Documentation
¶
Overview ¶
Package secrets provides secret resolution backends.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrUnknownScheme indicates the URI scheme is not recognized. ErrUnknownScheme = errors.New("unknown URI scheme") // ErrNoBackendRegistered indicates no backend is registered for the scheme. ErrNoBackendRegistered = errors.New("no backend registered for scheme") )
Common secret errors.
var ( // ErrReferenceEmpty indicates reference is empty. ErrReferenceEmpty = errors.New("reference cannot be empty") // ErrReferenceInvalidFormat indicates reference has invalid format. ErrReferenceInvalidFormat = errors.New("invalid reference format") // ErrReferenceEmptyParts indicates reference has empty required components. ErrReferenceEmptyParts = errors.New("reference has empty required parts") )
Generic reference errors (apply to all backends).
var ( // ErrFieldsEmpty indicates no fields requested for retrieval. ErrFieldsEmpty = errors.New("fields list cannot be empty") // ErrFieldNotFound indicates requested field not found in secret. ErrFieldNotFound = errors.New("field not found in secret") )
Generic field extraction errors (apply to all backends).
var ( // ErrFileNotFound indicates encrypted file not found. ErrFileNotFound = errors.New("file not found") // ErrDecryptionFailed indicates decryption operation failed. ErrDecryptionFailed = errors.New("decryption failed") // ErrInvalidJSON indicates decrypted content is not valid JSON. ErrInvalidJSON = errors.New("decrypted content is not valid JSON") // ErrIdentityNotSet indicates identity/key environment variable not set. ErrIdentityNotSet = errors.New("identity environment variable not set") // ErrIdentityNotFound indicates identity/key file not found. ErrIdentityNotFound = errors.New("identity file not found") // ErrNoMatchingIdentity indicates no identity could decrypt the content. ErrNoMatchingIdentity = errors.New("no identity matched (wrong key?)") )
Generic encryption/decryption errors (apply to encryption-based backends like age, SOPS).
var ( // ErrDocumentEmpty indicates document resolved to empty content. ErrDocumentEmpty = errors.New("document resolved to empty content") )
Generic document errors (apply to all backends).
Functions ¶
This section is empty.
Types ¶
type AgeBackend ¶
type AgeBackend struct{}
AgeBackend implements secret resolution using age encryption.
func (*AgeBackend) Resolve ¶
func (b *AgeBackend) Resolve(_ context.Context, path string, fields []string) (map[string]string, error)
Resolve retrieves secrets from age-encrypted files. Path format: "path/to/file.age[/json/path]" Examples:
- "secrets/db.json.age" - entire file
- "secrets/db.json.age/prod" - navigate to "prod" key
- "secrets/db.json.age/prod/credentials" - deep navigation
Paths are resolved relative to current working directory. Fields: list of field names to extract from the resolved JSON subtree.
func (*AgeBackend) ResolveDocument ¶
ResolveDocument retrieves raw decrypted content from age-encrypted files. Path format: "path/to/file.age" Returns the raw decrypted content without any JSON parsing.
func (*AgeBackend) Scheme ¶
func (*AgeBackend) Scheme() string
Scheme returns the URI scheme for age ("age").
type Backend ¶
type Backend interface {
// Resolve retrieves secrets from the backend.
// path: Backend-specific path without scheme (e.g., "vault/item" or "path/to/file.age/key")
// fields: List of field names to extract from the secret
// Returns a map of field name to field value.
Resolve(ctx context.Context, path string, fields []string) (map[string]string, error)
// ResolveDocument retrieves raw document content from the backend.
// path: Backend-specific path without scheme (e.g., "vault/item" or "path/to/file.age")
// Returns the raw decrypted/retrieved content as bytes.
ResolveDocument(ctx context.Context, path string) ([]byte, error)
// Scheme returns the URI scheme this backend handles (e.g., "op", "age")
Scheme() string
}
Backend defines the interface for secret resolution backends.
type OnePasswordBackend ¶
type OnePasswordBackend struct{}
OnePasswordBackend implements secret resolution using 1Password CLI.
func NewOnePasswordBackend ¶
func NewOnePasswordBackend() *OnePasswordBackend
NewOnePasswordBackend creates a new 1Password backend.
func (*OnePasswordBackend) Resolve ¶
func (*OnePasswordBackend) Resolve(ctx context.Context, path string, fields []string) (map[string]string, error)
Resolve retrieves secrets from 1Password. Path format: "vault/item" Fields: list of field names to extract from the item.
func (*OnePasswordBackend) ResolveDocument ¶
ResolveDocument retrieves raw document content from 1Password. Path format: "vault/item" Uses `op document get` to retrieve the raw document content.
func (*OnePasswordBackend) Scheme ¶
func (*OnePasswordBackend) Scheme() string
Scheme returns the URI scheme for 1Password ("op").
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver manages secret backends and routes requests to the appropriate backend.
Source Files