secrets

Documentation

Index

• func WithSkillAuthProfilePolicy(ctx context.Context, allowed []string, enforce bool) context.Context
• type Allow
• type AuthProfile
  • func (p AuthProfile) DenyPrivateIPs() bool
  • func (p AuthProfile) IsURLAllowed(u *url.URL, method string) error
  • func (p *AuthProfile) Validate() error
• type Config
• type Credential
• type EnvResolver
  • func (r *EnvResolver) Resolve(ctx context.Context, secretRef string) (string, error)
• type Inject
• type ProfileStore
  • func NewProfileStore(profiles map[string]AuthProfile) *ProfileStore
  • func (s *ProfileStore) Get(id string) (AuthProfile, bool)
• type Resolver
• type SkillAuthProfilePolicy
  • func SkillAuthProfilePolicyFromContext(ctx context.Context) (SkillAuthProfilePolicy, bool)
• type ToolBinding
  • func (b ToolBinding) Validate(toolName string) error
• type URLPrefixRule

Functions

func WithSkillAuthProfilePolicy

func WithSkillAuthProfilePolicy(ctx context.Context, allowed []string, enforce bool) context.Context

Types

type Allow

type Allow struct {
	// URLPrefixes is the primary allowlist syntax: each entry is a URL prefix like:
	//   https://api.example.com/v1/resource
	//
	// The actual request must match at least one prefix by:
	// - scheme
	// - hostname
	// - effective port (explicit or default 80/443)
	// - path prefix (segment-safe)
	URLPrefixes []string `mapstructure:"url_prefixes"`

	// Methods is the allowed HTTP method set (GET/POST/PUT/DELETE).
	Methods []string `mapstructure:"methods"`

	FollowRedirects bool  `mapstructure:"follow_redirects"`
	AllowProxy      bool  `mapstructure:"allow_proxy"`
	DenyPrivateIPs  *bool `mapstructure:"deny_private_ips"`

	ParsedURLPrefixes []URLPrefixRule `mapstructure:"-"`
}

type AuthProfile

type AuthProfile struct {
	ID         string                 `mapstructure:"-"`
	Credential Credential             `mapstructure:"credential"`
	Allow      Allow                  `mapstructure:"allow"`
	Bindings   map[string]ToolBinding `mapstructure:"bindings"`
}

func (AuthProfile) DenyPrivateIPs

func (p AuthProfile) DenyPrivateIPs() bool

func (AuthProfile) IsURLAllowed

func (p AuthProfile) IsURLAllowed(u *url.URL, method string) error

func (*AuthProfile) Validate

func (p *AuthProfile) Validate() error

type Config

type Config struct {
	Enabled       bool              `mapstructure:"enabled"`
	AllowProfiles []string          `mapstructure:"allow_profiles"`
	Aliases       map[string]string `mapstructure:"aliases"`
}

type Credential

type Credential struct {
	Kind      string `mapstructure:"kind"`
	SecretRef string `mapstructure:"secret_ref"`
}

type EnvResolver

type EnvResolver struct {
	Aliases map[string]string
}

EnvResolver resolves secrets from environment variables.

The MVP behavior is fail-closed: - missing/unset env var => error - empty value => error

func (*EnvResolver) Resolve

func (r *EnvResolver) Resolve(ctx context.Context, secretRef string) (string, error)

type Inject

type Inject struct {
	Location string `mapstructure:"location"`
	Name     string `mapstructure:"name"`
	Format   string `mapstructure:"format"`
}

type ProfileStore

type ProfileStore struct {
	// contains filtered or unexported fields
}

func NewProfileStore

func NewProfileStore(profiles map[string]AuthProfile) *ProfileStore

func (*ProfileStore) Get

func (s *ProfileStore) Get(id string) (AuthProfile, bool)

type Resolver

type Resolver interface {
	Resolve(ctx context.Context, secretRef string) (string, error)
}

type SkillAuthProfilePolicy

type SkillAuthProfilePolicy struct {
	Allowed map[string]bool
	Enforce bool
}

func SkillAuthProfilePolicyFromContext

func SkillAuthProfilePolicyFromContext(ctx context.Context) (SkillAuthProfilePolicy, bool)

type ToolBinding

type ToolBinding struct {
	Inject              Inject   `mapstructure:"inject"`
	AllowUserHeaders    bool     `mapstructure:"allow_user_headers"`
	UserHeaderAllowlist []string `mapstructure:"user_header_allowlist"`
}

func (ToolBinding) Validate

func (b ToolBinding) Validate(toolName string) error

type URLPrefixRule

type URLPrefixRule struct {
	Scheme     string
	Host       string
	Port       int
	PathPrefix string
}