store

Documentation

Overview

Package store provides swappable backends that can store secrets generated by the encryptor package.

Where suitable, secret stores should return error codes defined in this package.

Stores must use whatever encoding scheme is required to safely store binary data in the backend - i.e. Base64 if the backend only supports text, gobs if it supports binary, etc.

Index

• Variables
• type DB
  • func NewDB(db *sql.DB, opts *DBOpts) (*DB, error)
  • func (s *DB) Delete(name string) error
  • func (s *DB) Get(name string) (*encryptor.EncryptedData, error)
  • func (s *DB) Put(name string, data *encryptor.EncryptedData) error
• type DBOpts
• type Deleter
• type Getter
• type Interface
• type Memory
  • func NewMemory() *Memory
  • func (s *Memory) Delete(name string) error
  • func (s *Memory) Get(name string) (*encryptor.EncryptedData, error)
  • func (s *Memory) Put(name string, data *encryptor.EncryptedData) error
• type Putter
• type Redis
  • func NewRedis(opts *redis.Options) *Redis
  • func (s *Redis) Delete(name string) error
  • func (s *Redis) Get(name string) (*encryptor.EncryptedData, error)
  • func (s *Redis) Put(name string, data *encryptor.EncryptedData) error

Variables

var (
	// ErrNotFound is returned when a secret is not found in the store.
	ErrNotFound = errors.New("store: secret not found")

	// ErrInvalidName is returned when a name isn't supported (or is ridiculous, like "").
	ErrInvalidName = errors.New("store: invalid secret name")

	// ErrAlreadyExists is returned when attempting to Put() a secret with the
	// same name as an existing entry.
	ErrAlreadyExists = errors.New("store: secret already exists")
)

Types

type DB

type DB struct {
	// contains filtered or unexported fields
}

DB stores secrets in a database.

It is expected that the key column has a UNIQUE constraint. Unlike most stores, DB does not return ErrAlreadyExists when attempting to Put() a secret already in the store, as each database driver returns a different error - instead the driver specific error is returned.

func NewDB

func NewDB(db *sql.DB, opts *DBOpts) (*DB, error)

NewDB returns an initalised DB store

func (*DB) Delete

func (s *DB) Delete(name string) error

Delete removes a secret from the database.

func (*DB) Get

func (s *DB) Get(name string) (*encryptor.EncryptedData, error)

Get fetches the secret stored under name.

func (*DB) Put

func (s *DB) Put(name string, data *encryptor.EncryptedData) error

Put encodes data using binary gobs and stores the result in the database using name as the key.

type DBOpts

type DBOpts struct {
	Table string
	Key   string
	Value string
}

DBOpts allows the user to use a different database schema than the defaults.

It is expected that the DBOpts values are from trusted input (free from SQL injection vectors).

type Deleter

type Deleter interface {
	Delete(name string) error
}

Deleter defines the interface for deleting secrets from the back-end store.

type Getter

type Getter interface {
	Get(name string) (*encryptor.EncryptedData, error)
}

Getter defines the interface for fetching secrets from the back-end store.

type Interface

type Interface interface {
	Putter
	Getter
	Deleter
}

Interface combines the Putter, Getter and Deleter interface

type Memory

type Memory struct {
	// contains filtered or unexported fields
}

Memory is an in-memory data store. Contents are not persisted in any way after the process ends.

func NewMemory

func NewMemory() *Memory

NewMemory returns an initalised memory store.

func (*Memory) Delete

func (s *Memory) Delete(name string) error

Delete removes a secret from the memory store.

func (*Memory) Get

func (s *Memory) Get(name string) (*encryptor.EncryptedData, error)

Get fetches the EncryptedData stored under name.

func (*Memory) Put

func (s *Memory) Put(name string, data *encryptor.EncryptedData) error

Put stores data under the given name.

type Putter

type Putter interface {
	Put(name string, data *encryptor.EncryptedData) error
}

Putter defines the interface for storing secrets in a back-end store.

type Redis

type Redis struct {
	Redis redisInterface
}

Redis abstracts storing secrets in a redis backend.

If you're using a cluster of redis servers, you can initalise a Redis struct directly and pass in an initalised Client using redis.NewFailoverClient.

func NewRedis

func NewRedis(opts *redis.Options) *Redis

NewRedis returns an initalised Redis store.

func (*Redis) Delete

func (s *Redis) Delete(name string) error

Delete removes the secret from redis.

func (*Redis) Get

func (s *Redis) Get(name string) (*encryptor.EncryptedData, error)

Get fetches the secret from redis.

func (*Redis) Put

func (s *Redis) Put(name string, data *encryptor.EncryptedData) error

Put stores the given secret in redis, with no expiration set.