@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/c/feature/secrets/plugins/azuresecrets.c

@@ -0,0 +1,207 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/azuresecrets.c)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Azure Key Vault, with client-credential or IMDS login.
+ *
+ * A plugin because it opens a socket. The percent-encoder its login form
+ * needs is in `encode.c` with the transport, so this kind links no
+ * SHA-256 either.
+ *
+ * A port of typescript/plugins/azuresecrets.ts, which is canonical.
+ */
+
+#define _POSIX_C_SOURCE 200809L
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "support.h"
+
+#define AZURE_RESOURCE "https://vault.azure.net"
+
+typedef struct {
+  sek_pool *pool;
+  const char *vault;
+  const char *token;
+  const char *tenant;
+  const char *clientid;
+  const char *clientsecret;
+  const char *loginaddr;
+  const char *imdsaddr;
+  const char *apiversion;
+  char *livetoken;
+  long long renewat;
+  char *described;
+} azuredata;
+
+static sek_err azure_login(azuredata *data, char **out) {
+  sek_pool *pool = data->pool;
+  sek_map *headers;
+  sek_answer res;
+  sek_err err;
+  const char *got;
+  char *url;
+
+  if (!sek_empty(data->token)) {
+    *out = sek_strdup(pool, data->token);
+    return NULL;
+  }
+
+  if (!sek_empty(data->tenant) && !sek_empty(data->clientid) && !sek_empty(data->clientsecret)) {
+    const char *base = sek_first(data->loginaddr, "https://login.microsoftonline.com");
+    char *form;
+
+    err = sek_checkaddr(pool, base);
+    if (NULL != err) {
+      return err;
+    }
+
+    url = sek_fmt(pool, "%s/%s/oauth2/v2.0/token", sek_trimslash(pool, base), data->tenant);
+    form = sek_fmt(pool, "grant_type=client_credentials&client_id=%s&client_secret=%s&scope=%s",
+                   sek_uriescape(pool, data->clientid), sek_uriescape(pool, data->clientsecret),
+                   sek_uriescape(pool, AZURE_RESOURCE "/.default"));
+
+    headers = sek_map_new(pool);
+    sek_map_set(headers, "content-type", "application/x-www-form-urlencoded");
+
+    err = sek_fetchjson(pool, "POST", url, headers, form, &res);
+    if (NULL != err) {
+      return err;
+    }
+
+    got = sek_json_text(pool, sek_json_dig(res.body, "access_token", NULL));
+    if (200 != res.status || sek_empty(got)) {
+      return sek_fmt(pool, "sekreto: azure login failed: %d", res.status);
+    }
+
+    data->renewat = sek_renewtime(sek_json_dig(res.body, "expires_in", NULL));
+    *out = sek_strdup(pool, got);
+    return NULL;
+  }
+
+  /* IMDS: link-local by platform design, and it returns expires_in as a
+   * STRING, which renewtime accepts. */
+  url = sek_fmt(pool, "%s/metadata/identity/oauth2/token?api-version=2018-02-01&resource=%s",
+                sek_trimslash(pool, sek_first(data->imdsaddr, "http://169.254.169.254")),
+                sek_uriescape(pool, AZURE_RESOURCE));
+
+  headers = sek_map_new(pool);
+  sek_map_set(headers, "Metadata", "true");
+
+  err = sek_fetchjson(pool, "GET", url, headers, NULL, &res);
+  if (NULL != err) {
+    return err;
+  }
+
+  got = sek_json_text(pool, sek_json_dig(res.body, "access_token", NULL));
+  if (200 != res.status || sek_empty(got)) {
+    return sek_strdup(pool,
+                      "sekreto: azure: no token, no client credentials, and IMDS did not answer");
+  }
+
+  data->renewat = sek_renewtime(sek_json_dig(res.body, "expires_in", NULL));
+  *out = sek_strdup(pool, got);
+
+  return NULL;
+}
+
+static sek_err azure_lookup(sek_provider *self, const char *name, char **out) {
+  azuredata *data = (azuredata *)self->data;
+  sek_pool *pool = data->pool;
+  char *vaulturl;
+  char *flat = NULL;
+  char *url;
+  sek_map *headers;
+  sek_answer res;
+  sek_err err;
+  const char *text;
+
+  *out = NULL;
+
+  if (sek_empty(data->vault)) {
+    return sek_strdup(pool, "sekreto: azure: no vault");
+  }
+
+  /* ONLY an explicit scheme is a URL: a vault NAMED `httpvault` must
+   * still become https://httpvault.vault.azure.net. */
+  if (sek_has_prefix(data->vault, "http://") || sek_has_prefix(data->vault, "https://")) {
+    vaulturl = sek_strdup(pool, data->vault);
+  } else {
+    vaulturl = sek_fmt(pool, "https://%s.vault.azure.net", data->vault);
+  }
+
+  err = sek_checkaddr(pool, vaulturl);
+  if (NULL != err) {
+    return err;
+  }
+
+  if (NULL == data->livetoken || sek_nowms() >= data->renewat) {
+    err = azure_login(data, &data->livetoken);
+    if (NULL != err) {
+      return err;
+    }
+  }
+
+  /* Dots flatten to `-`: Key Vault names allow letters, digits and
+   * hyphens and nothing else. */
+  err = sek_flatname(pool, name, "-", &flat);
+  if (NULL != err) {
+    return err;
+  }
+
+  url = sek_fmt(pool, "%s/secrets/%s?api-version=%s", sek_trimslash(pool, vaulturl), flat,
+                sek_first(data->apiversion, "7.4"));
+
+  headers = sek_map_new(pool);
+  sek_map_set(headers, "authorization", sek_fmt(pool, "Bearer %s", sek_orempty(data->livetoken)));
+
+  err = sek_fetchjson(pool, "GET", url, headers, NULL, &res);
+  if (NULL != err) {
+    return err;
+  }
+
+  if (404 == res.status) {
+    return NULL;
+  }
+
+  if (200 != res.status) {
+    return sek_fmt(pool, "sekreto: azure error: %d: %s", res.status, sek_bareurl(pool, url));
+  }
+
+  text = sek_json_text(pool, sek_json_dig(res.body, "value", NULL));
+  if (NULL != text) {
+    *out = sek_strdup(pool, text);
+  }
+
+  return NULL;
+}
+
+static const char *azure_describe(sek_provider *self) {
+  return ((azuredata *)self->data)->described;
+}
+
+/* ---- the definition ------------------------------------------------ */
+
+static sek_err azuresecrets_make(sek_pool *pool, const sek_spec *spec, sek_provider **out) {
+  azuredata *data = (azuredata *)sek_alloc(pool, sizeof(azuredata));
+  data->pool = pool;
+  data->vault = sek_own(pool, spec->vault);
+  data->token = sek_own(pool, spec->token);
+  data->tenant = sek_own(pool, spec->tenant);
+  data->clientid = sek_own(pool, spec->clientid);
+  data->clientsecret = sek_own(pool, spec->clientsecret);
+  data->loginaddr = sek_own(pool, spec->loginaddr);
+  data->imdsaddr = sek_own(pool, spec->imdsaddr);
+  data->apiversion = sek_own(pool, spec->apiversion);
+  data->livetoken = NULL;
+  data->renewat = SEK_NEVER;
+  data->described = sek_fmt(pool, "azuresecrets:%s", sek_orempty(spec->vault));
+  *out = sek_provider_new(pool, azure_lookup, azure_describe, data);
+  return NULL;
+}
+
+static sek_providerkind AZURESECRETS_KIND;
+
+Definition *sek_plugin_azuresecrets(void) {
+  return sek_providerplugin(&AZURESECRETS_KIND, "azuresecrets", azuresecrets_make);
+}

package/project/.sdk/tm/c/feature/secrets/plugins/boru.c

@@ -0,0 +1,164 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/boru.c)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* A boru vault, through its CLI or over its wire protocol.
+ *
+ * A plugin twice over: it spawns a child when it runs `boru`, and opens a
+ * socket when an address and a capability token configure the wire form.
+ *
+ * A port of typescript/plugins/boru.ts, which is canonical.
+ */
+
+#define _POSIX_C_SOURCE 200809L
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "support.h"
+
+typedef struct {
+  sek_pool *pool;
+  const char *command;
+  const char *namespace_;
+  const char *home;
+  char *addr;
+  const char *token;
+  const char *mount;
+  char *described;
+} borudata;
+
+/* Does this boru failure mean "no such secret" rather than "I could not
+ * answer"? Matched on boru's own wording for a missing alias. A locked
+ * vault or a wrong passphrase is NOT a miss. */
+static int borumiss(const char *why) { return sek_contains(why, "no alias named"); }
+
+static sek_err boru_wire(borudata *data, const char *name, char **out) {
+  sek_pool *pool = data->pool;
+  sek_map *headers;
+  sek_answer res;
+  sek_err err = sek_checkaddr(pool, data->addr);
+  char *url;
+  const char *text;
+
+  if (NULL != err) {
+    return err;
+  }
+
+  /* The dotted name stays ONE path segment: a boru alias keeps its dots,
+   * unlike the api/token split a HashiCorp KV gets. */
+  if (sek_empty(data->namespace_)) {
+    url = sek_fmt(pool, "%s/v1/%s/data/%s", data->addr, data->mount, name);
+  } else {
+    url = sek_fmt(pool, "%s/v1/%s/data/%s/%s", data->addr, data->mount, data->namespace_, name);
+  }
+
+  headers = sek_map_new(pool);
+  sek_map_set(headers, "X-Vault-Token", sek_orempty(data->token));
+
+  err = sek_fetchjson(pool, "GET", url, headers, NULL, &res);
+  if (NULL != err) {
+    return err;
+  }
+
+  if (404 == res.status) {
+    return NULL;
+  }
+
+  if (200 != res.status) {
+    return sek_fmt(pool, "sekreto: boru serve error: %d: %s", res.status, url);
+  }
+
+  text = sek_json_text(pool, sek_json_dig(res.body, "data", "data", "value", NULL));
+  if (NULL != text) {
+    *out = sek_strdup(pool, text);
+  }
+
+  return NULL;
+}
+
+static sek_err boru_lookup(sek_provider *self, const char *name, char **out) {
+  borudata *data = (borudata *)self->data;
+  sek_pool *pool = data->pool;
+  sek_err err = sek_checkname(pool, name);
+  char *alias;
+  char *argv[6];
+  sek_ran ran;
+  size_t len;
+
+  *out = NULL;
+
+  if (NULL != err) {
+    return err;
+  }
+
+  if (!sek_empty(data->addr)) {
+    return boru_wire(data, name, out);
+  }
+
+  /* CLI mode: a COLON joins the namespace, not a slash. */
+  alias = sek_empty(data->namespace_) ? sek_strdup(pool, name)
+                                      : sek_fmt(pool, "%s:%s", data->namespace_, name);
+
+  argv[0] = (char *)data->command;
+  argv[1] = (char *)"vault";
+  argv[2] = (char *)"get";
+  argv[3] = (char *)"--reveal";
+  argv[4] = alias;
+  argv[5] = NULL;
+
+  /* The passphrase is never config and never on a command line, where the
+   * process table publishes it: boru reads BORU_VAULT_PASSPHRASE itself. */
+  err = sek_runcmd(pool, argv, data->command, sek_empty(data->home) ? NULL : "BORU_HOME",
+                   data->home, &ran);
+  if (NULL != err) {
+    return err;
+  }
+
+  if (0 == ran.status) {
+    /* boru prints the value and one newline, and nothing else. */
+    len = strlen(ran.out);
+    *out = 1 <= len && '\n' == ran.out[len - 1] ? sek_strndup(pool, ran.out, len - 1) : ran.out;
+    return NULL;
+  }
+
+  if (borumiss(ran.why)) {
+    return NULL;
+  }
+
+  return sek_fmt(pool, "sekreto: boru vault error: %s",
+                 sek_empty(ran.why) ? sek_fmt(pool, "exit %d", ran.status) : ran.why);
+}
+
+static const char *boru_describe(sek_provider *self) {
+  return ((borudata *)self->data)->described;
+}
+
+/* ---- the definition ------------------------------------------------ */
+
+static sek_err boru_make(sek_pool *pool, const sek_spec *spec, sek_provider **out) {
+  borudata *data = (borudata *)sek_alloc(pool, sizeof(borudata));
+  data->pool = pool;
+  data->command = sek_own(pool, sek_empty(spec->command) ? "boru" : spec->command);
+  data->namespace_ = sek_own(pool, spec->namespace_);
+  data->home = sek_own(pool, spec->home);
+  data->addr = NULL == spec->addr ? sek_strdup(pool, "") : sek_trimslash(pool, spec->addr);
+  data->token = sek_own(pool, sek_orempty(spec->token));
+  data->mount = sek_own(pool, sek_empty(spec->mount) ? "secret" : spec->mount);
+
+  if (!sek_empty(data->addr)) {
+    data->described = sek_fmt(pool, "boru:%s", data->addr);
+  } else {
+    data->described = sek_empty(data->namespace_)
+                          ? sek_strdup(pool, "boru")
+                          : sek_fmt(pool, "boru:%s", data->namespace_);
+  }
+
+  *out = sek_provider_new(pool, boru_lookup, boru_describe, data);
+  return NULL;
+}
+
+static sek_providerkind BORU_KIND;
+
+Definition *sek_plugin_boru(void) {
+  return sek_providerplugin(&BORU_KIND, "boru", boru_make);
+}

package/project/.sdk/tm/c/feature/secrets/plugins/clock.c

@@ -0,0 +1,75 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/clock.c)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* The clock the vault clients share: when a leased token must be renewed,
+ * and the timestamp SigV4 signs.
+ *
+ * Its own translation unit because `sek_nowms` is the transport's
+ * deadline clock as well, and the transport must not drag a child-process
+ * launcher into a link that has no CLI store in it.
+ */
+
+#define _POSIX_C_SOURCE 200809L
+
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+#include "support.h"
+
+/* MONOTONIC, not wall time: every deadline in this library is a duration
+ * from now, and a clock the operator can step backwards would turn a
+ * ten-second timeout into a hang. */
+long long sek_nowms(void) {
+  struct timespec now;
+
+  clock_gettime(CLOCK_MONOTONIC, &now);
+
+  return (long long)now.tv_sec * 1000ll + now.tv_nsec / 1000000ll;
+}
+
+/* now + max(seconds - 60, 1), so a token is renewed shortly before its
+ * lease runs out rather than after a vault has already expired it. A
+ * missing or zero expiry means never renew, which is what a configured
+ * token gets. */
+long long sek_renewtime(const sek_json *expires) {
+  double seconds = 0;
+
+  if (NULL == expires) {
+    return SEK_NEVER;
+  }
+
+  if (SEK_JSON_NUM == expires->type) {
+    seconds = expires->numval;
+  } else if (SEK_JSON_STR == expires->type) {
+    /* Azure IMDS sends expires_in as a STRING. */
+    char *stop = NULL;
+    seconds = strtod(expires->strval, &stop);
+    if (NULL == stop || stop == expires->strval) {
+      seconds = 0;
+    }
+  }
+
+  if (!(0 < seconds)) {
+    return SEK_NEVER;
+  }
+
+  if (60 < seconds) {
+    seconds -= 60;
+  } else {
+    seconds = 1;
+  }
+
+  return sek_nowms() + (long long)(seconds * 1000);
+}
+
+char *sek_awsnow(sek_pool *pool) {
+  time_t now = time(NULL);
+  struct tm parts;
+  char buf[32];
+
+  gmtime_r(&now, &parts);
+  strftime(buf, sizeof(buf), "%Y%m%dT%H%M%SZ", &parts);
+
+  return sek_strdup(pool, buf);
+}

package/project/.sdk/tm/c/feature/secrets/plugins/doppler.c

@@ -0,0 +1,141 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/doppler.c)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Doppler.
+ *
+ * A plugin because it opens a socket.
+ *
+ * A port of typescript/plugins/doppler.ts, which is canonical.
+ */
+
+#define _POSIX_C_SOURCE 200809L
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "support.h"
+
+typedef struct {
+  sek_pool *pool;
+  const char *token;
+  const char *project;
+  const char *config;
+  const char *addr;
+  sek_map *values;
+  char *described;
+} dopplerdata;
+
+/* The whole config is downloaded ONCE - Doppler's own bulk endpoint - and
+ * answered from memory, like a remote .env. A failure caches nothing, so
+ * a failed load retries on the next lookup. */
+static sek_err doppler_load(dopplerdata *data) {
+  sek_pool *pool = data->pool;
+  char *addr;
+  sek_buf url;
+  sek_map *headers;
+  sek_answer res;
+  sek_err err;
+  const sek_json *body;
+  sek_map *loaded;
+  size_t index;
+
+  if (NULL != data->values) {
+    return NULL;
+  }
+
+  addr = sek_trimslash(pool, sek_first(data->addr, "https://api.doppler.com"));
+  err = sek_checkaddr(pool, addr);
+  if (NULL != err) {
+    return err;
+  }
+
+  sek_buf_init(&url, pool);
+  sek_buf_addfmt(&url, "%s/v3/configs/config/secrets/download?format=json", addr);
+  if (!sek_empty(data->project)) {
+    sek_buf_addfmt(&url, "&project=%s", sek_uriescape(pool, data->project));
+  }
+  if (!sek_empty(data->config)) {
+    sek_buf_addfmt(&url, "&config=%s", sek_uriescape(pool, data->config));
+  }
+
+  headers = sek_map_new(pool);
+  sek_map_set(headers, "authorization", sek_fmt(pool, "Bearer %s", sek_orempty(data->token)));
+
+  err = sek_fetchjson(pool, "GET", url.data, headers, NULL, &res);
+  if (NULL != err) {
+    return err;
+  }
+
+  body = sek_json_asobj(res.body);
+  if (200 != res.status || NULL == body) {
+    return sek_fmt(pool, "sekreto: doppler error: %d", res.status);
+  }
+
+  loaded = sek_map_new(pool);
+  for (index = 0; index < body->maplen; index++) {
+    /* Entries with null values are skipped; the rest are stringified. */
+    const char *text = sek_json_text(pool, body->vals[index]);
+    if (NULL != text) {
+      sek_map_set(loaded, body->keys[index], text);
+    }
+  }
+
+  data->values = loaded;
+
+  return NULL;
+}
+
+static sek_err doppler_lookup(sek_provider *self, const char *name, char **out) {
+  dopplerdata *data = (dopplerdata *)self->data;
+  sek_pool *pool = data->pool;
+  char *key = NULL;
+  sek_err err;
+  const char *found;
+
+  *out = NULL;
+
+  /* The `prefix` option is deliberately not consulted by this kind. */
+  err = sek_envkey(pool, name, NULL, &key);
+  if (NULL != err) {
+    return err;
+  }
+
+  err = doppler_load(data);
+  if (NULL != err) {
+    return err;
+  }
+
+  found = sek_map_get(data->values, key);
+  if (NULL != found) {
+    *out = sek_strdup(pool, found);
+  }
+
+  return NULL;
+}
+
+static const char *doppler_describe(sek_provider *self) {
+  return ((dopplerdata *)self->data)->described;
+}
+
+/* ---- the definition ------------------------------------------------ */
+
+static sek_err doppler_make(sek_pool *pool, const sek_spec *spec, sek_provider **out) {
+  dopplerdata *data = (dopplerdata *)sek_alloc(pool, sizeof(dopplerdata));
+  data->pool = pool;
+  data->token = sek_own(pool, spec->token);
+  data->project = sek_own(pool, spec->project);
+  data->config = sek_own(pool, spec->config);
+  data->addr = sek_own(pool, spec->addr);
+  data->values = NULL;
+  data->described = sek_empty(spec->project)
+                        ? sek_strdup(pool, "doppler")
+                        : sek_fmt(pool, "doppler:%s/%s", spec->project, sek_orempty(spec->config));
+  *out = sek_provider_new(pool, doppler_lookup, doppler_describe, data);
+  return NULL;
+}
+
+static sek_providerkind DOPPLER_KIND;
+
+Definition *sek_plugin_doppler(void) {
+  return sek_providerplugin(&DOPPLER_KIND, "doppler", doppler_make);
+}