secretref

type Backend ¶

type Backend interface {
	Resolve(ctx context.Context, ref Ref) (string, error)
}

Backend resolves a parsed secret reference into a plaintext value.

type BlobBackend ¶

type BlobBackend interface {
	Backend
	Scheme() string
	LoadBlob(ctx context.Context, ref Ref) ([]byte, error)
}

BlobBackend extends a backend to support binary data retrieval.

type Error ¶

type Error struct {
	Kind   ErrorKind
	Ref    string
	Detail string
	Err    error
}

Error is a typed secret reference error.

func NewError(kind ErrorKind, ref, detail string, err error) *Error

func (e *Error) Error() string

func (e *Error) Unwrap() error

type ErrorKind ¶

type ErrorKind string

const (
	KindInvalidRef         ErrorKind = "invalid_ref"
	KindNotFound           ErrorKind = "not_found"
	KindBackendUnavailable ErrorKind = "backend_unavailable"
)

type Ref ¶

type Ref struct {
	Raw    string
	Scheme string
	Path   string
}

Ref represents a parsed secret reference in the form <scheme>://<path>.

func Parse(raw string) (Ref, error)

type Resolver ¶

type Resolver struct {
	// contains filtered or unexported fields
}

Resolver routes secret references by scheme.

Resolutions from interactive native stores (macOS Keychain, Windows Credential Manager, Linux Secret Service) are cached in-process and deduplicated with singleflight. This matters for unsigned/dev builds, where the OS cannot persist an "always allow" ACL keyed to the binary's code signature and so re-prompts on every keychain access: without the cache, the concurrent store probes and per-action re-probes would each pop a separate password dialog. With it, a given reference prompts at most once per process.

func NewResolver(backends map[string]Backend) *Resolver

func (r *Resolver) DeleteBlob(ctx context.Context, raw string) error

func (r *Resolver) Exists(ctx context.Context, raw string) (bool, error)

func (r *Resolver) LoadBlob(ctx context.Context, raw string) ([]byte, error)

func (r *Resolver) Resolve(ctx context.Context, raw string) (string, error)

func (r *Resolver) SaveBlob(ctx context.Context, raw string, data []byte) error

func (r *Resolver) Store(ctx context.Context, raw, value string) error

func (r *Resolver) WritableBackends() []WritableBackend

type WritableBackend ¶

type WritableBackend interface {
	Backend
	Scheme() string
	DisplayName() string
	WriteSupported() bool
	DefaultRef(storeName, account string) string
	Exists(ctx context.Context, ref Ref) (bool, error)
	Store(ctx context.Context, ref Ref, value string) error
}

WritableBackend extends a backend with native-store write and existence checks for interactive CLI flows.

type WritableBlobBackend ¶

type WritableBlobBackend interface {
	BlobBackend
	SaveBlob(ctx context.Context, ref Ref, data []byte) error
	DeleteBlob(ctx context.Context, ref Ref) error
}

WritableBlobBackend extends a backend to support atomic binary data storage.