Documentation
¶
Overview ¶
Package secure abstracts platform-specific secret storage.
Uses github.com/zalando/go-keyring which provides:
- macOS: Keychain Services
- Linux: libsecret / Secret Service (D-Bus)
- Windows: Windows Credential Manager
Service name: "conduit-credentials" — separate from CC's entries on all platforms. File fallback (~/.claude/.conduit-credentials.json) used when the platform keychain is unavailable (headless CI, no libsecret, etc.).
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNotFound = errors.New("secure: not found")
ErrNotFound is returned by Storage.Get when no value exists for the key.
Functions ¶
This section is empty.
Types ¶
type FileStorage ¶
type FileStorage struct {
// contains filtered or unexported fields
}
FileStorage persists secrets to a JSON file with mode 0600 in a directory owned by the current user (mode 0700). It is a stop-gap for environments that lack a real OS keychain — adequate for development and CI but NOT recommended for production credential storage on shared machines.
The on-disk format is a flat JSON object keyed by service\x00key. Reads and writes hold an in-memory cache to avoid spurious file IO under heavy access.
func NewFileStorage ¶
func NewFileStorage(path string) *FileStorage
NewFileStorage returns a FileStorage rooted at the given file path. The parent directory is created with mode 0700 on first write.
On read it performs a permissive permission check matching the TS reference's _x_ helper (decoded/1390.js:66): the file must exist and must not be group/world readable or writable, otherwise we refuse to load — this prevents another local user from planting a token.
func (*FileStorage) Delete ¶
func (s *FileStorage) Delete(service, key string) error
Delete implements Storage.
func (*FileStorage) Get ¶
func (s *FileStorage) Get(service, key string) ([]byte, error)
Get implements Storage.
func (*FileStorage) Set ¶
func (s *FileStorage) Set(service, key string, value []byte) error
Set implements Storage.
func (*FileStorage) String ¶
func (*FileStorage) String() string
String never reveals the file contents.
type MemoryStorage ¶
type MemoryStorage struct {
// contains filtered or unexported fields
}
MemoryStorage is an in-process map-backed Storage for tests.
func NewMemoryStorage ¶
func NewMemoryStorage() *MemoryStorage
func (*MemoryStorage) Delete ¶
func (s *MemoryStorage) Delete(service, key string) error
func (*MemoryStorage) String ¶
func (*MemoryStorage) String() string
type Storage ¶
type Storage interface {
Get(service, key string) ([]byte, error)
Set(service, key string, value []byte) error
Delete(service, key string) error
}
Storage is a per-key blob store.
func NewDefault ¶
func NewDefault() Storage
NewDefault returns the platform keychain with a file fallback. The file fallback handles headless CI and systems without a secret service.
Source Files