secret

Documentation

Index

• func ContainsRef(s string) bool
• func Hash(s string) string
• type Resolver
  • func NewResolver() *Resolver
  • func (r *Resolver) Resolve(s string) (string, error)
  • func (r *Resolver) ResolveJSON(raw string) (any, error)

Functions

func ContainsRef

func ContainsRef(s string) bool

ContainsRef reports whether s contains a ${...} reference.

func Hash

func Hash(s string) string

Hash returns the lowercase hex sha256 of s. It is used to record a non-secret fingerprint of a resolved value in state, so idempotency and drift can be checked without storing or printing the plaintext.

Types

type Resolver

type Resolver struct {
	Getenv func(string) string
	Pass   func(path string) (string, error)
	// contains filtered or unexported fields
}

Resolver replaces ${...} references with values from pass or the environment. Resolved tokens are memoized for the Resolver's lifetime (one `pass` invocation per distinct token per run; the CLI is single-threaded, so a plain map suffices).

func NewResolver

func NewResolver() *Resolver

NewResolver returns a Resolver backed by os.Getenv and `pass show`.

func (*Resolver) Resolve

func (r *Resolver) Resolve(s string) (string, error)

Resolve replaces every ${...} token in s with its resolved value.

func (*Resolver) ResolveJSON

func (r *Resolver) ResolveJSON(raw string) (any, error)

ResolveJSON parses a JSON-encoded value and resolves ${...} tokens in every string leaf, returning the resolved Go value. Resolving on parsed leaves (not on the serialized text) means a secret containing quotes, backslashes, or newlines can never corrupt the document or inject sibling keys.