secrets

package

v0.24.0 Latest Latest Go to latest Published: Aug 21, 2026 License: MIT Imports: 13 Imported by: 0

Details

Package secrets encrypts project secret values before they reach SQLite.

This section is empty.

This section is empty.

This section is empty.

type Manager struct {
	// contains filtered or unexported fields
}

func NewManager(database *store.Store, keyPath string) (*Manager, error)

func (m *Manager) Delete(ctx context.Context, secretID string) error

func (m *Manager) DeleteEnvironment(ctx context.Context, secretID string) error

func (m *Manager) List(ctx context.Context, projectID string) ([]store.Secret, error)

func (m *Manager) ResolveForJob(ctx context.Context, jobID string) (map[string]string, error)

ResolveForEnvironment merges project values with approved environment values. The narrower environment scope deliberately wins on duplicate names.

func (m *Manager) ResolveProject(ctx context.Context, projectID string) (map[string]string, error)

ResolveProject decrypts values only for the worker process. Callers must not serialize the returned map or persist it in a run snapshot.

func (m *Manager) Upsert(ctx context.Context, projectID, name, value string) (store.Secret, error)

func (m *Manager) UpsertEnvironment(ctx context.Context, environmentID, name, value string) (store.EnvironmentSecret, error)