secrets

Documentation

Index

• Variables
• func LoadRef(ref string) ([]byte, error)
• func ValidateRef(ref string) error
• type Set
  • func (s Set) SigningAt(t time.Time) (Version, bool)
  • func (s Set) ValidAt(t time.Time) []Version
  • func (s Set) Validate() error
• type Version
  • func (v Version) IsValidAt(t time.Time) bool

Variables

var (
	ErrInvalidSecret = errors.New("invalid secret")
)

var ErrSecretRef = errors.New("invalid secret reference")

Functions

func LoadRef

func LoadRef(ref string) ([]byte, error)

LoadRef loads a secret value from a reference string.

Supported forms: - env:NAME - file:/path/to/secret - raw:literal-value (intended for tests/dev only) - vault:secret/path[#field] (reads from Vault HTTP API using env-configured address/token)

func ValidateRef

func ValidateRef(ref string) error

ValidateRef validates a secret reference format without loading its value.

Supported forms: - env:NAME - file:/path/to/secret - raw:literal-value - vault:secret/path[#field]

Types

type Set

type Set struct {
	Versions []Version
}

func (Set) SigningAt

func (s Set) SigningAt(t time.Time) (Version, bool)

SigningAt returns the newest (most recent ValidFrom) secret that is valid at time t.

func (Set) ValidAt

func (s Set) ValidAt(t time.Time) []Version

ValidAt returns all secrets valid at time t, ordered by ValidFrom descending.

func (Set) Validate

func (s Set) Validate() error

type Version

type Version struct {
	ID         string
	Value      []byte
	ValidFrom  time.Time
	ValidUntil time.Time
}

Version is a single secret value with a validity window.

Semantics: - ValidFrom is inclusive. - ValidUntil is exclusive; a zero value means "no end".

func (Version) IsValidAt

func (v Version) IsValidAt(t time.Time) bool