secret

Documentation

Overview

Package secret contains the team secret registry domain model.

Index

• Constants
• Variables
• func IsGlobalWorkspace(name string) bool
• func NormalizeWorkspace(name string) string
• func ProviderRefFingerprint(key string, providerType ProviderType, ...) (string, error)
• func ValidateProviderType(providerType ProviderType) error
• func ValidateRef(ref string) error
• func ValidateWorkspace(name string) error
• type CreateInput
• type ListOptions
• type ProviderType
• type ReferenceResolver
  • func NewReferenceResolver(store Store, workspace string) *ReferenceResolver
  • func (r *ReferenceResolver) CheckReferenceAccessibility(ctx context.Context, ref secretref.Ref) error
  • func (r *ReferenceResolver) ResolveReference(ctx context.Context, ref secretref.Ref) (string, error)
• type Secret
  • func New(input CreateInput, now time.Time) (*Secret, error)
  • func (s *Secret) ApplyUpdate(input UpdateInput, now time.Time)
  • func (s *Secret) Clone() *Secret
  • func (s *Secret) SetStatus(status Status, actor string, now time.Time) error
• type Status
• type Store
• type UpdateInput
• type VersionMetadata
• type WriteValueInput

Constants

const (
	// GlobalWorkspace is the internal scope for secrets that are intentionally
	// shared across DAG workspaces. It is not a valid workspace name.
	GlobalWorkspace = ".global"
)

Variables

var (
	ErrAlreadyExists       = errors.New("secret already exists")
	ErrDisabled            = errors.New("secret is disabled")
	ErrInvalidProviderType = errors.New("invalid secret provider type")
	ErrInvalidRef          = errors.New("invalid secret ref")
	ErrInvalidSecretID     = errors.New("invalid secret id")
	ErrInvalidStatus       = errors.New("invalid secret status")
	ErrInvalidWorkspace    = errors.New("invalid secret workspace")
	ErrNoValue             = errors.New("secret has no value")
	ErrNotFound            = errors.New("secret not found")
	ErrUnsupportedProvider = errors.New("secret provider is not supported for registry resolution")
)

Functions

func IsGlobalWorkspace

func IsGlobalWorkspace(name string) bool

func NormalizeWorkspace

func NormalizeWorkspace(name string) string

func ProviderRefFingerprint

func ProviderRefFingerprint(key string, providerType ProviderType, providerConnectionID, providerRef string) (string, error)

func ValidateProviderType

func ValidateProviderType(providerType ProviderType) error

func ValidateRef

func ValidateRef(ref string) error

func ValidateWorkspace

func ValidateWorkspace(name string) error

Types

type CreateInput

type CreateInput struct {
	Workspace              string
	Ref                    string
	Description            string
	ProviderType           ProviderType
	ProviderConnectionID   string
	ProviderRef            string
	ProviderRefFingerprint string
	CreatedBy              string
}

type ListOptions

type ListOptions struct {
	// Workspace filters by internal workspace name. Nil means all scopes.
	// A pointer to GlobalWorkspace means the global scope.
	Workspace *string
}

type ProviderType

type ProviderType string

const (
	ProviderDaguManaged ProviderType = "dagu-managed"
	ProviderVault       ProviderType = "vault"
	ProviderKubernetes  ProviderType = "kubernetes"
	ProviderGCP         ProviderType = "gcp"
	ProviderAWS         ProviderType = "aws"
	ProviderAzure       ProviderType = "azure"
	ProviderAlibaba     ProviderType = "alibaba"
)

type ReferenceResolver

type ReferenceResolver struct {
	// contains filtered or unexported fields
}

func NewReferenceResolver

func NewReferenceResolver(store Store, workspace string) *ReferenceResolver

func (*ReferenceResolver) CheckReferenceAccessibility

func (r *ReferenceResolver) CheckReferenceAccessibility(ctx context.Context, ref secretref.Ref) error

func (*ReferenceResolver) ResolveReference

func (r *ReferenceResolver) ResolveReference(ctx context.Context, ref secretref.Ref) (string, error)

type Secret

type Secret struct {
	ID                     string
	Workspace              string
	Ref                    string
	Description            string
	ProviderType           ProviderType
	ProviderConnectionID   string
	ProviderRef            string
	ProviderRefFingerprint string
	CurrentVersion         int
	Status                 Status
	CreatedBy              string
	CreatedAt              time.Time
	UpdatedBy              string
	UpdatedAt              time.Time
	LastCheckedAt          *time.Time
	LastResolvedAt         *time.Time
	LastRotatedAt          *time.Time
}

Secret is the registry metadata for a scoped secret reference. It never contains plaintext secret values.

func New

func New(input CreateInput, now time.Time) (*Secret, error)

func (*Secret) ApplyUpdate

func (s *Secret) ApplyUpdate(input UpdateInput, now time.Time)

func (*Secret) Clone

func (s *Secret) Clone() *Secret

func (*Secret) SetStatus

func (s *Secret) SetStatus(status Status, actor string, now time.Time) error

type Status

type Status string

const (
	StatusActive   Status = "active"
	StatusDisabled Status = "disabled"
)

type Store

type Store interface {
	Create(ctx context.Context, secret *Secret, initialValue *WriteValueInput) error
	GetByID(ctx context.Context, id string) (*Secret, error)
	GetByRef(ctx context.Context, workspace, ref string) (*Secret, error)
	List(ctx context.Context, opts ListOptions) ([]*Secret, error)
	Update(ctx context.Context, secret *Secret) error
	Delete(ctx context.Context, id string) error
	WriteValue(ctx context.Context, id string, input WriteValueInput) (*Secret, error)
	GetCurrentVersion(ctx context.Context, id string) (*VersionMetadata, error)
	ResolveValue(ctx context.Context, id string) (string, *VersionMetadata, error)
}

type UpdateInput

type UpdateInput struct {
	Description            *string
	ProviderConnectionID   *string
	ProviderRef            *string
	ProviderRefFingerprint *string
	UpdatedBy              string
}

type VersionMetadata

type VersionMetadata struct {
	SecretID  string
	Version   int
	CreatedBy string
	CreatedAt time.Time
}

type WriteValueInput

type WriteValueInput struct {
	Value     string
	CreatedBy string
	CreatedAt time.Time
}