provider

type DeleteOption ¶

type DeleteOption interface {
	// contains filtered or unexported methods
}

DeleteOption is a provider-interpreted functional option for delete operations (e.g. AWS Secrets Manager ForceDelete / RecoveryWindow). It follows the same pass-through contract as WriteOption: consumers pass options through untyped and the adapter interprets the ones it recognizes. Concrete options satisfy it by embedding DeleteOptionMarker.

type DeleteOptionMarker ¶

type DeleteOptionMarker struct{}

DeleteOptionMarker is embedded by provider-specific delete-option types to satisfy DeleteOption. See WriteOptionMarker for the rationale.

type Describer ¶

type Describer interface {
	// Describe returns an entry's metadata without fetching its value.
	Describe(ctx context.Context, name string) (*domain.Entry, error)
}

Describer returns entry metadata without the value. Optional.

type Factory ¶

type Factory interface {
	// Store builds a Store for the given scope and kind.
	Store(ctx context.Context, scope Scope, kind Kind) (Store, error)
}

Factory builds a Store for a scope + kind. It returns ErrUnsupportedKind if the provider does not offer that kind (e.g. GoogleCloud has no param store).

type Kind ¶

type Kind string

Kind selects a store kind within a provider (some providers offer only one).

const (
	// KindParam selects a parameter store (e.g. AWS SSM Parameter Store).
	KindParam Kind = "param"
	// KindSecret selects a secret store (e.g. AWS Secrets Manager).
	KindSecret Kind = "secret"
)

type Provider ¶

type Provider string

Provider identifies a cloud provider backend.

const (
	// ProviderAWS is the Amazon Web Services provider.
	ProviderAWS Provider = "aws"
	// ProviderGoogleCloud is the Google Cloud Platform provider.
	ProviderGoogleCloud Provider = "googlecloud"
	// ProviderAzure is the Microsoft Azure provider.
	ProviderAzure Provider = "azure"
)

type Reader ¶

type Reader interface {
	// Resolve parses a provider-specific version spec string (e.g. "#3~1",
	// "#abc123", ":AWSCURRENT" for AWS) and resolves it to an opaque VersionRef.
	Resolve(ctx context.Context, name, spec string) (VersionRef, error)
	// Get retrieves the entry at the given version ref. It returns a wrapped
	// ErrNotFound if the entry does not exist.
	Get(ctx context.Context, name string, ref VersionRef) (*domain.Entry, error)
	// History returns the version history for an entry, newest first.
	History(ctx context.Context, name string) ([]domain.Version, error)
	// List returns the names of all entries in the provider's namespace.
	List(ctx context.Context) ([]string, error)
}

Reader provides read access to a provider's entries.

type Registry ¶

type Registry struct {
	// contains filtered or unexported fields
}

Registry maps a Provider to its Factory, replacing direct infra.NewXClient calls.

func NewRegistry() *Registry

func (r *Registry) Register(p Provider, f Factory)

func (r *Registry) Store(ctx context.Context, scope Scope, kind Kind) (Store, error)

type Restorer ¶

type Restorer interface {
	// Restore cancels a pending deletion for an entry.
	Restore(ctx context.Context, name string) error
}

Restorer restores a soft-deleted entry (e.g. Secrets Manager). Optional.

type Scope ¶

type Scope struct {
	// Provider selects which backend the scope belongs to.
	Provider Provider `json:"provider"`

	// AccountID is the AWS account id (AWS).
	AccountID string `json:"accountId,omitempty"`
	// Region is the AWS region (AWS).
	Region string `json:"region,omitempty"`

	// ProjectID is the Google Cloud project id (GoogleCloud).
	ProjectID string `json:"projectId,omitempty"`

	// SubscriptionID is the Azure subscription id (Azure).
	SubscriptionID string `json:"subscriptionId,omitempty"`
	// ResourceGroup is the Azure resource group (Azure).
	ResourceGroup string `json:"resourceGroup,omitempty"`
	// VaultName is the Azure Key Vault name (Azure, secret).
	VaultName string `json:"vaultName,omitempty"`
	// StoreName is the Azure App Configuration store name (Azure, param).
	StoreName string `json:"storeName,omitempty"`
}

Scope identifies a provider-specific namespace for staging state. The set of meaningful fields depends on Provider:

• AWS: AccountID + Region (shared for param and secret).
• GoogleCloud: ProjectID (Secret Manager only).
• Azure: SubscriptionID + ResourceGroup, plus VaultName (Key Vault, secret) or StoreName (App Configuration, param).

Scope is used both to select a provider factory (Provider field) and to key on-disk staging storage (see Key).

func AWSScope(accountID, region string) Scope

func AzureAppConfigScope(subscriptionID, resourceGroup, storeName string) Scope

func AzureKeyVaultScope(subscriptionID, resourceGroup, vaultName string) Scope

func GoogleCloudScope(projectID string) Scope

func (s Scope) Key() string

func (s Scope) SupportedKinds() []Kind

func (s Scope) SupportsService(kind Kind) bool

type Store ¶

type Store interface {
	Reader
	Writer
	Tagger
}

Store is the full provider contract for one service (e.g. AWS SSM or Secrets Manager). Providers may additionally implement the optional Restorer/Describer capabilities.

type Tagger ¶

type Tagger interface {
	// Tag adds or updates the given tags on an entry.
	Tag(ctx context.Context, name string, add map[string]string) error
	// Untag removes the tags with the given keys from an entry.
	Untag(ctx context.Context, name string, keys []string) error
}

Tagger provides tag mutation for a provider's entries.

type VersionRef ¶

type VersionRef struct {
	// contains filtered or unexported fields
}

VersionRef is an opaque reference to a specific version, produced by a provider (Resolve/History) and consumed by the same provider. The zero value denotes the latest/current version. It intentionally exposes no version-id or staging-label semantics to generic callers.

func NewVersionRef(id string) VersionRef

func (r VersionRef) ID() string

func (r VersionRef) IsLatest() bool

type WriteOption ¶

type WriteOption interface {
	// contains filtered or unexported methods
}

WriteOption is a provider-interpreted functional option for create/update operations. Providers define concrete option types (e.g. AWS param Tier or DataType) that satisfy this marker by embedding WriteOptionMarker.

Consumers (usecases, CLI) build and pass these options through WITHOUT type-asserting them; the provider adapter type-switches over the options it understands and silently ignores the rest. This keeps provider-specific options out of the neutral domain model while remaining strongly typed.

The marker method is unexported, so the WriteOption set stays closed to types that embed WriteOptionMarker; arbitrary external types cannot masquerade as options.

type WriteOptionMarker ¶

type WriteOptionMarker struct{}

WriteOptionMarker is embedded by provider-specific option types to satisfy WriteOption. Embedding it (rather than defining the unexported method in each provider package, which Go forbids across packages) is what lets the AWS adapters declare their own option types against this sealed interface.

type Writer ¶

type Writer interface {
	// Create creates a new entry and returns the resulting version. It returns
	// a wrapped ErrAlreadyExists if an entry with the same name already exists
	// (it never overwrites). Provider-specific WriteOptions are interpreted by
	// the adapter and ignored when unrecognized.
	Create(
		ctx context.Context, name, value string, valueType domain.ValueType, description string, opts ...WriteOption,
	) (domain.Version, error)
	// Put creates or updates an entry (upsert) and returns the resulting
	// version. Unlike Create it overwrites an existing entry. Provider-specific
	// WriteOptions are interpreted by the adapter and ignored when unrecognized.
	Put(
		ctx context.Context, name, value string, valueType domain.ValueType, description string, opts ...WriteOption,
	) (domain.Version, error)
	// Delete removes an entry. Provider-specific DeleteOptions are interpreted
	// by the adapter and ignored when unrecognized.
	Delete(ctx context.Context, name string, opts ...DeleteOption) error
}

Writer provides write access to a provider's entries.