rotator

type Env struct {
	Secrets          SecretStore
	Rollouts         RolloutWaiter
	SecretName       string        // "tmi-secrets"
	ServerDeployment string        // "tmi-server"
	RolloutTimeout   time.Duration // 10m
	Now              func() time.Time
}

type Escrow interface {
	Put(ctx context.Context, payload []byte) error
}

type FakeRolloutWaiter struct {
	Waits int
	// contains filtered or unexported fields
}

type GoRedisACL struct {
	// contains filtered or unexported fields
}

type GormSettingsStore struct {
	// contains filtered or unexported fields
}

type Keyring struct {
	CurrentKeyHex  string
	CurrentID      int
	PreviousKeyHex string
	PreviousID     int
}

type KubeRolloutWaiter struct {
	Poll time.Duration
	// contains filtered or unexported fields
}

type KubeSecretStore struct {
	// contains filtered or unexported fields
}

type MemorySecretStore struct {
	DataWrites int
	// contains filtered or unexported fields
}

type NoopEscrow struct{}

type RedisACL interface {
	AddPassword(ctx context.Context, pw string) error
	SetOnlyPassword(ctx context.Context, pw string) error
}

type RedisPasswordRotation struct {
	// contains filtered or unexported fields
}

type RolloutWaiter interface {
	Generation(ctx context.Context, deployment string) (int64, error)
	// WaitRolled returns once the Deployment's generation exceeds since and its rollout is complete.
	WaitRolled(ctx context.Context, deployment string, since int64, timeout time.Duration) error
}

type Rotation interface {
	Name() string
	// Run resumes from the phase recorded on the Secret and returns when the
	// rotation is complete or parked (waiting on a later run). Idempotent.
	// Returned errors must never contain secret values: implementations wrap
	// credential-bearing errors (e.g. Redis echoing an ACL password) with fixed messages.
	Run(ctx context.Context, env *Env) error
}

type Secret struct {
	Name            string
	Data            map[string]string
	Annotations     map[string]string
	ResourceVersion string
}

type SecretStore interface {
	Get(ctx context.Context, name string) (*Secret, error)
	// Update replaces data and annotations; returns ErrConflict when s.ResourceVersion is stale.
	Update(ctx context.Context, s *Secret) error
}

type SecretsManagerEscrow struct {
	// contains filtered or unexported fields
}

type SecretsManagerPutter interface {
	PutSecretValue(ctx context.Context, in *secretsmanager.PutSecretValueInput, optFns ...func(*secretsmanager.Options)) (*secretsmanager.PutSecretValueOutput, error)
}

type SettingsKeyRotation struct {
	// contains filtered or unexported fields
}

type SettingsStore interface {
	ReEncrypt(ctx context.Context, kr Keyring) (int, error)
	CountWithID(ctx context.Context, kr Keyring, id int) (int64, error)
}