Documentation
¶
Overview ¶
Package secrets resolves opaque reference strings into raw secret bytes for the auth layer — JWT signing keys, primarily.
A reference is a short string with an optional scheme prefix:
- "env:NAME" or a bare "NAME" — read environment variable NAME.
- "aws-sm:<secret-id>" — read an AWS Secrets Manager secret.
- "aws-sm:<secret-id>#<key>" — read one JSON key out of an AWS Secrets Manager secret whose value is a JSON object.
The package exists so the framework can pull key material from a managed secret store without that store's SDK leaking into any stable pkg/* surface (see ADR-005 and contracts/firewall_test.go). Every constructor returns the Resolver interface; no exported symbol names a third-party type.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func HasManagedScheme ¶
HasManagedScheme reports whether ref names a managed secret store (anything other than a plain env-var reference). App.New uses this to decide whether to build a managed resolver at all — if no key references one, no client is constructed and no cloud credential chain is touched.
func RegisterResolver ¶
func RegisterResolver(scheme string, factory ResolverFactory) error
RegisterResolver makes scheme resolvable by the returned resolver. The scheme must end in ":" — it is matched as a literal prefix of the reference, so "aws-sm:" owns "aws-sm:prod/jwt".
func RegisteredSchemes ¶
func RegisteredSchemes() []string
RegisteredSchemes returns every managed scheme currently registered.
Types ¶
type Chain ¶
type Chain struct {
// contains filtered or unexported fields
}
Chain routes a reference to the resolver that owns its scheme. A bare or "env:" reference goes to the EnvResolver; anything else goes to whoever registered that scheme. If no resolver owns it, Resolve says so and names what IS registered — the error is where an operator learns that the managed store they configured lives in a module they have not imported.
type EnvResolver ¶
type EnvResolver struct{}
EnvResolver resolves "env:NAME" and bare "NAME" references from the process environment. It has no dependencies beyond the standard library and is always part of the resolver chain.
type Resolver ¶
type Resolver interface {
// Resolve returns the secret bytes for ref, or an error if the
// reference is malformed, the secret is missing, or the backing
// store is unreachable. A missing secret and an unreachable store
// are both errors — callers decide whether to fail open or closed.
Resolve(ctx context.Context, ref string) ([]byte, error)
}
Resolver turns an opaque reference string into raw secret bytes. Implementations must be safe for concurrent use.
type ResolverFactory ¶
A managed secret store registers the scheme it owns, the same way a storage backend registers its name. Before this, the chain named the AWS resolver in its own struct, which meant the framework linked the AWS SDK to offer a scheme most deployments never write — the whole credential chain, for a feature behind an "aws-sm:" prefix nobody had typed.
The scheme is the contract: a reference "aws-sm:prod/jwt" routes to whoever registered "aws-sm:", and the resolver is built lazily, only if some key actually uses it.
Source Files