns the leases recorded against one request.
It reconciles task attribution first. That write-during-a-read is deliberate and is explained in statedb.AttributeRequestUseTasks: a lease is issued before the workload that holds it is dispatched, so the task can only be learned afterwards, and only while the dispatched handle is still live. Doing it here means an approver opening the panel captures attributions that would otherwise be lost when the workload ends. A failure is ignored rather than surfaced — the uses themselves are still the answer, just with one column short.
func (*Store) ListRotations ¶
func (s *Store) ListRotations(limit int) ([]secretbroker.RotationRecord, error)
ListRotations returns rotation history, newest first.
func (*Store) ListSealedNotUnder ¶
ListSealedNotUnder returns secrets still sealed under some other key.
A secret's associated data is its own ID, matching what Broker.Mint sealed it with. Getting this wrong would not silently weaken anything — the rewrap would fail authentication and the row would be reported as stuck — which is the property AAD binding is supposed to have.
func (*Store) ListSecrets ¶
func (s *Store) ListSecrets() ([]secretbroker.Secret, error)
ListSecrets returns every stored secret.
func (*Store) Location ¶ added in v0.0.5
Location names the database the store reads, for a subscriber to the broker's revocations that must tell control planes apart (Task 20403).
func (*Store) NoteLeaseRevocation ¶ added in v0.0.5
NoteLeaseRevocation records why a revocation is still pending.
func (*Store) PrimaryKEK ¶
func (s *Store) PrimaryKEK() (secretbroker.KEKRecord, bool, error)
PrimaryKEK returns the current primary, if any.
func (*Store) PromoteKEK ¶
PromoteKEK makes a key the sole primary.
func (*Store) PutAccessRequest ¶ added in v0.0.2
func (s *Store) PutAccessRequest(r secretbroker.AccessRequest) error
PutAccessRequest persists a request.
func (*Store) PutAppSlot ¶ added in v0.0.5
func (s *Store) PutAppSlot(r secretbroker.AppSlotRecord) error
PutAppSlot records a slot.
func (*Store) PutGrant ¶
func (s *Store) PutGrant(g secretbroker.Grant) error
PutGrant persists a grant.
func (*Store) PutKEK ¶
func (s *Store) PutKEK(k secretbroker.KEKRecord) error
PutKEK persists a key-encryption key record.
func (*Store) PutLease ¶ added in v0.0.5
func (s *Store) PutLease(r secretbroker.LeaseRecord) error
PutLease records a lease.
func (*Store) PutLeaseRevocation ¶ added in v0.0.5
func (s *Store) PutLeaseRevocation(r secretbroker.LeaseRevocation) error
PutLeaseRevocation records a lease revocation.
func (*Store) PutRotation ¶
func (s *Store) PutRotation(r secretbroker.RotationRecord) error
PutRotation records rotation progress.
func (*Store) PutSecret ¶
func (s *Store) PutSecret(sec secretbroker.Secret) error
PutSecret persists a sealed secret.
func (*Store) RecordRequestUse ¶ added in v0.0.2
func (s *Store) RecordRequestUse(u secretbroker.RequestUse) error
RecordRequestUse notes one lease that redeemed an approved request's grant.
func (*Store) ReplaceSealed ¶
ReplaceSealed swaps a secret's envelope under compare-and-swap.
func (*Store) RevokeGrant ¶
RevokeGrant stamps a grant revoked.
func (*Store) RevokeGrantSuperseded ¶ added in v0.0.5
RevokeGrantSuperseded stamps a grant revoked because successorID replaced it.
func (*Store) RevokeGrantWithCause ¶ added in v0.0.5
func (s *Store) RevokeGrantWithCause(id string, at time.Time, cause secretbroker.RevocationCause) error
RevokeGrantWithCause stamps a grant revoked and records why.
func (*Store) SealedSetName ¶
SealedSetName identifies this population in rotation reports and, more importantly, namespaces every envelope's associated data.
func (*Store) SetLeaseGrants ¶ added in v0.0.5
SetLeaseGrants rewrites the grants a record carries if holder holds it (Task 20403).
func (*Store) SetUnguardedAck ¶ added in v0.0.5
func (s *Store) SetUnguardedAck(id string, ack secretbroker.UnguardedAck) error
SetUnguardedAck records, or with a zero ack clears, the unguarded acknowledgement on grant id (secretbroker.UnguardedAcknowledger).
func (*Store) SettleLeaseRevocation ¶ added in v0.0.5
func (s *Store) SettleLeaseRevocation(leaseID, grantID, by, detail string, at time.Time) (bool, error)
SettleLeaseRevocation marks a pending revocation enforced.
func (*Store) TakeAppSlots ¶ added in v0.0.5
TakeAppSlots moves the slots of leaseID from one holder to another.
func (*Store) UpdateAppSlot ¶ added in v0.0.5
func (s *Store) UpdateAppSlot(r secretbroker.AppSlotRecord) (bool, error)
UpdateAppSlot rewrites a slot's mutable fields if r.Holder holds it.
Source Files