credentials

package
v0.3.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 2, 2026 License: MIT Imports: 12 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	StorageEnv         = snapshot.CredentialStorageEnv
	StorageEncryptedDB = snapshot.CredentialStorageEncryptedDB
	StorageVault       = snapshot.CredentialStorageVault

	StatusActive   = "active"
	StatusDisabled = "disabled"

	ScopeOrganization = snapshot.ScopeOrganization
	ScopeProject      = snapshot.ScopeProject
	ScopeAPIKey       = snapshot.ScopeAPIKey
)
View Source 
const CurrentKeyVersion = 1

CurrentKeyVersion is written into new encrypted payloads.

Variables

This section is empty.

Functions

func DeleteCredential 

func DeleteCredential(ctx context.Context, repo Repository, id string) error

DeleteCredential removes a credential when it has no assignments.

func ValidateAssignmentScope 

func ValidateAssignmentScope(scopeType string) error

ValidateAssignmentScope validates scope_type for credential assignments.

Types

type AssignInput 

type AssignInput struct {
	ID           string
	CredentialID string
	ScopeType    string
	ScopeID      string
	CreatedBy    string
	Now          time.Time
}

AssignInput creates or replaces the credential slot for a scope.

type Assignment 

type Assignment struct {
	ID             string    `json:"id"`
	CredentialID   string    `json:"credential_id"`
	OrganizationID string    `json:"organization_id"`
	ProviderType   string    `json:"provider_type"`
	ScopeType      string    `json:"scope_type"`
	ScopeID        string    `json:"scope_id"`
	CreatedAt      time.Time `json:"created_at"`
	CreatedBy      string    `json:"created_by,omitempty"`
}

Assignment binds a credential to an organization or project scope.

func Assign 

func Assign(ctx context.Context, repo Repository, scopes ScopeChecker, in AssignInput) (*Assignment, error)

Assign binds a credential to org or project scope (one slot per provider_type).

type Box 

type Box struct {
	// contains filtered or unexported fields
}

Box seals and opens credential secrets with a process master key.

func ParseMasterKey 

func ParseMasterKey(raw string) (*Box, error)

ParseMasterKey derives a 32-byte AES key. Accepts raw UTF-8 (SHA-256) or base64-encoded 32-byte material (with optional "base64:" prefix).

func (*Box) Open 

func (b *Box) Open(payload []byte) (string, error)

Open decrypts a Seal payload.

func (*Box) Seal 

func (b *Box) Seal(plaintext string) ([]byte, error)

Seal encrypts plaintext with AES-256-GCM. Stored as nonce||ciphertext.

type CreateInput 

type CreateInput struct {
	ID           string
	OrgID        string
	Name         string
	ProviderType string
	StorageKind  string
	SecretRef    string
	SecretValue  string
	Now          time.Time
}

CreateInput is the write payload for a new credential.

type Credential 

type Credential struct {
	ID               string    `json:"id"`
	OrganizationID   string    `json:"organization_id"`
	Name             string    `json:"name"`
	ProviderType     string    `json:"provider_type"`
	StorageKind      string    `json:"storage_kind"`
	SecretRef        string    `json:"secret_ref,omitempty"`
	EncryptedPayload []byte    `json:"-"`
	KeyVersion       int       `json:"key_version,omitempty"`
	Status           string    `json:"status"`
	HasSecret        bool      `json:"has_secret"`
	CreatedAt        time.Time `json:"created_at"`
	UpdatedAt        time.Time `json:"updated_at"`
}

Credential is an org-owned upstream provider secret (env ref or encrypted value).

func Create 

func Create(ctx context.Context, repo Repository, box *Box, in CreateInput) (*Credential, error)

Create validates, optionally encrypts, and persists a credential.

func NewCredential 

func NewCredential(id, orgID, name, providerType, storageKind, status string, now time.Time) (*Credential, error)

NewCredential validates and builds a credential entity (secret material applied by caller).

func RotateSecret 

func RotateSecret(ctx context.Context, repo Repository, box *Box, id, secretRef, secretValue string) (*Credential, error)

RotateSecret replaces the secret material for an existing credential.

func (Credential) Public 

func (c Credential) Public() Credential

Public strips non-API fields (already omitted via json tags) and sets HasSecret.

type Repository 

type Repository interface {
	ListByOrg(ctx context.Context, orgID string) ([]Credential, error)
	Get(ctx context.Context, id string) (*Credential, error)
	Insert(ctx context.Context, c Credential) error
	UpdateMeta(ctx context.Context, id, name, status string) (*Credential, error)
	UpdateSecret(ctx context.Context, id string, secretRef string, payload []byte, keyVersion int) (*Credential, error)
	Delete(ctx context.Context, id string) error
	OrgID(ctx context.Context, id string) (string, error)
	HasAssignments(ctx context.Context, credentialID string) (bool, error)

	ListAssignmentsByOrg(ctx context.Context, orgID string) ([]Assignment, error)
	InsertAssignment(ctx context.Context, a Assignment) error
	DeleteAssignment(ctx context.Context, id string) error
	AssignmentOrgID(ctx context.Context, id string) (string, error)
	UpsertAssignment(ctx context.Context, a Assignment) (*Assignment, error)
}

Repository persists credentials and assignments.

type ScopeChecker 

type ScopeChecker interface {
	ProjectBelongsToOrg(ctx context.Context, projectID, orgID string) error
	APIKeyBelongsToOrg(ctx context.Context, keyID, orgID string) error
}

ScopeChecker verifies assignment targets belong to the credential's org.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.