secretref

Documentation

Index

• type Backend
• type EnvBackend
  • func NewEnvBackend(lookup EnvLookup) *EnvBackend
  • func (b *EnvBackend) Resolve(_ context.Context, ref Ref) (string, error)
• type EnvLookup
• type Error
  • func (e *Error) Error() string
  • func (e *Error) Unwrap() error
• type ErrorKind
• type KeychainBackend
  • func NewKeychainBackend() *KeychainBackend
  • func (b *KeychainBackend) DefaultRef(storeName, account string) string
  • func (b *KeychainBackend) DisplayName() string
  • func (b *KeychainBackend) Exists(ctx context.Context, ref Ref) (bool, error)
  • func (b *KeychainBackend) Resolve(ctx context.Context, ref Ref) (string, error)
  • func (b *KeychainBackend) Scheme() string
  • func (b *KeychainBackend) Store(ctx context.Context, ref Ref, value string) error
  • func (b *KeychainBackend) WriteSupported() bool
• type Ref
  • func Parse(raw string) (Ref, error)
• type Resolver
  • func NewDefaultResolver() *Resolver
  • func NewResolver(backends map[string]Backend) *Resolver
  • func (r *Resolver) Exists(ctx context.Context, raw string) (bool, error)
  • func (r *Resolver) Resolve(ctx context.Context, raw string) (string, error)
  • func (r *Resolver) Store(ctx context.Context, raw, value string) error
  • func (r *Resolver) WritableBackends() []WritableBackend
• type SecretServiceBackend
  • func NewSecretServiceBackend() *SecretServiceBackend
  • func (b *SecretServiceBackend) DefaultRef(storeName, account string) string
  • func (b *SecretServiceBackend) DisplayName() string
  • func (b *SecretServiceBackend) Exists(ctx context.Context, ref Ref) (bool, error)
  • func (b *SecretServiceBackend) Resolve(ctx context.Context, ref Ref) (string, error)
  • func (b *SecretServiceBackend) Scheme() string
  • func (b *SecretServiceBackend) Store(ctx context.Context, ref Ref, value string) error
  • func (b *SecretServiceBackend) WriteSupported() bool
• type WincredBackend
  • func NewWincredBackend() *WincredBackend
  • func (b *WincredBackend) DefaultRef(storeName, account string) string
  • func (b *WincredBackend) DisplayName() string
  • func (b *WincredBackend) Exists(ctx context.Context, ref Ref) (bool, error)
  • func (b *WincredBackend) Resolve(ctx context.Context, ref Ref) (string, error)
  • func (b *WincredBackend) Scheme() string
  • func (b *WincredBackend) Store(ctx context.Context, ref Ref, value string) error
  • func (b *WincredBackend) WriteSupported() bool
• type WritableBackend

Types

type Backend

type Backend interface {
	Resolve(ctx context.Context, ref Ref) (string, error)
}

Backend resolves a parsed secret reference into a plaintext value.

type EnvBackend

type EnvBackend struct {
	// contains filtered or unexported fields
}

EnvBackend resolves env://VAR references.

func NewEnvBackend

func NewEnvBackend(lookup EnvLookup) *EnvBackend

func (*EnvBackend) Resolve

func (b *EnvBackend) Resolve(_ context.Context, ref Ref) (string, error)

type EnvLookup

type EnvLookup func(string) (string, bool)

type Error

type Error struct {
	Kind   ErrorKind
	Ref    string
	Detail string
	Err    error
}

Error is a typed secret reference error.

func (*Error) Error

func (e *Error) Error() string

func (*Error) Unwrap

func (e *Error) Unwrap() error

type ErrorKind

type ErrorKind string

const (
	KindInvalidRef         ErrorKind = "invalid_ref"
	KindNotFound           ErrorKind = "not_found"
	KindBackendUnavailable ErrorKind = "backend_unavailable"
)

type KeychainBackend

type KeychainBackend struct {
	// contains filtered or unexported fields
}

KeychainBackend resolves keychain://service/account references.

func NewKeychainBackend

func NewKeychainBackend() *KeychainBackend

NewKeychainBackend creates a keychain backend for the current platform.

func (*KeychainBackend) DefaultRef

func (b *KeychainBackend) DefaultRef(storeName, account string) string

func (*KeychainBackend) DisplayName

func (b *KeychainBackend) DisplayName() string

func (*KeychainBackend) Exists

func (b *KeychainBackend) Exists(ctx context.Context, ref Ref) (bool, error)

func (*KeychainBackend) Resolve

func (b *KeychainBackend) Resolve(ctx context.Context, ref Ref) (string, error)

func (*KeychainBackend) Scheme

func (b *KeychainBackend) Scheme() string

func (*KeychainBackend) Store

func (b *KeychainBackend) Store(ctx context.Context, ref Ref, value string) error

func (*KeychainBackend) WriteSupported

func (b *KeychainBackend) WriteSupported() bool

type Ref

type Ref struct {
	Raw    string
	Scheme string
	Path   string
}

Ref represents a parsed secret reference in the form <scheme>://<path>.

func Parse

func Parse(raw string) (Ref, error)

Parse parses a secret reference.

type Resolver

type Resolver struct {
	// contains filtered or unexported fields
}

Resolver routes secret references by scheme.

func NewDefaultResolver

func NewDefaultResolver() *Resolver

NewDefaultResolver builds the baseline resolver with env:// and keychain:// support.

func NewResolver

func NewResolver(backends map[string]Backend) *Resolver

NewResolver creates a resolver from scheme backends.

func (*Resolver) Exists

func (r *Resolver) Exists(ctx context.Context, raw string) (bool, error)

Exists reports whether a writable secret reference already exists.

func (*Resolver) Resolve

func (r *Resolver) Resolve(ctx context.Context, raw string) (string, error)

Resolve parses and resolves a secret reference.

func (*Resolver) Store

func (r *Resolver) Store(ctx context.Context, raw, value string) error

Store writes a secret value through a writable backend.

func (*Resolver) WritableBackends

func (r *Resolver) WritableBackends() []WritableBackend

WritableBackends returns registered backends that support interactive writes.

type SecretServiceBackend

type SecretServiceBackend struct {
	// contains filtered or unexported fields
}

SecretServiceBackend resolves secret-service://collection/item references.

func NewSecretServiceBackend

func NewSecretServiceBackend() *SecretServiceBackend

NewSecretServiceBackend creates a Secret Service backend for the current platform.

func (*SecretServiceBackend) DefaultRef

func (b *SecretServiceBackend) DefaultRef(storeName, account string) string

func (*SecretServiceBackend) DisplayName

func (b *SecretServiceBackend) DisplayName() string

func (*SecretServiceBackend) Exists

func (b *SecretServiceBackend) Exists(ctx context.Context, ref Ref) (bool, error)

func (*SecretServiceBackend) Resolve

func (b *SecretServiceBackend) Resolve(ctx context.Context, ref Ref) (string, error)

func (*SecretServiceBackend) Scheme

func (b *SecretServiceBackend) Scheme() string

func (*SecretServiceBackend) Store

func (b *SecretServiceBackend) Store(ctx context.Context, ref Ref, value string) error

func (*SecretServiceBackend) WriteSupported

func (b *SecretServiceBackend) WriteSupported() bool

type WincredBackend

type WincredBackend struct {
	// contains filtered or unexported fields
}

WincredBackend resolves wincred://target references.

func NewWincredBackend

func NewWincredBackend() *WincredBackend

NewWincredBackend creates a Windows Credential Manager backend for the current platform.

func (*WincredBackend) DefaultRef

func (b *WincredBackend) DefaultRef(storeName, account string) string

func (*WincredBackend) DisplayName

func (b *WincredBackend) DisplayName() string

func (*WincredBackend) Exists

func (b *WincredBackend) Exists(ctx context.Context, ref Ref) (bool, error)

func (*WincredBackend) Resolve

func (b *WincredBackend) Resolve(ctx context.Context, ref Ref) (string, error)

func (*WincredBackend) Scheme

func (b *WincredBackend) Scheme() string

func (*WincredBackend) Store

func (b *WincredBackend) Store(ctx context.Context, ref Ref, value string) error

func (*WincredBackend) WriteSupported

func (b *WincredBackend) WriteSupported() bool

type WritableBackend

type WritableBackend interface {
	Backend
	Scheme() string
	DisplayName() string
	WriteSupported() bool
	DefaultRef(storeName, account string) string
	Exists(ctx context.Context, ref Ref) (bool, error)
	Store(ctx context.Context, ref Ref, value string) error
}

WritableBackend extends a backend with native-store write and existence checks for interactive CLI flows.