secrets

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Feb 11, 2026 License: MIT Imports: 7 Imported by: 0

Documentation

Overview

Package secrets provides pluggable secret resolution from external backends. The resolver registry is safe for concurrent use.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ParseScheme

func ParseScheme(ref string) string

ParseScheme extracts the scheme from a URI (e.g., "op" from "op://vault/item").

func Register

func Register(r Resolver)

Register adds a resolver to the registry. Safe for concurrent use.

func Resolve

func Resolve(ctx context.Context, reference string) (string, error)

Resolve dispatches to the appropriate resolver based on URI scheme.

func ResolveAll

func ResolveAll(ctx context.Context, secrets map[string]string) (map[string]string, error)

ResolveAll resolves all secrets in the map, returning resolved values. Keys are environment variable names, values are secret references. Fails fast on first error.

Types

type BackendError

type BackendError struct {
	Backend   string
	Reference string
	Reason    string
	Fix       string
}

BackendError wraps errors from secret backends with actionable context.

func (*BackendError) Error

func (e *BackendError) Error() string

type InvalidReferenceError

type InvalidReferenceError struct {
	Reference string
	Reason    string
}

InvalidReferenceError indicates a malformed secret reference.

func (*InvalidReferenceError) Error

func (e *InvalidReferenceError) Error() string

type NotFoundError

type NotFoundError struct {
	Reference string
	Backend   string
}

NotFoundError indicates the secret was not found in the backend.

func (*NotFoundError) Error

func (e *NotFoundError) Error() string

type OnePasswordResolver

type OnePasswordResolver struct{}

OnePasswordResolver resolves secrets from 1Password using the op CLI.

func (*OnePasswordResolver) Resolve

func (r *OnePasswordResolver) Resolve(ctx context.Context, reference string) (string, error)

Resolve fetches a secret using `op read`.

func (*OnePasswordResolver) Scheme

func (r *OnePasswordResolver) Scheme() string

Scheme returns "op".

type Resolver

type Resolver interface {
	// Scheme returns the URI scheme this resolver handles (e.g., "op", "ssm").
	Scheme() string

	// Resolve fetches the secret value for the given reference.
	// The reference is the full URI (e.g., "op://Dev/OpenAI/api-key").
	Resolve(ctx context.Context, reference string) (string, error)
}

Resolver resolves a secret reference to its plaintext value.

type SSMResolver

type SSMResolver struct{}

SSMResolver resolves secrets from AWS Systems Manager Parameter Store.

func (*SSMResolver) Resolve

func (r *SSMResolver) Resolve(ctx context.Context, reference string) (string, error)

Resolve fetches a parameter using `aws ssm get-parameter`.

func (*SSMResolver) Scheme

func (r *SSMResolver) Scheme() string

Scheme returns "ssm".

type UnsupportedSchemeError

type UnsupportedSchemeError struct {
	Scheme string
}

UnsupportedSchemeError indicates an unrecognized URI scheme.

func (*UnsupportedSchemeError) Error

func (e *UnsupportedSchemeError) Error() string

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL