Documentation
¶
Overview ¶
Package local implements core.Vault on the local filesystem. The vault root is a directory tree the CLI writes per-run folders into. Suitable for development, single-host deployments, or any case where the vault and the CLI live on the same machine.
Index ¶
- type Vault
- func (v *Vault) GetBinary(_ context.Context, key string) ([]byte, error)
- func (v *Vault) Init(_ context.Context) error
- func (v *Vault) List(_ context.Context, prefix string) ([]string, error)
- func (v *Vault) PutBinary(_ context.Context, key string, body []byte, _ map[string]string) error
- func (v *Vault) PutEnvelope(_ context.Context, key string, e *core.Envelope) error
- func (v *Vault) PutJSON(_ context.Context, key string, body any) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Vault ¶
type Vault struct {
Root string
}
Vault is a filesystem-backed core.Vault. Every Put writes to filepath.Join(Root, key). Cleanup, encryption, and access control are the operator's responsibility.
func New ¶
New constructs a local Vault rooted at the given directory. The directory is created by Init if it does not already exist.
func (*Vault) GetBinary ¶
GetBinary reads the file at key and returns its bytes. A missing file is reported as an error containing "not found"; callers can match against errors.Is(err, fs.ErrNotExist) for type-safe checks.
func (*Vault) Init ¶
Init creates the vault root directory if it does not exist. Mode 0o755 matches Go's default for MkdirAll; operators wanting tighter permissions should pre-create the directory.
func (*Vault) List ¶
List walks the filesystem under prefix and returns the keys it finds (relative to Root, with forward slashes). The walk follows the spec: prefixes are slash-terminated logical buckets; directories without any files are not reported.
func (*Vault) PutBinary ¶
PutBinary writes the raw bytes. The metadata map is accepted for interface symmetry with object-store backends but is not persisted on the filesystem.
func (*Vault) PutEnvelope ¶
PutEnvelope writes the envelope as canonical JSON. The on-disk bytes are byte-identical to the bytes fed into the signer, so a reader can either re-canonicalize on parse or check the file's SHA-256 against a recorded hash. The envelope must already be signed; PutEnvelope returns an error if not.
Source Files