secrets

package

v1.0.1 Latest Latest Go to latest Published: Feb 10, 2026 License: Apache-2.0 Imports: 6 Imported by: 0

Details

This section is empty.

View Source

var (
	ErrInvalidSecret = errors.New("invalid secret")
)

View Source

var ErrSecretRef = errors.New("invalid secret reference")

func LoadRef(ref string) ([]byte, error)

LoadRef loads a secret value from a reference string.

Supported forms: - env:NAME - file:/path/to/secret - raw:literal-value (intended for tests/dev only)

type Set struct {
	Versions []Version
}

func (s Set) SigningAt(t time.Time) (Version, bool)

SigningAt returns the newest (most recent ValidFrom) secret that is valid at time t.

func (s Set) ValidAt(t time.Time) []Version

ValidAt returns all secrets valid at time t, ordered by ValidFrom descending.

func (s Set) Validate() error

type Version struct {
	ID         string
	Value      []byte
	ValidFrom  time.Time
	ValidUntil time.Time
}

Version is a single secret value with a validity window.

Semantics: - ValidFrom is inclusive. - ValidUntil is exclusive; a zero value means "no end".

func (v Version) IsValidAt(t time.Time) bool