providers

Documentation

Index

• Constants
• type CheckCapability
• type CheckCapabilityError
  • func (e *CheckCapabilityError) Error() string
• type ReferenceResolver
• type Registry
  • func NewRegistry(baseDirs ...string) *Registry
  • func NewRegistryWithReferenceResolver(referenceResolver ReferenceResolver, baseDirs ...string) *Registry
  • func (r *Registry) CheckAccessibility(ctx context.Context, refs []secretref.Ref) error
  • func (r *Registry) Close() error
  • func (r *Registry) Get(provider string) Resolver
  • func (r *Registry) Providers() []string
  • func (r *Registry) Register(name string, res Resolver)
  • func (r *Registry) Resolve(ctx context.Context, ref secretref.Ref) (string, error)
  • func (r *Registry) ResolveAll(ctx context.Context, refs []secretref.Ref) ([]string, error)
• type Resolver

Constants

const PresolvedEnvPrefix = "_DAGU_PRESOLVED_SECRET_"

PresolvedEnvPrefix is the env var prefix used to transport pre-resolved env-provider secret values from the parent process to the subprocess. When present, _DAGU_PRESOLVED_SECRET_<KEY>=<value> lets the subprocess resolve env secrets without requiring the original source variable.

Types

type CheckCapability

type CheckCapability string

CheckCapability describes whether a provider can check access without materializing plaintext secret values.

const (
	CheckCapabilityNoFetch           CheckCapability = "no_fetch"
	CheckCapabilityMetadataOnly      CheckCapability = "metadata_only"
	CheckCapabilityRequiresValueRead CheckCapability = "requires_value_read"
	CheckCapabilityUnsupported       CheckCapability = "unsupported"
)

type CheckCapabilityError

type CheckCapabilityError struct {
	Provider   string
	Capability CheckCapability
}

CheckCapabilityError is returned when the default check path cannot run without violating the no-value-read contract.

func (*CheckCapabilityError) Error

func (e *CheckCapabilityError) Error() string

type ReferenceResolver

type ReferenceResolver interface {
	ResolveReference(ctx context.Context, ref secretref.Ref) (string, error)
	CheckReferenceAccessibility(ctx context.Context, ref secretref.Ref) error
}

ReferenceResolver resolves workspace-local team secret registry references. Implementations are responsible for authorization, provenance, and avoiding plaintext persistence according to their deployment mode.

type Registry

type Registry struct {
	// contains filtered or unexported fields
}

Registry manages all secret resolvers. It is thread-safe and can be used concurrently.

func NewRegistry

func NewRegistry(baseDirs ...string) *Registry

NewRegistry creates a new registry with all registered providers. baseDirs is used by the file provider to resolve relative paths. The file provider tries each base directory in order until a file is found.

func NewRegistryWithReferenceResolver

func NewRegistryWithReferenceResolver(referenceResolver ReferenceResolver, baseDirs ...string) *Registry

NewRegistryWithReferenceResolver creates a registry that can resolve workspace-local team secret references through the provided resolver.

func (*Registry) CheckAccessibility

func (r *Registry) CheckAccessibility(ctx context.Context, refs []secretref.Ref) error

CheckAccessibility validates that all secrets are accessible through no-fetch or metadata-only provider checks. Providers that require value reads are rejected with CheckCapabilityError instead of being called.

func (*Registry) Close

func (r *Registry) Close() error

Close releases resources held by registered secret providers.

func (*Registry) Get

func (r *Registry) Get(provider string) Resolver

Get retrieves a resolver by provider name. Returns nil if the provider is not registered.

func (*Registry) Providers

func (r *Registry) Providers() []string

Providers returns the names of all registered providers.

func (*Registry) Register

func (r *Registry) Register(name string, res Resolver)

Register adds a custom resolver to the registry. If a resolver with the same name already exists, it will be replaced. This is useful for adding custom providers or testing.

func (*Registry) Resolve

func (r *Registry) Resolve(ctx context.Context, ref secretref.Ref) (string, error)

Resolve fetches a single secret value. Returns an error if the provider is unknown or resolution fails.

func (*Registry) ResolveAll

func (r *Registry) ResolveAll(ctx context.Context, refs []secretref.Ref) ([]string, error)

ResolveAll fetches all secrets and returns them as environment variable strings. Format: "NAME=value" Returns an error if any secret fails to resolve.

type Resolver

type Resolver interface {
	// Name returns the provider identifier (e.g., "env", "file", "vault").
	Name() string

	// Resolve fetches the secret value for the given reference.
	// Returns an error if the secret cannot be retrieved.
	Resolve(ctx context.Context, ref secretref.Ref) (string, error)

	// Validate checks if the secret reference is structurally valid for this provider.
	// This is called at parse time and should not make network calls.
	Validate(ref secretref.Ref) error

	// CheckCapability reports whether CheckAccessibility can run without
	// fetching plaintext secret values.
	CheckCapability(ref secretref.Ref) CheckCapability

	// CheckAccessibility verifies the secret is accessible. Providers may use
	// plaintext reads only when CheckCapability reports RequiresValueRead.
	// Callers that must avoid plaintext reads must check CheckCapability first.
	// Should verify:
	//   - Provider is reachable
	//   - Credentials are valid
	//   - Secret exists
	//   - Caller has permission
	CheckAccessibility(ctx context.Context, ref secretref.Ref) error
}

Resolver fetches secret values from a specific backend. Implementations must be thread-safe as they may be called concurrently.