processor

Documentation

Index

• func IsLeafValue(v interface{}) bool
• type EnvFile
  • func ParseEnvFile(content []byte) (*EnvFile, error)
  • func (e *EnvFile) Get(key string) (string, bool)
  • func (e *EnvFile) Keys() []string
  • func (e *EnvFile) Marshal() []byte
  • func (e *EnvFile) Set(key, value string) bool
  • func (e *EnvFile) ToMap() map[string]string
• type EnvLine
• type EnvLineType
• type FileFormat
  • func DetectFormat(filePath string, override ...string) FileFormat
• type IdentityLoader
• type MatchResult
• type Matcher
  • func NewMatcher(include, exclude []config.KeyRule) (*Matcher, error)
  • func (m *Matcher) FindMatchingKeys(data interface{}) []MatchResult
  • func (m *Matcher) ShouldEncrypt(keyName string, path []string) bool
• type Processor
  • func NewProcessor(cfg *config.Config, identityLoader IdentityLoader) (*Processor, error)
  • func (p *Processor) CheckFile(filePath string, formatOverride ...string) ([]MatchResult, error)
  • func (p *Processor) ComputeMAC(content []byte, fileFormat FileFormat) ([]byte, error)
  • func (p *Processor) Config() *config.Config
  • func (p *Processor) EncryptMAC(hash []byte) (string, error)
  • func (p *Processor) HasEncryptedValues(content []byte, filePath string, formatOverride ...string) bool
  • func (p *Processor) HasUnencryptedValues(content []byte, filePath string, formatOverride ...string) bool
  • func (p *Processor) MatchFile(filePath string, formatOverride ...string) ([]MatchResult, error)
  • func (p *Processor) ProcessContent(content []byte, filePath string, encrypt bool, fileFormat FileFormat) ([]byte, bool, error)
  • func (p *Processor) ProcessFile(filePath string, encrypt bool, formatOverride ...string) ([]byte, bool, error)
  • func (p *Processor) SaveEncryptedSecrets() error
  • func (p *Processor) SetupDecryption(identities []age.Identity) (string, error)
  • func (p *Processor) SetupEncryption() error
  • func (p *Processor) SetupEncryptionWithIdentities(identities []age.Identity) error
  • func (p *Processor) UpdateMAC(filePath string, content []byte, formatOverride ...string) error
  • func (p *Processor) VerifyMAC(filePath string, content []byte, formatOverride ...string) error
  • func (p *Processor) WriteFile(filePath string, content []byte) error

Functions

func IsLeafValue

func IsLeafValue(v interface{}) bool

IsLeafValue checks if a value is a leaf (not a map or slice)

Types

type EnvFile

type EnvFile struct {
	Lines []EnvLine
}

EnvFile represents a parsed .env file preserving structure

func ParseEnvFile

func ParseEnvFile(content []byte) (*EnvFile, error)

ParseEnvFile parses .env file content preserving structure

func (*EnvFile) Get

func (e *EnvFile) Get(key string) (string, bool)

Get returns the value for a key, or empty string if not found

func (*EnvFile) Keys

func (e *EnvFile) Keys() []string

Keys returns all key names in the file (in order)

func (*EnvFile) Marshal

func (e *EnvFile) Marshal() []byte

Marshal converts the EnvFile back to bytes, preserving structure

func (*EnvFile) Set

func (e *EnvFile) Set(key, value string) bool

Set updates the value for a key

func (*EnvFile) ToMap

func (e *EnvFile) ToMap() map[string]string

ToMap returns a map of all key-value pairs

type EnvLine

type EnvLine struct {
	Type    EnvLineType
	Key     string // For key-value pairs
	Value   string // Raw value after = (may include quotes)
	Raw     string // Original line content
	Comment string // Inline comment (not encrypted)
	Export  bool   // Whether line had "export " prefix
}

EnvLine represents a single line in an .env file

type EnvLineType

type EnvLineType int

EnvLineType represents the type of line in an .env file

const (
	EnvLineBlank EnvLineType = iota
	EnvLineComment
	EnvLineKeyValue
)

type FileFormat

type FileFormat int

FileFormat represents the format of a config file

const (
	FormatYAML FileFormat = iota
	FormatJSON
	FormatEnv
	FormatFull // Full file encryption (binary or text)
)

func DetectFormat

func DetectFormat(filePath string, override ...string) FileFormat

DetectFormat determines the file format from extension and optional override The override parameter can be "full", "yaml", "json", or "env" to force a specific format

type IdentityLoader

type IdentityLoader func() ([]age.Identity, error)

IdentityLoader is a function that loads age identities

type MatchResult

type MatchResult struct {
	Path      []string // Full path to the key
	KeyName   string   // Name of the key
	Value     interface{}
	Encrypted bool // Whether the value is already encrypted
}

MatchResult represents the result of checking a value for encryption

type Matcher

type Matcher struct {
	// contains filtered or unexported fields
}

Matcher handles key matching logic for encryption

func NewMatcher

func NewMatcher(include, exclude []config.KeyRule) (*Matcher, error)

NewMatcher creates a new Matcher from include and exclude rules

func (*Matcher) FindMatchingKeys

func (m *Matcher) FindMatchingKeys(data interface{}) []MatchResult

FindMatchingKeys traverses a data structure and finds all keys that should be encrypted

func (*Matcher) ShouldEncrypt

func (m *Matcher) ShouldEncrypt(keyName string, path []string) bool

ShouldEncrypt checks if a key at the given path should be encrypted keyName is the name of the key being checked path is the full path to the key (e.g., ["db", "connection", "password"])

type Processor

type Processor struct {
	// contains filtered or unexported fields
}

Processor handles encryption/decryption of config files

func NewProcessor

func NewProcessor(cfg *config.Config, identityLoader IdentityLoader) (*Processor, error)

NewProcessor creates a new Processor

func (*Processor) CheckFile

func (p *Processor) CheckFile(filePath string, formatOverride ...string) ([]MatchResult, error)

CheckFile checks a file for unencrypted keys that should be encrypted The optional formatOverride parameter can be used to force a specific format

func (*Processor) ComputeMAC

func (p *Processor) ComputeMAC(content []byte, fileFormat FileFormat) ([]byte, error)

ComputeMAC computes the MAC (SHA256 hash of all encrypted values) for a file

func (*Processor) Config

func (p *Processor) Config() *config.Config

Config returns the processor's config

func (*Processor) EncryptMAC

func (p *Processor) EncryptMAC(hash []byte) (string, error)

EncryptMAC encrypts the MAC hash using AES-GCM

func (*Processor) HasEncryptedValues

func (p *Processor) HasEncryptedValues(content []byte, filePath string, formatOverride ...string) bool

HasEncryptedValues checks if file content contains any encrypted values The optional formatOverride parameter can be used to force a specific format

func (*Processor) HasUnencryptedValues

func (p *Processor) HasUnencryptedValues(content []byte, filePath string, formatOverride ...string) bool

HasUnencryptedValues checks if file content contains any unencrypted values that match encryption rules The optional formatOverride parameter can be used to force a specific format

func (*Processor) MatchFile

func (p *Processor) MatchFile(filePath string, formatOverride ...string) ([]MatchResult, error)

MatchFile returns all keys matching the configured patterns, regardless of encryption state.

func (*Processor) ProcessContent

func (p *Processor) ProcessContent(content []byte, filePath string, encrypt bool, fileFormat FileFormat) ([]byte, bool, error)

ProcessContent processes content with a specific format for encryption or decryption

func (*Processor) ProcessFile

func (p *Processor) ProcessFile(filePath string, encrypt bool, formatOverride ...string) ([]byte, bool, error)

ProcessFile processes a single file for encryption or decryption The optional formatOverride parameter can be used to force a specific format

func (*Processor) SaveEncryptedSecrets

func (p *Processor) SaveEncryptedSecrets() error

SaveEncryptedSecrets encrypts the AES key for all recipients and saves to config

func (*Processor) SetupDecryption

func (p *Processor) SetupDecryption(identities []age.Identity) (string, error)

SetupDecryption prepares the processor for decryption. Returns the public key of the recipient that was used for decryption.

func (*Processor) SetupEncryption

func (p *Processor) SetupEncryption() error

SetupEncryption prepares the processor for encryption

func (*Processor) SetupEncryptionWithIdentities

func (p *Processor) SetupEncryptionWithIdentities(identities []age.Identity) error

SetupEncryptionWithIdentities prepares the processor for encryption with optional identities If identities is nil, it will try to load them from environment/default location

func (*Processor) UpdateMAC

func (p *Processor) UpdateMAC(filePath string, content []byte, formatOverride ...string) error

UpdateMAC computes and stores the MAC for a file The optional formatOverride parameter can be used to force a specific format

func (*Processor) VerifyMAC

func (p *Processor) VerifyMAC(filePath string, content []byte, formatOverride ...string) error

VerifyMAC verifies the MAC for a file The optional formatOverride parameter can be used to force a specific format

func (*Processor) WriteFile

func (p *Processor) WriteFile(filePath string, content []byte) error

WriteFile writes content to a file