provider

type DeleteOption ¶

type DeleteOption interface {
	// contains filtered or unexported methods
}

DeleteOption is a provider-interpreted functional option for delete operations (e.g. AWS Secrets Manager ForceDelete / RecoveryWindow). It follows the same pass-through contract as WriteOption: consumers pass options through untyped and the adapter interprets the ones it recognizes. Concrete options satisfy it by embedding DeleteOptionMarker.

type DeleteOptionMarker ¶

type DeleteOptionMarker struct{}

DeleteOptionMarker is embedded by provider-specific delete-option types to satisfy DeleteOption. See WriteOptionMarker for the rationale.

type Factory ¶

type Factory interface {
	// Store builds a Store for the given scope and kind.
	Store(ctx context.Context, scope Scope, kind Kind) (Store, error)
}

Factory builds a Store for a scope + kind. It returns ErrUnsupportedKind if the provider does not offer that kind (e.g. GoogleCloud has no param store).

type ForceDelete ¶ added in v1.5.2

type ForceDelete struct{ DeleteOptionMarker }

ForceDelete requests immediate, unrecoverable deletion, skipping any recovery window. Only AWS Secrets Manager honors it (mapped to ForceDeleteWithoutRecovery). Azure Key Vault ignores it — its retention is a vault-level property, not a per-delete option, so deletes stay soft (use Restore to recover). Providers without the concept ignore it.

type Kind ¶

type Kind string

Kind selects a store kind within a provider (some providers offer only one).

const (
	// KindParam selects a parameter store (e.g. AWS SSM Parameter Store, Azure App Configuration).
	KindParam Kind = "param"
	// KindSecret selects a secret store (e.g. AWS Secrets Manager, Azure Key Vault).
	KindSecret Kind = "secret"
)

type Provider ¶

type Provider string

Provider identifies a cloud provider backend.

const (
	// ProviderAWS is the Amazon Web Services provider.
	ProviderAWS Provider = "aws"
	// ProviderGoogleCloud is the Google Cloud Platform provider.
	ProviderGoogleCloud Provider = "googlecloud"
	// ProviderAzure is the Microsoft Azure provider.
	ProviderAzure Provider = "azure"
)

func Providers() []Provider

type Reader ¶

type Reader interface {
	// Resolve parses a provider-specific version spec string (e.g. "#3~1",
	// "#abc123", ":AWSCURRENT" for AWS) and resolves it to an opaque VersionRef.
	Resolve(ctx context.Context, name, spec string) (VersionRef, error)
	// Get retrieves the entry at the given version ref. It returns a wrapped
	// ErrNotFound if the entry does not exist.
	Get(ctx context.Context, name string, ref VersionRef) (*domain.Entry, error)
	// History returns the version history for an entry, newest first.
	History(ctx context.Context, name string) ([]domain.Version, error)
	// List returns the names of all entries in the provider's namespace.
	List(ctx context.Context) ([]string, error)
}

Reader provides read access to a provider's entries.

type Registry ¶

type Registry struct {
	// contains filtered or unexported fields
}

Registry maps a Provider to its Factory.

func NewRegistry() *Registry

func (r *Registry) Register(p Provider, f Factory)

func (r *Registry) Store(ctx context.Context, scope Scope, kind Kind) (Store, error)

type Restorer ¶

type Restorer interface {
	// Restore cancels a pending deletion for an entry.
	Restore(ctx context.Context, name string) error
}

Restorer restores a soft-deleted entry (e.g. Secrets Manager). Optional.

type Scope ¶

type Scope struct {
	// Provider selects which backend the scope belongs to.
	Provider Provider `json:"provider"`

	// AccountID is the AWS account id (AWS).
	AccountID string `json:"accountId,omitempty"`
	// Region is the AWS region (AWS).
	Region string `json:"region,omitempty"`

	// ProjectID is the Google Cloud project id (GoogleCloud).
	ProjectID string `json:"projectId,omitempty"`

	// VaultName is the Azure Key Vault name (Azure, secret).
	VaultName string `json:"vaultName,omitempty"`
	// StoreName is the Azure App Configuration store name (Azure, param).
	StoreName string `json:"storeName,omitempty"`
	// AppConfigNamespace is the Azure App Configuration namespace — the axis
	// Azure calls a "label" — selected for the store (Azure, param). Empty is
	// the null (default) namespace. A single resolved namespace only; the
	// filter grammar (`*`/`,`) never reaches staging (see #381).
	AppConfigNamespace string `json:"appConfigNamespace,omitempty"`
}

Scope identifies a provider-specific namespace for staging state. The set of meaningful fields depends on Provider:

• AWS: AccountID + Region (shared for param and secret).
• GoogleCloud: ProjectID (Secret Manager only).
• Azure: VaultName (Key Vault, secret) or StoreName (App Configuration, param) — each a globally-unique name that fully identifies the resource, so no subscription/resource-group is needed.

Scope is used both to select a provider factory (Provider field) and to key on-disk staging storage (see Key).

func AWSScope(accountID, region string) Scope

func AzureAppConfigScope(storeName string) Scope

func AzureKeyVaultScope(vaultName string) Scope

func GoogleCloudScope(projectID string) Scope

func (s Scope) Key() string

func (s Scope) SupportedKinds() []Kind

func (s Scope) SupportsService(kind Kind) bool

func (s Scope) Target() Target

type Store ¶

type Store interface {
	Reader
	Writer
	Tagger
}

Store is the full provider contract for one service (e.g. AWS SSM, Google Cloud Secret Manager, or Azure App Configuration). Providers may additionally implement the optional Restorer capability.

type Tagger ¶

type Tagger interface {
	// Tag adds or updates the given tags on an entry.
	Tag(ctx context.Context, name string, add map[string]string) error
	// Untag removes the tags with the given keys from an entry.
	Untag(ctx context.Context, name string, keys []string) error
}

Tagger provides tag mutation for a provider's entries.

type Target ¶ added in v1.10.0

type Target struct {
	// Segments are in display order. Each provider always lists the same labels,
	// so a UI can keep a stable layout while some values are still empty.
	Segments []TargetSegment
	// Pending is true when some values need a network lookup that has not run
	// yet (AWS: the STS caller identity). Resolve it through
	// builtin.ResolveTarget.
	Pending bool
}

Target describes, for display, what a scope points at: the ordered segments every UI shows as "who am I connected to" (the TUI status bar, the apply confirmation, the GUI sidebar, and the CLI confirmation prompts).

func AWSTarget(profile, accountID, region string) Target

func (t Target) String() string

type TargetSegment ¶ added in v1.10.0

type TargetSegment struct {
	Label string
	Value string
}

TargetSegment is one labeled part of a Target, such as "account" and its id. Value is empty when the part is unknown or unset.

type VersionRef ¶

type VersionRef struct {
	// contains filtered or unexported fields
}

VersionRef is an opaque reference to a specific version, produced by a provider (Resolve/History) and consumed by the same provider. The zero value denotes the latest/current version. It intentionally exposes no version-id or staging-label semantics to generic callers.

func NewVersionRef(id string) VersionRef

func (r VersionRef) ID() string

func (r VersionRef) IsLatest() bool

type WriteOption ¶

type WriteOption interface {
	// contains filtered or unexported methods
}

WriteOption is a provider-interpreted functional option for create/update operations. Providers define concrete option types (e.g. AWS param Tier or DataType) that satisfy this marker by embedding WriteOptionMarker.

Consumers (usecases, CLI) build and pass these options through WITHOUT type-asserting them; the provider adapter type-switches over the options it understands and silently ignores the rest. This keeps provider-specific options out of the neutral domain model while remaining strongly typed.

The marker method is unexported, so the WriteOption set stays closed to types that embed WriteOptionMarker; arbitrary external types cannot masquerade as options.

type WriteOptionMarker ¶

type WriteOptionMarker struct{}

WriteOptionMarker is embedded by provider-specific option types to satisfy WriteOption. Embedding it (rather than defining the unexported method in each provider package, which Go forbids across packages) is what lets the AWS adapters declare their own option types against this sealed interface.

type Writer ¶

type Writer interface {
	// Create creates a new entry and returns the resulting version. It returns
	// a wrapped ErrAlreadyExists if an entry with the same name already exists
	// (it never overwrites). Provider-specific WriteOptions are interpreted by
	// the adapter and ignored when unrecognized.
	Create(
		ctx context.Context, name, value string, valueType domain.ValueType, description string, opts ...WriteOption,
	) (domain.Version, error)
	// Put creates or updates an entry (upsert) and returns the resulting
	// version. Unlike Create it overwrites an existing entry. Provider-specific
	// WriteOptions are interpreted by the adapter and ignored when unrecognized.
	Put(
		ctx context.Context, name, value string, valueType domain.ValueType, description string, opts ...WriteOption,
	) (domain.Version, error)
	// Delete removes an entry. Provider-specific DeleteOptions are interpreted
	// by the adapter and ignored when unrecognized.
	Delete(ctx context.Context, name string, opts ...DeleteOption) error
}

Writer provides write access to a provider's entries.