Documentation
¶
Overview ¶
Package sink defines the managed writable secret sink contract. The host coordinator uses it to capture provider-returned secrets durably without ever exposing plaintext to provider code, and to recover captured secrets on the host side for its own use. A managed cloud backend implements the same contract behind an adapter; the in-process Memory implementation here is the conformance reference that host and adapter behavior are tested against.
The contract has four operations:
- Prepare returns an opaque capture target for one scoped secret slot.
- PutDurable makes a captured value durable before it reports success.
- Lookup recovers a durable value for authorized host use only.
- AbortUnused removes a reservation only while it is still unfilled.
A value that PutDurable has made durable is never rolled back implicitly: a later action failing does not undo the capture, and AbortUnused refuses to touch a filled reservation. Removing a durable secret is the explicit, separately audited Revoke lifecycle.
Index ¶
- type Address
- type AuditEvent
- type AuditOp
- type Memory
- func (m *Memory) AbortUnused(target string) error
- func (m *Memory) Audit() []AuditEvent
- func (m *Memory) Lookup(ref *providerv0.OpaqueReference) ([]byte, error)
- func (m *Memory) Prepare(addr Address, oneTime bool) (Reservation, error)
- func (m *Memory) PutDurable(target string, value []byte) (*providerv0.OpaqueReference, error)
- func (m *Memory) Revoke(ref *providerv0.OpaqueReference) error
- type Reservation
- type Sink
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Address ¶
type Address struct {
Consumer string
Environment string
Binding string
Provider string
Purpose providerv0.CredentialPurpose
Name string
}
Address scopes one secret slot by consumer, environment, binding, provider, and credential purpose. Name distinguishes multiple slots that otherwise share the same scope (for example two webhook secrets on one binding).
type AuditEvent ¶
type AuditEvent struct {
Seq uint64
Op AuditOp
Consumer string
Environment string
Binding string
Provider string
Purpose providerv0.CredentialPurpose
Name string
Reference string
Version uint64
Fingerprint string
}
AuditEvent records one sink operation. It carries scope, the opaque reference, the version, and a non-reversible fingerprint, but never a secret value.
type Memory ¶
type Memory struct {
// contains filtered or unexported fields
}
Memory is the in-process reference implementation of Sink. It enforces every contract property so host and backend adapters can be tested against it.
func (*Memory) AbortUnused ¶
func (*Memory) Audit ¶
func (m *Memory) Audit() []AuditEvent
Audit returns a copy of the value-free audit log in operation order.
func (*Memory) Lookup ¶
func (m *Memory) Lookup(ref *providerv0.OpaqueReference) ([]byte, error)
func (*Memory) PutDurable ¶
func (m *Memory) PutDurable(target string, value []byte) (*providerv0.OpaqueReference, error)
func (*Memory) Revoke ¶
func (m *Memory) Revoke(ref *providerv0.OpaqueReference) error
Revoke removes a durable secret. It is the only path that deletes durable material and is audited distinctly from an unused-reservation abort.
type Reservation ¶
type Reservation struct {
// contains filtered or unexported fields
}
Reservation is an opaque capture target bound to one Address. Provider code never sees it; the host hands PutDurable the Target once a value is captured.
func (Reservation) Address ¶
func (r Reservation) Address() Address
Address returns the scope the reservation was prepared for.
func (Reservation) OneTime ¶
func (r Reservation) OneTime() bool
OneTime reports whether the reserved slot holds a one-time secret that Lookup consumes on first authorized recovery.
func (Reservation) Target ¶
func (r Reservation) Target() string
Target is the opaque capture target. It reveals nothing about the value and is safe to carry through host coordination.
type Sink ¶
type Sink interface {
// Prepare returns a stable opaque capture target for addr. Preparing the
// same address again returns the same target so retried preparation does
// not fork a second reservation.
Prepare(addr Address, oneTime bool) (Reservation, error)
// PutDurable makes value durable for the reservation identified by target
// and returns an opaque reference to it. Re-putting the value already stored
// for the target is idempotent and returns the same reference; putting a
// different value rotates to a new version.
PutDurable(target string, value []byte) (*providerv0.OpaqueReference, error)
// Lookup recovers the durable value for host use. It never returns a value
// to provider code. A one-time secret is consumed on the first Lookup.
Lookup(ref *providerv0.OpaqueReference) ([]byte, error)
// AbortUnused removes a still-unfilled reservation. It refuses to remove a
// reservation whose value has already been made durable.
AbortUnused(target string) error
}
Sink is the managed writable secret sink contract.
Source Files