Documentation
¶
Overview ¶
Package ward provides the application engine layer between the CLI and the secrets package. All orchestration logic lives here; the CLI layer only handles flag parsing and output formatting.
Index ¶
- type Encryptor
- type Engine
- func (e *Engine) Decrypt(path string) ([]byte, error)
- func (e *Engine) Encrypt(path string, plaintext []byte) error
- func (e *Engine) EnvVars(r *MergeResult, prefixed bool) (map[string]secrets.EnvEntry, error)
- func (e *Engine) EnvVarsMap(r *MergeResult, prefixed bool) (map[string]string, error)
- func (e *Engine) EnvVarsPrefer(r *MergeResult, prefixed bool, preferPrefix string) (map[string]secrets.EnvEntry, error)
- func (e *Engine) GetAtPath(r *MergeResult, dotPath string) (*secrets.Node, error)
- func (e *Engine) Inspect() error
- func (e *Engine) InspectAll(scopePrefix string, prefixed bool) (InspectAllResult, error)
- func (e *Engine) InspectScoped(scopePrefix string, prefixed bool) error
- func (e *Engine) LoadFiles() ([]secrets.ParsedFile, error)
- func (e *Engine) Merge() (*MergeResult, error)
- func (e *Engine) MergeForView() (*MergeResult, error)
- func (e *Engine) MergeScoped(scopePrefix string) (*MergeResult, error)
- func (e *Engine) SourcePaths() []string
- type InspectAllResult
- type MergeResult
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Encryptor ¶
Encrypt writes content back to path using the configured encryptor. For SopsDecryptor this calls "sops encrypt"; for MockDecryptor it writes plain.
type Engine ¶
type Engine struct {
// contains filtered or unexported fields
}
Engine orchestrates secret discovery, loading, merging and env-var resolution. The zero value is not usable; construct via NewEngine.
func (*Engine) Decrypt ¶
Decrypt returns the plain-text YAML bytes of a .ward file using the configured decryptor. For plain (unencrypted) files this is a passthrough.
func (*Engine) Encrypt ¶
Encrypt re-encrypts plaintext and writes it to path. Falls back to a plain write when no real encryptor is configured.
func (*Engine) EnvVars ¶
EnvVars resolves env vars from the merged result. Flat leaf names (DATABASE_URL), or full path if --prefixed.
func (*Engine) EnvVarsMap ¶
EnvVarsMap is like EnvVars but returns plain string values (for injection into a child process environment).
func (*Engine) EnvVarsPrefer ¶
func (e *Engine) EnvVarsPrefer(r *MergeResult, prefixed bool, preferPrefix string) (map[string]secrets.EnvEntry, error)
EnvVarsPrefer is like EnvVars but resolves env var collisions in favour of entries whose dot-path is under preferPrefix. All other vars from the full tree are still included.
func (*Engine) GetAtPath ¶
GetAtPath navigates the merged tree by dot-path and returns the node at that location, or a *secrets.KeyNotFoundError (naming the level where the path broke and the keys available there) when it does not exist.
func (*Engine) Inspect ¶
Inspect reports any conflict across all files: a Type-1 file conflict (*secrets.ConflictError) or a Type-2 env var collision (*secrets.EnvConflictError). It returns nil when the whole set is clean.
func (*Engine) InspectAll ¶ added in v0.1.76
func (e *Engine) InspectAll(scopePrefix string, prefixed bool) (InspectAllResult, error)
InspectAll runs all checks without short-circuiting, so every error category is always reported even when multiple types are present. When prefixed is true, Type-2 env var collisions are not checked (same semantics as InspectScoped).
func (*Engine) InspectScoped ¶ added in v0.1.76
InspectScoped is like Inspect but narrows detection to a dot-path and can model the --prefixed resolution. Conflicts and collisions outside the scope are resolved away so a caller can check a single path in isolation; passing "" inspects the whole tree. When prefixed is true, env var names use their full dot-path (as `--prefixed` does), so Type-2 collisions cannot occur and only Type-1 file conflicts are reported — letting a caller confirm that --prefixed resolves the collisions.
func (*Engine) LoadFiles ¶ added in v0.1.76
func (e *Engine) LoadFiles() ([]secrets.ParsedFile, error)
LoadFiles discovers and loads all .ward files from every configured vault, returning them parsed but unmerged (in config/discovery order).
func (*Engine) Merge ¶
func (e *Engine) Merge() (*MergeResult, error)
Merge loads all .ward files from all vaults and merges them using the on_conflict mode from the configuration. Merge loads all vaults and merges them. Any conflict is an error.
func (*Engine) MergeForView ¶
func (e *Engine) MergeForView() (*MergeResult, error)
MergeForView is like Merge but always produces a complete tree even when conflicts exist. Conflict information is attached to the result so the presentation layer can highlight conflicting keys.
func (*Engine) MergeScoped ¶
func (e *Engine) MergeScoped(scopePrefix string) (*MergeResult, error)
MergeScoped is like Merge but scopes conflict detection to a dot-path prefix. Conflicts outside that prefix are silently resolved so the scoped path can be used without being blocked by unrelated conflicts.
func (*Engine) SourcePaths ¶
SourcePaths returns the configured source directory paths.
type InspectAllResult ¶ added in v0.1.76
type InspectAllResult struct {
ConflictErr *secrets.ConflictError
EnvConflictErr *secrets.EnvConflictError
}
InspectAllResult holds all detected issues across the three error categories. Unlike InspectScoped, collection does not short-circuit on the first error type.
type MergeResult ¶
type MergeResult struct {
Tree map[string]*secrets.Node
ConflictErr *secrets.ConflictError // non-nil only when called via MergeForView
}
MergeResult is the outcome of a load-and-merge operation.
Source Files