secrets
packageAPI reference for the secrets
package.
Imports
(8)CipherStore
CipherStore wraps a Store and encrypts values at rest.
type CipherStore struct
Methods
Parameters
Returns
func (*CipherStore) Set(key string, value []byte) error
{
block, err := aes.NewCipher(c.key)
if err != nil {
return err
}
gcm, err := cipher.NewGCM(block)
if err != nil {
return err
}
nonce := make([]byte, gcm.NonceSize())
if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
return err
}
ciphertext := gcm.Seal(nil, nonce, value, nil)
return c.store.Set(key, append(nonce, ciphertext...))
}Parameters
Returns
func (*CipherStore) Get(key string) ([]byte, error)
{
data, err := c.store.Get(key)
if err != nil {
return nil, err
}
block, err := aes.NewCipher(c.key)
if err != nil {
return nil, err
}
gcm, err := cipher.NewGCM(block)
if err != nil {
return nil, err
}
nonceSize := gcm.NonceSize()
if len(data) < nonceSize {
return nil, errors.New("secrets: ciphertext too short")
}
plaintext, err := gcm.Open(nil, data[:nonceSize], data[nonceSize:], nil)
if err != nil {
return nil, fmt.Errorf("secrets: decrypt failed: %w", err)
}
return plaintext, nil
}Parameters
Returns
func (*CipherStore) Delete(key string) error
{
return c.store.Delete(key)
}Fields
| Name | Type | Description |
|---|---|---|
| store | Store | |
| key | []byte |
Uses
NewCipherStore
NewCipherStore creates a store that encrypts values with AES-GCM.
Parameters
Returns
func NewCipherStore(store Store, key []byte) (*CipherStore, error)
{
if len(key) != 32 {
return nil, errors.New("secrets: cipher key must be 32 bytes")
}
return &CipherStore{store: store, key: key}, nil
}Uses
PrefixStore
PrefixStore adds a namespace prefix to keys.
type PrefixStore struct
Methods
Parameters
Returns
func (*PrefixStore) Set(key string, value []byte) error
{
return p.store.Set(p.prefix+key, value)
}Parameters
Returns
func (*PrefixStore) Get(key string) ([]byte, error)
{
return p.store.Get(p.prefix + key)
}Parameters
Returns
func (*PrefixStore) Delete(key string) error
{
return p.store.Delete(p.prefix + key)
}Fields
| Name | Type | Description |
|---|---|---|
| store | Store | |
| prefix | string |
Uses
NewPrefixStore
NewPrefixStore wraps a Store and prepends the given prefix to all keys.
Parameters
Returns
func NewPrefixStore(store Store, prefix string) *PrefixStore
{
return &PrefixStore{store: store, prefix: prefix}
}Uses
FallbackStore
FallbackStore tries the primary store first, then falls back to secondary.
type FallbackStore struct
Methods
Parameters
Returns
func (*FallbackStore) Set(key string, value []byte) error
{
err := f.primary.Set(key, value)
if err != nil {
return f.secondary.Set(key, value)
}
return nil
}Parameters
Returns
func (*FallbackStore) Get(key string) ([]byte, error)
{
v, err := f.primary.Get(key)
if err == nil {
return v, nil
}
return f.secondary.Get(key)
}Parameters
Returns
func (*FallbackStore) Delete(key string) error
{
err1 := f.primary.Delete(key)
err2 := f.secondary.Delete(key)
if err1 != nil && err2 != nil {
return err1
}
return nil
}NewFallbackStore
NewFallbackStore creates a store that tries primary first, then falls back to secondary.
Returns
func NewFallbackStore(primary, secondary Store) *FallbackStore
{
return &FallbackStore{primary: primary, secondary: secondary}
}Store
Store is the shared contract for secret backends.
type Store interface
MemoryStore
MemoryStore is a thread-safe in-memory store intended for tests and ephemeral use.
type MemoryStore struct
Methods
Set stores a copy of the provided secret value.
Parameters
Returns
func (*MemoryStore) Set(key string, value []byte) error
{
s.mu.Lock()
defer s.mu.Unlock()
s.m[key] = append([]byte(nil), value...)
return nil
}Get returns a copy of the stored secret value.
Parameters
Returns
func (*MemoryStore) Get(key string) ([]byte, error)
{
s.mu.RLock()
defer s.mu.RUnlock()
v, ok := s.m[key]
if !ok {
return nil, ErrNotFound
}
return append([]byte(nil), v...), nil
}Delete removes a secret from the in-memory store.
Parameters
Returns
func (*MemoryStore) Delete(key string) error
{
s.mu.Lock()
defer s.mu.Unlock()
delete(s.m, key)
return nil
}Fields
| Name | Type | Description |
|---|---|---|
| mu | sync.RWMutex | |
| m | map[string][]byte |
NewMemoryStore
NewMemoryStore creates a new in-memory store.
Returns
func NewMemoryStore() *MemoryStore
{
return &MemoryStore{m: make(map[string][]byte)}
}EnvStore
EnvStore provides read-only access to environment variables.
type EnvStore struct
Methods
Set reports that environment-backed stores are read-only.
Parameters
Returns
func (*EnvStore) Set(key string, value []byte) error
{
return ErrReadOnly
}Get returns the environment variable value for the provided key.
Parameters
Returns
func (*EnvStore) Get(key string) ([]byte, error)
{
v, ok := os.LookupEnv(key)
if !ok {
return nil, ErrNotFound
}
return []byte(v), nil
}Delete reports that environment-backed stores are read-only.
Parameters
Returns
func (*EnvStore) Delete(key string) error
{
return ErrReadOnly
}NewEnvStore
NewEnvStore creates a new environment-backed secret store.
Returns
func NewEnvStore() *EnvStore
{
return &EnvStore{}
}VaultStore
VaultStore is a placeholder for an external secret manager implementation.
type VaultStore struct
Methods
Set reports that the placeholder Vault store is not implemented yet.
Parameters
Returns
func (*VaultStore) Set(key string, value []byte) error
{
return ErrNotImplemented
}Get reports that the placeholder Vault store is not implemented yet.
Parameters
Returns
func (*VaultStore) Get(key string) ([]byte, error)
{
return nil, ErrNotImplemented
}Delete reports that the placeholder Vault store is not implemented yet.
Parameters
Returns
func (*VaultStore) Delete(key string) error
{
return ErrNotImplemented
}NewVaultStore
NewVaultStore creates a placeholder Vault-backed store.
Returns
func NewVaultStore() *VaultStore
{
return &VaultStore{}
}