secrets

Documentation

Overview

Package secrets contains the secrets management logic for ToolHive.

Index

• Constants
• Variables
• func GetSecretsPassword() ([]byte, error)
• func ResetKeyringSecret() error
• func SecretParametersToCLI(params []SecretParameter) []string
• type EncryptedManager
  • func (e *EncryptedManager) Cleanup() error
  • func (e *EncryptedManager) DeleteSecret(name string) error
  • func (e *EncryptedManager) GetSecret(name string) (string, error)
  • func (e *EncryptedManager) ListSecrets() ([]string, error)
  • func (e *EncryptedManager) SetSecret(name, value string) error
• type OPSecretsService
• type OnePasswordManager
  • func NewOnePasswordManagerWithService(secretsService OPSecretsService) *OnePasswordManager
  • func (*OnePasswordManager) Cleanup() error
  • func (*OnePasswordManager) DeleteSecret(_ string) error
  • func (opm *OnePasswordManager) GetSecret(path string) (string, error)
  • func (*OnePasswordManager) ListSecrets() ([]string, error)
  • func (*OnePasswordManager) SetSecret(_, _ string) error
• type Provider
  • func CreateSecretProvider(managerType ProviderType) (Provider, error)
  • func NewEncryptedManager(filePath string, key []byte) (Provider, error)
  • func NewOnePasswordManager() (Provider, error)
• type ProviderType
• type SecretParameter
  • func ParseSecretParameter(parameter string) (SecretParameter, error)

Constants

const (
	// PasswordEnvVar is the environment variable used to specify the password for encrypting and decrypting secrets.
	PasswordEnvVar = "TOOLHIVE_SECRETS_PASSWORD"
)

Variables

var ErrUnknownManagerType = errors.New("unknown secret manager type")

ErrUnknownManagerType is returned when an invalid value for ProviderType is specified.

Functions

func GetSecretsPassword

func GetSecretsPassword() ([]byte, error)

GetSecretsPassword returns the password to use for encrypting and decrypting secrets. It will attempt to retrieve it from the environment variable TOOLHIVE_SECRETS_PASSWORD. If the environment variable is not set, it will prompt the user to enter a password.

func ResetKeyringSecret

func ResetKeyringSecret() error

ResetKeyringSecret clears out the secret from the keystore (if present).

func SecretParametersToCLI

func SecretParametersToCLI(params []SecretParameter) []string

SecretParametersToCLI does the reverse of `ParseSecretParameter` TODO: It may be possible to get rid of this with refactoring.

Types

type EncryptedManager

type EncryptedManager struct {
	// contains filtered or unexported fields
}

EncryptedManager stores secrets in an encrypted file. AES-256-GCM is used for encryption.

func (*EncryptedManager) Cleanup

func (e *EncryptedManager) Cleanup() error

Cleanup removes all secrets managed by this manager.

func (*EncryptedManager) DeleteSecret

func (e *EncryptedManager) DeleteSecret(name string) error

DeleteSecret removes a secret from the secret store.

func (*EncryptedManager) GetSecret

func (e *EncryptedManager) GetSecret(name string) (string, error)

GetSecret retrieves a secret from the secret store.

func (*EncryptedManager) ListSecrets

func (e *EncryptedManager) ListSecrets() ([]string, error)

ListSecrets returns a list of all secret names stored in the manager.

func (*EncryptedManager) SetSecret

func (e *EncryptedManager) SetSecret(name, value string) error

SetSecret stores a secret in the secret store.

type OPSecretsService

type OPSecretsService interface {
	Resolve(ctx context.Context, secretReference string) (string, error)
}

OPSecretsService defines the interface for the 1Password Secrets service

type OnePasswordManager

type OnePasswordManager struct {
	// contains filtered or unexported fields
}

OnePasswordManager manages secrets in 1Password.

func NewOnePasswordManagerWithService

func NewOnePasswordManagerWithService(secretsService OPSecretsService) *OnePasswordManager

NewOnePasswordManagerWithService creates an instance of OnePasswordManager with a provided secrets service. This function is primarily intended for testing purposes.

func (*OnePasswordManager) Cleanup

func (*OnePasswordManager) Cleanup() error

Cleanup is not needed for 1Password.

func (*OnePasswordManager) DeleteSecret

func (*OnePasswordManager) DeleteSecret(_ string) error

DeleteSecret is not supported for 1Password unless there is demand for it.

func (*OnePasswordManager) GetSecret

func (opm *OnePasswordManager) GetSecret(path string) (string, error)

GetSecret retrieves a secret from 1Password.

func (*OnePasswordManager) ListSecrets

func (*OnePasswordManager) ListSecrets() ([]string, error)

ListSecrets is not supported for 1Password unless there is demand for it.

func (*OnePasswordManager) SetSecret

func (*OnePasswordManager) SetSecret(_, _ string) error

SetSecret is not supported for 1Password unless there is demand for it.

type Provider

type Provider interface {
	GetSecret(name string) (string, error)
	SetSecret(name, value string) error
	DeleteSecret(name string) error
	ListSecrets() ([]string, error)
	Cleanup() error
}

Provider describes a type which can manage secrets.

func CreateSecretProvider

func CreateSecretProvider(managerType ProviderType) (Provider, error)

CreateSecretProvider creates the specified type of secrets provider.

func NewEncryptedManager

func NewEncryptedManager(filePath string, key []byte) (Provider, error)

NewEncryptedManager creates an instance of EncryptedManager.

func NewOnePasswordManager

func NewOnePasswordManager() (Provider, error)

NewOnePasswordManager creates an instance of OnePasswordManager.

type ProviderType

type ProviderType string

ProviderType represents an enum of the types of available secrets providers.

const (
	// EncryptedType represents the encrypted secret provider.
	EncryptedType ProviderType = "encrypted"

	// OnePasswordType represents the 1Password secret provider.
	OnePasswordType ProviderType = "1password"
)

type SecretParameter

type SecretParameter struct {
	Name   string `json:"name"`
	Target string `json:"target"`
}

SecretParameter represents a parsed `--secret` parameter.

func ParseSecretParameter

func ParseSecretParameter(parameter string) (SecretParameter, error)

ParseSecretParameter creates an instance of SecretParameter from a string. Expected format: `<Name>,target=<Target>`.