Documentation
¶
Index ¶
- Constants
- Variables
- func DefaultBulkDecrypt(ctx context.Context, decrypter Decrypter, ciphertexts []string) (map[string]string, error)
- type Crypter
- type Decrypter
- type Encrypter
- type Key
- type KeyArray
- type Map
- func (m Map) AsDecryptedPropertyMap(ctx context.Context, decrypter Decrypter) (resource.PropertyMap, error)
- func (m Map) Copy(decrypter Decrypter, encrypter Encrypter) (Map, error)
- func (m Map) Decrypt(decrypter Decrypter) (map[Key]string, error)
- func (m Map) Get(k Key, path bool) (_ Value, ok bool, err error)
- func (m Map) HasSecureValue() bool
- func (m Map) MarshalJSON() ([]byte, error)
- func (m Map) MarshalYAML() (interface{}, error)
- func (m Map) Remove(k Key, path bool) error
- func (m Map) SecureKeys() []Key
- func (m Map) Set(k Key, v Value, path bool) error
- func (m *Map) UnmarshalJSON(b []byte) error
- func (m *Map) UnmarshalYAML(unmarshal func(interface{}) error) error
- type Plaintext
- func (c Plaintext) Encrypt(ctx context.Context, encrypter Encrypter) (Value, error)
- func (c Plaintext) GoValue() any
- func (c Plaintext) MarshalJSON() ([]byte, error)
- func (c Plaintext) MarshalYAML() (any, error)
- func (c Plaintext) PropertyValue() resource.PropertyValue
- func (c Plaintext) Secure() bool
- func (c *Plaintext) UnmarshalJSON(b []byte) error
- func (c *Plaintext) UnmarshalYAML(unmarshal func(any) error) error
- func (c Plaintext) Value() any
- type PlaintextType
- type Value
- func (c Value) Copy(decrypter Decrypter, encrypter Encrypter) (Value, error)
- func (c Value) Decrypt(ctx context.Context, decrypter Decrypter) (Plaintext, error)
- func (c Value) MarshalJSON() ([]byte, error)
- func (c Value) MarshalYAML() (interface{}, error)
- func (c Value) Merge(base Value) (Value, error)
- func (c Value) Object() bool
- func (c Value) Secure() bool
- func (c Value) SecureValues(decrypter Decrypter) ([]string, error)
- func (c Value) ToObject() (any, error)
- func (c *Value) UnmarshalJSON(b []byte) (err error)
- func (c *Value) UnmarshalYAML(unmarshal func(interface{}) error) (err error)
- func (c Value) Value(decrypter Decrypter) (string, error)
Constants ¶
const SymmetricCrypterKeyBytes = 32
SymmetricCrypterKeyBytes is the required key size in bytes.
Variables ¶
var ( NopDecrypter Decrypter = nopCrypter{} NopEncrypter Encrypter = nopCrypter{} )
Functions ¶
func DefaultBulkDecrypt ¶
func DefaultBulkDecrypt(ctx context.Context, decrypter Decrypter, ciphertexts []string, ) (map[string]string, error)
DefaultBulkDecrypt decrypts a list of ciphertexts. Each ciphertext is decrypted individually. The returned map maps from ciphertext to plaintext. This should only be used by implementers of Decrypter to implement their BulkDecrypt method in cases where they can't do more efficient than just individual decryptions.
Types ¶
type Crypter ¶
Crypter can both encrypt and decrypt values.
var Base64Crypter Crypter = &base64Crypter{}
Base64Crypter is a Crypter that "encrypts" by encoding the string to base64.
var BlindingCrypter Crypter = blindingCrypter{}
BlindingCrypter returns a Crypter that instead of decrypting or encrypting data, just returns "[secret]", it can be used when you want to display configuration information to a user but don't want to prompt for a password so secrets will not be decrypted or encrypted.
func NewPanicCrypter ¶
func NewPanicCrypter() Crypter
NewPanicCrypter returns a new config crypter that will panic if used.
func NewSymmetricCrypter ¶
NewSymmetricCrypter creates a crypter that encrypts and decrypts values using AES-256-GCM. The nonce is stored with the value itself as a pair of base64 values separated by a colon and a version tag `v1` is prepended.
func NewSymmetricCrypterFromPassphrase ¶
NewSymmetricCrypterFromPassphrase uses a passphrase and salt to generate a key, and then returns a crypter using it.
type Decrypter ¶
type Decrypter interface {
DecryptValue(ctx context.Context, ciphertext string) (string, error)
// BulkDecrypt supports bulk decryption of secrets.
BulkDecrypt(ctx context.Context, ciphertexts []string) (map[string]string, error)
}
Decrypter decrypts encrypted ciphertext to its plaintext representation.
func NewBlindingDecrypter ¶
func NewBlindingDecrypter() Decrypter
NewBlindingDecrypter returns a blinding decrypter.
type Key ¶
type Key struct {
// contains filtered or unexported fields
}
func MustMakeKey ¶
MustMakeKey constructs a config.Key for a given namespace and name. The namespace may not contain a `:`
func MustParseKey ¶
MustParseKey creates a config.Key from a string. The string must be of the form `<namespace>:<name>`.
func (Key) MarshalJSON ¶
func (Key) MarshalYAML ¶
func (*Key) UnmarshalJSON ¶
func (*Key) UnmarshalYAML ¶
type Map ¶
Map is a bag of config stored in the settings file.
func (Map) AsDecryptedPropertyMap ¶
func (m Map) AsDecryptedPropertyMap(ctx context.Context, decrypter Decrypter) (resource.PropertyMap, error)
AsDecryptedPropertyMap returns the config as a property map, with secret values decrypted.
func (Map) Decrypt ¶
Decrypt returns the configuration as a map from module member to decrypted value.
func (Map) Get ¶
Get gets the value for a given key. If path is true, the key's name portion is treated as a path.
func (Map) HasSecureValue ¶
HasSecureValue returns true if the config map contains a secure (encrypted) value.
func (Map) MarshalJSON ¶
func (Map) MarshalYAML ¶
func (Map) Remove ¶
Remove removes the value for a given key. If path is true, the key's name portion is treated as a path.
func (Map) SecureKeys ¶
SecureKeys returns a list of keys that have secure values.
func (Map) Set ¶
Set sets the value for a given key. If path is true, the key's name portion is treated as a path.
func (*Map) UnmarshalJSON ¶
func (*Map) UnmarshalYAML ¶
type Plaintext ¶
type Plaintext struct {
// contains filtered or unexported fields
}
Plaintext is a single plaintext config value.
func NewPlaintext ¶
func NewPlaintext[T PlaintextType](v T) Plaintext
NewPlaintext creates a new plaintext config value.
func NewSecurePlaintext ¶
NewSecurePlaintext creates a new secure string with the given plaintext.
func (Plaintext) Encrypt ¶
Encrypt converts the receiver as a Value. All secure strings in the result are encrypted using encrypter.
func (Plaintext) GoValue ¶
GoValue returns the inner plaintext value as a plain Go value:
- secure strings are mapped to their plaintext
- []Plaintext values are mapped to []any values
- map[string]Plaintext values are mapped to map[string]any values
func (Plaintext) MarshalJSON ¶
func (Plaintext) MarshalYAML ¶
func (Plaintext) PropertyValue ¶
func (c Plaintext) PropertyValue() resource.PropertyValue
func (Plaintext) Secure ¶
Secure returns true if the receiver is a secure string or a composite value that contains a secure string.
func (*Plaintext) UnmarshalJSON ¶
func (*Plaintext) UnmarshalYAML ¶
type PlaintextType ¶
type PlaintextType interface {
bool | int64 | float64 | string | []Plaintext | map[string]Plaintext
}
PlaintextType describes the allowed types for a Plaintext.
type Value ¶
type Value struct {
// contains filtered or unexported fields
}
Value is a single config value.
func NewObjectValue ¶
func NewSecureObjectValue ¶
func NewSecureValue ¶
func (Value) MarshalJSON ¶
func (Value) MarshalYAML ¶
func (Value) ToObject ¶
ToObject returns the string value (if not an object), or the unmarshalled JSON object (if an object).
Source Files