Documentation
¶
Overview ¶
Package secrets stores per-source credentials separately from config.toml.
Per ADR-008, secrets live at ~/.config/clawtool/secrets.toml (mode 0600). Keeping them out of config.toml means the latter can be safely committed to a repo / synced via dotfiles, while credentials stay machine-local.
The store is structured as: scope (= source instance name) → key/value map. Scope "global" holds env that applies to every source.
Resolve() interpolates ${VAR} references in a config-supplied env map against secrets first, then the process env, returning the env that should be set on a spawned source process.
Index ¶
- func DefaultPath() string
- type Store
- func (s *Store) Delete(scope, key string)
- func (s *Store) Expand(scope, v string) (string, []string)
- func (s *Store) Get(scope, key string) (string, bool)
- func (s *Store) Resolve(scope string, template map[string]string) (resolved map[string]string, missing []string)
- func (s *Store) Save(path string) error
- func (s *Store) Set(scope, key, value string)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultPath ¶
func DefaultPath() string
DefaultPath returns ~/.config/clawtool/secrets.toml (or the XDG variant). Mirrors config.DefaultPath but with the secrets.toml filename.
Types ¶
type Store ¶
Store is the in-memory representation of secrets.toml.
func LoadOrEmpty ¶
LoadOrEmpty reads the secrets file. A missing file is not an error; we return an empty store so callers can Set+Save without first running an init step.
func (*Store) Delete ¶
Delete removes a key from a scope. Empty scopes are pruned to keep the on-disk file tidy.
func (*Store) Expand ¶ added in v0.9.0
Expand resolves every ${VAR} reference in v against the secrets scope first, then the "global" scope, then the process env, returning the expanded string plus the list of variable names that could not be resolved (in encounter order, deduplicated).
A literal without any ${...} substring is returned verbatim with no missing entries — this is the hot-path callers depend on so they don't pay the regex cost on plain values.
func (*Store) Get ¶
Get returns the value for (scope, key). It checks the requested scope first, then the "global" scope, then returns ok=false. This lets the user define shared values once in [scopes.global] and override per instance only when needed.
func (*Store) Resolve ¶
func (s *Store) Resolve(scope string, template map[string]string) (resolved map[string]string, missing []string)
Resolve takes the env map a catalog entry asks for (e.g. {GITHUB_TOKEN: "${GITHUB_TOKEN}"}) and returns the env that should be set on the spawned source. Each ${VAR} reference is filled in by:
- The store at scope+key, then store global+key
- The process env
- Empty string (with `missing` populated so callers can warn)
Plain (non-${...}) values are passed through unchanged.
Source Files