Documentation
¶
Index ¶
- Constants
- func CompositionOptions(cfg Config) (includePopular bool, include, exclude []string, minBytes int, ...)
- func EnabledRegistrations(regs []lipsdk.Registration) ([]lipsdk.Registration, error)
- func FeatureBundle(cfg Config) lipfeature.FeatureBundle
- func HasSingleUserKey(n yaml.Node) bool
- func NewGuard(cfg Config) sdk.Guard
- func ValidateAccessMode(_ Config, multiUser bool, raw yaml.Node) error
- type Config
- type RedactionConfig
- type RuntimeConfig
- type SingleUserConfig
Constants ¶
const ( ActionBlock = "block" ActionRedact = "redact" ActionLog = "log" )
Action values for enabled configuration.
const ( AuditFailClosed = "fail_closed" AuditBestEffort = "best_effort" )
Audit failure policy values.
const ( DefaultScanMaxBytes = 2 << 20 MaxScanMaxBytes = 64 << 20 DefaultMinSecretBytes = 8 DefaultMaskByte = "*" )
Defaults applied by DecodeConfig.
const FailureKindScanLimit = "scan_limit"
FailureKindScanLimit is set on Decision when scan_max_bytes is exceeded.
const FailureKindUnsupportedJSONToken = "unsupported_json_token"
FailureKindUnsupportedJSONToken is set on Decision when a JSON key or scalar token matched during redact but cannot be mutated in place.
const ID = "secrets-guard"
ID is the feature plugin id / factory kind for secrets-guard.
Variables ¶
This section is empty.
Functions ¶
func CompositionOptions ¶
func CompositionOptions(cfg Config) (includePopular bool, include, exclude []string, minBytes int, auditPolicy string, maskByte byte, preservePrefix bool)
CompositionOptions extracts inventory and presentation options from a validated Config for composition-time wiring (env catalog / redaction hints).
func EnabledRegistrations ¶
func EnabledRegistrations(regs []lipsdk.Registration) ([]lipsdk.Registration, error)
EnabledRegistrations returns the enabled secrets-guard feature registrations in config order. It rejects more than one enabled secrets-guard registration so startup cannot silently pick an arbitrary instance.
func FeatureBundle ¶
func FeatureBundle(cfg Config) lipfeature.FeatureBundle
FeatureBundle returns a schema-V1 feature bundle contributing one SecretGuard.
func HasSingleUserKey ¶
HasSingleUserKey reports whether raw YAML is a mapping that contains the single_user key (document wrappers are unwrapped). Used by composition; DecodeConfig does not enforce access-mode rules.
Types ¶
type Config ¶
type Config struct {
Order *int `yaml:"order"`
Action string `yaml:"action"`
AuditFailurePolicy string `yaml:"audit_failure_policy"`
MinSecretBytes int `yaml:"min_secret_bytes"`
ScanMaxBytes int `yaml:"scan_max_bytes"`
SingleUser SingleUserConfig `yaml:"single_user"`
Redaction RedactionConfig `yaml:"redaction"`
}
Config is the secrets-guard feature plugin YAML configuration.
type RedactionConfig ¶
type RedactionConfig struct {
MaskByte string `yaml:"mask_byte"`
PreserveKnownPrefixes bool `yaml:"preserve_known_prefixes"`
}
RedactionConfig controls mask presentation hints for operators / future matcher wiring.
type RuntimeConfig ¶
type RuntimeConfig struct {
Enabled bool
Action string
AuditFailurePolicy string
AuditConfigVersion string
IncludePopularEnv bool
IncludeEnv []string
ExcludeEnv []string
MinSecretBytes int
PreserveKnownPrefixes bool
MaskByte byte
}
RuntimeConfig is the decoded secrets-guard feature config used by runtimebundle.
func ComposeRuntimeConfig ¶
func ComposeRuntimeConfig(accessMode string, regs []lipsdk.Registration) (RuntimeConfig, error)
ComposeRuntimeConfig decodes enabled secrets-guard feature YAML.
type SingleUserConfig ¶
type SingleUserConfig struct {
IncludePopularEnv bool `yaml:"include_popular_env"`
IncludeEnv []string `yaml:"include_env"`
ExcludeEnv []string `yaml:"exclude_env"`
}
SingleUserConfig configures single-user environment inventory hints (composition uses these later).
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Package engine provides the concrete secret catalog, Aho-Corasick exact pattern matching automaton, credential inventory discovery, and source policy implementation for the secretguard feature plugin.
|
Package engine provides the concrete secret catalog, Aho-Corasick exact pattern matching automaton, credential inventory discovery, and source policy implementation for the secretguard feature plugin. |