templatehook

Documentation

Overview

Package templatehook implements the built-in, in-process template.v1 hook. It has no command, file, URL, or network primitives and writes only through the realization containment boundary.

Index

• Constants
• Variables
• func Write(options WriteOptions, rendered []byte) (string, error)
• type Input
  • func PublicInput(value string) Input
  • func SecretInput(value string) Input
  • func (i Input) String() string
• type InputContext
• type Renderer
  • func (r Renderer) Render(name string, source []byte, inputs map[string]Input) ([]byte, error)
• type ResolvedInputs
  • func ResolveInputs(ctx context.Context, sources map[string]domain.InputSource, ...) (ResolvedInputs, error)
• type SecretResolver
• type WriteOptions

Constants

const DefaultMaxTemplateBytes int64 = 1 << 20

Variables

var (
	ErrTemplateTooLarge = errors.New("templatehook: template exceeds limit")
	ErrOutputTooLarge   = errors.New("templatehook: output exceeds limit")
	ErrUnsafeMode       = errors.New("templatehook: unsafe output mode")
	ErrDestination      = errors.New("templatehook: destination already exists")
	ErrSecretEncoding   = errors.New("templatehook: secret input requires a context encoder")
	ErrCfgValue         = errors.New("templatehook: invalid cfg value")
	ErrFunction         = errors.New("templatehook: function is not allowlisted")
)

var ErrInputSource = errors.New("templatehook: unsupported input source")

Functions

func Write

func Write(options WriteOptions, rendered []byte) (string, error)

Write atomically publishes rendered bytes without replacement. Executable or group/other-writable output is always refused; secret-bearing output must be owner-only.

Types

type Input

type Input struct {
	// contains filtered or unexported fields
}

Input retains sensitivity until template validation. Secret values cannot be stringified directly; cfgQuote is the only v1 context encoder that may read their plaintext.

func PublicInput

func PublicInput(value string) Input

func SecretInput

func SecretInput(value string) Input

func (Input) String

func (i Input) String() string

type InputContext

type InputContext struct {
	Target      domain.Target
	Environment domain.Environment
	Release     domain.Release
	Secrets     SecretResolver
}

type Renderer

type Renderer struct {
	MaxTemplateBytes int64
	MaxOutputBytes   int64
}

Renderer bounds both template source and output. Inputs are plain strings; callers resolve typed Target/Release/literal/secret sources before rendering.

func (Renderer) Render

func (r Renderer) Render(name string, source []byte, inputs map[string]Input) ([]byte, error)

Render executes template.v1 with missing-key failure and a fixed function allowlist. It exposes only .Inputs; there are no I/O, environment, network, subprocess, or dynamic-include primitives.

type ResolvedInputs

type ResolvedInputs struct {
	Inputs         map[string]Input
	SecretVersions map[string]string
	ContainsSecret bool
}

func ResolveInputs

func ResolveInputs(ctx context.Context, sources map[string]domain.InputSource, inputContext InputContext) (ResolvedInputs, error)

ResolveInputs maps the schema-checked source union through an explicit exposable-field allowlist. It resolves each logical secret once and returns only opaque versions alongside sensitivity-preserving template inputs.

type SecretResolver

type SecretResolver interface {
	Resolve(context.Context, string, domain.SecretRef) (secrets.Value, error)
}

type WriteOptions

type WriteOptions struct {
	RealizationDir         string
	AllowedDestinationRoot string
	Destination            string
	Mode                   string
	ContainsSecret         bool
}