keychain

Documentation

Overview

Package keychain provides cross-platform secure storage for secrets. macOS uses the system Keychain; Linux uses AES-256-GCM encrypted files; Windows uses DPAPI + registry.

Index

• Constants
• func Get(service, account string) string
• func Remove(service, account string) error
• func Set(service, account, data string) error
• func StorageDir(service string) string
• type KeychainAccess
  • func Default() KeychainAccess

Constants

const (
	// LarkCliService is the unified keychain service name for all secrets
	// (both AppSecret and UAT). Entries are distinguished by account key format:
	//   - AppSecret: "appsecret:<appId>"
	//   - UAT:       "<appId>:<userOpenId>"
	LarkCliService = "lark-cli"
)

Functions

func Get

func Get(service, account string) string

Get retrieves a value from the keychain. Returns empty string if the entry does not exist.

func Remove

func Remove(service, account string) error

Remove deletes an entry from the keychain. No error if not found.

func Set

func Set(service, account, data string) error

Set stores a value in the keychain, overwriting any existing entry.

func StorageDir

func StorageDir(service string) string

StorageDir returns the storage directory for a given service name. Each service gets its own directory for physical isolation.

Types

type KeychainAccess

type KeychainAccess interface {
	Get(service, account string) (string, error)
	Set(service, account, value string) error
	Remove(service, account string) error
}

KeychainAccess abstracts keychain Get/Set/Remove for dependency injection. Used by AppSecret operations (ForStorage, ResolveSecretInput, RemoveSecretStore). UAT operations in token_store.go use the package-level Get/Set/Remove directly.

func Default

func Default() KeychainAccess

Default returns a KeychainAccess backed by the real platform keychain.