secrets

type BackendInit func(
	secretConfig map[string]interface{},
) (Secrets, error)

type ErrInvalidKeyContext struct {
	Reason string
}

type ErrProviderInternal struct {
	Provider string
	Reason   string
}

type ReaderInit func(map[string]interface{}) (SecretReader, error)

type SecretKey struct {
	// Prefix is an optional part of the SecretKey.
	Prefix string
	// Name is a mandatory part of the SecretKey.
	Name string
}

type SecretReader interface {
	// String representation of the backend.
	String() string
	// Get returns the secret associate with the supplied key.
	Get(ctx context.Context, key SecretKey) (secret map[string]interface{}, err error)
}

type SecretStore interface {
	SecretReader
	// Set stores the secret data identified by the key.
	// The caller should ensure they use unique key so that they won't
	// unknowingly overwrite an existing secret.
	Set(ctx context.Context, key SecretKey, secret map[string]interface{}) error
	// Delete deletes the secret data associated with the supplied key.
	Delete(ctx context.Context, key SecretKey) error
}

type Secrets interface {
	// String representation of the backend KMS
	String() string

	// GetSecret returns the secret data associated with the
	// supplied secretId. The secret data / plain text  can be used
	// by callers to encrypt their data. It is assumed that the plain text
	// data will be destroyed by the caller once used.
	GetSecret(
		secretId string,
		keyContext map[string]string,
	) (map[string]interface{}, Version, error)

	// PutSecret will associate an secretId to its secret data
	// provided in the arguments and store it into the secret backend
	// The caller should ensure they use unique secretIDs so that they won't
	// unknowingly overwrite an existing secret.
	PutSecret(
		secretId string,
		plainText map[string]interface{},
		keyContext map[string]string,
	) (Version, error)

	// DeleteSecret deletes the secret data associated with the
	// supplied secretId.
	DeleteSecret(
		secretId string,
		keyContext map[string]string,
	) error

	// Encrypt encrypts the supplied plain text data using the given key.
	// The API would fetch the plain text key, encrypt the data with it.
	// The plain text key will not be stored anywhere else and would be
	// deleted from memory.
	Encrypt(
		secretId string,
		plaintTextData string,
		keyContext map[string]string,
	) (string, error)

	// Decrypt decrypts the supplied encrypted  data using the given key.
	// The API would fetch the plain text key, decrypt the data with it.
	// The plain text key will not be stored anywhere else and would be
	// deleted from memory.
	Decrypt(
		secretId string,
		encryptedData string,
		keyContext map[string]string,
	) (string, error)

	// Reencrypt decrypts the data with the previous key and re-encrypts it
	// with the new key..
	Rencrypt(
		originalSecretId string,
		newSecretId string,
		originalKeyContext map[string]string,
		newKeyContext map[string]string,
		encryptedData string,
	) (string, error)

	// ListSecrets returns a list of known secretIDs
	ListSecrets() ([]string, error)
}

type StoreInit func(map[string]interface{}) (SecretStore, error)

type Version string