Documentation
¶
Overview ¶
Package env validates and resolves the workflow's env schema + values. The Env namespace ({{.Env.X}}) carries non-secret config; the Secret namespace ({{.Secret.X}}) decrypts wick_enc_ tokens at run time. Plain helpers + leak guard, no filesystem.
Index ¶
- Constants
- func LeakGuard(rendered string, secrets map[string]string) error
- func MarshalYAMLFile(values map[string]string) ([]byte, error)
- func OrphanKeys(schema []workflow.EnvField, values map[string]string) []string
- func ResolveSecrets(schema []workflow.EnvField, values map[string]string, dec SecretDecryptor) (envMap, secrets map[string]string, err error)
- func UnmarshalYAMLFile(data []byte, out *map[string]string) error
- func ValidateValues(schema []workflow.EnvField, values map[string]string) error
- type NoopDecryptor
- type SecretDecryptor
Constants ¶
const ( WidgetText = "text" WidgetTextarea = "textarea" WidgetSecret = "secret" WidgetNumber = "number" WidgetCheckbox = "checkbox" WidgetDropdown = "dropdown" WidgetEmail = "email" WidgetURL = "url" WidgetColor = "color" WidgetDate = "date" WidgetDateTime = "datetime" WidgetKVList = "kvlist" WidgetPicker = "picker" )
Widget values mirror config-tags vocab.
Variables ¶
This section is empty.
Functions ¶
func LeakGuard ¶
LeakGuard renders a template and reports if any rendered segment contains a known secret value verbatim.
func MarshalYAMLFile ¶
MarshalYAMLFile serializes values map to env.yaml bytes.
func OrphanKeys ¶
OrphanKeys returns values entries not declared in schema.
func ResolveSecrets ¶
func ResolveSecrets(schema []workflow.EnvField, values map[string]string, dec SecretDecryptor) (envMap, secrets map[string]string, err error)
ResolveSecrets splits the flat env values map into a plain Env map and a Secret map.
func UnmarshalYAMLFile ¶
UnmarshalYAMLFile decodes env.yaml bytes into a plain string→string map. Accepts both legacy plain-map form and the {values: {...}} envelope.
Types ¶
type SecretDecryptor ¶
SecretDecryptor unwraps a wick_enc_ token. Engine wires this from the existing encrypted-fields service; pass a NoopDecryptor for tests.
Source Files