Documentation
¶
Overview ¶
Package secrets provides the team-mode secret store: an OmniVault-backed, multi-tenant vault whose per-agent namespaces let a runtime instance (RMI-OMNIAGENT-310) load only its own agent's secrets. OmniVault itself is a flat, path-keyed store with no native tenancy; ScopedVault adds that tenancy by path-namespacing, and Service turns an agent's namespace into the env map its instance injects into MCP subprocesses and secrets-aware skills.
ScopedVault is a generic decorator intended to be upstreamed into omnivault; it lives here for now (RMI-310) to avoid a cross-repo release cycle.
Index ¶
- func AgentNamespace(agentID uuid.UUID) string
- type Config
- type ScopedVault
- func (s *ScopedVault) Capabilities() vault.Capabilities
- func (s *ScopedVault) Close() error
- func (s *ScopedVault) Delete(ctx context.Context, path string) error
- func (s *ScopedVault) Exists(ctx context.Context, path string) (bool, error)
- func (s *ScopedVault) Get(ctx context.Context, path string) (*vault.Secret, error)
- func (s *ScopedVault) List(ctx context.Context, prefix string) ([]string, error)
- func (s *ScopedVault) Name() string
- func (s *ScopedVault) Set(ctx context.Context, path string, secret *vault.Secret) error
- type Service
- func (s *Service) AgentVault(agentID uuid.UUID) *ScopedVault
- func (s *Service) DeleteAgentSecret(ctx context.Context, agentID uuid.UUID, name string) error
- func (s *Service) ListAgentSecretNames(ctx context.Context, agentID uuid.UUID) ([]string, error)
- func (s *Service) ResolveAgentSecrets(ctx context.Context, agentID uuid.UUID) (map[string]string, error)
- func (s *Service) SetAgentSecret(ctx context.Context, agentID uuid.UUID, name, value string) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AgentNamespace ¶
AgentNamespace returns the vault namespace for an agent's secrets.
Types ¶
type Config ¶
type Config struct {
// Vault is the backing store (any omnivault provider). Required. Tenant
// isolation is applied by the service via ScopedVault, so pass the raw
// deployment vault, not a pre-scoped one.
Vault vault.Vault
// Logger defaults to slog.Default().
Logger *slog.Logger
}
Config configures the secret service.
type ScopedVault ¶
type ScopedVault struct {
// contains filtered or unexported fields
}
ScopedVault confines a vault.Vault to a namespace by prefixing every path with "<namespace>/". It is how OmniVault — a flat, path-keyed store with no native tenancy — is made multi-tenant: a caller handed Scoped(v, "agents/A") cannot express a path outside "agents/A/", so two tenants over one backing store share no reachable keys. Isolation is structural, not policy-enforced.
func Scoped ¶
func Scoped(inner vault.Vault, ns string) *ScopedVault
Scoped returns inner confined to namespace ns. Surrounding slashes on ns are normalized away; an empty ns yields a passthrough (equivalent to inner).
func (*ScopedVault) Capabilities ¶
func (s *ScopedVault) Capabilities() vault.Capabilities
Capabilities delegates to the backing provider.
func (*ScopedVault) Close ¶
func (s *ScopedVault) Close() error
Close is a no-op: the backing vault is shared across scopes and owned by whoever constructed it.
func (*ScopedVault) Delete ¶
func (s *ScopedVault) Delete(ctx context.Context, path string) error
Delete removes a secret at the namespace-relative path.
func (*ScopedVault) List ¶
List returns the namespace-relative paths matching prefix. Backing keys outside the namespace are never returned — both because the query is scoped to "<ns>/<prefix>" and because any out-of-namespace key is defensively filtered.
func (*ScopedVault) Name ¶
func (s *ScopedVault) Name() string
Name delegates to the backing provider.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service reads secrets from the team's OmniVault-backed store, scoped per tenant. For RMI-310 it resolves an agent's secrets into the env map its runtime instance injects; per-user resolution (INIT-004) layers on the same store via the user namespace.
func NewService ¶
NewService creates a secret service over the given vault.
func (*Service) AgentVault ¶
func (s *Service) AgentVault(agentID uuid.UUID) *ScopedVault
AgentVault returns a vault confined to the agent's namespace. Callers can only reach that agent's secrets through it.
func (*Service) DeleteAgentSecret ¶
DeleteAgentSecret removes a single agent secret by env-var name.
func (*Service) ListAgentSecretNames ¶ added in v0.18.0
ListAgentSecretNames returns the env-var names of an agent's set secrets, without their values — the write-only listing the management API/UI use to show set/unset state (INIT-OMNIAGENT-004). Never returns values.
func (*Service) ResolveAgentSecrets ¶
func (s *Service) ResolveAgentSecrets(ctx context.Context, agentID uuid.UUID) (map[string]string, error)
ResolveAgentSecrets returns the agent's secrets as an env map (env-var name → value), read from the agent's namespace. Because the namespace is applied by ScopedVault, this can only ever return the given agent's secrets — the basis for RMI-310's disjoint-isolation guarantee. An agent with no secrets yields an empty (non-nil) map.
Source Files