secrets

type Envelope ¶

type Envelope struct {
	ID         ID
	Value      []byte    `json:",omitzero"`
	Provider   string    `json:",omitzero"`
	Version    string    `json:",omitzero"`
	Error      string    `json:",omitzero"`
	CreatedAt  time.Time `json:",omitzero"`
	ResolvedAt time.Time `json:",omitzero"`
	ExpiresAt  time.Time `json:",omitzero"`
}

type ID ¶

type ID string

ID contains a secret identifier. Valid secret identifiers must match the format [A-Za-z0-9.-]+(/[A-Za-z0-9.-]+)+?.

For storage, we don't really differentiate much about the ID format but by convention we do simple, slash-separated management, providing a groupable access control system for management across plugins.

func ParseID(s string) (ID, error)

func (id ID) Match(pattern Pattern) bool

func (id ID) String() string

func (id ID) Valid() error

type Pattern ¶

type Pattern string

Pattern can be used to match secret identifiers. Valid patterns must follow the same validation rules as secret identifiers, with the exception that '*' can be used to match a single component, and '**' can be used to match zero or more components.

func ParsePattern(pattern string) (Pattern, error)

func (p Pattern) Match(id ID) bool

func (p Pattern) Valid() error

type Request ¶

type Request struct {
	ID ID `json:",omitzero"`

	// Provider can be optionally specified to restrict the resolver
	// to a particular provider stack.
	Provider    string `json:",omitzero"`
	ClientID    string `json:",omitzero"`
	RequestedAt time.Time
}

type Resolver ¶

type Resolver interface {
	GetSecret(ctx context.Context, request Request) (Envelope, error)
}

type Restricted ¶

type Restricted struct {
	// contains filtered or unexported fields
}

Restricted controls access to a set of secrets.

By default, it allows access to no secrets but can be modified safely from other threads.

func NewRestricted(resolver Resolver, allowed ...ID) *Restricted

func (r *Restricted) Allow(allowed ...ID)

func (r *Restricted) GetSecret(ctx context.Context, request Request) (Envelope, error)