Documentation
¶
Index ¶
- Constants
- func DeleteCredential(ctx context.Context, repo Repository, id string) error
- func ValidateAssignmentScope(scopeType string) error
- type AssignInput
- type Assignment
- type Box
- type CreateInput
- type Credential
- func Create(ctx context.Context, repo Repository, box *Box, in CreateInput) (*Credential, error)
- func NewCredential(id, orgID, name, providerType, storageKind, status string, now time.Time) (*Credential, error)
- func RotateSecret(ctx context.Context, repo Repository, box *Box, ...) (*Credential, error)
- type Repository
- type ScopeChecker
Constants ¶
const ( StorageEnv = snapshot.CredentialStorageEnv StorageEncryptedDB = snapshot.CredentialStorageEncryptedDB StorageVault = snapshot.CredentialStorageVault StatusActive = "active" StatusDisabled = "disabled" ScopeOrganization = snapshot.ScopeOrganization ScopeProject = snapshot.ScopeProject ScopeAPIKey = snapshot.ScopeAPIKey )
const CurrentKeyVersion = 1
CurrentKeyVersion is written into new encrypted payloads.
Variables ¶
This section is empty.
Functions ¶
func DeleteCredential ¶
func DeleteCredential(ctx context.Context, repo Repository, id string) error
DeleteCredential removes a credential when it has no assignments.
func ValidateAssignmentScope ¶
ValidateAssignmentScope validates scope_type for credential assignments.
Types ¶
type AssignInput ¶
type AssignInput struct {
ID string
CredentialID string
ScopeType string
ScopeID string
CreatedBy string
Now time.Time
}
AssignInput creates or replaces the credential slot for a scope.
type Assignment ¶
type Assignment struct {
ID string `json:"id"`
CredentialID string `json:"credential_id"`
OrganizationID string `json:"organization_id"`
ProviderType string `json:"provider_type"`
ScopeType string `json:"scope_type"`
ScopeID string `json:"scope_id"`
CreatedAt time.Time `json:"created_at"`
CreatedBy string `json:"created_by,omitempty"`
}
Assignment binds a credential to an organization or project scope.
func Assign ¶
func Assign(ctx context.Context, repo Repository, scopes ScopeChecker, in AssignInput) (*Assignment, error)
Assign binds a credential to org or project scope (one slot per provider_type).
type Box ¶
type Box struct {
// contains filtered or unexported fields
}
Box seals and opens credential secrets with a process master key.
func ParseMasterKey ¶
ParseMasterKey derives a 32-byte AES key. Accepts raw UTF-8 (SHA-256) or base64-encoded 32-byte material (with optional "base64:" prefix).
type CreateInput ¶
type CreateInput struct {
ID string
OrgID string
Name string
ProviderType string
StorageKind string
SecretRef string
SecretValue string
Now time.Time
}
CreateInput is the write payload for a new credential.
type Credential ¶
type Credential struct {
ID string `json:"id"`
OrganizationID string `json:"organization_id"`
Name string `json:"name"`
ProviderType string `json:"provider_type"`
StorageKind string `json:"storage_kind"`
SecretRef string `json:"secret_ref,omitempty"`
EncryptedPayload []byte `json:"-"`
KeyVersion int `json:"key_version,omitempty"`
Status string `json:"status"`
HasSecret bool `json:"has_secret"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
}
Credential is an org-owned upstream provider secret (env ref or encrypted value).
func Create ¶
func Create(ctx context.Context, repo Repository, box *Box, in CreateInput) (*Credential, error)
Create validates, optionally encrypts, and persists a credential.
func NewCredential ¶
func NewCredential(id, orgID, name, providerType, storageKind, status string, now time.Time) (*Credential, error)
NewCredential validates and builds a credential entity (secret material applied by caller).
func RotateSecret ¶
func RotateSecret(ctx context.Context, repo Repository, box *Box, id, secretRef, secretValue string) (*Credential, error)
RotateSecret replaces the secret material for an existing credential.
func (Credential) Public ¶
func (c Credential) Public() Credential
Public strips non-API fields (already omitted via json tags) and sets HasSecret.
type Repository ¶
type Repository interface {
ListByOrg(ctx context.Context, orgID string) ([]Credential, error)
Get(ctx context.Context, id string) (*Credential, error)
Insert(ctx context.Context, c Credential) error
UpdateMeta(ctx context.Context, id, name, status string) (*Credential, error)
UpdateSecret(ctx context.Context, id string, secretRef string, payload []byte, keyVersion int) (*Credential, error)
Delete(ctx context.Context, id string) error
OrgID(ctx context.Context, id string) (string, error)
HasAssignments(ctx context.Context, credentialID string) (bool, error)
ListAssignmentsByOrg(ctx context.Context, orgID string) ([]Assignment, error)
InsertAssignment(ctx context.Context, a Assignment) error
DeleteAssignment(ctx context.Context, id string) error
AssignmentOrgID(ctx context.Context, id string) (string, error)
UpsertAssignment(ctx context.Context, a Assignment) (*Assignment, error)
}
Repository persists credentials and assignments.
Source Files