secrets

Documentation

Overview

Package secrets provides opaque secret references and redaction helpers.

ShiftLock never becomes a secret manager: values are resolved at use sites and must not appear in logs, diagnostics, or incident bundles.

Index

• Constants
• Variables
• func Redact(s string) string
• func RedactMap(m map[string]string) map[string]string
• type EnvFileResolver
  • func (r EnvFileResolver) Resolve(ref Ref) (Value, error)
• type Ref
  • func ParseRef(s string) (Ref, error)
  • func (r Ref) PathOrName() string
  • func (r Ref) Scheme() string
  • func (r Ref) String() string
• type Resolver
• type RotationLog
  • func NewRotationLog(max int) *RotationLog
  • func (l *RotationLog) Advance(name string, phase RotationPhase, message string) error
  • func (l *RotationLog) Get(name string) (RotationRecord, error)
  • func (l *RotationLog) List() []RotationRecord
  • func (l *RotationLog) Plan(name string, oldRef, newRef Ref, actor string) error
• type RotationPhase
• type RotationRecord
• type Value
  • func (v Value) Bytes() []byte
  • func (v *Value) Clear()
  • func (v Value) GoString() string
  • func (v Value) String() string

Constants

const DefaultMaxRotations = 256

DefaultMaxRotations bounds tracked rotation records.

Variables

var (
	ErrRotationNotFound = errors.New("secrets: rotation not found")
	ErrRotationDup      = errors.New("secrets: duplicate rotation")
	ErrRotationBound    = errors.New("secrets: rotation bound exceeded")
	ErrSecretValue      = errors.New("secrets: secret values must not be recorded")
)

var (
	ErrUnsupportedScheme = errors.New("secrets: unsupported scheme")
	ErrEmptyRef          = errors.New("secrets: empty reference")
	ErrResolveFailed     = errors.New("secrets: resolve failed")
)

Functions

func Redact

func Redact(s string) string

Redact replaces likely secret material in s with [REDACTED].

func RedactMap

func RedactMap(m map[string]string) map[string]string

RedactMap returns a copy with sensitive-looking keys/values redacted.

Types

type EnvFileResolver

type EnvFileResolver struct {
	ReadFile  func(name string) ([]byte, error)
	LookupEnv func(key string) (string, bool)
}

EnvFileResolver resolves env:// and file:// references.

func (EnvFileResolver) Resolve

func (r EnvFileResolver) Resolve(ref Ref) (Value, error)

Resolve implements Resolver.

type Ref

type Ref struct {
	// contains filtered or unexported fields
}

Ref is an opaque secret locator. String() never includes resolved material.

func ParseRef

func ParseRef(s string) (Ref, error)

ParseRef accepts env://NAME or file://path (and file:///absolute).

func (Ref) PathOrName

func (r Ref) PathOrName() string

PathOrName returns the env var name or filesystem path.

func (Ref) Scheme

func (r Ref) Scheme() string

Scheme returns env or file.

func (Ref) String

func (r Ref) String() string

String returns the opaque reference (never the secret).

type Resolver

type Resolver interface {
	Resolve(ref Ref) (Value, error)
}

Resolver resolves opaque refs. Implementations must not log values.

type RotationLog

type RotationLog struct {
	// contains filtered or unexported fields
}

RotationLog records rotation workflow steps by opaque Ref strings.

func NewRotationLog

func NewRotationLog(max int) *RotationLog

NewRotationLog creates an empty rotation log.

func (*RotationLog) Advance

func (l *RotationLog) Advance(name string, phase RotationPhase, message string) error

Advance moves a rotation to the next recorded phase (references only).

func (*RotationLog) Get

func (l *RotationLog) Get(name string) (RotationRecord, error)

Get returns a copy of the rotation record.

func (*RotationLog) List

func (l *RotationLog) List() []RotationRecord

List returns all rotation records (references only).

func (*RotationLog) Plan

func (l *RotationLog) Plan(name string, oldRef, newRef Ref, actor string) error

Plan registers a rotation using opaque references only.

type RotationPhase

type RotationPhase string

RotationPhase is a secret rotation lifecycle stage.

const (
	RotationPlanned    RotationPhase = "planned"
	RotationIssued     RotationPhase = "issued"
	RotationPropagated RotationPhase = "propagated"
	RotationVerified   RotationPhase = "verified"
	RotationRetired    RotationPhase = "retired"
	RotationFailed     RotationPhase = "failed"
)

type RotationRecord

type RotationRecord struct {
	Name      string        `json:"name"`
	OldRef    string        `json:"old_ref"`
	NewRef    string        `json:"new_ref"`
	Phase     RotationPhase `json:"phase"`
	Actor     string        `json:"actor,omitempty"`
	Message   string        `json:"message,omitempty"`
	UpdatedAt time.Time     `json:"updated_at"`
}

RotationRecord tracks secret references only — never values.

type Value

type Value struct {
	// contains filtered or unexported fields
}

Value is a resolved secret. Do not log, fmt, or JSON-encode it.

func (Value) Bytes

func (v Value) Bytes() []byte

Bytes returns a copy of the secret bytes.

func (*Value) Clear

func (v *Value) Clear()

Clear overwrites the backing buffer.

func (Value) GoString

func (v Value) GoString() string

GoString for %#v.

func (Value) String

func (v Value) String() string

String is intentionally unhelpful to reduce accidental logging.