Documentation
¶
Overview ¶
Package secrets is the credential-source client tier: it selects a secret backend — an environment variable (env/), a git-ignored local file (file/), or AWS Secrets Manager (awssm/) — by Kind (env when empty) and returns the interfaces.Source contract, so switching where a credential is read is a configuration change, not a caller edit. The contract (interfaces.Source plus the opaque types.Secret) lives in core; each backend implements it; this is the factory, mirroring the cache/storage/auth NewFromConfig pattern.
This tier is the generic MECHANISM. The Ref→backend-address mapping is supplied by the caller as POLICY — this tier knows nothing of any specific credential's meaning, and routing a Ref to a particular Kind is likewise the caller's concern.
Index ¶
- Constants
- func Decorate(base interfaces.Source, decs decorate.Decorations, name string, ...) (interfaces.Source, error)
- func GuardDomain(subject, expected, resolved string) error
- func NewFromConfig(ctx context.Context, cfg Config, deps Deps) (interfaces.Source, error)
- func ProjectEnv(ctx context.Context, src interfaces.Source, ref types.Ref, ...) ([]string, error)
- type Config
- type Deps
Constants ¶
const ( // KindEnv reads credentials from environment variables (read-only; the default). KindEnv client.Kind = "env" // KindFile reads and writes credentials in a git-ignored local file. KindFile client.Kind = "file" // KindAWSSM reads credentials from AWS Secrets Manager (read-only; IaC writes them). KindAWSSM client.Kind = "aws-sm" )
Variables ¶
This section is empty.
Functions ¶
func Decorate ¶ added in v0.0.7
func Decorate( base interfaces.Source, decs decorate.Decorations, name string, opts ...client.Option, ) (interfaces.Source, error)
Decorate runs Get and Put of base through the client tier as the client named name. A Get may be retried (when the tier retries); a Put never is. The secret value never reaches a log or span: only the operation is observed.
func GuardDomain ¶ added in v0.0.19
GuardDomain refuses a resolved credential whose domain (a tenant or issuer host) is not the expected one, so a credential for one tenant is never used against another. An empty resolved domain is a mismatch: a credential with no domain cannot be proven safe. subject names the credential in the error (e.g. `Auth0 credentials for env "stg"`). Surrounding space is ignored; a mismatch is CodeInvalidInput.
func NewFromConfig ¶
NewFromConfig builds the credential source cfg.Kind selects, run through the client tier. ctx bounds the AWS config load of KindAWSSM. An unknown kind, or KindFile without a Runner, is CodeInvalidInput.
func ProjectEnv ¶ added in v0.0.19
func ProjectEnv( ctx context.Context, src interfaces.Source, ref types.Ref, fields map[string]string, ) ([]string, error)
ProjectEnv resolves each field of ref through src and returns them as child-process environment entries, `VAR=value`, where fields maps a field name to its variable. It is where a secret value is revealed, for a child's environment only. A field src reports CodeNotFound is skipped, so the fields that resolve are still projected and the child fails on the specific missing variable; any other error is returned. The entries are sorted by variable.
Types ¶
type Config ¶
type Config struct {
// Kind selects the backend; empty means KindEnv.
Kind client.Kind `yaml:"kind" mapstructure:"kind"`
// EnvVars maps a Ref to its environment variable name (KindEnv).
EnvVars map[types.Ref]string `yaml:"env_vars" mapstructure:"env_vars"`
// Files maps a Ref to its git-ignored file location (KindFile).
Files map[types.Ref]file.Location `yaml:"files" mapstructure:"files"`
// Secrets maps a Ref to its Secrets Manager location (KindAWSSM).
Secrets map[types.Ref]awssm.Location `yaml:"secrets" mapstructure:"secrets"`
// Region is the AWS region for the Secrets Manager backend (KindAWSSM).
Region string `yaml:"region" mapstructure:"region"`
// Name labels the client in decoration overrides, metrics, spans and logs; empty
// uses the family name ("secrets").
Name string `yaml:"name" mapstructure:"name"`
}
Config selects the credential backend and maps each Ref to its address there.
type Deps ¶ added in v0.0.7
type Deps struct {
// Decorations decorates the client from the decoration config (decoration.clients)
// and supplies its observability.
decorate.Decorations
// Runner runs `git check-ignore` for the file backend's write guard (KindFile).
Runner interfaces.CommandRunner
}
Deps carries the credential backends' runtime collaborators.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package awssm implements the AWS Secrets Manager credential Source: it reads a credential from a Secrets Manager secret (a JSON object) named by a caller-supplied Ref→location mapping, extracting the configured JSON field.
|
Package awssm implements the AWS Secrets Manager credential Source: it reads a credential from a Secrets Manager secret (a JSON object) named by a caller-supplied Ref→location mapping, extracting the configured JSON field. |
|
Package env implements the environment-variable credential Source: it resolves a Ref to a configured environment variable name and reads its value via os.Getenv.
|
Package env implements the environment-variable credential Source: it resolves a Ref to a configured environment variable name and reads its value via os.Getenv. |
|
Package file implements the file-backed credential Source: it reads and writes credentials in a git-ignored local file (a dotenv-style KEY=value store) named by a caller-supplied Ref→location mapping.
|
Package file implements the file-backed credential Source: it reads and writes credentials in a git-ignored local file (a dotenv-style KEY=value store) named by a caller-supplied Ref→location mapping. |