postgres

package
v1.8.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 11, 2026 License: MIT Imports: 18 Imported by: 6

Documentation

Overview

Package postgres provides a Grove ORM implementation of all Vault store interfaces.

Index

Constants

This section is empty.

Variables

View Source 
var Migrations = migrate.NewGroup("vault")

Migrations is the migration group for the Vault store. Register this group with the grove migrator to manage schema changes.

Functions

This section is empty.

Types

type AuditModel 

type AuditModel struct {
	grove.BaseModel `grove:"table:vault_audit,alias:a"`
	ID              string          `grove:"id,pk"`
	Action          string          `grove:"action,notnull"`
	Resource        string          `grove:"resource,notnull"`
	Key             string          `grove:"key"`
	AppID           string          `grove:"app_id"`
	TenantID        string          `grove:"tenant_id"`
	UserID          string          `grove:"user_id"`
	IP              string          `grove:"ip"`
	Outcome         string          `grove:"outcome"`
	Metadata        json.RawMessage `grove:"metadata,type:jsonb"`
	CreatedAt       time.Time       `grove:"created_at,notnull"`
}

AuditModel is the Grove model for vault_audit.

type ConfigModel 

type ConfigModel struct {
	grove.BaseModel `grove:"table:vault_config,alias:c"`
	ID              string          `grove:"id,pk"`
	Key             string          `grove:"key,notnull"`
	Value           json.RawMessage `grove:"value,type:jsonb"`
	ValueType       string          `grove:"value_type"`
	Version         int64           `grove:"version,notnull"`
	Description     string          `grove:"description"`
	AppID           string          `grove:"app_id,notnull"`
	Metadata        json.RawMessage `grove:"metadata,type:jsonb"`
	CreatedAt       time.Time       `grove:"created_at,notnull"`
	UpdatedAt       time.Time       `grove:"updated_at,notnull"`
}

ConfigModel is the Grove model for vault_config.

type ConfigVersionModel 

type ConfigVersionModel struct {
	grove.BaseModel `grove:"table:vault_config_versions,alias:cv"`
	ID              string          `grove:"id,pk"`
	ConfigKey       string          `grove:"config_key,notnull"`
	AppID           string          `grove:"app_id,notnull"`
	Version         int64           `grove:"version,notnull"`
	Value           json.RawMessage `grove:"value,type:jsonb"`
	CreatedBy       string          `grove:"created_by"`
	CreatedAt       time.Time       `grove:"created_at,notnull"`
}

ConfigVersionModel is the Grove model for vault_config_versions.

type FlagModel 

type FlagModel struct {
	grove.BaseModel `grove:"table:vault_flags,alias:f"`
	ID              string          `grove:"id,pk"`
	Key             string          `grove:"key,notnull"`
	Type            string          `grove:"type,notnull"`
	DefaultValue    json.RawMessage `grove:"default_value,type:jsonb"`
	Description     string          `grove:"description"`
	Tags            json.RawMessage `grove:"tags,type:jsonb"`
	Variants        json.RawMessage `grove:"variants,type:jsonb"`
	Enabled         bool            `grove:"enabled,notnull"`
	AppID           string          `grove:"app_id,notnull"`
	Metadata        json.RawMessage `grove:"metadata,type:jsonb"`
	CreatedAt       time.Time       `grove:"created_at,notnull"`
	UpdatedAt       time.Time       `grove:"updated_at,notnull"`
}

FlagModel is the Grove model for vault_flags.

type FlagOverrideModel 

type FlagOverrideModel struct {
	grove.BaseModel `grove:"table:vault_flag_overrides,alias:fo"`
	ID              string          `grove:"id,pk"`
	FlagKey         string          `grove:"flag_key,notnull"`
	AppID           string          `grove:"app_id,notnull"`
	TenantID        string          `grove:"tenant_id,notnull"`
	Value           json.RawMessage `grove:"value,type:jsonb"`
	CreatedAt       time.Time       `grove:"created_at,notnull"`
	UpdatedAt       time.Time       `grove:"updated_at,notnull"`
}

FlagOverrideModel is the Grove model for vault_flag_overrides.

type FlagRuleModel 

type FlagRuleModel struct {
	grove.BaseModel `grove:"table:vault_flag_rules,alias:fr"`
	ID              string          `grove:"id,pk"`
	FlagKey         string          `grove:"flag_key,notnull"`
	AppID           string          `grove:"app_id,notnull"`
	Priority        int             `grove:"priority,notnull"`
	Type            string          `grove:"type,notnull"`
	Config          json.RawMessage `grove:"config,type:jsonb"`
	ReturnValue     json.RawMessage `grove:"return_value,type:jsonb"`
	CreatedAt       time.Time       `grove:"created_at,notnull"`
	UpdatedAt       time.Time       `grove:"updated_at,notnull"`
}

FlagRuleModel is the Grove model for vault_flag_rules.

type OverrideModel 

type OverrideModel struct {
	grove.BaseModel `grove:"table:vault_overrides,alias:ov"`
	ID              string          `grove:"id,pk"`
	Key             string          `grove:"key,notnull"`
	Value           json.RawMessage `grove:"value,type:jsonb"`
	AppID           string          `grove:"app_id,notnull"`
	TenantID        string          `grove:"tenant_id,notnull"`
	Metadata        json.RawMessage `grove:"metadata,type:jsonb"`
	CreatedAt       time.Time       `grove:"created_at,notnull"`
	UpdatedAt       time.Time       `grove:"updated_at,notnull"`
}

OverrideModel is the Grove model for vault_overrides.

type RotationPolicyModel 

type RotationPolicyModel struct {
	grove.BaseModel `grove:"table:vault_rotation_policies,alias:rp"`
	ID              string     `grove:"id,pk"`
	SecretKey       string     `grove:"secret_key,notnull"`
	AppID           string     `grove:"app_id,notnull"`
	IntervalNS      int64      `grove:"interval_ns,notnull"`
	Enabled         bool       `grove:"enabled,notnull"`
	LastRotatedAt   *time.Time `grove:"last_rotated_at"`
	NextRotationAt  *time.Time `grove:"next_rotation_at"`
	CreatedAt       time.Time  `grove:"created_at,notnull"`
	UpdatedAt       time.Time  `grove:"updated_at,notnull"`
}

RotationPolicyModel is the Grove model for vault_rotation_policies.

type RotationRecordModel 

type RotationRecordModel struct {
	grove.BaseModel `grove:"table:vault_rotation_records,alias:rr"`
	ID              string    `grove:"id,pk"`
	SecretKey       string    `grove:"secret_key,notnull"`
	AppID           string    `grove:"app_id,notnull"`
	OldVersion      int64     `grove:"old_version,notnull"`
	NewVersion      int64     `grove:"new_version,notnull"`
	RotatedBy       string    `grove:"rotated_by"`
	RotatedAt       time.Time `grove:"rotated_at,notnull"`
}

RotationRecordModel is the Grove model for vault_rotation_records.

type SecretModel 

type SecretModel struct {
	grove.BaseModel `grove:"table:vault_secrets,alias:s"`
	ID              string          `grove:"id,pk"`
	Key             string          `grove:"key,notnull"`
	AppID           string          `grove:"app_id,notnull"`
	TenantID        string          `grove:"tenant_id,notnull"`
	EncryptedValue  []byte          `grove:"encrypted_value"`
	EncryptionAlg   string          `grove:"encryption_alg"`
	EncryptionKeyID string          `grove:"encryption_key_id"`
	Version         int64           `grove:"version,notnull"`
	Metadata        json.RawMessage `grove:"metadata,type:jsonb"`
	ExpiresAt       *time.Time      `grove:"expires_at"`
	CreatedAt       time.Time       `grove:"created_at,notnull"`
	UpdatedAt       time.Time       `grove:"updated_at,notnull"`
}

SecretModel is the Grove model for vault_secrets.

type SecretVersionModel 

type SecretVersionModel struct {
	grove.BaseModel `grove:"table:vault_secret_versions,alias:sv"`
	ID              string    `grove:"id,pk"`
	SecretKey       string    `grove:"secret_key,notnull"`
	AppID           string    `grove:"app_id,notnull"`
	TenantID        string    `grove:"tenant_id,notnull"`
	Version         int64     `grove:"version,notnull"`
	EncryptedValue  []byte    `grove:"encrypted_value"`
	EncryptionAlg   *string   `grove:"encryption_alg"`
	CreatedBy       string    `grove:"created_by"`
	CreatedAt       time.Time `grove:"created_at,notnull"`
}

SecretVersionModel is the Grove model for vault_secret_versions.

type Store 

type Store struct {
	// contains filtered or unexported fields
}

Store is a Grove ORM implementation of all Vault store interfaces.

func New 

func New(db *grove.DB, opts ...StoreOption) *Store

New creates a new Grove store using the given grove.DB instance.

func (*Store) ClaimDueRotation 

func (s *Store) ClaimDueRotation(ctx context.Context, key, appID string, now, until time.Time) (bool, error)

ClaimDueRotation claims a due policy for one rotation run. It is a single conditional UPDATE, so the row lock Postgres takes for it lets only one of several concurrent callers match a given due time: the others re-check the condition after the winner commits and find next_rotation_at already moved to until. A missing policy returns false and a nil error.

func (*Store) Close 

func (s *Store) Close() error

Close releases the database connection.

func (*Store) CountAudit 

func (s *Store) CountAudit(ctx context.Context, appID string) (int64, error)

CountAudit returns the number of audit entries belonging to appID.

func (*Store) CountAuditMatching 

func (s *Store) CountAuditMatching(ctx context.Context, appID string, opts audit.ListOpts) (int64, error)

CountAuditMatching returns the number of audit entries belonging to appID that match opts. Limit and Offset are ignored.

func (*Store) CountConfig 

func (s *Store) CountConfig(ctx context.Context, appID string) (int64, error)

CountConfig returns the number of config entries belonging to appID.

func (*Store) CountConfigMatching 

func (s *Store) CountConfigMatching(ctx context.Context, appID string, opts cfgpkg.ListOpts) (int64, error)

CountConfigMatching returns the number of config entries belonging to appID whose key starts with opts.KeyPrefix. Limit and Offset are ignored.

func (*Store) CountFlagDefinitions 

func (s *Store) CountFlagDefinitions(ctx context.Context, appID string) (int64, error)

CountFlagDefinitions returns the number of flag definitions belonging to appID.

func (*Store) CountFlagDefinitionsMatching 

func (s *Store) CountFlagDefinitionsMatching(ctx context.Context, appID string, opts flag.ListOpts) (int64, error)

CountFlagDefinitionsMatching returns the number of flag definitions belonging to appID that match opts. Limit and Offset are ignored.

func (*Store) CountOverrides 

func (s *Store) CountOverrides(ctx context.Context, appID string) (int64, error)

CountOverrides returns the number of tenant overrides belonging to appID.

func (*Store) CountRotationPolicies 

func (s *Store) CountRotationPolicies(ctx context.Context, appID string) (int64, error)

CountRotationPolicies returns the number of rotation policies belonging to appID.

func (*Store) CountSecrets 

func (s *Store) CountSecrets(ctx context.Context, appID string) (int64, error)

CountSecrets returns the number of secrets belonging to appID, across every tenant.

func (*Store) CountSecretsMatching 

func (s *Store) CountSecretsMatching(ctx context.Context, appID string, opts secret.ListOpts) (int64, error)

CountSecretsMatching returns the number of secrets belonging to appID, across every tenant, that pass the expiry bounds in opts. TenantID, Limit and Offset are ignored.

func (*Store) CountSecretsUnencrypted 

func (s *Store) CountSecretsUnencrypted(ctx context.Context, appID string) (int64, error)

CountSecretsUnencrypted returns the number of secrets belonging to appID, across every tenant, that were stored without an encryption algorithm.

func (*Store) CountVersionEncryption 

func (s *Store) CountVersionEncryption(ctx context.Context, appID string) (secret.VersionEncryptionCounts, error)

CountVersionEncryption tallies appID's version rows, across every tenant, by recorded algorithm in one pass, leaving out each secret's current version. A version row is matched to its secret by key, app and tenant: matching on key and app alone would let one tenant's current version hide another tenant's earlier row with the same number.

func (*Store) DefineFlag 

func (s *Store) DefineFlag(ctx context.Context, f *flag.Definition) error

DefineFlag creates or updates a flag definition.

func (*Store) DeleteConfig 

func (s *Store) DeleteConfig(ctx context.Context, key, appID string) error

DeleteConfig removes a config entry and all its versions.

func (*Store) DeleteFlagDefinition 

func (s *Store) DeleteFlagDefinition(ctx context.Context, key, appID string) error

DeleteFlagDefinition removes a flag definition and its rules and overrides.

func (*Store) DeleteFlagTenantOverride 

func (s *Store) DeleteFlagTenantOverride(ctx context.Context, key, appID, tenantID string) error

DeleteFlagTenantOverride removes a tenant override.

func (*Store) DeleteOverride 

func (s *Store) DeleteOverride(ctx context.Context, key, appID, tenantID string) error

DeleteOverride removes a tenant override.

func (*Store) DeleteRotationPolicy 

func (s *Store) DeleteRotationPolicy(ctx context.Context, key, appID string) error

DeleteRotationPolicy removes a rotation policy.

func (*Store) DeleteSecret 

func (s *Store) DeleteSecret(ctx context.Context, key, appID, tenantID string) error

DeleteSecret removes a secret and all its versions, in one app and tenant.

func (*Store) GetConfig 

func (s *Store) GetConfig(ctx context.Context, key, appID string) (*cfgpkg.Entry, error)

GetConfig retrieves a config entry by key and app ID.

func (*Store) GetConfigVersion 

func (s *Store) GetConfigVersion(ctx context.Context, key, appID string, version int64) (*cfgpkg.Entry, error)

GetConfigVersion retrieves a specific version of a config entry.

func (*Store) GetFlagDefinition 

func (s *Store) GetFlagDefinition(ctx context.Context, key, appID string) (*flag.Definition, error)

GetFlagDefinition retrieves a flag definition.

func (*Store) GetFlagRules 

func (s *Store) GetFlagRules(ctx context.Context, key, appID string) ([]*flag.Rule, error)

GetFlagRules returns targeting rules for a flag, ordered by priority.

func (*Store) GetFlagTenantOverride 

func (s *Store) GetFlagTenantOverride(ctx context.Context, key, appID, tenantID string) (any, error)

GetFlagTenantOverride retrieves a tenant override for a flag.

func (*Store) GetOverride 

func (s *Store) GetOverride(ctx context.Context, key, appID, tenantID string) (*override.Override, error)

GetOverride retrieves a tenant override by key, app ID, and tenant ID.

func (*Store) GetRotationPolicy 

func (s *Store) GetRotationPolicy(ctx context.Context, key, appID string) (*rotation.Policy, error)

GetRotationPolicy retrieves a rotation policy by secret key and app ID.

func (*Store) GetSecret 

func (s *Store) GetSecret(ctx context.Context, key, appID, tenantID string) (*secret.Secret, error)

GetSecret retrieves the latest version of a secret in one app and tenant.

func (*Store) GetSecretVersion 

func (s *Store) GetSecretVersion(ctx context.Context, key, appID, tenantID string, version int64) (*secret.Secret, error)

GetSecretVersion retrieves a specific version of a secret in one app and tenant. The secret and the version row are both looked up by the tenant.

func (*Store) ListAudit 

func (s *Store) ListAudit(ctx context.Context, appID string, opts audit.ListOpts) ([]*audit.Entry, error)

ListAudit returns audit entries for an app.

func (*Store) ListAuditByKey 

func (s *Store) ListAuditByKey(ctx context.Context, key, appID string, opts audit.ListOpts) ([]*audit.Entry, error)

ListAuditByKey returns audit entries for a specific key within an app.

func (*Store) ListConfig 

func (s *Store) ListConfig(ctx context.Context, appID string, opts cfgpkg.ListOpts) ([]*cfgpkg.Entry, error)

ListConfig returns config entries for an app.

func (*Store) ListConfigVersions 

func (s *Store) ListConfigVersions(ctx context.Context, key, appID string) ([]*cfgpkg.EntryVersion, error)

ListConfigVersions returns all versions of a config entry.

func (*Store) ListFlagDefinitions 

func (s *Store) ListFlagDefinitions(ctx context.Context, appID string, opts flag.ListOpts) ([]*flag.Definition, error)

ListFlagDefinitions returns all flag definitions for an app.

func (*Store) ListFlagTenantOverrides 

func (s *Store) ListFlagTenantOverrides(ctx context.Context, key, appID string) ([]*flag.TenantOverride, error)

ListFlagTenantOverrides returns all tenant overrides for a flag.

func (*Store) ListOverridesByKey 

func (s *Store) ListOverridesByKey(ctx context.Context, key, appID string) ([]*override.Override, error)

ListOverridesByKey returns all tenant overrides for a specific config key.

func (*Store) ListOverridesByTenant 

func (s *Store) ListOverridesByTenant(ctx context.Context, appID, tenantID string) ([]*override.Override, error)

ListOverridesByTenant returns all overrides for a specific tenant.

func (*Store) ListRotationPolicies 

func (s *Store) ListRotationPolicies(ctx context.Context, appID string) ([]*rotation.Policy, error)

ListRotationPolicies returns all rotation policies for an app.

func (*Store) ListRotationRecords 

func (s *Store) ListRotationRecords(ctx context.Context, key, appID string, opts rotation.ListOpts) ([]*rotation.Record, error)

ListRotationRecords returns rotation history for a secret.

func (*Store) ListSecretVersions 

func (s *Store) ListSecretVersions(ctx context.Context, key, appID, tenantID string) ([]*secret.Version, error)

ListSecretVersions returns all versions of a secret in one app and tenant.

func (*Store) ListSecrets 

func (s *Store) ListSecrets(ctx context.Context, appID string, opts secret.ListOpts) ([]*secret.Meta, error)

ListSecrets returns secret metadata for an app and the tenant in opts.TenantID, matched exactly.

func (*Store) ListUnrecordedVersions 

func (s *Store) ListUnrecordedVersions(ctx context.Context, appID, after string, limit int) ([]*secret.Version, error)

ListUnrecordedVersions returns up to limit version rows of appID, across every tenant, whose encryption algorithm was never recorded, in ascending id order, after the id after.

func (*Store) Migrate 

func (s *Store) Migrate(ctx context.Context) error

Migrate creates all tables using Grove's migration system. This method is kept for backward compatibility; prefer using the Migrations group with grove's migrator for production deployments.

func (*Store) Ping 

func (s *Store) Ping(ctx context.Context) error

Ping checks the database connection.

func (*Store) RecordAudit 

func (s *Store) RecordAudit(ctx context.Context, e *audit.Entry) error

RecordAudit persists an audit log entry.

func (*Store) RecordRotation 

func (s *Store) RecordRotation(ctx context.Context, r *rotation.Record) error

RecordRotation records a completed rotation event.

func (*Store) SaveRotationPolicy 

func (s *Store) SaveRotationPolicy(ctx context.Context, p *rotation.Policy) error

SaveRotationPolicy creates or updates a rotation policy.

func (*Store) SetConfig 

func (s *Store) SetConfig(ctx context.Context, e *cfgpkg.Entry) error

SetConfig creates or updates a config entry with auto-versioning.

func (*Store) SetFlagRules 

func (s *Store) SetFlagRules(ctx context.Context, key, appID string, rules []*flag.Rule) error

SetFlagRules replaces all targeting rules for a flag.

func (*Store) SetFlagTenantOverride 

func (s *Store) SetFlagTenantOverride(ctx context.Context, key, appID, tenantID string, value any) error

SetFlagTenantOverride sets a direct per-tenant override value.

func (*Store) SetOverride 

func (s *Store) SetOverride(ctx context.Context, o *override.Override) error

SetOverride creates or updates a tenant override.

func (*Store) SetSecret 

func (s *Store) SetSecret(ctx context.Context, sec *secret.Secret) error

SetSecret creates or updates a secret with auto-versioning.

func (*Store) SetVersionEncryption 

func (s *Store) SetVersionEncryption(ctx context.Context, versionID id.ID, alg string) error

SetVersionEncryption records the algorithm of the version row with the given id. An unknown id updates nothing and is not an error.

type StoreOption 

type StoreOption func(*Store)

StoreOption configures the Store.

func WithLogger 

func WithLogger(l log.Logger) StoreOption

WithLogger sets the logger for the store.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.