Documentation
¶
Overview ¶
Package keyfetch provides a client for fetching encryption keys from an HTTP endpoint.
The client retrieves public keys in JSON Web Key Set (JWKs) format from a remote server and converts them into usable cryptographic keys for envelope encryption.
This package uses github.com/lestrrat-go/jwx/v3/jwk for JWK parsing and handling.
Currently, keyfetch only supports RSA keys for envelope encryption.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client fetches public keys from a CyberArk HTTP endpoint that provides keys in JWKS format. It can be expanded in future to support other key types and formats, but for now it only supports RSA keys and ignored other types.
func NewClient ¶
func NewClient(ctx context.Context, discoveryClient *servicediscovery.Client, cfg cyberark.ClientConfig, httpClient *http.Client) (*Client, error)
NewClient creates a new key fetching client. Uses CyberArk service discovery to derive the JWKS endpoint and CyberArk identity client for authentication. Constructing the client involves a service discovery call to initialise the identity client, so this may return an error if the discovery client is not able to connect to the service discovery endpoint. If httpClient is nil, a default HTTP client will be created.
type FakeClient ¶
type FakeClient struct {
// Key is the public key that will be returned by FetchKey.
// If nil, a random key will be generated on the first call.
Key *PublicKey
// Err is the error that will be returned by FetchKey.
// If both Key and Err are set, Err takes precedence.
Err error
// FetchKeyCalls tracks how many times FetchKey was called
FetchKeyCalls int
}
FakeClient is a fake implementation of the key fetcher for testing. It can be configured to return specific keys or errors for testing different scenarios.
func NewFakeClient ¶
func NewFakeClient() *FakeClient
NewFakeClient creates a new fake client for testing.
func NewFakeClientWithError ¶
func NewFakeClientWithError(err error) *FakeClient
NewFakeClientWithError creates a new fake client that returns the specified error.
func NewFakeClientWithKey ¶
func NewFakeClientWithKey(keyID string, key *rsa.PublicKey) *FakeClient
NewFakeClientWithKey creates a new fake client that returns the specified key.
Source Files