Documentation
¶
Overview ¶
Package secrets provides a provider-based secret management system.
Index ¶
- func IsNotFound(err error) bool
- type ChainProvider
- type EncryptedFileProvider
- func (p *EncryptedFileProvider) Delete(key string) error
- func (p *EncryptedFileProvider) Get(key string) (string, error)
- func (p *EncryptedFileProvider) List() ([]string, error)
- func (p *EncryptedFileProvider) Name() string
- func (p *EncryptedFileProvider) Set(key, value string) error
- func (p *EncryptedFileProvider) SetBatch(pairs map[string]string) error
- type EnvProvider
- type ErrSecretNotFound
- type Provider
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsNotFound ¶
IsNotFound reports whether err is an ErrSecretNotFound.
Types ¶
type ChainProvider ¶
type ChainProvider struct {
// contains filtered or unexported fields
}
ChainProvider tries multiple providers in order, returning the first successful result.
func NewChainProvider ¶
func NewChainProvider(providers ...Provider) *ChainProvider
NewChainProvider creates a ChainProvider that queries providers in order. The first provider to return a value wins. Non-NotFound errors (e.g. decrypt failure) are propagated immediately.
func (*ChainProvider) Get ¶
func (c *ChainProvider) Get(key string) (string, error)
Get tries each provider in order. Returns the first successful value. Non-NotFound errors are propagated immediately.
func (*ChainProvider) GetWithSource ¶
func (c *ChainProvider) GetWithSource(key string) (value, source string, err error)
GetWithSource tries each provider in order and returns the value along with the name of the provider that resolved it.
func (*ChainProvider) List ¶
func (c *ChainProvider) List() ([]string, error)
List returns the union of all keys across all providers, deduplicated.
func (*ChainProvider) Name ¶
func (c *ChainProvider) Name() string
type EncryptedFileProvider ¶
type EncryptedFileProvider struct {
// contains filtered or unexported fields
}
EncryptedFileProvider stores secrets in an AES-256-GCM encrypted JSON file with Argon2id key derivation.
File format: salt(16) || nonce(12) || AES-GCM-ciphertext Plaintext is JSON: {"key": "value", ...}
func NewEncryptedFileProvider ¶
func NewEncryptedFileProvider(path string, passphrase func() (string, error)) *EncryptedFileProvider
NewEncryptedFileProvider creates a provider that reads/writes an encrypted secrets file at path. The passphrase callback is invoked lazily on first access, keeping the core package free of terminal I/O.
func (*EncryptedFileProvider) Delete ¶
func (p *EncryptedFileProvider) Delete(key string) error
Delete removes a secret and re-encrypts the file.
func (*EncryptedFileProvider) Get ¶
func (p *EncryptedFileProvider) Get(key string) (string, error)
Get returns the secret for key, decrypting the file on first access.
func (*EncryptedFileProvider) List ¶
func (p *EncryptedFileProvider) List() ([]string, error)
List returns all secret keys in the encrypted file.
func (*EncryptedFileProvider) Name ¶
func (p *EncryptedFileProvider) Name() string
func (*EncryptedFileProvider) Set ¶
func (p *EncryptedFileProvider) Set(key, value string) error
Set stores or updates a secret and re-encrypts the file.
type EnvProvider ¶
type EnvProvider struct {
// contains filtered or unexported fields
}
EnvProvider reads secrets from environment variables.
func NewEnvProvider ¶
func NewEnvProvider(prefix string) *EnvProvider
NewEnvProvider creates an EnvProvider. An optional prefix is prepended to every key before looking it up in the environment.
func (*EnvProvider) Get ¶
func (p *EnvProvider) Get(key string) (string, error)
Get returns the environment variable value for key (with optional prefix).
func (*EnvProvider) List ¶
func (p *EnvProvider) List() ([]string, error)
List returns nil — environment variables are not enumerable by design.
func (*EnvProvider) Name ¶
func (p *EnvProvider) Name() string
type ErrSecretNotFound ¶
ErrSecretNotFound is returned when a requested secret key does not exist.
func (*ErrSecretNotFound) Error ¶
func (e *ErrSecretNotFound) Error() string
type Provider ¶
type Provider interface {
// Get retrieves a secret by key. Returns ErrSecretNotFound if the key does not exist.
Get(key string) (string, error)
// List returns all available secret keys.
List() ([]string, error)
// Name returns the provider's identifier (e.g. "env", "encrypted-file").
Name() string
}
Provider is the interface that secret backends must implement.
Source Files