secrets

type Backend ¶ added in v1.10.0

type Backend string

const (
	BackendAuto    Backend = "auto"
	BackendKeyring Backend = "keyring"
	BackendFile    Backend = "file"
)

type Kind ¶ added in v1.10.0

type Kind string

Kind distinguishes secrets (values in the backend) from env vars (inline).

const (
	KindSecret Kind = "secret"
	KindEnv    Kind = "env"
)

type LocalSource ¶

type LocalSource struct {
	// contains filtered or unexported fields
}

LocalSource adapts the Devsy Store to the generic source interface.

func NewLocalSource(store Store, contextName string) *LocalSource

func (s *LocalSource) Get(_ context.Context, name string) (ResolvedSecret, error)

type ProjectConfig ¶

type ProjectConfig struct {
	SecretSources []SourceConfig `json:"secretSources,omitempty" yaml:"secretSources,omitempty"`
	Secrets       []string       `json:"secrets,omitempty"       yaml:"secrets,omitempty"`
}

ProjectConfig is the repository-owned subset of Devsy configuration used by secret discovery.

func LoadProjectConfigFromRoot(root string) (*ProjectConfig, bool, error)

func LoadProjectConfigFromRootWithOptions(
	root, devContainerPath, devContainerID string,
) (*ProjectConfig, bool, error)

func ParseProjectConfig(data []byte) (*ProjectConfig, error)

type Redactor ¶ added in v1.10.0

type Redactor struct {
	// contains filtered or unexported fields
}

func NewRedactor(secretsEnv []string) *Redactor

func (r *Redactor) Redact(s string) string

type ResolvedSecret ¶

type ResolvedSecret struct {
	Name      string
	Value     string
	Sensitive bool
	Source    string
}

ResolvedSecret is the runtime value returned by a secret source.

type Resolver ¶

type Resolver struct {
	// contains filtered or unexported fields
}

Resolver routes a SecretRef to an explicitly registered source instance.

func NewResolver() *Resolver

func NewResolverForConfig(devsyConfig *config.Config) (*Resolver, error)

func (r *Resolver) Register(name, typeName string, source Source) error

func (r *Resolver) Resolve(ctx context.Context, ref SecretRef) (ResolvedSecret, error)

type SOPSSource ¶

type SOPSSource struct {
	// contains filtered or unexported fields
}

SOPSSource resolves values from one SOPS-encrypted document. A source is command-scoped: decrypted values are cached in memory for the lifetime of the source instance.

func NewSOPSDataSource(name, logicalPath, format string, encrypted []byte) *SOPSSource

func NewSOPSSource(name, filePath, format string) *SOPSSource

func (s *SOPSSource) Get(ctx context.Context, name string) (ResolvedSecret, error)

func (s *SOPSSource) Validate(ctx context.Context) error

type SecretMeta ¶ added in v1.10.0

type SecretMeta struct {
	Name     string    `json:"name"`
	Context  string    `json:"context"`
	Kind     Kind      `json:"kind"`
	Value    string    `json:"value,omitempty"`
	Created  time.Time `json:"created"`
	LastUsed time.Time `json:"lastUsed,omitzero"`

	Orphaned bool `json:"-"`
}

func (m SecretMeta) Sensitive() bool

type SecretRef ¶

type SecretRef struct {
	Type   string
	Source string
	Name   string
}

SecretRef identifies a named secret and the source instance that owns it. Unqualified references resolve from the local Devsy store. Qualified references use TYPE:SOURCE/NAME, for example sops:project/API_TOKEN.

func ParseRef(value string) (SecretRef, error)

func (r SecretRef) String() string

type Source ¶

type Source interface {
	Get(ctx context.Context, name string) (ResolvedSecret, error)
}

Source resolves externally or locally owned secret values.

type SourceConfig ¶

type SourceConfig struct {
	Name   string `json:"name"             yaml:"name"`
	Type   string `json:"type"             yaml:"type"`
	Path   string `json:"path,omitempty"   yaml:"path,omitempty"`
	Format string `json:"format,omitempty" yaml:"format,omitempty"`
}

SourceConfig describes an external secret source. It contains references only; secret values and decryption credentials are never persisted here.

func AddSourceConfig(sources []SourceConfig, source SourceConfig) ([]SourceConfig, error)

func FindSourceConfig(sources []SourceConfig, name string) (SourceConfig, bool)

func LoadSourceConfigs(devsyConfig *config.Config) ([]SourceConfig, error)

func RemoveSourceConfig(sources []SourceConfig, name string) ([]SourceConfig, bool)

type Store ¶ added in v1.10.0

type Store interface {
	Set(context, name, value string, kind Kind) error
	Get(context, name string) (string, error)
	Meta(context, name string) (SecretMeta, error)
	List(context string) ([]SecretMeta, error)
	Delete(context, name string) error
}

func NewStoreForConfig(devsyConfig *config.Config) (Store, error)