Documentation
¶
Overview ¶
Package secret provides Value, a wrapper that refuses to render.
String, MarshalJSON, and MarshalLogObject all return [redacted]. This is how R-194 is enforced structurally rather than by review: a secret cannot be accidentally logged because the type will not print. All three must redact — a type that redacts in String but not in MarshalJSON will leak through an error envelope.
Index ¶
- Constants
- type Value
- func (v Value) Format(f fmt.State, verb rune)
- func (v Value) GoString() string
- func (v Value) IsZero() bool
- func (v Value) Len() int
- func (v Value) MarshalJSON() ([]byte, error)
- func (v Value) MarshalLogObject(enc zapcore.ObjectEncoder) error
- func (v Value) MarshalText() ([]byte, error)
- func (v Value) Reveal() string
- func (v Value) String() string
- func (v *Value) UnmarshalJSON(b []byte) error
Constants ¶
const Redacted = "[redacted]"
Redacted is what a Value renders as, everywhere, always.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Value ¶
type Value struct {
// contains filtered or unexported fields
}
Value holds a secret and refuses to render it.
R-194 is enforced structurally rather than by review: a secret cannot be accidentally logged, serialized, or formatted into an error string, because the type will not print. Getting the value out requires calling Reveal, which is deliberately conspicuous and greppable.
The zero Value is valid and empty.
func (Value) Format ¶
Format implements fmt.Formatter, which takes precedence over Stringer and GoStringer for every verb. It exists so that no verb — including ones that would otherwise reach the struct directly, such as %d or %x on a misused value — can render the secret.
func (Value) GoString ¶
GoString implements fmt.GoStringer. Without it, %#v prints the struct's fields verbatim and defeats String entirely — the most easily overlooked leak path of the set, because %#v is what people reach for when debugging.
func (Value) IsZero ¶
IsZero reports whether the Value holds nothing. Useful for validation without revealing.
func (Value) Len ¶
Len returns the length of the secret. Safe to log: it discloses nothing an attacker cannot infer, and it makes "the secret is empty" debuggable without a Reveal.
func (Value) MarshalJSON ¶
MarshalJSON implements json.Marshaler. A Value inside an error envelope, audit detail, or API response serializes as the redaction string.
func (Value) MarshalLogObject ¶
func (v Value) MarshalLogObject(enc zapcore.ObjectEncoder) error
MarshalLogObject implements zapcore.ObjectMarshaler, so zap.Object and zap.Any redact rather than reflecting over the struct.
func (Value) MarshalText ¶
MarshalText implements encoding.TextMarshaler, for libraries that reach for it instead of json.Marshaler.
func (Value) Reveal ¶
Reveal returns the underlying secret. Every call site is a place a secret escapes the type's protection, so they should be few and obvious. Core calls it during plan resolution to populate WorkloadPlan.Env, and essentially nowhere else.
func (Value) String ¶
String implements fmt.Stringer. Covers %s, %v, and any code path that stringifies a value.
func (*Value) UnmarshalJSON ¶
UnmarshalJSON implements json.Unmarshaler, so a Value can be decoded from a request body. Decoding the redaction string yields an empty Value rather than the literal text — round-tripping a redacted payload must not set a secret to "[redacted]".
Source Files