Documentation
¶
Index ¶
- Constants
- Variables
- func KeyringType(config *schema.AuthConfig) string
- func NewCredentialStore() types.CredentialStoredeprecated
- func NewCredentialStoreWithConfig(authConfig *schema.AuthConfig) types.CredentialStore
- func NewKeyringAuthStore() types.CredentialStore
- func OpenKeyring(config *schema.AuthConfig) (keyring.Keyring, error)
- func RegisterCodec(tag string, constructor CredentialConstructor) error
- type CodecRegistry
- type CredentialConstructor
Constants ¶
const ( // KeyringUser is the "account" used to store credentials in the keyring. Here we use atmos-auth to provide a consistent way to search for atmos credentials. KeyringUser = "atmos-auth" // KeyringRealmPrefix is the prefix used for realm-scoped keyring keys. KeyringRealmPrefix = "atmos" // KeyringSeparator is the separator used between key components. // Uses underscore instead of colon for Windows compatibility (colons not allowed in filenames). KeyringSeparator = "_" )
const (
// KeyringDirPermissions is the default permission for the keyring directory (owner-only).
KeyringDirPermissions = 0o700
)
Variables ¶
var ( // ErrUnsupportedCredentialType indicates the credential type is not supported. ErrUnsupportedCredentialType = errors.New("unsupported credential type") // ErrUnknownCredentialType indicates an unknown credential type was encountered. ErrUnknownCredentialType = errors.New("unknown credential type") // ErrCredentialsNotFound indicates credentials were not found for the given key. ErrCredentialsNotFound = errors.New("credentials not found") // ErrDataNotFound indicates data was not found for the given key. ErrDataNotFound = errors.New("data not found") // ErrPasswordRequired indicates a password is required but not provided. ErrPasswordRequired = errors.New("keyring password required") // ErrPasswordTooShort indicates the password does not meet the minimum length requirement. ErrPasswordTooShort = errors.New("password must be at least 8 characters") )
var ErrCredentialStore = errors.New("credential store")
ErrCredentialStore is the static sentinel for credential-store failures.
var ErrListNotSupported = errors.New("listing credentials is not supported with keyring backend")
ErrListNotSupported indicates that listing credentials is not supported with keyring backend.
var ErrNotSupported = errors.New("not supported")
ErrNotSupported indicates an unsupported operation for this backend.
Functions ¶
func KeyringType ¶
func KeyringType(config *schema.AuthConfig) string
KeyringType reports the selected backend including the existing environment override.
func NewCredentialStore
deprecated
func NewCredentialStore() types.CredentialStore
NewCredentialStore creates a new credential store instance based on configuration. It selects the appropriate backend (system, file, or memory) based on: 1. ATMOS_KEYRING_TYPE environment variable (highest priority). 2. AuthConfig.Keyring.Type configuration. 3. Default to "system" for backward compatibility.
Deprecated: this no-argument form cannot honor auth.keyring.type from atmos.yaml because it passes a nil config to NewCredentialStoreWithConfig. Production code MUST use NewCredentialStoreWithConfig(authConfig) so the configured keyring backend is selected (see issue #2544). This form remains only for tests and other call sites that genuinely have no auth config.
func NewCredentialStoreWithConfig ¶ added in v1.196.0
func NewCredentialStoreWithConfig(authConfig *schema.AuthConfig) types.CredentialStore
NewCredentialStoreWithConfig creates a credential store with explicit configuration.
func NewKeyringAuthStore ¶
func NewKeyringAuthStore() types.CredentialStore
NewKeyringAuthStore creates a new system keyring-based auth store (for backward compatibility). Deprecated: Use NewCredentialStore() instead.
func OpenKeyring ¶
func OpenKeyring(config *schema.AuthConfig) (keyring.Keyring, error)
OpenKeyring opens the configured auth backend for private provider sessions. Unlike optional credential caching, durable session writes must fail visibly when the requested backend cannot be opened; no fallback to noop is allowed.
func RegisterCodec ¶
func RegisterCodec(tag string, constructor CredentialConstructor) error
RegisterCodec extends credential persistence without replacing a built-in codec.
Types ¶
type CodecRegistry ¶
type CodecRegistry struct {
// contains filtered or unexported fields
}
CodecRegistry maps persisted envelope tags to credential types. Registering a new type never changes the encoding of existing sessions.
func NewCodecRegistry ¶
func NewCodecRegistry() *CodecRegistry
NewCodecRegistry registers the legacy JSON representations used by existing sessions.
func (*CodecRegistry) Marshal ¶
func (r *CodecRegistry) Marshal(creds types.ICredentials) (string, []byte, error)
Marshal encodes credentials using their registered, stable envelope tag.
func (*CodecRegistry) Register ¶
func (r *CodecRegistry) Register(tag string, constructor CredentialConstructor) error
Register binds a unique persisted tag to a unique concrete credential type. Constructors must return a fresh pointer of the same type on every call.
func (*CodecRegistry) Unmarshal ¶
func (r *CodecRegistry) Unmarshal(tag string, raw []byte) (types.ICredentials, error)
Unmarshal decodes a stored envelope. Unknown tags fail without interpreting its payload.
type CredentialConstructor ¶
type CredentialConstructor func() types.ICredentials
CredentialConstructor returns a fresh non-nil pointer for JSON decoding.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package credtest isolates tests from the operating-system keychain.
|
Package credtest isolates tests from the operating-system keychain. |
|
Package prompt provides shared secret input forms for auth identities.
|
Package prompt provides shared secret input forms for auth identities. |