cache

Documentation

Index

• Constants
• func ZeroizeString(s *string)
• type Cache
  • func New(ttl time.Duration) *Cache
  • func (c *Cache) CleanupExpired() int
  • func (c *Cache) Clear() int
  • func (c *Cache) DecInFlight()
  • func (c *Cache) Get(key string) (string, bool, time.Time, time.Time)
  • func (c *Cache) IncHit()
  • func (c *Cache) IncInFlight()
  • func (c *Cache) IncMiss()
  • func (c *Cache) Invalidate(ref string) int
  • func (c *Cache) Persist(s *Store, maxIdle time.Duration, onErr func(error)) (int, error)
  • func (c *Cache) Refresh(key, val string) bool
  • func (c *Cache) Set(key, val string)
  • func (c *Cache) Snapshot() []Record
  • func (c *Cache) Stats() (size int, hits, misses int64, inflight int)
  • func (c *Cache) TTL() time.Duration
• type Record
• type Store
  • func NewStore(path string, key []byte) (*Store, error)
  • func OpenStore() (*Store, error)
  • func (s *Store) Delete() error
  • func (s *Store) Load() ([]Record, time.Time, error)
  • func (s *Store) Path() string
  • func (s *Store) Save(records []Record) error

Constants

const DefaultTTL = 4 * time.Hour

DefaultTTL is how long a fetched secret stays hot. It is deliberately long: the whole point of the daemon is that one 1Password unlock covers a work block instead of prompting again every couple of minutes.

Functions

func ZeroizeString

func ZeroizeString(s *string)

Best-effort zeroize when replacing strings (Go GC caveats apply).

Types

type Cache

type Cache struct {
	// contains filtered or unexported fields
}

func New

func New(ttl time.Duration) *Cache

func (*Cache) CleanupExpired

func (c *Cache) CleanupExpired() int

CleanupExpired removes expired entries from the cache

func (*Cache) Clear

func (c *Cache) Clear() int

Clear removes all entries from the cache with secure zeroization

func (*Cache) DecInFlight

func (c *Cache) DecInFlight()

func (*Cache) Get

func (c *Cache) Get(key string) (string, bool, time.Time, time.Time)

func (*Cache) IncHit

func (c *Cache) IncHit()

func (*Cache) IncInFlight

func (c *Cache) IncInFlight()

func (*Cache) IncMiss

func (c *Cache) IncMiss()

func (*Cache) Invalidate

func (c *Cache) Invalidate(ref string) int

Invalidate drops every cached entry for a ref, across all flag variants (the cache key is "ref" or "ref|flags:..."), and returns how many it removed.

Rotating a secret out of band leaves the daemon serving the old value until its TTL runs out; this is how a writer tells it otherwise.

func (*Cache) Persist

func (c *Cache) Persist(s *Store, maxIdle time.Duration, onErr func(error)) (int, error)

Persist attaches an encrypted store and restores whatever unexpired entries it holds, so the daemon starts warm. Returns the number of entries restored.

maxIdle, when non-zero, discards the whole file if it has sat untouched for longer than the session idle timeout. Without that, restarting the daemon would reset the idle clock and keep serving a cache that should have been wiped by an idle lock.

func (*Cache) Refresh

func (c *Cache) Refresh(key, val string) bool

Refresh replaces the value of an existing entry, deliberately keeping its original expiry. Revalidation must be able to correct a rotated secret without extending how long it stays cached, or a periodically-refreshed entry would never age out and the TTL would stop meaning anything.

Returns false if the entry is gone or already expired, so a racing eviction cannot be resurrected.

func (*Cache) Set

func (c *Cache) Set(key, val string)

func (*Cache) Snapshot

func (c *Cache) Snapshot() []Record

Snapshot returns the live entries. Used by the revalidator to walk what is cached without holding the lock across slow backend calls.

func (*Cache) Stats

func (c *Cache) Stats() (size int, hits, misses int64, inflight int)

func (*Cache) TTL

func (c *Cache) TTL() time.Duration

type Record

type Record struct {
	Key    string    `json:"k"`
	Value  string    `json:"v"`
	Exp    time.Time `json:"e"`
	Cached time.Time `json:"c"`
}

Record is one persisted cache entry.

type Store

type Store struct {
	// contains filtered or unexported fields
}

Store persists cache entries to disk as a single AES-256-GCM blob. The key lives in the OS keyring, never on disk beside the ciphertext.

func NewStore

func NewStore(path string, key []byte) (*Store, error)

NewStore builds a store around an explicit key. The key must be 32 bytes.

func OpenStore

func OpenStore() (*Store, error)

OpenStore returns a store in the XDG data dir, keyed by a secret from the OS keyring (generated on first use). It fails when no keyring is available: stashing the key next to the ciphertext would make the encryption pointless.

func (*Store) Delete

func (s *Store) Delete() error

Delete removes the store file. A missing file is a no-op.

func (*Store) Load

func (s *Store) Load() ([]Record, time.Time, error)

Load returns the records on disk and when they were written. A missing file is not an error; a file that fails to decrypt is, so a tampered or key-mismatched store is never silently treated as an empty cache.

func (*Store) Path

func (s *Store) Path() string

Path reports where the encrypted cache lives.

func (*Store) Save

func (s *Store) Save(records []Record) error

Save encrypts records and atomically replaces the store file. An empty record set removes the file rather than leaving a decryptable empty blob behind.