Documentation
¶
Index ¶
- Constants
- func Decrypt(key, nonce, ciphertext []byte) ([]byte, error)
- func DeriveKey(passphrase string, salt []byte) []byte
- func Encrypt(key, plaintext []byte) (nonce, ciphertext []byte, err error)
- func GenerateDEK() ([]byte, error)
- func GenerateSalt() ([]byte, error)
- func IsValidType(t VariableType) bool
- func UnlockVault(ev *EncryptedVault, passphrase string) ([]byte, error)
- type Blob
- type EncryptedVault
- type KDFParams
- type Set
- type SetSummary
- type Store
- func (s *Store) ChangePassphrase(oldPass, newPass string) error
- func (s *Store) CreateSet(name string) error
- func (s *Store) Delete(key string) error
- func (s *Store) DeleteSet(name string) error
- func (s *Store) Export() map[string]string
- func (s *Store) Get(key string) (string, bool)
- func (s *Store) GetSetSecrets(setName string) []Variable
- func (s *Store) GetVariable(key string) (Variable, bool)
- func (s *Store) Has(key string) bool
- func (s *Store) Import(secrets map[string]string) (int, error)
- func (s *Store) ImportVariables(vars []Variable) (int, error)
- func (s *Store) IsEncrypted() bool
- func (s *Store) IsLocked() bool
- func (s *Store) Keys() []string
- func (s *Store) List() []Variable
- func (s *Store) ListSets() []SetSummary
- func (s *Store) Load() error
- func (s *Store) Lock(passphrase string) error
- func (s *Store) Set(key, value string) error
- func (s *Store) SetSecretSet(key, setName string) error
- func (s *Store) SetVariable(v Variable) error
- func (s *Store) SetWithSet(key, value, setName string) error
- func (s *Store) Unlock(passphrase string) error
- func (s *Store) Values() []string
- type Variable
- type VariableType
Constants ¶
const CurrentStoreVersion = 2
CurrentStoreVersion is the on-disk schema version this build emits. v0 (legacy flat array) and v1 (object with "secrets" key) loads are supported but every save rewrites the file as v2.
Variables ¶
This section is empty.
Functions ¶
func GenerateDEK ¶
GenerateDEK returns 32 random bytes for use as a data encryption key.
func GenerateSalt ¶
GenerateSalt returns 16 random bytes for use as a KDF salt.
func IsValidType ¶
func IsValidType(t VariableType) bool
IsValidType reports whether t is one of the supported variable types.
func UnlockVault ¶
func UnlockVault(ev *EncryptedVault, passphrase string) ([]byte, error)
UnlockVault decrypts an encrypted vault, returning the plaintext secrets JSON.
Types ¶
type Blob ¶
type Blob struct {
Nonce string `json:"nonce"` // base64
Ciphertext string `json:"ciphertext"` // base64
}
Blob holds a nonce + ciphertext pair for XChaCha20-Poly1305.
type EncryptedVault ¶
type EncryptedVault struct {
Version int `json:"version"`
Encrypted bool `json:"encrypted"`
KDF KDFParams `json:"kdf"`
DEK Blob `json:"dek"`
Data Blob `json:"data"`
}
EncryptedVault is the JSON schema for secrets.enc (envelope-encrypted vault).
func ChangePassphrase ¶
func ChangePassphrase(ev *EncryptedVault, oldPass, newPass string) (*EncryptedVault, error)
ChangePassphrase re-encrypts the DEK with a new passphrase. The data ciphertext is unchanged.
type KDFParams ¶
type KDFParams struct {
Algorithm string `json:"algorithm"`
Salt string `json:"salt"` // base64
Time uint32 `json:"time"` // iterations
Memory uint32 `json:"memory"` // KiB
Threads uint8 `json:"threads"`
}
KDFParams holds the Argon2id key derivation parameters.
type SetSummary ¶
type SetSummary struct {
Name string `json:"name"`
Description string `json:"description,omitempty"`
Count int `json:"count"`
}
SetSummary is a set with its member count.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store manages variables in a JSON file with mutex-protected access. It serves both secrets (IsSecret=true, redacted in logs) and non-sensitive configuration (IsSecret=false, plaintext in logs).
func (*Store) ChangePassphrase ¶
ChangePassphrase re-encrypts the DEK with a new passphrase.
func (*Store) DeleteSet ¶
DeleteSet removes a set. Variables in the set are unassigned but not deleted.
func (*Store) Get ¶
Get returns a variable's value and whether it exists. Read methods take the write lock because reloadIfChanged may mutate state.
func (*Store) GetSetSecrets ¶
GetSetSecrets returns all variables belonging to a set, sorted by key. Retains its historic name (set-based "secrets" lookup) for backward compatibility with callers; the unified store treats plaintext and secret variables identically when grouping by set.
func (*Store) GetVariable ¶
GetVariable returns the full variable record (including type and sensitivity) and whether it exists.
func (*Store) Import ¶
Import bulk-imports variables. Plain-map imports default to secret/string (Article XII secure default); callers needing per-key type or visibility should use ImportVariables.
func (*Store) ImportVariables ¶
ImportVariables bulk-imports variables, preserving per-entry metadata. Returns the count of keys imported.
func (*Store) IsEncrypted ¶
IsEncrypted returns true when the vault has an encrypted backing file. Takes the write lock so reloadIfChanged can pick up external lock/unlock transitions before reporting state.
func (*Store) IsLocked ¶
IsLocked returns true when the vault is encrypted and not yet unlocked. Takes the write lock so reloadIfChanged can pick up external lock/unlock transitions before reporting state.
func (*Store) ListSets ¶
func (s *Store) ListSets() []SetSummary
ListSets returns all sets with their member counts.
func (*Store) Load ¶
Load reads variables into memory. Checks for secrets.enc first (encrypted), then falls back to secrets.json (plaintext). If the file doesn't exist, starts empty.
func (*Store) Set ¶
Set adds or updates a variable's value. For existing keys, the previous Set, Type, and IsSecret are preserved (this is the historic Set behaviour from the secrets-only era and many callers rely on it). For new keys the secure default (IsSecret=true, Type=string) applies (Article XII).
func (*Store) SetSecretSet ¶
SetSecretSet assigns a variable to a set (or unassigns if setName is empty).
func (*Store) SetVariable ¶
SetVariable adds or updates a variable with full metadata control. All fields are taken from v; existing entries are fully replaced. Used by the CLI/API when callers want to thread type and sensitivity explicitly. Auto-creates referenced sets so callers don't need a separate CreateSet.
func (*Store) SetWithSet ¶
SetWithSet adds or updates a variable and assigns it to a set. Preserves existing Type/IsSecret metadata for known keys; new keys default to secret/string.
type Variable ¶
type Variable struct {
Key string `json:"key"`
Value string `json:"value"`
Type VariableType `json:"type"`
IsSecret bool `json:"is_secret"`
Set string `json:"set,omitempty"`
}
Variable represents a stored variable. Secrets and non-sensitive configuration share the same struct; IsSecret gates redaction and the on-disk encryption envelope is unchanged either way.
type VariableType ¶
type VariableType string
VariableType enumerates the supported value types for stored variables. PR 1 records the type as metadata only; expansion treats every value as a string. PR 2 will rewrite ${var:KEY} expansion to honour the type.
const ( TypeString VariableType = "string" TypeJSON VariableType = "json" TypeList VariableType = "list" TypeNumber VariableType = "number" TypeBool VariableType = "bool" )
Source Files