secrets

func (*CipherStore) Set(key string, value []byte) error
{
	block, err := aes.NewCipher(c.key)
	if err != nil {
		return err
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return err
	}
	nonce := make([]byte, gcm.NonceSize())
	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
		return err
	}
	ciphertext := gcm.Seal(nil, nonce, value, []byte(key))
	return c.store.Set(key, append(nonce, ciphertext...))
}

func (*CipherStore) Get(key string) ([]byte, error)
{
	data, err := c.store.Get(key)
	if err != nil {
		return nil, err
	}
	block, err := aes.NewCipher(c.key)
	if err != nil {
		return nil, err
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, err
	}
	nonceSize := gcm.NonceSize()
	if len(data) < nonceSize {
		return nil, errors.New("secrets: ciphertext too short")
	}
	plaintext, err := gcm.Open(nil, data[:nonceSize], data[nonceSize:], []byte(key))
	if err != nil {
		return nil, fmt.Errorf("secrets: decrypt failed: %w", err)
	}
	return plaintext, nil
}

func (*FallbackStore) Delete(key string) error
{
	err1 := f.primary.Delete(key)
	if err1 != nil && !errors.Is(err1, ErrNotFound) {
		return err1
	}
	err2 := f.secondary.Delete(key)
	if err2 != nil && !errors.Is(err2, ErrNotFound) {
		return err2
	}
	return nil
}

func (*MemoryStore) Get(key string) ([]byte, error)
{
	s.mu.RLock()
	defer s.mu.RUnlock()

	v, ok := s.m[key]
	if !ok {
		return nil, ErrNotFound
	}

	return append([]byte(nil), v...), nil
}

func (*VaultStore) Set(key string, value []byte) error
{
	if err := v.ready(); err != nil {
		return err
	}
	if len(value) > maxVaultSecretSize {
		return errors.New("secrets: vault value exceeds size limit")
	}
	body := map[string]any{
		"data": map[string]string{
			"value": base64.StdEncoding.EncodeToString(value),
		},
	}
	data, err := json.Marshal(body)
	if err != nil {
		return err
	}
	req, err := v.request(http.MethodPut, key, bytes.NewReader(data))
	if err != nil {
		return err
	}
	resp, err := v.client.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	return vaultStatus(resp, http.StatusOK, http.StatusNoContent)
}

func (*VaultStore) Get(key string) ([]byte, error)
{
	if err := v.ready(); err != nil {
		return nil, err
	}
	req, err := v.request(http.MethodGet, key, nil)
	if err != nil {
		return nil, err
	}
	resp, err := v.client.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()
	if resp.StatusCode == http.StatusNotFound {
		return nil, ErrNotFound
	}
	if err := vaultStatus(resp, http.StatusOK); err != nil {
		return nil, err
	}

	var out struct {
		Data struct {
			Data map[string]string `json:"data"`
		} `json:"data"`
	}
	data, err := io.ReadAll(io.LimitReader(resp.Body, maxVaultResponseSize+1))
	if err != nil {
		return nil, err
	}
	if len(data) > maxVaultResponseSize {
		return nil, errors.New("secrets: vault response exceeds size limit")
	}
	if err := json.Unmarshal(data, &out); err != nil {
		return nil, err
	}
	encoded, ok := out.Data.Data["value"]
	if !ok {
		return nil, ErrNotFound
	}
	value, err := base64.StdEncoding.DecodeString(encoded)
	if err != nil {
		return nil, fmt.Errorf("secrets: vault decode failed: %w", err)
	}
	return value, nil
}

func (*VaultStore) Delete(key string) error
{
	if err := v.ready(); err != nil {
		return err
	}
	req, err := v.request(http.MethodDelete, key, nil)
	if err != nil {
		return err
	}
	resp, err := v.client.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	return vaultStatus(resp, http.StatusOK, http.StatusNoContent, http.StatusNotFound)
}

func (*VaultStore) ready() error
{
	if v.addr == "" || v.token == "" || v.mount == "" || v.client == nil {
		return ErrNotConfigured
	}
	parsed, err := url.Parse(v.addr)
	if err != nil || parsed.Host == "" {
		return ErrNotConfigured
	}
	if parsed.Scheme != "https" && !isLoopbackHTTP(parsed) {
		return ErrInsecureVaultAddress
	}
	return nil
}

func (*VaultStore) request(method, key string, body io.Reader) (*http.Request, error)
{
	escapedKey, err := escapeVaultKey(key)
	if err != nil {
		return nil, err
	}
	u := strings.TrimRight(v.addr, "/") + "/v1/" + url.PathEscape(v.mount) + "/data/" + escapedKey
	req, err := http.NewRequest(method, u, body)
	if err != nil {
		return nil, err
	}
	req.Header.Set("X-Vault-Token", v.token)
	if body != nil {
		req.Header.Set("Content-Type", "application/json")
	}
	return req, nil
}