@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/lua/feature/secrets/sekreto/name.lua

@@ -0,0 +1,315 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/name.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- The pure name functions: everything sekreto knows about a secret's
+-- name before any store is asked.
+--
+-- All synchronous, all pure, all accepting any Lua value - the shared
+-- corpus feeds them numbers, booleans and nulls. All of them check the
+-- name first, except `validname`, which never raises at all.
+--
+-- These live in their own module rather than in `sekreto.lua` because the
+-- providers need them too, and `sekreto.lua` requires the providers: one
+-- of the two edges has to be somewhere else.
+--
+-- A port of typescript/src/Sekreto.ts, which is canonical.
+
+local err = require('feature.secrets.sekreto.err')
+
+local M = {}
+
+-- ASCII case folding, spelled out. `string.upper` goes through the C
+-- library's toupper, which follows the machine's locale - and in a
+-- Turkish locale `i` does not fold to `I`, which would silently change
+-- every environment-variable key this library computes.
+local function upperascii(text)
+  return (text:gsub('[a-z]', function(ch) return string.char(ch:byte() - 32) end))
+end
+
+--- Split on `.`, keeping empty segments (so `a..b` yields an empty one).
+local function segments(name)
+  local out = {}
+  local at = 1
+
+  while true do
+    local stop = name:find('.', at, true)
+    if not stop then
+      out[#out + 1] = name:sub(at)
+      return out
+    end
+    out[#out + 1] = name:sub(at, stop - 1)
+    at = stop + 1
+  end
+end
+
+M.segments = segments
+
+--- Is this a well-formed secret name? Never raises, whatever it is given.
+---
+--- Scanned byte by byte rather than matched against `^[a-z0-9_]+$`: in
+--- several languages `$` also matches before a final newline, and four
+--- ports accepted `api.token\n` because of it. A scan cannot make that
+--- mistake, and the corpus pins all three newline forms as false.
+function M.validname(name)
+  if 'string' ~= type(name) or '' == name then
+    return false
+  end
+
+  for _, part in ipairs(segments(name)) do
+    if '' == part then
+      return false
+    end
+
+    for index = 1, #part do
+      local byte = part:byte(index)
+      local okbyte = (97 <= byte and 122 >= byte) or
+        (48 <= byte and 57 >= byte) or
+        95 == byte
+
+      if not okbyte then
+        return false
+      end
+    end
+  end
+
+  return true
+end
+
+--- The name, or a SekretoError. Every entry point checks its name here.
+function M.checkname(name)
+  if not M.validname(name) then
+    err.fail('sekreto: invalid name: ' .. ('string' == type(name) and name or
+      (nil == name and '' or tostring(name))))
+  end
+
+  return name
+end
+
+--- The environment-variable key for a name: `api.token` -> `API_TOKEN`.
+--- The prefix is joined verbatim and is NOT uppercased.
+function M.envkey(name, prefix)
+  local checked = M.checkname(name)
+  return (prefix or '') .. upperascii(table.concat(segments(checked), '_'))
+end
+
+--- Where a name lives in a KV vault: `api.token` -> `api` / `token`.
+---
+--- A single-segment name has no path of its own, so it becomes a secret
+--- of that name with the conventional field `value`.
+function M.vaultref(name)
+  local parts = segments(M.checkname(name))
+
+  if 1 == #parts then
+    return { path = parts[1], field = 'value' }
+  end
+
+  local field = parts[#parts]
+  table.remove(parts)
+
+  return { path = table.concat(parts, '/'), field = field }
+end
+
+--- A name flattened to one segment: `api.token` -> `api_token` (GCP
+--- Secret Manager, `_`) or `api-token` (Azure Key Vault, `-`).
+---
+--- With `-` as the separator underscores flatten too: Key Vault's
+--- alphabet is letters, digits and hyphens only, so `with_underscore`
+--- must still be representable there.
+function M.flatname(name, sep)
+  local usesep = sep or ''
+  local flat = table.concat(segments(M.checkname(name)), usesep)
+
+  if '-' == usesep then
+    return (flat:gsub('_', '-'))
+  end
+
+  return flat
+end
+
+--- The AWS SSM Parameter Store name: dots become the path hierarchy,
+--- rooted at `/` or at a prefix. `db.pass.main` -> `/db/pass/main`.
+function M.awsparam(name, prefix)
+  local checked = M.checkname(name)
+
+  local base = prefix or ''
+  if '' ~= base and '/' ~= base:sub(1, 1) then
+    base = '/' .. base
+  end
+  if '/' == base:sub(-1) then
+    base = base:sub(1, #base - 1)
+  end
+
+  return base .. '/' .. table.concat(segments(checked), '/')
+end
+
+local function trim(text)
+  return (text:gsub('^[ \t\r\n\f\v]+', ''):gsub('[ \t\r\n\f\v]+$', ''))
+end
+
+M.trim = trim
+
+--- Unescape a double-quoted `.env` value.
+---
+--- `\n \r \t \\ \"` only. Any other escape is preserved as backslash plus
+--- the character, and a trailing backslash is literal. A scan, not a
+--- chain of replacements, so `\\n` cannot be read as a newline.
+local function unescape(text)
+  local out = {}
+  local index = 1
+
+  while index <= #text do
+    local ch = text:sub(index, index)
+
+    if '\\' == ch and index < #text then
+      local next = text:sub(index + 1, index + 1)
+      index = index + 2
+
+      if 'n' == next then
+        out[#out + 1] = '\n'
+      elseif 'r' == next then
+        out[#out + 1] = '\r'
+      elseif 't' == next then
+        out[#out + 1] = '\t'
+      elseif '\\' == next then
+        out[#out + 1] = '\\'
+      elseif '"' == next then
+        out[#out + 1] = '"'
+      else
+        out[#out + 1] = '\\' .. next
+      end
+    else
+      out[#out + 1] = ch
+      index = index + 1
+    end
+  end
+
+  return table.concat(out)
+end
+
+--- Parse `.env` text into raw keys and values.
+---
+--- There is no `.env` standard, so this function IS the specification:
+--- `KEY=value`, an optional `export`, `#` comments on their own line, and
+--- single- or double-quoted values (double quotes also unescape). A line
+--- with no `=`, or with an empty key, is skipped silently rather than
+--- aborting the rest of the file.
+---
+--- Returns a plain table of key to value, plus the key order under
+--- `order` - Lua tables have no insertion order of their own.
+function M.parsedotenv(text)
+  local values = {}
+  local order = {}
+
+  if 'string' ~= type(text) then
+    return values, order
+  end
+
+  local at = 1
+
+  while at <= #text + 1 do
+    local stop = text:find('\n', at, true)
+    local rawline = stop and text:sub(at, stop - 1) or text:sub(at)
+    at = (stop or #text) + 1
+
+    if '\r' == rawline:sub(-1) then
+      rawline = rawline:sub(1, #rawline - 1)
+    end
+
+    local line = trim(rawline)
+
+    if '' ~= line and '#' ~= line:sub(1, 1) then
+      local body = line
+      if 'export ' == body:sub(1, 7) then
+        body = trim(body:sub(8))
+      end
+
+      local eq = body:find('=', 1, true)
+
+      -- `nil` is "no =", `1` is "empty key": both are skipped.
+      if nil ~= eq and 1 < eq then
+        local key = trim(body:sub(1, eq - 1))
+        local value = trim(body:sub(eq + 1))
+
+        if 2 <= #value and '"' == value:sub(1, 1) and '"' == value:sub(-1) then
+          value = unescape(value:sub(2, #value - 1))
+        elseif 2 <= #value and "'" == value:sub(1, 1) and "'" == value:sub(-1) then
+          value = value:sub(2, #value - 1)
+        end
+
+        if nil == values[key] then
+          order[#order + 1] = key
+        end
+        values[key] = value
+      end
+    end
+
+    if not stop then
+      break
+    end
+  end
+
+  return values, order
+end
+
+--- Replace every occurrence of `needle` in `text` with `replacement`.
+--- A literal search, never a pattern: a secret containing `%` or `-`
+--- must not be interpreted as one.
+local function replaceall(text, needle, replacement)
+  local out = {}
+  local at = 1
+
+  while true do
+    local start, stop = text:find(needle, at, true)
+    if not start then
+      out[#out + 1] = text:sub(at)
+      return table.concat(out)
+    end
+
+    out[#out + 1] = text:sub(at, start - 1)
+    out[#out + 1] = replacement
+    at = stop + 1
+  end
+end
+
+--- Replace known secret values in text with `[redacted]`.
+---
+--- Only values of four characters or more: shorter ones are too likely to
+--- appear in ordinary text, and redacting them would make logs unreadable
+--- without making them safer.
+---
+--- Longest first, always, so `abcd1234` is replaced before `abcd` can eat
+--- its prefix - the corpus pins both arrival orders of that pair. The
+--- list is COPIED before sorting: `Sekreto.redact` passes its own live
+--- redaction history, and an in-place sort would reorder it.
+function M.redact(text, values)
+  local out = 'string' == type(text) and text or ''
+
+  local usable = {}
+  for _, value in ipairs(values or {}) do
+    if 'string' == type(value) and 4 <= #value then
+      usable[#usable + 1] = value
+    end
+  end
+
+  table.sort(usable, function(left, right) return #left > #right end)
+
+  for _, value in ipairs(usable) do
+    out = replaceall(out, value, '[redacted]')
+  end
+
+  return out
+end
+
+--- The store name a provider answers to when nothing says otherwise.
+---
+--- `describe()` opens with the provider's kind - `hashicorp:...`,
+--- `dotenv:...`, plain `env` - so the kind is the natural default, and a
+--- custom provider gets a sensible name without implementing anything
+--- extra.
+function M.storename(provider)
+  local text = provider.describe()
+  local mark = text:find(':', 1, true)
+  return mark and text:sub(1, mark - 1) or text
+end
+
+return M

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/aws.lua

@@ -0,0 +1,228 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/aws.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- The aws plugin: Secrets Manager and SSM Parameter Store, two kinds in
+-- one module because they share SigV4 request signing and one signed
+-- call.
+--
+-- SIGV4 TRAVELS WITH THIS PLUGIN. It is the crypto edge - HMAC-SHA256 -
+-- and the core of no port imports a hash function, so
+-- sekreto.plugins.sigv4 and the SHA-256 in sekreto.plugins.crypto behind
+-- it are reached from here and from nowhere else in the library.
+--
+-- A port of typescript/plugins/aws.ts, which is canonical.
+
+local err = require('feature.secrets.sekreto.err')
+local name = require('feature.secrets.sekreto.name')
+local addr = require('feature.secrets.sekreto.addr')
+local providers = require('feature.secrets.sekreto.providers')
+local json = require('feature.secrets.sekreto.plugins.json')
+local httpjson = require('feature.secrets.sekreto.plugins.httpjson')
+local support = require('feature.secrets.sekreto.plugins.support')
+local crypto = require('feature.secrets.sekreto.plugins.crypto')
+local sigv4 = require('feature.secrets.sekreto.plugins.sigv4')
+
+local fail = err.fail
+local trimslash = providers.trimslash
+local providerplugin = providers.providerplugin
+local first = support.first
+local awsnow = support.awsnow
+local fetchjson = httpjson.fetchjson
+
+local M = {}
+
+--- Region and credentials, from config first and the standard AWS_*
+--- environment variables second. Missing either is an error: an AWS store
+--- with no credentials could not answer.
+local function awsauth(region, keyid, secret, session)
+  local useregion = first(region, os.getenv('AWS_REGION'), os.getenv('AWS_DEFAULT_REGION'))
+  local usekeyid = first(keyid, os.getenv('AWS_ACCESS_KEY_ID'))
+  local usesecret = first(secret, os.getenv('AWS_SECRET_ACCESS_KEY'))
+  local usesession = first(session, os.getenv('AWS_SESSION_TOKEN'))
+
+  if '' == useregion then
+    fail('sekreto: aws: no region (set region or AWS_REGION)')
+  end
+  if '' == usekeyid or '' == usesecret then
+    fail('sekreto: aws: no credentials' ..
+      ' (set keyid/secret or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)')
+  end
+
+  return {
+    region = useregion,
+    keyid = usekeyid,
+    secret = usesecret,
+    session = ('' == usesession) and nil or usesession,
+  }
+end
+
+M.awsauth = awsauth
+
+--- One signed call to an AWS JSON-1.1 API.
+local function awscall(region, keyid, secret, session, useaddr, service, target, payload)
+  local auth = awsauth(region, keyid, secret, session)
+
+  -- The China partition lives under its own suffix; every other
+  -- commercial region is plain amazonaws.com.
+  local suffix = ('cn-' == auth.region:sub(1, 3)) and '.amazonaws.com.cn'
+    or '.amazonaws.com'
+  local address = first(useaddr, 'https://' .. service .. '.' .. auth.region .. suffix)
+  addr.checkaddr(address)
+
+  local url = trimslash(address) .. '/'
+
+  local extras = {
+    { 'content-type', 'application/x-amz-json-1.1' },
+    { 'x-amz-target', target },
+  }
+
+  local signed = sigv4.sigv4({
+    method = 'POST',
+    url = url,
+    service = service,
+    region = auth.region,
+    keyid = auth.keyid,
+    secret = auth.secret,
+    datetime = awsnow(),
+    headers = extras,
+    body = payload,
+    session = auth.session,
+  })
+
+  local headers = {}
+  for _, pair in ipairs(extras) do
+    headers[#headers + 1] = pair
+  end
+  for _, pair in ipairs(signed) do
+    headers[#headers + 1] = pair
+  end
+
+  return fetchjson('POST', url, headers, payload)
+end
+
+--- Does this AWS error body name one of the not-found types? Those are a
+--- miss; every other failure is a store that could not answer.
+local function awsmiss(body, ...)
+  local errtype = json.asstr(json.dig(body, '__type'))
+  if nil == errtype then
+    return false
+  end
+
+  for _, want in ipairs({ ... }) do
+    if nil ~= errtype:find(want, 1, true) then
+      return true
+    end
+  end
+
+  return false
+end
+
+M.awsmiss = awsmiss
+
+--- AWS Secrets Manager.
+---
+--- `api.token` reads the secret named `api` (the vaultref path) and takes
+--- the `token` field of its JSON SecretString - the AWS idiom of one JSON
+--- map per secret. A SecretString that is not JSON is the value itself,
+--- under the conventional field `value`.
+local function awssecrets(region, keyid, secret, session, useaddr)
+  return {
+    lookup = function(name_)
+      local ref = name.vaultref(name_)
+
+      local res = awscall(
+        region, keyid, secret, session, useaddr,
+        'secretsmanager', 'secretsmanager.GetSecretValue',
+        json.stringify(json.obj({ { 'SecretId', ref.path } }))
+      )
+
+      if 400 == res.status and awsmiss(res.body, 'ResourceNotFoundException') then
+        return nil
+      end
+
+      if 200 ~= res.status then
+        fail('sekreto: aws secretsmanager error: ' .. res.status)
+      end
+
+      local text = json.asstr(json.dig(res.body, 'SecretString'))
+
+      if nil == text then
+        -- A binary secret has no fields to address; only the conventional
+        -- `value` field can mean "the bytes themselves".
+        local bin = json.asstr(json.dig(res.body, 'SecretBinary'))
+        if nil ~= bin and 'value' == ref.field then
+          local decoded = crypto.unbase64(bin)
+          if nil == decoded then
+            fail('sekreto: aws secretsmanager: undecodable secret')
+          end
+          return decoded
+        end
+        return nil
+      end
+
+      local parsed = json.parse(text)
+
+      if json.isobj(parsed) then
+        return json.text(parsed.vals[ref.field])
+      end
+
+      -- A plain-string secret is the whole value; it has no named fields.
+      if 'value' == ref.field then
+        return text
+      end
+
+      return nil
+    end,
+    -- Config only, never the environment: describe() feeds the spec's
+    -- sources group, which must answer the same everywhere.
+    describe = function()
+      return 'awssecrets:' .. (region or '')
+    end,
+  }
+end
+
+--- AWS SSM Parameter Store.
+---
+--- `db.pass.main` reads the parameter `/db/pass/main` (under an optional
+--- prefix path), decrypted. Parameter Store carries flat strings, so
+--- there is no field indirection.
+local function awsparams(region, keyid, secret, session, useaddr, prefix)
+  return {
+    lookup = function(name_)
+      local payload = json.obj({
+        { 'Name', name.awsparam(name_, prefix) },
+        { 'WithDecryption', true },
+      })
+
+      local res = awscall(
+        region, keyid, secret, session, useaddr,
+        'ssm', 'AmazonSSM.GetParameter', json.stringify(payload)
+      )
+
+      if 400 == res.status and awsmiss(res.body, 'ParameterNotFound') then
+        return nil
+      end
+
+      if 200 ~= res.status then
+        fail('sekreto: aws ssm error: ' .. res.status)
+      end
+
+      return json.text(json.dig(res.body, 'Parameter', 'Value'))
+    end,
+    describe = function()
+      return 'awsparams:' .. (region or '') .. (prefix or '')
+    end,
+  }
+end
+
+--- The two kinds, as voxgig/plugin definitions.
+M.awssecrets = providerplugin('awssecrets', function(spec)
+  return awssecrets(spec.region, spec.keyid, spec.secret, spec.session, spec.addr)
+end)
+
+M.awsparams = providerplugin('awsparams', function(spec)
+  return awsparams(spec.region, spec.keyid, spec.secret, spec.session,
+    spec.addr, spec.prefix)
+end)
+
+return M

package/project/.sdk/tm/lua/feature/secrets/sekreto/plugins/azuresecrets.lua

@@ -0,0 +1,137 @@
+-- VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (lua/src/sekreto/plugins/azuresecrets.lua)
+-- Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+-- License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+-- The azuresecrets plugin: Azure Key Vault, over HTTPS, with a
+-- client-credentials login and the IMDS managed-identity endpoint.
+--
+-- A port of typescript/plugins/azuresecrets.ts, which is canonical.
+
+local err = require('feature.secrets.sekreto.err')
+local name = require('feature.secrets.sekreto.name')
+local addr = require('feature.secrets.sekreto.addr')
+local providers = require('feature.secrets.sekreto.providers')
+local json = require('feature.secrets.sekreto.plugins.json')
+local httpjson = require('feature.secrets.sekreto.plugins.httpjson')
+local support = require('feature.secrets.sekreto.plugins.support')
+
+local fail = err.fail
+local nonempty = providers.nonempty
+local trimslash = providers.trimslash
+local providerplugin = providers.providerplugin
+local first = support.first
+local nowms = support.nowms
+local renewtime = support.renewtime
+local NEVER = support.NEVER
+local fetchjson = httpjson.fetchjson
+local uriescape = support.uriescape
+
+local M = {}
+
+local AZURERESOURCE = 'https://vault.azure.net'
+
+--- Azure Key Vault.
+---
+--- `api.token` reads secret `api-token` (dots flattened to `-`; Key Vault
+--- names allow nothing else), current version. The token comes from
+--- config, then a client-credentials login when tenant/clientid/
+--- clientsecret are given, then the IMDS managed-identity endpoint.
+local function azuresecrets(vault, token, tenant, clientid, clientsecret,
+  loginaddr, imdsaddr, apiversion)
+  local livetoken = nil
+  local renewat = NEVER
+
+  local function login()
+    if nonempty(token) then
+      return token
+    end
+
+    if nonempty(tenant) and nonempty(clientid) and nonempty(clientsecret) then
+      local useloginaddr = first(loginaddr, 'https://login.microsoftonline.com')
+      addr.checkaddr(useloginaddr)
+
+      local url = trimslash(useloginaddr) .. '/' .. tenant .. '/oauth2/v2.0/token'
+      local form = 'grant_type=client_credentials&client_id=' ..
+        uriescape(clientid) ..
+        '&client_secret=' .. uriescape(clientsecret) ..
+        '&scope=' .. uriescape(AZURERESOURCE .. '/.default')
+
+      local res = fetchjson(
+        'POST', url,
+        { { 'content-type', 'application/x-www-form-urlencoded' } },
+        form
+      )
+
+      local got = json.text(json.dig(res.body, 'access_token'))
+      if 200 ~= res.status or nil == got or '' == got then
+        fail('sekreto: azure login failed: ' .. res.status)
+      end
+
+      renewat = renewtime(json.dig(res.body, 'expires_in'))
+      return got
+    end
+
+    local imds = trimslash(first(imdsaddr, 'http://169.254.169.254')) ..
+      '/metadata/identity/oauth2/token?api-version=2018-02-01&resource=' ..
+      uriescape(AZURERESOURCE)
+
+    local res = fetchjson('GET', imds, { { 'Metadata', 'true' } })
+
+    local got = json.text(json.dig(res.body, 'access_token'))
+    if 200 ~= res.status or nil == got or '' == got then
+      fail('sekreto: azure: no token, no client credentials, and IMDS did not answer')
+    end
+
+    -- IMDS sends expires_in as a STRING, unlike everyone else.
+    renewat = renewtime(json.dig(res.body, 'expires_in'))
+    return got
+  end
+
+  return {
+    lookup = function(secret)
+      local usevault = vault or ''
+      if '' == usevault then
+        fail('sekreto: azure: no vault')
+      end
+
+      -- Only an explicit scheme is a URL; a vault NAMED httpvault must
+      -- still become https://httpvault.vault.azure.net.
+      local vaulturl
+      if 'http://' == usevault:sub(1, 7) or 'https://' == usevault:sub(1, 8) then
+        vaulturl = usevault
+      else
+        vaulturl = 'https://' .. usevault .. '.vault.azure.net'
+      end
+      addr.checkaddr(vaulturl)
+
+      if nil == livetoken or nowms() >= renewat then
+        livetoken = login()
+      end
+
+      local url = trimslash(vaulturl) .. '/secrets/' .. name.flatname(secret, '-') ..
+        '?api-version=' .. first(apiversion, '7.4')
+
+      local res = fetchjson('GET', url, { { 'authorization', 'Bearer ' .. livetoken } })
+
+      if 404 == res.status then
+        return nil
+      end
+
+      if 200 ~= res.status then
+        fail('sekreto: azure error: ' .. res.status .. ': ' .. addr.bare(url))
+      end
+
+      return json.text(json.dig(res.body, 'value'))
+    end,
+    describe = function()
+      return 'azuresecrets:' .. (vault or '')
+    end,
+  }
+end
+
+--- The kind, as a voxgig/plugin definition.
+M.azuresecrets = providerplugin('azuresecrets', function(spec)
+  return azuresecrets(spec.vault, spec.token, spec.tenant, spec.clientid,
+    spec.clientsecret, spec.loginaddr, spec.imdsaddr, spec.apiversion)
+end)
+
+return M