secrets

Documentation

Index

• Variables
• type Envelope
• type ID
  • func ParseID(s string) (ID, error)
  • func (id ID) Match(pattern string) bool
  • func (id ID) String() string
  • func (id ID) Valid() error
• type Request
• type Resolver
• type Restricted
  • func NewRestricted(resolver Resolver, allowed ...ID) *Restricted
  • func (r *Restricted) Allow(allowed ...ID)
  • func (r *Restricted) GetSecret(request Request) (Envelope, error)

Variables

var (
	ErrNotFound     = errors.New("secret not found")
	ErrAccessDenied = errors.New("access denied") // nuh, uh, uh!
)

Types

type Envelope

type Envelope struct {
	ID         ID
	Value      []byte    `json:",omitzero"`
	Provider   string    `json:",omitzero"`
	Version    string    `json:",omitzero"`
	Error      string    `json:",omitzero"`
	CreatedAt  time.Time `json:",omitzero"`
	ResolvedAt time.Time `json:",omitzero"`
	ExpiresAt  time.Time `json:",omitzero"`
}

type ID

type ID string

ID contains a secret identifier. Valid secret identifiers must match the format [A-Za-z0-9.-]+(/[A-Za-z0-9.-]+)+?.

For storage, we don't really differentiate much about the ID format but by convention we do simple, slash-separated management, providing a groupable access control system for management across plugins.

func ParseID

func ParseID(s string) (ID, error)

func (ID) Match

func (id ID) Match(pattern string) bool

Match checks if a given identifier matches the pattern. - "*" matches a single component - "**" matches zero or more components - "/" is the separator

func (ID) String

func (id ID) String() string

func (ID) Valid

func (id ID) Valid() error

Valid returns nil if the identifier if considered valid.

type Request

type Request struct {
	ID ID `json:",omitzero"`

	// Provider can be optionally specified to restrict the resolver
	// to a particular provider stack.
	Provider    string `json:",omitzero"`
	ClientID    string `json:",omitzero"`
	RequestedAt time.Time
}

type Resolver

type Resolver interface {
	GetSecret(request Request) (Envelope, error)
}

type Restricted

type Restricted struct {
	// contains filtered or unexported fields
}

Restricted controls access to a set of secrets.

By default, it allows access to no secrets but can be modified safely from other threads.

func NewRestricted

func NewRestricted(resolver Resolver, allowed ...ID) *Restricted

func (*Restricted) Allow

func (r *Restricted) Allow(allowed ...ID)

func (*Restricted) GetSecret

func (r *Restricted) GetSecret(request Request) (Envelope, error)