@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/cpp/feature/secrets/plugins/Proc.hpp

@@ -0,0 +1,47 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Proc.hpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Running another program, and the environment it inherits.
+//
+// Two of the ten kinds read a secret out of a CLI - boru and secretspec -
+// and a child process is exactly the sort of thing the split exists to
+// keep out of the core: `fork` and `execve` are one `#include` away in any
+// C++ file, and a chain of built-ins must link neither.
+//
+// The argument list is passed as an array, never through a shell, and no
+// secret is ever put on a command line where the process table publishes
+// it.
+
+#ifndef SEKRETO_PLUGINS_PROC_HPP
+#define SEKRETO_PLUGINS_PROC_HPP
+
+#include <string>
+#include <vector>
+
+#include "../sekreto/Providers.hpp"
+#include "../sekreto/Sekreto.hpp"
+
+namespace sekreto {
+
+/// What a finished child process left behind.
+struct Ran {
+  std::string out;
+  std::string why;
+  int status = 0;
+};
+
+/// Run a child to completion and collect both its streams. Raises a
+/// SekretoError when the program cannot be run at all.
+Ran runcmd(const std::vector<std::string>& argv,
+           const std::vector<std::string>& environment, const std::string& command);
+
+/// The process environment as `KEY=value` entries.
+std::vector<std::string> processenv();
+
+/// Set one variable in such a list, in place where it is already there.
+void setenvvar(std::vector<std::string>& environment, const std::string& key,
+               const std::string& value);
+
+}  // namespace sekreto
+
+#endif

package/project/.sdk/tm/cpp/feature/secrets/plugins/Secretspec.cpp

@@ -0,0 +1,104 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Secretspec.cpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+#include "Secretspec.hpp"
+
+#include "Proc.hpp"
+#include "../sekreto/Providers.hpp"
+#include "../sekreto/Sekreto.hpp"
+
+namespace sekreto {
+
+namespace {
+
+// ------------------------------------------------------------- secretspec
+
+/// SecretSpec (https://secretspec.dev).
+///
+/// A declaration - a `secretspec.toml` naming the secrets a project needs
+/// - plus a chain of its own backends to satisfy them from. `backend`
+/// selects one of those (`--provider`) and is called `backend` here only
+/// because `provider` already means something else in this library.
+///
+/// A reason is required, not optional: SecretSpec records every read in an
+/// audit log and refuses to read at all without one.
+class SecretspecProvider : public Provider {
+ public:
+  SecretspecProvider(const std::string& command, const std::string& file,
+                     const std::string& profile, const std::string& backend,
+                     const std::string& reason, const std::string& prefix)
+      : command_(first(command, "secretspec")),
+        file_(file),
+        profile_(profile),
+        backend_(backend),
+        reason_(reason),
+        prefix_(prefix) {}
+
+  std::optional<std::string> lookup(const std::string& name) override {
+    std::string key = envkey(name, prefix_);
+
+    // `--file` comes BEFORE the subcommand; everything else after it.
+    std::vector<std::string> argv{command_};
+    if (!file_.empty()) {
+      argv.push_back("--file");
+      argv.push_back(file_);
+    }
+    argv.push_back("get");
+    argv.push_back(key);
+    if (!backend_.empty()) {
+      argv.push_back("--provider");
+      argv.push_back(backend_);
+    }
+    if (!profile_.empty()) {
+      argv.push_back("--profile");
+      argv.push_back(profile_);
+    }
+    argv.push_back("--reason");
+    argv.push_back(first(reason_, "sekreto"));
+
+    Ran ran = runcmd(argv, processenv(), command_);
+
+    if (0 == ran.status) {
+      // The value and one newline, and nothing else.
+      return dropnewline(ran.out);
+    }
+
+    if (secretspecmiss(ran.why, key)) return std::nullopt;
+
+    throw SekretoError("sekreto: secretspec error: " +
+                       (ran.why.empty() ? "exit " + std::to_string(ran.status) : ran.why));
+  }
+
+  std::string describe() const override {
+    return backend_.empty() ? "secretspec" : "secretspec:" + backend_;
+  }
+
+ private:
+  std::string command_;
+  std::string file_;
+  std::string profile_;
+  std::string backend_;
+  std::string reason_;
+  std::string prefix_;
+};
+
+}  // namespace
+
+// MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
+// `Provider backend 'keyring' not found`, which is a store that could not
+// answer at all - and reading that as a miss is the worst failure this
+// library has, because the chain then falls through to a weaker store
+// without saying so. The key is required to appear, so the two cannot be
+// confused.
+bool secretspecmiss(const std::string& why, const std::string& key) {
+  return std::string::npos != why.find("Secret '" + key + "' not found");
+}
+
+Definition secretspec() {
+  return providerplugin("secretspec", [](const ProviderSpec& spec) -> std::shared_ptr<Provider> {
+    return std::make_shared<SecretspecProvider>(spec.command, spec.file, spec.profile,
+                                                spec.backend, spec.reason, spec.prefix);
+  });
+}
+
+}  // namespace sekreto

package/project/.sdk/tm/cpp/feature/secrets/plugins/Secretspec.hpp

@@ -0,0 +1,27 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Secretspec.hpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// SecretSpec, read through its own CLI.
+//
+// A PLUGIN, not a built-in: this kind opens a socket, signs a request or
+// spawns a process, so a chain that does not name it links none of that.
+// The calling project includes this header and passes what it declares to
+// the Sekreto constructor (docs/design/plugin-providers.md).
+
+#ifndef SEKRETO_PLUGINS_SECRETSPEC_HPP
+#define SEKRETO_PLUGINS_SECRETSPEC_HPP
+
+#include "../sekreto/Provider.hpp"
+
+namespace sekreto {
+
+/// The `secretspec` provider kind, as a voxgig/plugin definition.
+Definition secretspec();
+
+/// Does this SecretSpec failure mean "no such secret"? Matched on the
+/// WHOLE phrase, key included.
+bool secretspecmiss(const std::string& why, const std::string& key);
+
+}  // namespace sekreto
+
+#endif

package/project/.sdk/tm/cpp/feature/secrets/plugins/Sigv4.cpp

@@ -0,0 +1,242 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Sigv4.cpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+#include "Sigv4.hpp"
+
+#include <algorithm>
+#include <cstdio>
+
+#include "Crypto.hpp"
+#include "Httpjson.hpp"
+
+namespace sekreto {
+
+std::string sha256hex(const std::string& text) {
+  return hex(sha256(tobytes(text)));
+}
+
+namespace {
+
+Bytes hmactext(const Bytes& key, const std::string& text) {
+  return hmacsha256(key, tobytes(text));
+}
+
+}  // namespace
+
+std::string canonicalquery(const std::string& query) {
+  if (query.empty()) return "";
+
+  std::vector<std::pair<std::string, std::string>> pairs;
+  size_t start = 0;
+
+  while (true) {
+    size_t at = query.find('&', start);
+    std::string pair =
+        (std::string::npos == at) ? query.substr(start) : query.substr(start, at - start);
+
+    // Split on the FIRST `=`; a pair with none has an empty value and is
+    // still emitted with its `=`.
+    size_t eq = pair.find('=');
+    std::string key = (std::string::npos == eq) ? pair : pair.substr(0, eq);
+    std::string value = (std::string::npos == eq) ? "" : pair.substr(eq + 1);
+
+    pairs.emplace_back(uriescape(uridecode(key)), uriescape(uridecode(value)));
+
+    if (std::string::npos == at) break;
+    start = at + 1;
+  }
+
+  std::stable_sort(pairs.begin(), pairs.end(),
+                   [](const std::pair<std::string, std::string>& left,
+                      const std::pair<std::string, std::string>& right) {
+                     if (left.first != right.first) return left.first < right.first;
+                     return left.second < right.second;
+                   });
+
+  std::string out;
+  for (size_t index = 0; index < pairs.size(); index++) {
+    if (0 < index) out += "&";
+    out += pairs[index].first + "=" + pairs[index].second;
+  }
+
+  return out;
+}
+
+namespace {
+
+/// A URL, split by hand.
+///
+/// Not a platform URL type: what SigV4 signs must match what checkaddr saw
+/// and what the client will dial, and a URL parser is free to normalise
+/// any of the three differently. `host` follows the WHATWG rule the AWS
+/// SDKs use - lowercased, userinfo stripped, the port present only when it
+/// is not the scheme's default.
+struct Urlparts {
+  std::string scheme;
+  std::string host;
+  std::string path;
+  std::string query;
+};
+
+Urlparts urlparts(const std::string& url) {
+  Urlparts out;
+
+  std::string rest = url;
+  size_t mark = url.find("://");
+
+  if (std::string::npos != mark) {
+    out.scheme = asciilower(url.substr(0, mark));
+    rest = url.substr(mark + 3);
+  }
+
+  std::string authority = rest;
+  std::string tail;
+
+  size_t stop = rest.find_first_of("/?#");
+  if (std::string::npos != stop) {
+    authority = rest.substr(0, stop);
+    tail = rest.substr(stop);
+  }
+
+  // Userinfo is not part of the host, and never part of a signature.
+  size_t at = authority.rfind('@');
+  if (std::string::npos != at) authority = authority.substr(at + 1);
+
+  std::string hostname = authority;
+  std::string port;
+
+  if (!authority.empty() && '[' == authority[0]) {
+    size_t close = authority.find(']');
+    if (std::string::npos != close) {
+      hostname = authority.substr(0, close + 1);
+      std::string after = authority.substr(close + 1);
+      if (!after.empty() && ':' == after[0]) port = after.substr(1);
+    }
+  } else {
+    size_t colon = authority.rfind(':');
+    if (std::string::npos != colon) {
+      hostname = authority.substr(0, colon);
+      port = authority.substr(colon + 1);
+    }
+  }
+
+  hostname = asciilower(hostname);
+
+  // A default port is implicit: `Host: example.com:443` is not what an AWS
+  // SDK signs, and a signature over the wrong host is refused.
+  if (("https" == out.scheme && "443" == port) || ("http" == out.scheme && "80" == port)) {
+    port = "";
+  }
+
+  out.host = port.empty() ? hostname : hostname + ":" + port;
+  out.path = "/";
+
+  if (!tail.empty()) {
+    std::string pathpart = tail;
+
+    size_t hash = pathpart.find('#');
+    if (std::string::npos != hash) pathpart = pathpart.substr(0, hash);
+
+    size_t question = pathpart.find('?');
+    if (std::string::npos != question) {
+      out.query = pathpart.substr(question + 1);
+      pathpart = pathpart.substr(0, question);
+    }
+
+    if (!pathpart.empty()) out.path = pathpart;
+  }
+
+  return out;
+}
+
+/// Trim, and collapse every internal run of spaces and tabs to one space.
+///
+/// AWS folds sequential whitespace before signing, so a header value like
+/// `a  b\tc` must sign as `a b c` or the service refuses the request.
+std::string foldspace(const std::string& text) {
+  std::string out;
+  bool pending = false;
+  bool started = false;
+
+  for (char ch : text) {
+    if (' ' == ch || '\t' == ch || '\n' == ch || '\r' == ch) {
+      if (started) pending = true;
+      continue;
+    }
+    if (pending) {
+      out.push_back(' ');
+      pending = false;
+    }
+    out.push_back(ch);
+    started = true;
+  }
+
+  return out;
+}
+
+}  // namespace
+
+Ordered sigv4(const Signing& input) {
+  Urlparts parts = urlparts(input.url);
+
+  std::string date = input.datetime.substr(0, std::min<size_t>(8, input.datetime.size()));
+
+  // Every header that will be signed: the caller's extras, plus host and
+  // x-amz-date (and the session token when present). The built-in three go
+  // in AFTER the caller's, so they win over anything passed in.
+  Ordered headers;
+
+  for (const auto& entry : input.headers.pairs) {
+    headers.set(asciilower(entry.first), foldspace(entry.second));
+  }
+
+  headers.set("host", parts.host);
+  headers.set("x-amz-date", input.datetime);
+  if (!input.session.empty()) headers.set("x-amz-security-token", input.session);
+
+  std::vector<std::pair<std::string, std::string>> sorted = headers.pairs;
+  std::stable_sort(sorted.begin(), sorted.end(),
+                   [](const std::pair<std::string, std::string>& left,
+                      const std::pair<std::string, std::string>& right) {
+                     return left.first < right.first;
+                   });
+
+  std::string canonicalheaders;
+  std::string signedheaders;
+
+  for (size_t index = 0; index < sorted.size(); index++) {
+    canonicalheaders += sorted[index].first + ":" + sorted[index].second + "\n";
+    if (0 < index) signedheaders += ";";
+    signedheaders += sorted[index].first;
+  }
+
+  // Six lines. `canonicalheaders` already ends with a newline, which is
+  // what produces the blank line the algorithm calls for.
+  std::string canonicalrequest = asciiupper(input.method) + "\n" + parts.path + "\n" +
+                                 canonicalquery(parts.query) + "\n" + canonicalheaders + "\n" +
+                                 signedheaders + "\n" + sha256hex(input.body);
+
+  std::string scope = date + "/" + input.region + "/" + input.service + "/aws4_request";
+
+  std::string stringtosign = "AWS4-HMAC-SHA256\n" + input.datetime + "\n" + scope + "\n" +
+                             sha256hex(canonicalrequest);
+
+  Bytes kdate = hmactext(tobytes("AWS4" + input.secret), date);
+  Bytes kregion = hmactext(kdate, input.region);
+  Bytes kservice = hmactext(kregion, input.service);
+  Bytes ksigning = hmactext(kservice, "aws4_request");
+  std::string signature = hex(hmactext(ksigning, stringtosign));
+
+  Ordered out;
+
+  out.set("authorization", "AWS4-HMAC-SHA256 Credential=" + input.keyid + "/" + scope +
+                               ", SignedHeaders=" + signedheaders +
+                               ", Signature=" + signature);
+  out.set("x-amz-date", input.datetime);
+
+  if (!input.session.empty()) out.set("x-amz-security-token", input.session);
+
+  return out;
+}
+
+}  // namespace sekreto

package/project/.sdk/tm/cpp/feature/secrets/plugins/Sigv4.hpp

@@ -0,0 +1,58 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (cpp/plugins/Sigv4.hpp)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// AWS Signature Version 4, hand-rolled.
+//
+// The AWS providers need exactly one thing from the AWS SDK - request
+// signing - and taking the SDK for it would break the no-dependency rule
+// that keeps the ports honest. SigV4 is a stable, published algorithm
+// built from HMAC-SHA256, which Crypto.cpp supplies.
+//
+// `sigv4` is pure: the caller passes the timestamp, so the same input
+// yields the same signature everywhere. That is what lets the shared spec
+// carry known-answer cases all ports reproduce bit for bit, and lets the
+// integration mock recompute the signature server-side. The clock is never
+// sampled here.
+//
+// A port of typescript/plugins/sigv4.ts, which is canonical.
+
+#ifndef SEKRETO_PLUGINS_SIGV4_HPP
+#define SEKRETO_PLUGINS_SIGV4_HPP
+
+#include <string>
+
+#include "Httpjson.hpp"
+#include "../sekreto/Sekreto.hpp"
+
+namespace sekreto {
+
+/// One request to sign - the same declarative shape the shared spec uses.
+/// `datetime` is `YYYYMMDDTHHMMSSZ`, and it is the caller's.
+struct Signing {
+  std::string method;
+  std::string url;
+  std::string service;
+  std::string region;
+  std::string keyid;
+  std::string secret;
+  std::string datetime;
+  Ordered headers;
+  std::string body;
+  std::string session;
+};
+
+/// SHA-256 of some text, as lowercase hex.
+std::string sha256hex(const std::string& text);
+
+/// The canonical query string: each pair decoded then RFC 3986-escaped,
+/// sorted by escaped key then escaped value.
+std::string canonicalquery(const std::string& query);
+
+/// Sign one request. Returns the headers to attach: authorization,
+/// x-amz-date, and x-amz-security-token when a session token was given, in
+/// that order - the spec compares the result as a JSON object.
+Ordered sigv4(const Signing& input);
+
+}  // namespace sekreto
+
+#endif