Documentation
¶
Overview ¶
Package credential manages named project tokens without exposing secret values through its metadata API. Encryption protects a database copy without its local key; cooperative processes running as the same user can access managed files.
Index ¶
- Constants
- Variables
- type RequestResult
- type Store
- func (s *Store) Close() error
- func (s *Store) Invalidate(ctx context.Context, reference, id, by string) error
- func (s *Store) List(ctx context.Context, reference string) ([]Token, error)
- func (s *Store) Metadata(ctx context.Context, reference, id string) (map[string]string, error)
- func (s *Store) Remove(ctx context.Context, reference, id, by string) error
- func (s *Store) RemoveMetadata(ctx context.Context, reference, id, key, by string) error
- func (s *Store) Request(ctx context.Context, reference, id string, refresh bool, by string) (RequestResult, error)
- func (s *Store) Set(ctx context.Context, reference, id string, secret []byte, expiry *time.Time, ...) (Token, error)
- func (s *Store) SetMetadata(ctx context.Context, reference, id, key, value, by string) error
- func (s *Store) Status(ctx context.Context, reference, id string) (Token, error)
- type Token
Constants ¶
const ( StatusPending = "pending" StatusAvailable = "available" StatusReplacementRequested = "replacement-requested" StatusInvalidated = "invalidated" StatusExpired = "expired" StatusRemovalPending = "removal-pending" )
const MaxMetadataBytes = 32 * 1024
const MaxMetadataEntries = 64
const MaxMetadataValueBytes = 4096
const MaxSecretBytes = 64 * 1024
Variables ¶
var ( ErrProjectNotFound = errors.New("project not found") ErrProjectArchived = errors.New("archived projects cannot mutate tokens") ErrTokenNotFound = errors.New("token not found") ErrInvalidIdentifier = errors.New("token identifier must use 1 to 128 ASCII letters, digits, dots, underscores or hyphens, start with a letter or digit, and cannot be request or list") ErrInvalidSecret = errors.New("token must contain 1 to 65536 bytes without line breaks or NUL") ErrInvalidMetadata = errors.New("token metadata is invalid or exceeds its size limits") ErrProtection = errors.New("credential protection or materialization failed; no ready path is available") ErrCleanup = errors.New("credential cleanup failed; the prior plaintext file may remain") ErrUnsupportedPlatform = errors.New("credential protection is unsupported on this platform") ErrPersistence = errors.New("credential persistence failed") )
Functions ¶
This section is empty.
Types ¶
type RequestResult ¶
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
func (*Store) Invalidate ¶
Invalidate discards ciphertext before attempting deletion; retries can only clean up the owned file and cannot reactivate the credential.
func (*Store) List ¶
List returns metadata only, including pending replacement requests on invalidated identifiers.
func (*Store) Metadata ¶ added in v0.31.0
Metadata returns user-provided context only through this explicit read path.
func (*Store) Remove ¶
Remove retains a removal-pending tombstone until owned-file cleanup succeeds.
func (*Store) RemoveMetadata ¶ added in v0.31.0
RemoveMetadata deletes one key without recording its name or value in audits.
func (*Store) Request ¶
func (s *Store) Request(ctx context.Context, reference, id string, refresh bool, by string) (RequestResult, error)
Request idempotently requests replacement or materializes the current value. Every mutation and file operation shares a native process lock so a request holding an old revision cannot recreate it after invalidation completes.
func (*Store) Set ¶
func (s *Store) Set(ctx context.Context, reference, id string, secret []byte, expiry *time.Time, by string) (Token, error)
Set explicitly establishes a new usable revision. A materialization error may follow a committed encrypted value; a later Request repairs the file.
func (*Store) SetMetadata ¶ added in v0.31.0
SetMetadata stores one user-provided string value without adding it to audits.
type Token ¶
type Token struct {
ProjectID int64 `json:"projectId"`
Identifier string `json:"identifier"`
Status string `json:"status"`
Revision int `json:"revision"`
ExpiresAt *time.Time `json:"expiresAt,omitempty"`
RequestedAt *time.Time `json:"requestedAt,omitempty"`
CreatedAt time.Time `json:"createdAt"`
UpdatedAt time.Time `json:"updatedAt"`
}
Source Files