Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsVaultRef ¶
IsVaultRef returns true if the value is a vault:// reference.
func ParseVaultRef ¶
ParseVaultRef extracts the path from a vault:// reference. Returns the path portion (e.g. "providers/anthropic/primary") and true, or empty string and false if not a vault reference.
Types ¶
type ChainVaultBackend ¶ added in v0.1.1
type ChainVaultBackend struct {
// contains filtered or unexported fields
}
ChainVaultBackend tries multiple VaultStore backends in order. It implements VaultStore.
func NewChainVaultBackend ¶ added in v0.1.1
func NewChainVaultBackend(names []string, stores []VaultStore, log logger.Logger) *ChainVaultBackend
NewChainVaultBackend creates a ChainVaultBackend from ordered backends. names and stores must have the same length.
func (*ChainVaultBackend) Delete ¶ added in v0.1.1
func (c *ChainVaultBackend) Delete(path string) error
Delete removes a secret from the first backend.
func (*ChainVaultBackend) List ¶ added in v0.1.1
func (c *ChainVaultBackend) List() ([]string, error)
List returns all secret paths from the first backend.
type EnvVaultBackend ¶
type EnvVaultBackend struct{}
EnvVaultBackend resolves secrets from environment variables. Path mapping: vault://providers/{provider}/{key} -> TERN_VAULT_{PROVIDER}_{KEY}
func NewEnvVaultBackend ¶
func NewEnvVaultBackend() *EnvVaultBackend
NewEnvVaultBackend creates a new EnvVaultBackend.
func (*EnvVaultBackend) Delete ¶
func (b *EnvVaultBackend) Delete(path string) error
Delete removes a secret by unsetting the corresponding environment variable.
func (*EnvVaultBackend) List ¶
func (b *EnvVaultBackend) List() ([]string, error)
List returns all secret paths by scanning environment variables with TERN_VAULT_ prefix.
type FileVaultBackend ¶
type FileVaultBackend struct {
// contains filtered or unexported fields
}
func NewFileVaultBackend ¶
func NewFileVaultBackend(filepath string) (*FileVaultBackend, error)
func (*FileVaultBackend) Delete ¶
func (b *FileVaultBackend) Delete(path string) error
func (*FileVaultBackend) List ¶
func (b *FileVaultBackend) List() ([]string, error)
func (*FileVaultBackend) Set ¶
func (b *FileVaultBackend) Set(path, value string) error
type KeyringVaultBackend ¶
type KeyringVaultBackend struct {
// contains filtered or unexported fields
}
KeyringVaultBackend implements VaultStore using OS Keyring (Windows Credential Manager, macOS Keychain, Linux Secret Service). It is safe for concurrent use.
func NewKeyringVaultBackend ¶
func NewKeyringVaultBackend(tenantID ...string) *KeyringVaultBackend
NewKeyringVaultBackend creates a backend scoped to the given tenant. If no tenantID is provided, "default" is used.
func (*KeyringVaultBackend) Delete ¶
func (k *KeyringVaultBackend) Delete(path string) error
Delete removes a secret from the OS Keyring.
func (*KeyringVaultBackend) List ¶
func (k *KeyringVaultBackend) List() ([]string, error)
List returns all stored secret paths from the key index.
func (*KeyringVaultBackend) Resolve ¶
func (k *KeyringVaultBackend) Resolve(ref string) (string, error)
Resolve resolves a vault:// reference to the actual secret from OS Keyring.
func (*KeyringVaultBackend) ServiceName ¶
func (k *KeyringVaultBackend) ServiceName() string
ServiceName returns the computed OS keyring service name (for testing).
type VaultStore ¶
type VaultStore interface {
// Resolve resolves a vault:// reference to the actual secret value.
// Returns an error if the reference cannot be resolved.
Resolve(ref string) (string, error)
// Set stores a secret at the given path.
Set(path string, value string) error
// Delete removes a secret at the given path.
Delete(path string) error
// List returns all stored secret paths.
List() ([]string, error)
}
VaultStore manages secret storage and retrieval.
Source Files