store

package
v1.225.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 5, 2026 License: Apache-2.0 Imports: 9 Imported by: 0

Documentation

Overview

Package store is a generated GoMock package.

Package store is a generated GoMock package.

Index

Constants

View Source 
const (
	KindArtifactory    = "artifactory"
	KindAzureKeyVault  = "azure/keyvault"
	KindAWSSSM         = "aws/ssm"
	KindAWSASM         = "aws/asm"
	KindGCPSecret      = "gcp/secretmanager"
	KindHashicorpVault = "hashicorp/vault"
	KindRedis          = "redis"
	KindOnePassword    = "onepassword"
	KindKeychain       = "keychain"
	KindGitHubActions  = "github/actions"
)

Backend kind constants (cloud/thing vocabulary, shared with the secrets subsystem).

Variables

View Source 
var (
	// Common validation errors.
	ErrEmptyStack           = errors.New("stack cannot be empty")
	ErrEmptyComponent       = errors.New("component cannot be empty")
	ErrEmptyKey             = errors.New("key cannot be empty")
	ErrStackDelimiterNotSet = errors.New("stack delimiter is not set")
	ErrGetKey               = errors.New("failed to get key")

	// AWS SSM specific errors.
	ErrRegionRequired  = errors.New("region is required in ssm store configuration")
	ErrLoadAWSConfig   = errors.New("failed to load AWS config")
	ErrSetParameter    = errors.New("failed to set parameter")
	ErrGetParameter    = errors.New("failed to get parameter")
	ErrDeleteParameter = errors.New("failed to delete parameter")
	ErrListParameters  = errors.New("failed to list parameters")
	ErrAssumeRole      = errors.New("failed to assume role")

	// ErrDeleteNotSupported is returned by stores that do not support deletion.
	ErrDeleteNotSupported = errors.New("delete is not supported by this store")
	// ErrListNotSupported is returned by stores that do not support key enumeration.
	ErrListNotSupported = errors.New("list is not supported by this store")

	// Azure Key Vault specific errors.
	ErrVaultURLRequired     = errors.New("vault_url is required in azure key vault store configuration")
	ErrCreateClient         = errors.New("failed to create client")
	ErrAccessSecret         = errors.New("failed to access secret")
	ErrResourceNotFound     = errors.New("resource not found")
	ErrPermissionDenied     = errors.New("permission denied")
	ErrListSecretProperties = errors.New("failed to list secret properties")

	// Redis specific errors.
	ErrParseRedisURL   = errors.New("failed to parse redis url")
	ErrMissingRedisURL = errors.New("either url must be set in options or ATMOS_REDIS_URL environment variable must be set")
	ErrGetRedisKey     = errors.New("failed to get key from redis")
	ErrScanRedisKeys   = errors.New("failed to scan redis keys")

	// Artifactory specific errors.
	ErrMissingArtifactoryToken = errors.New("either access_token must be set in options or one of JFROG_ACCESS_TOKEN or ARTIFACTORY_ACCESS_TOKEN environment variables must be set")
	ErrCreateTempDir           = errors.New("failed to create temp dir")
	ErrCreateTempFile          = errors.New("failed to create temp file")
	ErrDownloadFile            = errors.New("failed to download file")
	ErrNoFilesDownloaded       = errors.New("no files downloaded")
	ErrReadFile                = errors.New("failed to read file")
	ErrUnmarshalFile           = errors.New("failed to unmarshal file")
	ErrWriteTempFile           = errors.New("failed to write to temp file")
	ErrUploadFile              = errors.New("failed to upload file")
	ErrListArtifacts           = errors.New("failed to list artifacts")

	// Google Secret Manager specific errors.
	ErrProjectIDRequired = errors.New("project_id is required in Google Secret Manager store configuration")
	ErrValueMustBeString = errors.New("value must be a string")
	ErrCreateSecret      = errors.New("failed to create secret")
	ErrAddSecretVersion  = errors.New("failed to add secret version")
	ErrListGoogleSecrets = errors.New("failed to list Google Secret Manager secrets")

	// Registry specific errors.
	ErrParseArtifactoryOptions    = errors.New("failed to parse Artifactory store options")
	ErrParseAzureKeyVaultOptions  = errors.New("failed to parse Azure Key Vault store options")
	ErrParseSSMOptions            = errors.New("failed to parse SSM store options")
	ErrParseSecretsManagerOptions = errors.New("failed to parse AWS Secrets Manager store options")
	ErrParseGSMOptions            = errors.New("failed to parse Google Secret Manager store options")
	ErrParseVaultOptions          = errors.New("failed to parse HashiCorp Vault store options")
	ErrParseRedisOptions          = errors.New("failed to parse Redis store options")
	ErrStoreTypeNotFound          = errors.New("store type not found")
	ErrSecretBackendNotEncrypted  = errors.New("store cannot be marked secret: backend does not encrypt values at rest")

	// ErrStoreNotConfigured is returned when a named store is referenced (e.g. by the `atmos
	// store` CLI or a `type: store` workflow step) but no store with that name is configured
	// under `stores:` in atmos.yaml.
	ErrStoreNotConfigured = errors.New("store not configured")

	// AWS Secrets Manager specific errors.
	ErrSetSecret    = errors.New("failed to set secret")
	ErrGetSecret    = errors.New("failed to get secret")
	ErrDeleteSecret = errors.New("failed to delete secret")
	ErrListSecrets  = errors.New("failed to list secrets")

	// HashiCorp Vault specific errors.
	ErrVaultAddressRequired = errors.New("address is required in hashicorp vault store configuration")
	ErrVaultMountRequired   = errors.New("mount is required in hashicorp vault store configuration")
	ErrVaultWrite           = errors.New("failed to write secret to vault")
	ErrVaultRead            = errors.New("failed to read secret from vault")
	ErrVaultDelete          = errors.New("failed to delete secret from vault")
	ErrVaultList            = errors.New("failed to list secrets from vault")
	ErrVaultEmptyData       = errors.New("vault returned empty data for secret")

	// 1Password specific errors.
	ErrOnePasswordNoAuth            = errors.New("no 1Password credentials found: set OP_SERVICE_ACCOUNT_TOKEN (or options.token), or OP_CONNECT_HOST + OP_CONNECT_TOKEN (or options.connect_host/connect_token)")
	ErrOnePasswordUnknownMode       = errors.New("unknown 1Password mode (expected auto, connect, or service-account)")
	ErrOnePasswordClientInit        = errors.New("failed to initialize 1Password client")
	ErrOnePasswordResolve           = errors.New("failed to resolve 1Password reference")
	ErrOnePasswordWrite             = errors.New("failed to write 1Password secret")
	ErrOnePasswordDelete            = errors.New("failed to delete 1Password secret")
	ErrOnePasswordReferenceTemplate = errors.New("failed to render 1Password reference template")
	ErrOnePasswordInvalidReference  = errors.New("invalid 1Password secret reference")
	ErrOnePasswordNotFound          = errors.New("1Password reference not found")
	ErrParseOnePasswordOptions      = errors.New("failed to parse 1Password store options")

	// GitHub Actions specific errors.
	ErrParseGitHubActionsOptions = errors.New("failed to parse GitHub Actions store options")
	ErrGitHubOwnerRepoRequired   = errors.New("owner and repo are required in GitHub Actions store configuration")
	ErrGitHubInvalidSecretName   = errors.New("invalid GitHub Actions secret name")
	ErrGitHubSecretValueCIOnly   = errors.New("GitHub Actions secret value is not readable outside a GitHub Actions runner")
	ErrGitHubSecretNotInEnv      = errors.New("GitHub Actions secret is not present in the environment")
	ErrGitHubSealSecret          = errors.New("failed to encrypt GitHub Actions secret")
	ErrGitHubPublicKeySize       = errors.New("GitHub Actions public key has unexpected size")
	ErrGitHubGetPublicKey        = errors.New("failed to get GitHub Actions public key")
	ErrGitHubPutSecret           = errors.New("failed to write GitHub Actions secret")
	ErrGitHubGetSecret           = errors.New("failed to get GitHub Actions secret")
	ErrGitHubDeleteSecret        = errors.New("failed to delete GitHub Actions secret")
	ErrGitHubResolveRepoID       = errors.New("failed to resolve GitHub repository ID")
	ErrGitHubListSecrets         = errors.New("failed to list GitHub Actions secrets")

	// Keychain specific errors.
	ErrParseKeychainOptions = errors.New("failed to parse keychain store options")
	ErrKeychainInit         = errors.New("failed to initialize keychain store")
	ErrKeychainWrite        = errors.New("failed to write keychain secret")
	ErrKeychainRead         = errors.New("failed to read keychain secret")
	ErrKeychainDelete       = errors.New("failed to delete keychain secret")
	ErrKeychainNotFound     = errors.New("keychain secret not found")
	ErrKeychainList         = errors.New("failed to list keychain secrets")

	// Identity errors.
	ErrIdentityNotConfigured   = errors.New("store identity is configured but auth resolver is not set")
	ErrAuthContextNotAvailable = errors.New("auth context not available for identity")

	// Shared errors.
	ErrSerializeJSON = errors.New("failed to serialize value to JSON")
	ErrMarshalValue  = errors.New("failed to marshal value")
	ErrNilValue      = errors.New("cannot store nil value")
)

Common errors shared across store implementations.

Functions

func ApplySecretDefaults added in v1.222.0 

func ApplySecretDefaults(config StoresConfig)

ApplySecretDefaults marks secret-by-default backends (e.g. 1Password) as `secret: true` when the config didn't set it. It mutates the config in place so both the store registry and the secrets subsystem (which reads StoreConfig.Secret) agree on subsystem membership. Call it once after loading the stores config and before building the registry.

func Register added in v1.225.0 

func Register(kind string, factory StoreFactory)

Register associates a backend kind (e.g. KindRedis) with the factory that builds it. Provider packages call this from their init() functions, so importing a provider package — typically via a blank import of pkg/store/providers — makes its store kinds available to NewStoreRegistry. Register under the canonical kind; legacy `type` values are mapped to a kind by resolveKind before the factory is looked up.

It panics if the same kind is registered twice, which indicates a programming error (two factories claiming the same kind).

func Reset added in v1.225.0 

func Reset()

Reset clears all registered store factories.

WARNING: This function is for TESTING ONLY. It should never be called in production code. It lets tests start from a clean registry state.

func WarnIdentityIgnored added in v1.225.0 

func WarnIdentityIgnored(key string, storeConfig StoreConfig, storeType string)

WarnIdentityIgnored logs a warning when an identity is configured for a store type that does not support identity-based authentication. Provider factories call it for non-identity-aware backends so a misconfigured `identity` is surfaced rather than silently ignored.

Types

type AWSAuthConfig added in v1.208.0 

type AWSAuthConfig struct {
	CredentialsFile string
	ConfigFile      string
	Profile         string
	Region          string
	EndpointURL     string
}

AWSAuthConfig holds the AWS-specific authentication configuration resolved from an identity. This mirrors the relevant fields from schema.AWSAuthContext without importing pkg/schema to avoid circular dependencies (pkg/schema imports pkg/store).

type AuthContextResolver added in v1.208.0 

type AuthContextResolver interface {
	// ResolveAWSAuthContext authenticates the named identity and returns AWS credentials.
	ResolveAWSAuthContext(ctx context.Context, identityName string) (*AWSAuthConfig, error)

	// ResolveAzureAuthContext authenticates the named identity and returns Azure credentials.
	ResolveAzureAuthContext(ctx context.Context, identityName string) (*AzureAuthConfig, error)

	// ResolveGCPAuthContext authenticates the named identity and returns GCP credentials.
	ResolveGCPAuthContext(ctx context.Context, identityName string) (*GCPAuthConfig, error)
}

AuthContextResolver resolves an identity name to a cloud-specific auth configuration. Implemented outside this package (in pkg/store/authbridge) to avoid circular deps.

type AzureAuthConfig added in v1.208.0 

type AzureAuthConfig struct {
	CredentialsFile string
	SubscriptionID  string
	TenantID        string
	UseOIDC         bool
	ClientID        string
	TokenFilePath   string
}

AzureAuthConfig holds the Azure-specific authentication configuration resolved from an identity. Fields mirror schema.AzureAuthContext; realm-scoped paths are embedded in CredentialsFile.

type DeletableStore added in v1.222.0 

type DeletableStore interface {
	Store
	// Delete removes the value for a specific stack, component, and key combination.
	Delete(stack string, component string, key string) error
}

DeletableStore extends Store with the ability to remove a value. Backends that support deletion (SSM, ASM, Vault, Azure Key Vault, GCP Secret Manager) implement this; backends that don't may return ErrDeleteNotSupported. The secrets CLI (`atmos secret delete`) requires it.

type Descriptor added in v1.225.0 

type Descriptor struct {
	Name      string
	Kind      string
	Secret    bool
	Deletable bool
	HasStatus bool
	Local     bool
	Listable  bool
}

Descriptor summarizes a configured store backend for `atmos store list`: its name, backend kind, secret-subsystem membership, and which optional capabilities (see store.go) its live instance implements.

type GCPAuthConfig added in v1.208.0 

type GCPAuthConfig struct {
	CredentialsFile string
	ProjectID       string
	AccessToken     string //nolint:gosec // Intentional credential field resolved from Atmos identity context.
	TokenExpiry     time.Time
}

GCPAuthConfig holds the GCP-specific authentication configuration resolved from an identity. Fields mirror schema.GCPAuthContext; realm-scoped paths are embedded in CredentialsFile.

type IdentityAwareStore added in v1.208.0 

type IdentityAwareStore interface {
	Store
	// SetAuthContext injects the resolver and identity name so the store can
	// lazily resolve credentials on first Get/Set call.
	SetAuthContext(resolver AuthContextResolver, identityName string)
}

IdentityAwareStore is implemented by stores that support identity-based authentication. Stores that implement this interface can authenticate using Atmos auth identities instead of the default credential chain.

type KeyValue added in v1.225.0 

type KeyValue struct {
	Key   string
	Value any
}

KeyValue pairs a key with its current value, as returned by ListKeyValues.

type ListableStore added in v1.225.0 

type ListableStore interface {
	Store
	// Keys lists the keys under a stack/component scope (or globally when both are empty).
	Keys(stack, component string) ([]string, error)
}

ListableStore is implemented by stores that can enumerate the keys stored under a stack/component scope (or globally when both are empty). Not every backend can enumerate keys cheaply or safely (see each provider's Keys implementation for details) — 1Password never implements this (its addressing is opaque op:// reference templates, not the getKey() scheme every other backend shares), and the keychain store's default (system/OS) backend returns ErrListNotSupported at runtime even though it implements the interface. Keys returns key names only; fetch a value with Get/GetKey.

type LocalStore added in v1.222.0 

type LocalStore interface {
	Store
	// IsLocal reports whether the store operates without network access or authentication.
	IsLocal() bool
}

LocalStore is an optional marker for stores whose existence check (Has) needs no network access and no authentication — e.g. the OS keychain. `atmos secret list` treats local stores as always-safe to check (free), and reports non-local (remote) stores as Unknown unless verification is explicitly requested (`--verify`). Remote stores must NOT implement it.

type MockAuthContextResolver added in v1.208.0 

type MockAuthContextResolver struct {
	// contains filtered or unexported fields
}

MockAuthContextResolver is a mock of AuthContextResolver interface.

func NewMockAuthContextResolver added in v1.208.0 

func NewMockAuthContextResolver(ctrl *gomock.Controller) *MockAuthContextResolver

NewMockAuthContextResolver creates a new mock instance.

func (*MockAuthContextResolver) EXPECT added in v1.208.0 

func (m *MockAuthContextResolver) EXPECT() *MockAuthContextResolverMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockAuthContextResolver) ResolveAWSAuthContext added in v1.208.0 

func (m *MockAuthContextResolver) ResolveAWSAuthContext(ctx context.Context, identityName string) (*AWSAuthConfig, error)

ResolveAWSAuthContext mocks base method.

func (*MockAuthContextResolver) ResolveAzureAuthContext added in v1.208.0 

func (m *MockAuthContextResolver) ResolveAzureAuthContext(ctx context.Context, identityName string) (*AzureAuthConfig, error)

ResolveAzureAuthContext mocks base method.

func (*MockAuthContextResolver) ResolveGCPAuthContext added in v1.208.0 

func (m *MockAuthContextResolver) ResolveGCPAuthContext(ctx context.Context, identityName string) (*GCPAuthConfig, error)

ResolveGCPAuthContext mocks base method.

type MockAuthContextResolverMockRecorder added in v1.208.0 

type MockAuthContextResolverMockRecorder struct {
	// contains filtered or unexported fields
}

MockAuthContextResolverMockRecorder is the mock recorder for MockAuthContextResolver.

func (*MockAuthContextResolverMockRecorder) ResolveAWSAuthContext added in v1.208.0 

func (mr *MockAuthContextResolverMockRecorder) ResolveAWSAuthContext(ctx, identityName any) *gomock.Call

ResolveAWSAuthContext indicates an expected call of ResolveAWSAuthContext.

func (*MockAuthContextResolverMockRecorder) ResolveAzureAuthContext added in v1.208.0 

func (mr *MockAuthContextResolverMockRecorder) ResolveAzureAuthContext(ctx, identityName any) *gomock.Call

ResolveAzureAuthContext indicates an expected call of ResolveAzureAuthContext.

func (*MockAuthContextResolverMockRecorder) ResolveGCPAuthContext added in v1.208.0 

func (mr *MockAuthContextResolverMockRecorder) ResolveGCPAuthContext(ctx, identityName any) *gomock.Call

ResolveGCPAuthContext indicates an expected call of ResolveGCPAuthContext.

type MockDeletableStore added in v1.222.0 

type MockDeletableStore struct {
	// contains filtered or unexported fields
}

MockDeletableStore is a mock of DeletableStore interface.

func NewMockDeletableStore added in v1.222.0 

func NewMockDeletableStore(ctrl *gomock.Controller) *MockDeletableStore

NewMockDeletableStore creates a new mock instance.

func (*MockDeletableStore) Delete added in v1.222.0 

func (m *MockDeletableStore) Delete(stack, component, key string) error

Delete mocks base method.

func (*MockDeletableStore) EXPECT added in v1.222.0 

func (m *MockDeletableStore) EXPECT() *MockDeletableStoreMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockDeletableStore) Get added in v1.222.0 

func (m *MockDeletableStore) Get(stack, component, key string) (any, error)

Get mocks base method.

func (*MockDeletableStore) GetKey added in v1.222.0 

func (m *MockDeletableStore) GetKey(key string) (any, error)

GetKey mocks base method.

func (*MockDeletableStore) Set added in v1.222.0 

func (m *MockDeletableStore) Set(stack, component, key string, value any) error

Set mocks base method.

type MockDeletableStoreMockRecorder added in v1.222.0 

type MockDeletableStoreMockRecorder struct {
	// contains filtered or unexported fields
}

MockDeletableStoreMockRecorder is the mock recorder for MockDeletableStore.

func (*MockDeletableStoreMockRecorder) Delete added in v1.222.0 

func (mr *MockDeletableStoreMockRecorder) Delete(stack, component, key any) *gomock.Call

Delete indicates an expected call of Delete.

func (*MockDeletableStoreMockRecorder) Get added in v1.222.0 

func (mr *MockDeletableStoreMockRecorder) Get(stack, component, key any) *gomock.Call

Get indicates an expected call of Get.

func (*MockDeletableStoreMockRecorder) GetKey added in v1.222.0 

func (mr *MockDeletableStoreMockRecorder) GetKey(key any) *gomock.Call

GetKey indicates an expected call of GetKey.

func (*MockDeletableStoreMockRecorder) Set added in v1.222.0 

func (mr *MockDeletableStoreMockRecorder) Set(stack, component, key, value any) *gomock.Call

Set indicates an expected call of Set.

type MockIdentityAwareStore added in v1.208.0 

type MockIdentityAwareStore struct {
	// contains filtered or unexported fields
}

MockIdentityAwareStore is a mock of IdentityAwareStore interface.

func NewMockIdentityAwareStore added in v1.208.0 

func NewMockIdentityAwareStore(ctrl *gomock.Controller) *MockIdentityAwareStore

NewMockIdentityAwareStore creates a new mock instance.

func (*MockIdentityAwareStore) EXPECT added in v1.208.0 

func (m *MockIdentityAwareStore) EXPECT() *MockIdentityAwareStoreMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockIdentityAwareStore) Get added in v1.208.0 

func (m *MockIdentityAwareStore) Get(stack, component, key string) (any, error)

Get mocks base method.

func (*MockIdentityAwareStore) GetKey added in v1.208.0 

func (m *MockIdentityAwareStore) GetKey(key string) (any, error)

GetKey mocks base method.

func (*MockIdentityAwareStore) Set added in v1.208.0 

func (m *MockIdentityAwareStore) Set(stack, component, key string, value any) error

Set mocks base method.

func (*MockIdentityAwareStore) SetAuthContext added in v1.208.0 

func (m *MockIdentityAwareStore) SetAuthContext(resolver AuthContextResolver, identityName string)

SetAuthContext mocks base method.

type MockIdentityAwareStoreMockRecorder added in v1.208.0 

type MockIdentityAwareStoreMockRecorder struct {
	// contains filtered or unexported fields
}

MockIdentityAwareStoreMockRecorder is the mock recorder for MockIdentityAwareStore.

func (*MockIdentityAwareStoreMockRecorder) Get added in v1.208.0 

func (mr *MockIdentityAwareStoreMockRecorder) Get(stack, component, key any) *gomock.Call

Get indicates an expected call of Get.

func (*MockIdentityAwareStoreMockRecorder) GetKey added in v1.208.0 

func (mr *MockIdentityAwareStoreMockRecorder) GetKey(key any) *gomock.Call

GetKey indicates an expected call of GetKey.

func (*MockIdentityAwareStoreMockRecorder) Set added in v1.208.0 

func (mr *MockIdentityAwareStoreMockRecorder) Set(stack, component, key, value any) *gomock.Call

Set indicates an expected call of Set.

func (*MockIdentityAwareStoreMockRecorder) SetAuthContext added in v1.208.0 

func (mr *MockIdentityAwareStoreMockRecorder) SetAuthContext(resolver, identityName any) *gomock.Call

SetAuthContext indicates an expected call of SetAuthContext.

type MockListableStore added in v1.225.0 

type MockListableStore struct {
	// contains filtered or unexported fields
}

MockListableStore is a mock of ListableStore interface.

func NewMockListableStore added in v1.225.0 

func NewMockListableStore(ctrl *gomock.Controller) *MockListableStore

NewMockListableStore creates a new mock instance.

func (*MockListableStore) EXPECT added in v1.225.0 

func (m *MockListableStore) EXPECT() *MockListableStoreMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockListableStore) Get added in v1.225.0 

func (m *MockListableStore) Get(stack, component, key string) (any, error)

Get mocks base method.

func (*MockListableStore) GetKey added in v1.225.0 

func (m *MockListableStore) GetKey(key string) (any, error)

GetKey mocks base method.

func (*MockListableStore) Keys added in v1.225.0 

func (m *MockListableStore) Keys(stack, component string) ([]string, error)

Keys mocks base method.

func (*MockListableStore) Set added in v1.225.0 

func (m *MockListableStore) Set(stack, component, key string, value any) error

Set mocks base method.

type MockListableStoreMockRecorder added in v1.225.0 

type MockListableStoreMockRecorder struct {
	// contains filtered or unexported fields
}

MockListableStoreMockRecorder is the mock recorder for MockListableStore.

func (*MockListableStoreMockRecorder) Get added in v1.225.0 

func (mr *MockListableStoreMockRecorder) Get(stack, component, key any) *gomock.Call

Get indicates an expected call of Get.

func (*MockListableStoreMockRecorder) GetKey added in v1.225.0 

func (mr *MockListableStoreMockRecorder) GetKey(key any) *gomock.Call

GetKey indicates an expected call of GetKey.

func (*MockListableStoreMockRecorder) Keys added in v1.225.0 

func (mr *MockListableStoreMockRecorder) Keys(stack, component any) *gomock.Call

Keys indicates an expected call of Keys.

func (*MockListableStoreMockRecorder) Set added in v1.225.0 

func (mr *MockListableStoreMockRecorder) Set(stack, component, key, value any) *gomock.Call

Set indicates an expected call of Set.

type MockLocalStore added in v1.225.0 

type MockLocalStore struct {
	// contains filtered or unexported fields
}

MockLocalStore is a mock of LocalStore interface.

func NewMockLocalStore added in v1.225.0 

func NewMockLocalStore(ctrl *gomock.Controller) *MockLocalStore

NewMockLocalStore creates a new mock instance.

func (*MockLocalStore) EXPECT added in v1.225.0 

func (m *MockLocalStore) EXPECT() *MockLocalStoreMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockLocalStore) Get added in v1.225.0 

func (m *MockLocalStore) Get(stack, component, key string) (any, error)

Get mocks base method.

func (*MockLocalStore) GetKey added in v1.225.0 

func (m *MockLocalStore) GetKey(key string) (any, error)

GetKey mocks base method.

func (*MockLocalStore) IsLocal added in v1.225.0 

func (m *MockLocalStore) IsLocal() bool

IsLocal mocks base method.

func (*MockLocalStore) Set added in v1.225.0 

func (m *MockLocalStore) Set(stack, component, key string, value any) error

Set mocks base method.

type MockLocalStoreMockRecorder added in v1.225.0 

type MockLocalStoreMockRecorder struct {
	// contains filtered or unexported fields
}

MockLocalStoreMockRecorder is the mock recorder for MockLocalStore.

func (*MockLocalStoreMockRecorder) Get added in v1.225.0 

func (mr *MockLocalStoreMockRecorder) Get(stack, component, key any) *gomock.Call

Get indicates an expected call of Get.

func (*MockLocalStoreMockRecorder) GetKey added in v1.225.0 

func (mr *MockLocalStoreMockRecorder) GetKey(key any) *gomock.Call

GetKey indicates an expected call of GetKey.

func (*MockLocalStoreMockRecorder) IsLocal added in v1.225.0 

func (mr *MockLocalStoreMockRecorder) IsLocal() *gomock.Call

IsLocal indicates an expected call of IsLocal.

func (*MockLocalStoreMockRecorder) Set added in v1.225.0 

func (mr *MockLocalStoreMockRecorder) Set(stack, component, key, value any) *gomock.Call

Set indicates an expected call of Set.

type MockSecretAwareStore added in v1.222.0 

type MockSecretAwareStore struct {
	// contains filtered or unexported fields
}

MockSecretAwareStore is a mock of SecretAwareStore interface.

func NewMockSecretAwareStore added in v1.222.0 

func NewMockSecretAwareStore(ctrl *gomock.Controller) *MockSecretAwareStore

NewMockSecretAwareStore creates a new mock instance.

func (*MockSecretAwareStore) EXPECT added in v1.222.0 

func (m *MockSecretAwareStore) EXPECT() *MockSecretAwareStoreMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockSecretAwareStore) Get added in v1.222.0 

func (m *MockSecretAwareStore) Get(stack, component, key string) (any, error)

Get mocks base method.

func (*MockSecretAwareStore) GetKey added in v1.222.0 

func (m *MockSecretAwareStore) GetKey(key string) (any, error)

GetKey mocks base method.

func (*MockSecretAwareStore) Set added in v1.222.0 

func (m *MockSecretAwareStore) Set(stack, component, key string, value any) error

Set mocks base method.

func (*MockSecretAwareStore) SetSecret added in v1.222.0 

func (m *MockSecretAwareStore) SetSecret(secret bool)

SetSecret mocks base method.

type MockSecretAwareStoreMockRecorder added in v1.222.0 

type MockSecretAwareStoreMockRecorder struct {
	// contains filtered or unexported fields
}

MockSecretAwareStoreMockRecorder is the mock recorder for MockSecretAwareStore.

func (*MockSecretAwareStoreMockRecorder) Get added in v1.222.0 

func (mr *MockSecretAwareStoreMockRecorder) Get(stack, component, key any) *gomock.Call

Get indicates an expected call of Get.

func (*MockSecretAwareStoreMockRecorder) GetKey added in v1.222.0 

func (mr *MockSecretAwareStoreMockRecorder) GetKey(key any) *gomock.Call

GetKey indicates an expected call of GetKey.

func (*MockSecretAwareStoreMockRecorder) Set added in v1.222.0 

func (mr *MockSecretAwareStoreMockRecorder) Set(stack, component, key, value any) *gomock.Call

Set indicates an expected call of Set.

func (*MockSecretAwareStoreMockRecorder) SetSecret added in v1.222.0 

func (mr *MockSecretAwareStoreMockRecorder) SetSecret(secret any) *gomock.Call

SetSecret indicates an expected call of SetSecret.

type MockStatusStore added in v1.222.0 

type MockStatusStore struct {
	// contains filtered or unexported fields
}

MockStatusStore is a mock of StatusStore interface.

func NewMockStatusStore added in v1.222.0 

func NewMockStatusStore(ctrl *gomock.Controller) *MockStatusStore

NewMockStatusStore creates a new mock instance.

func (*MockStatusStore) EXPECT added in v1.222.0 

func (m *MockStatusStore) EXPECT() *MockStatusStoreMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockStatusStore) Get added in v1.222.0 

func (m *MockStatusStore) Get(stack, component, key string) (any, error)

Get mocks base method.

func (*MockStatusStore) GetKey added in v1.222.0 

func (m *MockStatusStore) GetKey(key string) (any, error)

GetKey mocks base method.

func (*MockStatusStore) Has added in v1.222.0 

func (m *MockStatusStore) Has(stack, component, key string) (bool, error)

Has mocks base method.

func (*MockStatusStore) Set added in v1.222.0 

func (m *MockStatusStore) Set(stack, component, key string, value any) error

Set mocks base method.

type MockStatusStoreMockRecorder added in v1.222.0 

type MockStatusStoreMockRecorder struct {
	// contains filtered or unexported fields
}

MockStatusStoreMockRecorder is the mock recorder for MockStatusStore.

func (*MockStatusStoreMockRecorder) Get added in v1.222.0 

func (mr *MockStatusStoreMockRecorder) Get(stack, component, key any) *gomock.Call

Get indicates an expected call of Get.

func (*MockStatusStoreMockRecorder) GetKey added in v1.222.0 

func (mr *MockStatusStoreMockRecorder) GetKey(key any) *gomock.Call

GetKey indicates an expected call of GetKey.

func (*MockStatusStoreMockRecorder) Has added in v1.222.0 

func (mr *MockStatusStoreMockRecorder) Has(stack, component, key any) *gomock.Call

Has indicates an expected call of Has.

func (*MockStatusStoreMockRecorder) Set added in v1.222.0 

func (mr *MockStatusStoreMockRecorder) Set(stack, component, key, value any) *gomock.Call

Set indicates an expected call of Set.

type MockStore added in v1.203.0 

type MockStore struct {
	// contains filtered or unexported fields
}

MockStore is a mock of Store interface.

func NewMockStore added in v1.203.0 

func NewMockStore(ctrl *gomock.Controller) *MockStore

NewMockStore creates a new mock instance.

func (*MockStore) EXPECT added in v1.203.0 

func (m *MockStore) EXPECT() *MockStoreMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockStore) Get added in v1.203.0 

func (m *MockStore) Get(stack, component, key string) (any, error)

Get mocks base method.

func (*MockStore) GetKey added in v1.203.0 

func (m *MockStore) GetKey(key string) (any, error)

GetKey mocks base method.

func (*MockStore) Set added in v1.203.0 

func (m *MockStore) Set(stack, component, key string, value any) error

Set mocks base method.

type MockStoreMockRecorder added in v1.203.0 

type MockStoreMockRecorder struct {
	// contains filtered or unexported fields
}

MockStoreMockRecorder is the mock recorder for MockStore.

func (*MockStoreMockRecorder) Get added in v1.203.0 

func (mr *MockStoreMockRecorder) Get(stack, component, key any) *gomock.Call

Get indicates an expected call of Get.

func (*MockStoreMockRecorder) GetKey added in v1.203.0 

func (mr *MockStoreMockRecorder) GetKey(key any) *gomock.Call

GetKey indicates an expected call of GetKey.

func (*MockStoreMockRecorder) Set added in v1.203.0 

func (mr *MockStoreMockRecorder) Set(stack, component, key, value any) *gomock.Call

Set indicates an expected call of Set.

type MockValueListableStore added in v1.225.0 

type MockValueListableStore struct {
	// contains filtered or unexported fields
}

MockValueListableStore is a mock of ValueListableStore interface.

func NewMockValueListableStore added in v1.225.0 

func NewMockValueListableStore(ctrl *gomock.Controller) *MockValueListableStore

NewMockValueListableStore creates a new mock instance.

func (*MockValueListableStore) EXPECT added in v1.225.0 

func (m *MockValueListableStore) EXPECT() *MockValueListableStoreMockRecorder

EXPECT returns an object that allows the caller to indicate expected use.

func (*MockValueListableStore) Get added in v1.225.0 

func (m *MockValueListableStore) Get(stack, component, key string) (any, error)

Get mocks base method.

func (*MockValueListableStore) GetKey added in v1.225.0 

func (m *MockValueListableStore) GetKey(key string) (any, error)

GetKey mocks base method.

func (*MockValueListableStore) Keys added in v1.225.0 

func (m *MockValueListableStore) Keys(stack, component string) ([]string, error)

Keys mocks base method.

func (*MockValueListableStore) Set added in v1.225.0 

func (m *MockValueListableStore) Set(stack, component, key string, value any) error

Set mocks base method.

func (*MockValueListableStore) ValueListingSupported added in v1.225.0 

func (m *MockValueListableStore) ValueListingSupported() bool

ValueListingSupported mocks base method.

type MockValueListableStoreMockRecorder added in v1.225.0 

type MockValueListableStoreMockRecorder struct {
	// contains filtered or unexported fields
}

MockValueListableStoreMockRecorder is the mock recorder for MockValueListableStore.

func (*MockValueListableStoreMockRecorder) Get added in v1.225.0 

func (mr *MockValueListableStoreMockRecorder) Get(stack, component, key any) *gomock.Call

Get indicates an expected call of Get.

func (*MockValueListableStoreMockRecorder) GetKey added in v1.225.0 

func (mr *MockValueListableStoreMockRecorder) GetKey(key any) *gomock.Call

GetKey indicates an expected call of GetKey.

func (*MockValueListableStoreMockRecorder) Keys added in v1.225.0 

func (mr *MockValueListableStoreMockRecorder) Keys(stack, component any) *gomock.Call

Keys indicates an expected call of Keys.

func (*MockValueListableStoreMockRecorder) Set added in v1.225.0 

func (mr *MockValueListableStoreMockRecorder) Set(stack, component, key, value any) *gomock.Call

Set indicates an expected call of Set.

func (*MockValueListableStoreMockRecorder) ValueListingSupported added in v1.225.0 

func (mr *MockValueListableStoreMockRecorder) ValueListingSupported() *gomock.Call

ValueListingSupported indicates an expected call of ValueListingSupported.

type SecretAwareStore added in v1.222.0 

type SecretAwareStore interface {
	Store
	// SetSecret marks the store as a secret backend so writes use the sensitive at-rest variant.
	SetSecret(secret bool)
}

SecretAwareStore is implemented by stores that change their at-rest behavior when used as a secret backend (e.g. AWS SSM writes a SecureString instead of a String). The registry calls SetSecret(true) for stores configured with `secret: true`.

type SecretsAuthContext added in v1.222.0 

type SecretsAuthContext struct {
	// Resolver authenticates an identity name and returns cloud-specific credentials.
	Resolver AuthContextResolver
	// DefaultIdentity is the effective identity (from --identity/ATMOS_IDENTITY or the stack/component
	// default) used when a provider does not name its own identity.
	DefaultIdentity string
}

SecretsAuthContext carries an identity-resolving AuthContextResolver and the effective default identity name to non-store secret backends (e.g. cloud-KMS SOPS providers) that live outside the store registry but need the same identity->credentials resolution. It is populated by the same code paths that inject the store auth resolver (the `atmos secret` command and terraform), so SOPS providers can authenticate KMS calls via an Atmos identity instead of ambient credentials.

type Service added in v1.225.0 

type Service struct {
	// contains filtered or unexported fields
}

Service is a thin CRUD facade over a StoreRegistry, used by the `atmos store` command family to read, write, delete, and enumerate raw values in any configured store by name. Unlike the secrets subsystem (pkg/secrets), there is no declaration or scope layer here: callers name a configured store directly and this reads/writes/deletes against it.

func NewService added in v1.225.0 

func NewService(config StoresConfig, registry StoreRegistry) *Service

NewService builds a Service over the given configured stores and their live registry (typically atmosConfig.StoresConfig and atmosConfig.Stores).

func (*Service) Delete added in v1.225.0 

func (s *Service) Delete(name, stack, component, key string) error

Delete removes a value from the named store. It returns ErrDeleteNotSupported if the store's backend does not implement DeletableStore.

func (*Service) Get added in v1.225.0 

func (s *Service) Get(name, stack, component, key string) (any, error)

Get retrieves a value from the named store, scoped to a stack and component. Note: unlike secrets.Service.Get, this does not register the value with the masker -- pkg/store sits below pkg/io in the import graph (pkg/schema, which pkg/store's config types are part of, is imported by pkg/io), so registering here would create an import cycle. Callers that surface a Get result to a human (e.g. `atmos store get`, see cmd/store/get.go) are responsible for registering the value with io.RegisterSecretValue themselves before writing it out.

func (*Service) GetKey added in v1.225.0 

func (s *Service) GetKey(name, key string) (any, error)

GetKey retrieves a value directly by key, without stack or component scoping. See the Get doc comment for why masker registration is not done here.

func (*Service) IsSecret added in v1.225.0 

func (s *Service) IsSecret(name string) bool

IsSecret reports whether the named store is configured with `secret: true`. Callers that surface a value to a human (e.g. `atmos store get`, `atmos store list STORE`) use this to decide whether to register the value with the masker -- a non-secret store's values are shown as-is.

func (*Service) Keys added in v1.225.0 

func (s *Service) Keys(name, stack, component string) ([]string, error)

Keys lists the keys under a stack/component scope (or globally when both are empty) in the named store. It returns ErrListNotSupported if the store's backend does not implement ListableStore.

func (*Service) List added in v1.225.0 

func (s *Service) List() []Descriptor

List returns a Descriptor for every configured store, sorted by name.

func (*Service) ListKeyValues added in v1.225.0 

func (s *Service) ListKeyValues(name, stack, component string) ([]KeyValue, error)

ListKeyValues lists every key under a stack/component scope (or globally when both are empty) in the named store, together with its current value, sorted by key. It returns ErrListNotSupported if the store's backend does not implement ListableStore, or if it implements ValueListableStore and reports that value listing isn't currently supported (e.g. a GitHub Actions store run outside a runner) -- checked up front so the call fails fast instead of aborting mid-enumeration on the first Get error.

func (*Service) Set added in v1.225.0 

func (s *Service) Set(name, stack, component, key string, value any) error

Set writes a value to the named store.

type StatusStore added in v1.222.0 

type StatusStore interface {
	Store
	// Has reports whether a value exists for a specific stack, component, and key, without
	// retrieving or decrypting the value.
	Has(stack string, component string, key string) (bool, error)
}

StatusStore extends Store with an existence check used by `atmos secret list`/`validate` to report whether a declared secret has been initialized.

Has MUST determine existence without retrieving or decrypting the value: it uses a metadata/describe API (e.g. SSM GetParameter with WithDecryption=false, Secrets Manager DescribeSecret, GCP GetSecretVersion) so that listing never requires a decrypt-capable identity (no kms:Decrypt) and never registers a plaintext value with the masker.

type Store 

type Store interface {
	// Set stores a value for a specific stack, component, and key combination.
	Set(stack string, component string, key string, value any) error
	// Get retrieves a value for a specific stack, component, and key combination.
	Get(stack string, component string, key string) (any, error)
	// GetKey retrieves a value directly by key without stack or component context.
	GetKey(key string) (any, error)
}

Store defines the common interface for all store implementations.

type StoreConfig 

type StoreConfig struct {
	// Type is the legacy backend selector (e.g. "aws-ssm-parameter-store").
	Type string `yaml:"type,omitempty" json:"type,omitempty" mapstructure:"type"`
	// Kind is the new cloud/thing backend selector (e.g. "aws/ssm"); when set it takes
	// precedence over Type. The registry maps legacy Type to Kind for backward compatibility.
	Kind string `yaml:"kind,omitempty" json:"kind,omitempty" mapstructure:"kind"`
	// Secret marks this store as a secret backend (subsystem membership). A secret store
	// is the only backend the !secret function and the `atmos secret` CLI resolve from, and
	// `!store` against it is an error ("use !secret"). Secret stores always write the
	// sensitive variant at rest (e.g. SSM SecureString).
	Secret   bool                   `yaml:"secret,omitempty" json:"secret,omitempty" mapstructure:"secret"`
	Identity string                 `yaml:"identity,omitempty" json:"identity,omitempty" mapstructure:"identity"`
	Options  map[string]interface{} `yaml:"options" json:"options,omitempty" mapstructure:"options"`
}

type StoreFactory 

type StoreFactory func(name string, config StoreConfig) (Store, error)

StoreFactory builds a store backend from its configuration. Provider packages register a factory for each backend kind they implement via Register, typically from an init() function. The name is the configured store's key and is used only for diagnostics (e.g. warnings).

type StoreRegistry 

type StoreRegistry map[string]Store

StoreRegistry is a map of store name to a live store implementation.

func NewStoreRegistry 

func NewStoreRegistry(config *StoresConfig) (StoreRegistry, error)

NewStoreRegistry builds a registry of live stores from the provided config, resolving each configured store to a canonical kind and looking it up in the factories registered by the provider packages. Import the provider package (e.g. with a blank import of pkg/store/providers) so the built-in backends are registered before this runs.

func (StoreRegistry) SetAuthContextResolver added in v1.208.0 

func (r StoreRegistry) SetAuthContextResolver(resolver AuthContextResolver)

SetAuthContextResolver injects an auth context resolver into all identity-aware stores that have an identity configured. This should be called after authentication is complete and before stores are accessed.

func (StoreRegistry) SetAuthContextResolverWithDefaultIdentity added in v1.221.0 

func (r StoreRegistry) SetAuthContextResolverWithDefaultIdentity(resolver AuthContextResolver, defaultIdentity string)

SetAuthContextResolverWithDefaultIdentity injects an auth context resolver into identity-aware stores. Stores with their own configured identity keep it; eligible store types without a configured identity inherit defaultIdentity.

type StoresConfig 

type StoresConfig = map[string]StoreConfig

type ValueListableStore added in v1.225.0 

type ValueListableStore interface {
	ListableStore
	// ValueListingSupported reports whether Get can currently be called for every key Keys
	// returns.
	ValueListingSupported() bool
}

ValueListableStore is implemented by stores whose ListableStore.Keys enumeration is only safe to pair with per-key Get calls in some execution contexts. GitHubActionsStore's Get requires a GitHub Actions runner; outside one it implements this to report false so ListKeyValues can fail fast with ErrListNotSupported instead of aborting mid-enumeration on the first Get error.

Source Files

View all Source files

Directories

Path Synopsis
Package authbridge provides an implementation of store.AuthContextResolver that bridges the store package with the auth system.
 Package authbridge provides an implementation of store.AuthContextResolver that bridges the store package with the auth system.
Package providers is a generated GoMock package.
 Package providers is a generated GoMock package.
Package sopsauth bridges the Atmos auth/identity system to the getsops SDK for cloud-KMS SOPS backends.
 Package sopsauth bridges the Atmos auth/identity system to the getsops SDK for cloud-KMS SOPS backends.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.