Documentation
¶
Index ¶
- Variables
- func ContextWithRejectedSecretValue(ctx context.Context, fingerprint string) context.Context
- func RegisterLLMConfigResolver(r LLMConfigResolver)
- func RejectedSecretValue(ctx context.Context) string
- func Schemes() []string
- type LLMConfigResolver
- type SecretProvider
- type SecretProviderProxy
- type SecretResolver
Constants ¶
This section is empty.
Variables ¶
var ErrNoLLMConfigResolver = errors.New("llmconfig:// secrets are only served by the dagger CLI")
ErrNoLLMConfigResolver reports a llmconfig:// lookup in a process that serves no LLM configuration (anything but the dagger CLI).
Functions ¶
func ContextWithRejectedSecretValue ¶
ContextWithRejectedSecretValue marks a secret lookup with the SHA-256 hex fingerprint of a value its consumer has rejected. An empty fingerprint clears a prior rejection, including one inherited from incoming RPC metadata.
func RegisterLLMConfigResolver ¶
func RegisterLLMConfigResolver(r LLMConfigResolver)
RegisterLLMConfigResolver installs the resolver behind the llmconfig:// scheme. Passing nil clears it. Safe to call concurrently.
func RejectedSecretValue ¶
RejectedSecretValue returns the rejected value's fingerprint at either end of a secret RPC. Outgoing metadata takes precedence to allow clearing it.
Types ¶
type LLMConfigResolver ¶
LLMConfigResolver serves the llmconfig:// scheme: credentials the dagger CLI holds for the engine's LLM router (an API key stored in the user's config file, a subscription OAuth token it keeps refreshed). The path is "<provider>/<field>", e.g. "anthropic/auth_token"; see hack/designs/llm-config-transport.md for the fields.
Only the CLI can serve it — it owns the config file and the OAuth refresh flows — so it registers the resolver at startup via RegisterLLMConfigResolver. The scheme itself is always known, so that `secret(uri:"llmconfig://...")` validates in the engine; resolving one where no resolver is registered is an error.
A resolver may be handed a RejectedSecretValue fingerprint in the context: the consumer has found the value it last served unusable, and the resolver should rotate it if it can rather than serve it again.
type SecretProvider ¶
type SecretProvider struct{}
func NewSecretProvider ¶
func NewSecretProvider() SecretProvider
func (SecretProvider) GetSecret ¶
func (sp SecretProvider) GetSecret(ctx context.Context, req *secrets.GetSecretRequest) (*secrets.GetSecretResponse, error)
func (SecretProvider) Register ¶
func (sp SecretProvider) Register(server *grpc.Server)
type SecretProviderProxy ¶ added in v0.19.7
type SecretProviderProxy struct {
// contains filtered or unexported fields
}
func NewSecretProviderProxy ¶ added in v0.19.7
func NewSecretProviderProxy(client secrets.SecretsClient) SecretProviderProxy
func (SecretProviderProxy) GetSecret ¶ added in v0.19.7
func (sp SecretProviderProxy) GetSecret(ctx context.Context, req *secrets.GetSecretRequest) (*secrets.GetSecretResponse, error)
func (SecretProviderProxy) Register ¶ added in v0.19.7
func (sp SecretProviderProxy) Register(server *grpc.Server)
type SecretResolver ¶
func ResolverForID ¶
func ResolverForID(id string) (SecretResolver, string, error)
Source Files