config

func DeleteKeyringPassphrase ¶

func DeleteKeyringPassphrase(opts StoreKeyringOptions) (bool, error)

DeleteKeyringPassphrase removes the configured passphrase from the OS keyring. It returns false without error when no entry exists.

func DiscoverPath ¶

func DiscoverPath() string

DiscoverPath returns the config path commands use when the operator did not pass --config explicitly:

1. ./sentra.yaml, when it exists as a regular file — a project-local config always outranks the user-level one.
2. $XDG_CONFIG_HOME/sentra/sentra.yaml, defaulting XDG_CONFIG_HOME to ~/.config. This is the gh-CLI convention: ~/.config even on macOS, deliberately not os.UserConfigDir's ~/Library/Application Support.

When neither file exists the home path is still returned — it is the write target a first-run setup should persist to, so bare `sentra` from any directory lands on the wizard once and the dashboard forever after. If the home directory cannot be determined, fall back to the cwd-relative name (the pre-discovery behavior) rather than failing.

DiscoverPath only names the path; it never reads or writes the file.

func KeyringUserForConfig ¶

func KeyringUserForConfig(cfg *Config) string

KeyringUserForConfig derives the per-repo keyring identifier from the S3 coordinates. Binding both bucket and prefix means two repos that share a bucket but differ only by prefix get distinct keyring entries — the fix for the earlier bug where they aliased onto the same stored passphrase.

func LegacyKeyringUsersForConfig ¶

func LegacyKeyringUsersForConfig(cfg *Config) []string

LegacyKeyringUsersForConfig lists the pre-prefix keyring identifiers to try after the current KeyringUserForConfig misses. Before the bucket+prefix identity existed, entries were keyed on the bucket alone; this lets an existing entry still resolve after an upgrade. It returns nothing when the current identity already equals the bucket (nothing to fall back to).

func Render ¶

func Render(cfg *Config) []byte

Render produces the on-disk sentra.yaml body that init, setup, policy add/remove, and passwd-forget write. We render from the resolved Config (defaults + yaml + env overlay + flags/prompts) so the file faithfully reflects what the user actually configured.

The body is hand-shaped rather than yaml.Marshal'd so we can keep the inline comments that explain each field — the file is a teaching artifact, not just a serialization. No secret material (passphrase, wrapped keys, salts) is ever a Config field, so this can never leak one.

func Resolve ¶

func Resolve(opts ResolveOptions) ([]byte, error)

Resolve looks up the passphrase per the documented priority and returns the bytes. The caller is responsible for zeroizing the returned slice after deriving keys from it.

On a keyring lookup miss (ErrKeyringEntryNotFound), Resolve falls through to the prompt branch — a clean install hasn't stored the passphrase in the keyring yet. Other keyring errors surface as-is.

func ResolveNonInteractive ¶

func ResolveNonInteractive(passphraseFile string) ([]byte, string, error)

ResolveNonInteractive resolves the passphrase from the non-interactive sources only — the --passphrase-file path, then SENTRA_PASSPHRASE — and reports which one supplied it. It is the first half of Resolve's priority list, split out for callers that must decide whether to prompt at all rather than pass a prompt callback: the TUI setup wizard skips its passphrase entry stage when a source answers here, so the repository is initialized under the same secret every later command will resolve.

A clean miss (no file path, no env var) returns (nil, "", nil) — the caller's interactive path is the normal continuation, not an error. A named file that cannot be read, or that has group/world-readable bits, IS an error: the operator pointed at a source, and quietly prompting instead would initialize the repo under a different passphrase than the one they configured.

The caller owns zeroizing the returned bytes.

func StoreKeyringPassphrase ¶

func StoreKeyringPassphrase(opts StoreKeyringOptions, passphrase []byte) error

StoreKeyringPassphrase saves passphrase in the OS keyring. It never writes the secret to sentra.yaml; callers should store only non-secret keyring lookup settings in config.

func Update ¶

func Update(path string, mutate func(*Config) error) error

Update applies mutate to the config as it exists on disk and writes the result back to path. It is the safe way to change one field of sentra.yaml.

The base is loadOnDisk, not Load. Load overlays SENTRA_* env vars, and rendering that resolved Config back out would bake a transient override into the file permanently: flipping the cosmetic splash toggle under `SENTRA_REPO__S3__BUCKET=scratch` used to rewrite the operator's real bucket. Everything mutate does not touch round-trips back exactly as the file had it.

mutate sees Defaults() + whatever the file said, so a partial sentra.yaml still renders complete. Returning an error from mutate aborts before any write — the file is left untouched — which lets callers fold validation (duplicate policy names, unknown keys) into the same critical section.

func Write ¶

func Write(path string, cfg *Config) error

Write renders cfg and writes it to path with 0o600 perms. The file names the bucket/region/profile but never a secret, yet 0o600 keeps it out of other users' reach as a matter of policy hygiene.

Write creates path's parent directory (0o700) when missing — the user-level config location may not exist on a fresh machine.

Write authors the *whole* file from the Config it is handed, so it is only correct when the caller means to materialize a resolved config: `init` (Defaults < yaml < env < flags, and it must record the bucket it just initialized) and `setup` (the wizard prompts for these values and shows them on the review screen before provisioning against them). Both would otherwise write `bucket: ""` after acting on an env-supplied bucket.

To change one field of an existing file, use Update. Passing a Config from Load to Write silently persists that process's SENTRA_* overrides.

The replacement is atomic and written through a symlinked path (atomicfile.Write): a crash mid-write must never leave a truncated sentra.yaml, because an empty file still counts as configured (ConfigExists) yet loads as bucket "" — the next launch lands on the connect gate with the bucket, profile and every policy gone, and nothing on screen says why. And a sentra.yaml kept in a dotfiles repo behind a symlink must stay a symlink across every settings toggle, policy add or passwd forget.