sqlite

package
v1.8.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 11, 2026 License: MIT Imports: 20 Imported by: 0

Documentation

Overview

Package sqlite provides a Grove ORM SQLite implementation of all Vault store interfaces.

Index

Constants

This section is empty.

Variables

View Source 
var Migrations = migrate.NewGroup("vault")

Migrations is the grove migration group for the Vault store (SQLite).

Functions

This section is empty.

Types

type AuditModel 

type AuditModel struct {
	grove.BaseModel `grove:"table:vault_audit,alias:a"`
	ID              string    `grove:"id,pk"`
	Action          string    `grove:"action,notnull"`
	Resource        string    `grove:"resource,notnull"`
	Key             string    `grove:"key"`
	AppID           string    `grove:"app_id"`
	TenantID        string    `grove:"tenant_id"`
	UserID          string    `grove:"user_id"`
	IP              string    `grove:"ip"`
	Outcome         string    `grove:"outcome"`
	Metadata        string    `grove:"metadata"`
	CreatedAt       time.Time `grove:"created_at,notnull"`
}

AuditModel is the Grove model for vault_audit (SQLite).

type ConfigModel 

type ConfigModel struct {
	grove.BaseModel `grove:"table:vault_config,alias:c"`
	ID              string    `grove:"id,pk"`
	Key             string    `grove:"key,notnull"`
	Value           string    `grove:"value"`
	ValueType       string    `grove:"value_type"`
	Version         int64     `grove:"version,notnull"`
	Description     string    `grove:"description"`
	AppID           string    `grove:"app_id,notnull"`
	Metadata        string    `grove:"metadata"`
	CreatedAt       time.Time `grove:"created_at,notnull"`
	UpdatedAt       time.Time `grove:"updated_at,notnull"`
}

ConfigModel is the Grove model for vault_config (SQLite).

type ConfigVersionModel 

type ConfigVersionModel struct {
	grove.BaseModel `grove:"table:vault_config_versions,alias:cv"`
	ID              string    `grove:"id,pk"`
	ConfigKey       string    `grove:"config_key,notnull"`
	AppID           string    `grove:"app_id,notnull"`
	Version         int64     `grove:"version,notnull"`
	Value           string    `grove:"value"`
	CreatedBy       string    `grove:"created_by"`
	CreatedAt       time.Time `grove:"created_at,notnull"`
}

ConfigVersionModel is the Grove model for vault_config_versions (SQLite).

type FlagModel 

type FlagModel struct {
	grove.BaseModel `grove:"table:vault_flags,alias:f"`
	ID              string    `grove:"id,pk"`
	Key             string    `grove:"key,notnull"`
	Type            string    `grove:"type,notnull"`
	DefaultValue    string    `grove:"default_value"`
	Description     string    `grove:"description"`
	Tags            string    `grove:"tags"`
	Variants        string    `grove:"variants"`
	Enabled         bool      `grove:"enabled,notnull"`
	AppID           string    `grove:"app_id,notnull"`
	Metadata        string    `grove:"metadata"`
	CreatedAt       time.Time `grove:"created_at,notnull"`
	UpdatedAt       time.Time `grove:"updated_at,notnull"`
}

FlagModel is the Grove model for vault_flags (SQLite).

type FlagOverrideModel 

type FlagOverrideModel struct {
	grove.BaseModel `grove:"table:vault_flag_overrides,alias:fo"`
	ID              string    `grove:"id,pk"`
	FlagKey         string    `grove:"flag_key,notnull"`
	AppID           string    `grove:"app_id,notnull"`
	TenantID        string    `grove:"tenant_id,notnull"`
	Value           string    `grove:"value"`
	CreatedAt       time.Time `grove:"created_at,notnull"`
	UpdatedAt       time.Time `grove:"updated_at,notnull"`
}

FlagOverrideModel is the Grove model for vault_flag_overrides (SQLite).

type FlagRuleModel 

type FlagRuleModel struct {
	grove.BaseModel `grove:"table:vault_flag_rules,alias:fr"`
	ID              string    `grove:"id,pk"`
	FlagKey         string    `grove:"flag_key,notnull"`
	AppID           string    `grove:"app_id,notnull"`
	Priority        int       `grove:"priority,notnull"`
	Type            string    `grove:"type,notnull"`
	Config          string    `grove:"config"`
	ReturnValue     string    `grove:"return_value"`
	CreatedAt       time.Time `grove:"created_at,notnull"`
	UpdatedAt       time.Time `grove:"updated_at,notnull"`
}

FlagRuleModel is the Grove model for vault_flag_rules (SQLite).

type OverrideModel 

type OverrideModel struct {
	grove.BaseModel `grove:"table:vault_overrides,alias:ov"`
	ID              string    `grove:"id,pk"`
	Key             string    `grove:"key,notnull"`
	Value           string    `grove:"value"`
	AppID           string    `grove:"app_id,notnull"`
	TenantID        string    `grove:"tenant_id,notnull"`
	Metadata        string    `grove:"metadata"`
	CreatedAt       time.Time `grove:"created_at,notnull"`
	UpdatedAt       time.Time `grove:"updated_at,notnull"`
}

OverrideModel is the Grove model for vault_overrides (SQLite).

type RotationPolicyModel 

type RotationPolicyModel struct {
	grove.BaseModel `grove:"table:vault_rotation_policies,alias:rp"`
	ID              string     `grove:"id,pk"`
	SecretKey       string     `grove:"secret_key,notnull"`
	AppID           string     `grove:"app_id,notnull"`
	IntervalNS      int64      `grove:"interval_ns,notnull"`
	Enabled         bool       `grove:"enabled,notnull"`
	LastRotatedAt   *time.Time `grove:"last_rotated_at"`
	NextRotationAt  *time.Time `grove:"next_rotation_at"`
	CreatedAt       time.Time  `grove:"created_at,notnull"`
	UpdatedAt       time.Time  `grove:"updated_at,notnull"`
}

RotationPolicyModel is the Grove model for vault_rotation_policies (SQLite).

type RotationRecordModel 

type RotationRecordModel struct {
	grove.BaseModel `grove:"table:vault_rotation_records,alias:rr"`
	ID              string    `grove:"id,pk"`
	SecretKey       string    `grove:"secret_key,notnull"`
	AppID           string    `grove:"app_id,notnull"`
	OldVersion      int64     `grove:"old_version,notnull"`
	NewVersion      int64     `grove:"new_version,notnull"`
	RotatedBy       string    `grove:"rotated_by"`
	RotatedAt       time.Time `grove:"rotated_at,notnull"`
}

RotationRecordModel is the Grove model for vault_rotation_records (SQLite).

type SecretModel 

type SecretModel struct {
	grove.BaseModel `grove:"table:vault_secrets,alias:s"`
	ID              string     `grove:"id,pk"`
	Key             string     `grove:"key,notnull"`
	AppID           string     `grove:"app_id,notnull"`
	TenantID        string     `grove:"tenant_id,notnull"`
	EncryptedValue  []byte     `grove:"encrypted_value"`
	EncryptionAlg   string     `grove:"encryption_alg"`
	EncryptionKeyID string     `grove:"encryption_key_id"`
	Version         int64      `grove:"version,notnull"`
	Metadata        string     `grove:"metadata"`
	ExpiresAt       *time.Time `grove:"expires_at"`
	CreatedAt       time.Time  `grove:"created_at,notnull"`
	UpdatedAt       time.Time  `grove:"updated_at,notnull"`
}

SecretModel is the Grove model for vault_secrets (SQLite).

type SecretVersionModel 

type SecretVersionModel struct {
	grove.BaseModel `grove:"table:vault_secret_versions,alias:sv"`
	ID              string    `grove:"id,pk"`
	SecretKey       string    `grove:"secret_key,notnull"`
	AppID           string    `grove:"app_id,notnull"`
	TenantID        string    `grove:"tenant_id,notnull"`
	Version         int64     `grove:"version,notnull"`
	EncryptedValue  []byte    `grove:"encrypted_value"`
	EncryptionAlg   *string   `grove:"encryption_alg"`
	CreatedBy       string    `grove:"created_by"`
	CreatedAt       time.Time `grove:"created_at,notnull"`
}

SecretVersionModel is the Grove model for vault_secret_versions (SQLite).

type Store 

type Store struct {
	// contains filtered or unexported fields
}

Store is a Grove ORM SQLite implementation of all Vault store interfaces.

func New 

func New(db *grove.DB, opts ...StoreOption) *Store

New creates a new SQLite store backed by Grove ORM.

func (*Store) ClaimDueRotation 

func (s *Store) ClaimDueRotation(ctx context.Context, key, appID string, now, until time.Time) (bool, error)

ClaimDueRotation claims a due policy for one rotation run. A missing policy returns false and a nil error.

The due test runs in Go, not SQL. This store binds times through the driver's default text format, and rows written before times were normalised to UTC can hold other offsets, so a text comparison in SQL would order some instants wrongly. Instead the row is read, judged with the loop's own now.After(next), and updated by primary key, all inside one transaction.

That is safe against concurrent claimers because SQLite admits one writer at a time and its transactions are serializable. A second claimer that read the row before the winner committed cannot then write: SQLite refuses the upgrade with SQLITE_BUSY (the winner still holds the write lock) or SQLITE_BUSY_SNAPSHOT (the winner has committed and the read is stale). A claimer that reads after the winner commits sees next_rotation_at already at until and finds nothing due. A busy or locked result is reported as not claimed, because this call wrote nothing and some other writer holds the database; the loop tries again on its next tick if the policy is still due.

func (*Store) Close 

func (s *Store) Close() error

Close closes the database connection.

func (*Store) CountAudit 

func (s *Store) CountAudit(ctx context.Context, appID string) (int64, error)

CountAudit returns the number of audit entries belonging to appID.

func (*Store) CountAuditMatching 

func (s *Store) CountAuditMatching(ctx context.Context, appID string, opts audit.ListOpts) (int64, error)

CountAuditMatching returns the number of audit entries belonging to appID that match opts. Limit and Offset are ignored.

func (*Store) CountConfig 

func (s *Store) CountConfig(ctx context.Context, appID string) (int64, error)

CountConfig returns the number of config entries belonging to appID.

func (*Store) CountConfigMatching 

func (s *Store) CountConfigMatching(ctx context.Context, appID string, opts cfgpkg.ListOpts) (int64, error)

CountConfigMatching returns the number of config entries belonging to appID whose key starts with opts.KeyPrefix. Limit and Offset are ignored.

func (*Store) CountFlagDefinitions 

func (s *Store) CountFlagDefinitions(ctx context.Context, appID string) (int64, error)

CountFlagDefinitions returns the number of flag definitions belonging to appID.

func (*Store) CountFlagDefinitionsMatching 

func (s *Store) CountFlagDefinitionsMatching(ctx context.Context, appID string, opts flag.ListOpts) (int64, error)

CountFlagDefinitionsMatching returns the number of flag definitions belonging to appID that match opts. Limit and Offset are ignored.

func (*Store) CountOverrides 

func (s *Store) CountOverrides(ctx context.Context, appID string) (int64, error)

CountOverrides returns the number of tenant overrides belonging to appID.

func (*Store) CountRotationPolicies 

func (s *Store) CountRotationPolicies(ctx context.Context, appID string) (int64, error)

CountRotationPolicies returns the number of rotation policies belonging to appID.

func (*Store) CountSecrets 

func (s *Store) CountSecrets(ctx context.Context, appID string) (int64, error)

CountSecrets returns the number of secrets belonging to appID, across every tenant.

func (*Store) CountSecretsMatching 

func (s *Store) CountSecretsMatching(ctx context.Context, appID string, opts secret.ListOpts) (int64, error)

CountSecretsMatching returns the number of secrets belonging to appID, across every tenant, that pass the expiry bounds in opts. TenantID, Limit and Offset are ignored.

func (*Store) CountSecretsUnencrypted 

func (s *Store) CountSecretsUnencrypted(ctx context.Context, appID string) (int64, error)

CountSecretsUnencrypted returns the number of secrets belonging to appID, across every tenant, that were stored without an encryption algorithm.

func (*Store) CountVersionEncryption 

func (s *Store) CountVersionEncryption(ctx context.Context, appID string) (secret.VersionEncryptionCounts, error)

CountVersionEncryption tallies appID's version rows, across every tenant, by recorded algorithm in one pass, leaving out each secret's current version. A version row is matched to its secret by key, app and tenant: matching on key and app alone would let one tenant's current version hide another tenant's earlier row with the same number.

func (*Store) DB 

func (s *Store) DB() *grove.DB

DB returns the underlying grove database for direct access.

func (*Store) DefineFlag 

func (s *Store) DefineFlag(ctx context.Context, f *flag.Definition) error

DefineFlag creates or updates a flag definition.

func (*Store) DeleteConfig 

func (s *Store) DeleteConfig(ctx context.Context, key, appID string) error

DeleteConfig removes a config entry and all its versions.

func (*Store) DeleteFlagDefinition 

func (s *Store) DeleteFlagDefinition(ctx context.Context, key, appID string) error

DeleteFlagDefinition removes a flag definition and its rules and overrides.

func (*Store) DeleteFlagTenantOverride 

func (s *Store) DeleteFlagTenantOverride(ctx context.Context, key, appID, tenantID string) error

DeleteFlagTenantOverride removes a tenant override.

func (*Store) DeleteOverride 

func (s *Store) DeleteOverride(ctx context.Context, key, appID, tenantID string) error

DeleteOverride removes a tenant override.

func (*Store) DeleteRotationPolicy 

func (s *Store) DeleteRotationPolicy(ctx context.Context, key, appID string) error

DeleteRotationPolicy removes a rotation policy.

func (*Store) DeleteSecret 

func (s *Store) DeleteSecret(ctx context.Context, key, appID, tenantID string) error

DeleteSecret removes a secret and all its versions, in one app and tenant.

func (*Store) GetConfig 

func (s *Store) GetConfig(ctx context.Context, key, appID string) (*cfgpkg.Entry, error)

GetConfig retrieves a config entry by key and app ID.

func (*Store) GetConfigVersion 

func (s *Store) GetConfigVersion(ctx context.Context, key, appID string, version int64) (*cfgpkg.Entry, error)

GetConfigVersion retrieves a specific version of a config entry.

func (*Store) GetFlagDefinition 

func (s *Store) GetFlagDefinition(ctx context.Context, key, appID string) (*flag.Definition, error)

GetFlagDefinition retrieves a flag definition.

func (*Store) GetFlagRules 

func (s *Store) GetFlagRules(ctx context.Context, key, appID string) ([]*flag.Rule, error)

GetFlagRules returns targeting rules for a flag, ordered by priority.

func (*Store) GetFlagTenantOverride 

func (s *Store) GetFlagTenantOverride(ctx context.Context, key, appID, tenantID string) (any, error)

GetFlagTenantOverride retrieves a tenant override for a flag.

func (*Store) GetOverride 

func (s *Store) GetOverride(ctx context.Context, key, appID, tenantID string) (*override.Override, error)

GetOverride retrieves a tenant override by key, app ID, and tenant ID.

func (*Store) GetRotationPolicy 

func (s *Store) GetRotationPolicy(ctx context.Context, key, appID string) (*rotation.Policy, error)

GetRotationPolicy retrieves a rotation policy by secret key and app ID.

func (*Store) GetSecret 

func (s *Store) GetSecret(ctx context.Context, key, appID, tenantID string) (*secret.Secret, error)

GetSecret retrieves the latest version of a secret in one app and tenant.

func (*Store) GetSecretVersion 

func (s *Store) GetSecretVersion(ctx context.Context, key, appID, tenantID string, version int64) (*secret.Secret, error)

GetSecretVersion retrieves a specific version of a secret in one app and tenant. The secret and the version row are both looked up by the tenant.

func (*Store) ListAudit 

func (s *Store) ListAudit(ctx context.Context, appID string, opts audit.ListOpts) ([]*audit.Entry, error)

ListAudit returns audit entries for an app.

func (*Store) ListAuditByKey 

func (s *Store) ListAuditByKey(ctx context.Context, key, appID string, opts audit.ListOpts) ([]*audit.Entry, error)

ListAuditByKey returns audit entries for a specific key within an app.

func (*Store) ListConfig 

func (s *Store) ListConfig(ctx context.Context, appID string, opts cfgpkg.ListOpts) ([]*cfgpkg.Entry, error)

ListConfig returns config entries for an app.

func (*Store) ListConfigVersions 

func (s *Store) ListConfigVersions(ctx context.Context, key, appID string) ([]*cfgpkg.EntryVersion, error)

ListConfigVersions returns all versions of a config entry.

func (*Store) ListFlagDefinitions 

func (s *Store) ListFlagDefinitions(ctx context.Context, appID string, opts flag.ListOpts) ([]*flag.Definition, error)

ListFlagDefinitions returns all flag definitions for an app.

func (*Store) ListFlagTenantOverrides 

func (s *Store) ListFlagTenantOverrides(ctx context.Context, key, appID string) ([]*flag.TenantOverride, error)

ListFlagTenantOverrides returns all tenant overrides for a flag.

func (*Store) ListOverridesByKey 

func (s *Store) ListOverridesByKey(ctx context.Context, key, appID string) ([]*override.Override, error)

ListOverridesByKey returns all tenant overrides for a specific config key.

func (*Store) ListOverridesByTenant 

func (s *Store) ListOverridesByTenant(ctx context.Context, appID, tenantID string) ([]*override.Override, error)

ListOverridesByTenant returns all overrides for a specific tenant.

func (*Store) ListRotationPolicies 

func (s *Store) ListRotationPolicies(ctx context.Context, appID string) ([]*rotation.Policy, error)

ListRotationPolicies returns all rotation policies for an app.

func (*Store) ListRotationRecords 

func (s *Store) ListRotationRecords(ctx context.Context, key, appID string, opts rotation.ListOpts) ([]*rotation.Record, error)

ListRotationRecords returns rotation history for a secret.

func (*Store) ListSecretVersions 

func (s *Store) ListSecretVersions(ctx context.Context, key, appID, tenantID string) ([]*secret.Version, error)

ListSecretVersions returns all versions of a secret in one app and tenant.

func (*Store) ListSecrets 

func (s *Store) ListSecrets(ctx context.Context, appID string, opts secret.ListOpts) ([]*secret.Meta, error)

ListSecrets returns secret metadata for an app and the tenant in opts.TenantID, matched exactly.

func (*Store) ListUnrecordedVersions 

func (s *Store) ListUnrecordedVersions(ctx context.Context, appID, after string, limit int) ([]*secret.Version, error)

ListUnrecordedVersions returns up to limit version rows of appID, across every tenant, whose encryption algorithm was never recorded, in ascending id order, after the id after.

func (*Store) Migrate 

func (s *Store) Migrate(ctx context.Context) error

Migrate creates the required tables and indexes using the grove orchestrator.

func (*Store) Ping 

func (s *Store) Ping(ctx context.Context) error

Ping checks database connectivity.

func (*Store) RecordAudit 

func (s *Store) RecordAudit(ctx context.Context, e *audit.Entry) error

RecordAudit persists an audit log entry.

func (*Store) RecordRotation 

func (s *Store) RecordRotation(ctx context.Context, r *rotation.Record) error

RecordRotation records a completed rotation event.

func (*Store) SaveRotationPolicy 

func (s *Store) SaveRotationPolicy(ctx context.Context, p *rotation.Policy) error

SaveRotationPolicy creates or updates a rotation policy.

func (*Store) SetConfig 

func (s *Store) SetConfig(ctx context.Context, e *cfgpkg.Entry) error

SetConfig creates or updates a config entry with auto-versioning.

func (*Store) SetFlagRules 

func (s *Store) SetFlagRules(ctx context.Context, key, appID string, rules []*flag.Rule) error

SetFlagRules replaces all targeting rules for a flag.

func (*Store) SetFlagTenantOverride 

func (s *Store) SetFlagTenantOverride(ctx context.Context, key, appID, tenantID string, value any) error

SetFlagTenantOverride sets a direct per-tenant override value.

func (*Store) SetOverride 

func (s *Store) SetOverride(ctx context.Context, o *override.Override) error

SetOverride creates or updates a tenant override.

func (*Store) SetSecret 

func (s *Store) SetSecret(ctx context.Context, sec *secret.Secret) error

SetSecret creates or updates a secret with auto-versioning.

func (*Store) SetVersionEncryption 

func (s *Store) SetVersionEncryption(ctx context.Context, versionID id.ID, alg string) error

SetVersionEncryption records the algorithm of the version row with the given id. An unknown id updates nothing and is not an error.

type StoreOption 

type StoreOption func(*Store)

StoreOption configures the Store.

func WithLogger 

func WithLogger(l log.Logger) StoreOption

WithLogger sets the logger for the store.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.