Documentation
¶
Overview ¶
Package secrets stores per-source credentials separately from config.toml.
Per ADR-008, secrets live at ~/.config/clawtool/secrets.toml (mode 0600). Keeping them out of config.toml means the latter can be safely committed to a repo / synced via dotfiles, while credentials stay machine-local.
The store is structured as: scope (= source instance name) → key/value map. Scope "global" holds env that applies to every source.
Resolve() interpolates ${VAR} references in a config-supplied env map against secrets first, then the process env, returning the env that should be set on a spawned source process.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultPath ¶
func DefaultPath() string
DefaultPath returns ~/.config/clawtool/secrets.toml (or the XDG variant). Mirrors config.DefaultPath but with the secrets.toml filename.
Types ¶
type Store ¶
Store is the in-memory representation of secrets.toml.
func LoadOrEmpty ¶
LoadOrEmpty reads the secrets file. A missing file is not an error; we return an empty store so callers can Set+Save without first running an init step.
func (*Store) Delete ¶
Delete removes a key from a scope. Empty scopes are pruned to keep the on-disk file tidy.
func (*Store) Get ¶
Get returns the value for (scope, key). It checks the requested scope first, then the "global" scope, then returns ok=false. This lets the user define shared values once in [scopes.global] and override per instance only when needed.
func (*Store) Resolve ¶
func (s *Store) Resolve(scope string, template map[string]string) (resolved map[string]string, missing []string)
Resolve takes the env map a catalog entry asks for (e.g. {GITHUB_TOKEN: "${GITHUB_TOKEN}"}) and returns the env that should be set on the spawned source. Each ${VAR} reference is filled in by:
- The store at scope+key, then store global+key
- The process env
- Empty string (with `missing` populated so callers can warn)
Plain (non-${...}) values are passed through unchanged.
Source Files