backends

package
v1.18.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 2, 2026 License: MIT Imports: 15 Imported by: 0

Documentation

Overview

Package backends holds the secret backends Cloudstic ships with, split out from the pkg/secretref contract so that implementing a custom backend does not drag in the platform-native ones (macOS Keychain, libsecret, Windows Credential Manager) and their build constraints.

Callers who want to *add* a scheme rather than replace the built-in set start from Default: 

b := backends.Default()
b["vault"] = myVaultBackend{}
resolver := secretref.NewResolver(b)

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Default 

func Default() map[string]secretref.Backend

Default returns a fresh map of the built-in backends, keyed by scheme. The map is newly allocated on each call, so callers may add to or remove from it without affecting anyone else.

Replacing an entry is also how you reconfigure a built-in. The config-token backend writes into Cloudstic's own config directory by default, which a program embedding this package usually does not want: 

b := backends.Default()
b["config-token"] = backends.NewConfigTokenBackend(backends.WithConfigDir(myDir))
resolver := secretref.NewResolver(b)

func NewDefaultResolver 

func NewDefaultResolver() *secretref.Resolver

NewDefaultResolver builds the standard resolver over Default.

Types

type ConfigTokenBackend 

type ConfigTokenBackend struct {
	// contains filtered or unexported fields
}

ConfigTokenBackend handles config-token://<provider>/<name> references. It stores tokens in a managed config directory, encrypted at rest.

Unlike file://, whose reference carries its own path, this backend chooses where to write. That choice defaults to Cloudstic's own config directory, which is right for the CLI but not for a program embedding this package — hence WithConfigDir.

func NewConfigTokenBackend 

func NewConfigTokenBackend(opts ...ConfigTokenOption) *ConfigTokenBackend

func (*ConfigTokenBackend) DefaultRef 

func (b *ConfigTokenBackend) DefaultRef(name, account string) string

func (*ConfigTokenBackend) DeleteBlob 

func (b *ConfigTokenBackend) DeleteBlob(ctx context.Context, ref secretref.Ref) error

func (*ConfigTokenBackend) DisplayName 

func (b *ConfigTokenBackend) DisplayName() string

func (*ConfigTokenBackend) Exists 

func (b *ConfigTokenBackend) Exists(ctx context.Context, ref secretref.Ref) (bool, error)

func (*ConfigTokenBackend) LoadBlob 

func (b *ConfigTokenBackend) LoadBlob(_ context.Context, ref secretref.Ref) ([]byte, error)

func (*ConfigTokenBackend) Resolve 

func (b *ConfigTokenBackend) Resolve(ctx context.Context, ref secretref.Ref) (string, error)

func (*ConfigTokenBackend) SaveBlob 

func (b *ConfigTokenBackend) SaveBlob(ctx context.Context, ref secretref.Ref, data []byte) error

func (*ConfigTokenBackend) Scheme 

func (b *ConfigTokenBackend) Scheme() string

func (*ConfigTokenBackend) Store 

func (b *ConfigTokenBackend) Store(ctx context.Context, ref secretref.Ref, value string) error

func (*ConfigTokenBackend) WriteSupported 

func (b *ConfigTokenBackend) WriteSupported() bool

type ConfigTokenOption 

type ConfigTokenOption func(*ConfigTokenBackend)

ConfigTokenOption configures a ConfigTokenBackend.

func WithConfigDir 

func WithConfigDir(dir string) ConfigTokenOption

WithConfigDir places managed tokens under dir instead of Cloudstic's own config directory.

The salt that derives the at-rest encryption key lives in this directory too, so pointing two backends at different directories gives them different keys: tokens written under one are not readable under the other.

func WithConfigTokenLogger 

func WithConfigTokenLogger(w io.Writer) ConfigTokenOption

WithConfigTokenLogger sends this backend's debug output to w.

type EnvBackend 

type EnvBackend struct {
	// contains filtered or unexported fields
}

EnvBackend resolves env://VAR references.

func NewEnvBackend 

func NewEnvBackend(lookup EnvLookup) *EnvBackend

func (*EnvBackend) Resolve 

func (b *EnvBackend) Resolve(_ context.Context, ref secretref.Ref) (string, error)

type EnvLookup 

type EnvLookup func(string) (string, bool)

type FileBackend 

type FileBackend struct{}

FileBackend handles file://<path> references.

func NewFileBackend 

func NewFileBackend() *FileBackend

func (*FileBackend) DefaultRef 

func (b *FileBackend) DefaultRef(name, account string) string

func (*FileBackend) DeleteBlob 

func (b *FileBackend) DeleteBlob(_ context.Context, ref secretref.Ref) error

func (*FileBackend) DisplayName 

func (b *FileBackend) DisplayName() string

func (*FileBackend) Exists 

func (b *FileBackend) Exists(_ context.Context, ref secretref.Ref) (bool, error)

func (*FileBackend) LoadBlob 

func (b *FileBackend) LoadBlob(_ context.Context, ref secretref.Ref) ([]byte, error)

func (*FileBackend) Resolve 

func (b *FileBackend) Resolve(ctx context.Context, ref secretref.Ref) (string, error)

func (*FileBackend) SaveBlob 

func (b *FileBackend) SaveBlob(_ context.Context, ref secretref.Ref, data []byte) error

func (*FileBackend) Scheme 

func (b *FileBackend) Scheme() string

func (*FileBackend) Store 

func (b *FileBackend) Store(ctx context.Context, ref secretref.Ref, value string) error

func (*FileBackend) WriteSupported 

func (b *FileBackend) WriteSupported() bool

type KeychainBackend 

type KeychainBackend struct {
	// contains filtered or unexported fields
}

KeychainBackend resolves keychain://service/account references.

func NewKeychainBackend 

func NewKeychainBackend() *KeychainBackend

NewKeychainBackend creates a keychain backend for the current platform.

func (*KeychainBackend) DefaultRef 

func (b *KeychainBackend) DefaultRef(storeName, account string) string

func (*KeychainBackend) DeleteBlob 

func (b *KeychainBackend) DeleteBlob(ctx context.Context, ref secretref.Ref) error

func (*KeychainBackend) DisplayName 

func (b *KeychainBackend) DisplayName() string

func (*KeychainBackend) Exists 

func (b *KeychainBackend) Exists(ctx context.Context, ref secretref.Ref) (bool, error)

func (*KeychainBackend) LoadBlob 

func (b *KeychainBackend) LoadBlob(ctx context.Context, ref secretref.Ref) ([]byte, error)

func (*KeychainBackend) Resolve 

func (b *KeychainBackend) Resolve(ctx context.Context, ref secretref.Ref) (string, error)

func (*KeychainBackend) SaveBlob 

func (b *KeychainBackend) SaveBlob(ctx context.Context, ref secretref.Ref, data []byte) error

func (*KeychainBackend) Scheme 

func (b *KeychainBackend) Scheme() string

func (*KeychainBackend) Store 

func (b *KeychainBackend) Store(ctx context.Context, ref secretref.Ref, value string) error

func (*KeychainBackend) WriteSupported 

func (b *KeychainBackend) WriteSupported() bool

type SecretServiceBackend 

type SecretServiceBackend struct {
	// contains filtered or unexported fields
}

SecretServiceBackend resolves secret-service://collection/item references.

func NewSecretServiceBackend 

func NewSecretServiceBackend() *SecretServiceBackend

NewSecretServiceBackend creates a Secret Service backend for the current platform.

func (*SecretServiceBackend) DefaultRef 

func (b *SecretServiceBackend) DefaultRef(storeName, account string) string

func (*SecretServiceBackend) DisplayName 

func (b *SecretServiceBackend) DisplayName() string

func (*SecretServiceBackend) Exists 

func (b *SecretServiceBackend) Exists(ctx context.Context, ref secretref.Ref) (bool, error)

func (*SecretServiceBackend) Resolve 

func (b *SecretServiceBackend) Resolve(ctx context.Context, ref secretref.Ref) (string, error)

func (*SecretServiceBackend) Scheme 

func (b *SecretServiceBackend) Scheme() string

func (*SecretServiceBackend) Store 

func (b *SecretServiceBackend) Store(ctx context.Context, ref secretref.Ref, value string) error

func (*SecretServiceBackend) WriteSupported 

func (b *SecretServiceBackend) WriteSupported() bool

type WincredBackend 

type WincredBackend struct {
	// contains filtered or unexported fields
}

WincredBackend resolves wincred://target references.

func NewWincredBackend 

func NewWincredBackend() *WincredBackend

NewWincredBackend creates a Windows Credential Manager backend for the current platform.

func (*WincredBackend) DefaultRef 

func (b *WincredBackend) DefaultRef(storeName, account string) string

func (*WincredBackend) DisplayName 

func (b *WincredBackend) DisplayName() string

func (*WincredBackend) Exists 

func (b *WincredBackend) Exists(ctx context.Context, ref secretref.Ref) (bool, error)

func (*WincredBackend) Resolve 

func (b *WincredBackend) Resolve(ctx context.Context, ref secretref.Ref) (string, error)

func (*WincredBackend) Scheme 

func (b *WincredBackend) Scheme() string

func (*WincredBackend) Store 

func (b *WincredBackend) Store(ctx context.Context, ref secretref.Ref, value string) error

func (*WincredBackend) WriteSupported 

func (b *WincredBackend) WriteSupported() bool

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.