Documentation
¶
Overview ¶
Package credentials mints and resolves opaque credential handles as attenuated capabilities. A provider never receives a raw secret: it receives a handle bound to an exact principal, binding, action, request, origin, purpose, and injection location. The host resolves the handle only after every request check has already passed, injects the value without logging it, never returns it, and rejects any cross-purpose, cross-binding, or cross-action reuse. A handle is not permission; it is one narrow capability the host still re-checks at use.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Injection ¶
type Injection struct {
Kind InjectionKind
Name string
}
Injection is where the host places a resolved secret. The provider never selects this; it is fixed at mint time from the plan.
type InjectionKind ¶
type InjectionKind string
InjectionKind is the closed set of host-owned injection locations.
const ( // InjectBearer sets Authorization: Bearer <secret>. InjectBearer InjectionKind = "bearer" // InjectHeader sets a named API-key header to <secret>. InjectHeader InjectionKind = "header" // InjectQuery sets a named query parameter to <secret>. InjectQuery InjectionKind = "query" )
type Scope ¶
type Scope struct {
Principal string
Organization string
ArtifactDigest string
Binding *providerv0.BindingAddress
PlanID string
ActionID string
RequestDigest string
Purpose providerv0.CredentialPurpose
Origin urlguard.Origin
Method providerv0.HTTPMethod
Injection Injection
MaxUses uint32
TTL time.Duration
}
Scope is the exact capability a handle grants. Every field is host-derived and immutable after minting.
type Use ¶
type Use struct {
Purpose providerv0.CredentialPurpose
Binding *providerv0.BindingAddress
ActionID string
RequestDigest string
Origin urlguard.Origin
Method providerv0.HTTPMethod
}
Use is the exact request context presented at resolution. It must match the minted scope in every dimension or resolution fails.
type Vault ¶
type Vault struct {
// contains filtered or unexported fields
}
Vault mints and resolves handles. It holds raw secrets and never exposes them; only opaque handle IDs and safe correlation are observable.
func (*Vault) Inject ¶
Inject resolves the handle against the exact use, decrements its remaining uses, and writes the secret into the request. It returns a scope error without ever echoing the secret. The request is mutated only on success.
func (*Vault) Mint ¶
func (v *Vault) Mint(secret string, scope Scope) (*providerv0.CredentialHandle, error)
Mint stores secret under a fresh opaque handle bound to scope. The returned CredentialHandle carries only the opaque id and the purpose.
Source Files