Documentation
¶
Overview ¶
Package session resolves a credential from a secrets Source, verifies it once, and projects it into the environment a command runs with: the session a CLI command opens before it calls a cloud or an identity provider.
Index ¶
Constants ¶
const ExpirySkew = 5 * time.Minute
ExpirySkew is how long before its expiry a cached credential stops being served: a credential that expires within it is resolved again, so a call never starts with one that lapses mid-request.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Expiring ¶ added in v0.0.19
type Expiring interface {
// ExpiresAt reports when the credential stops working; zero means never.
ExpiresAt() time.Time
}
Expiring is a credential that knows when it expires. A Provider resolves a cached Expiring credential again once its ExpiresAt is within ExpirySkew; a zero ExpiresAt never expires. A credential that does not implement it is cached for the Provider's lifetime.
type Provider ¶
type Provider[Cred any] struct { // contains filtered or unexported fields }
Provider resolves, verifies and caches credentials of type Cred.
func NewProvider ¶
func NewProvider[Cred any]( src interfaces.Source, parse func([]byte) (Cred, error), verify func(context.Context, Cred) error, project func(Cred) []string, ) *Provider[Cred]
NewProvider returns a Provider over src. It does no I/O.
func (*Provider[Cred]) Resolve ¶
Resolve returns the verified credential ref names, resolving and verifying it on first use and serving it from the cache after, until it nears expiry (Expiring). A credential that fails verification is CodeUnauthorized and is not cached, so a fixed credential works on the next call.
Source Files