@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/zig/feature/secrets/plugins/infisical.zig

@@ -0,0 +1,167 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/infisical.zig)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! Infisical - a sekreto plugin. Needs HTTPS.
+
+const std = @import("std");
+
+const sekreto = @import("sekreto");
+const httpjson = @import("httpjson.zig");
+
+const Allocator = std.mem.Allocator;
+const Answer = sekreto.Answer;
+const Found = sekreto.Found;
+const Provider = sekreto.Provider;
+const ProviderSpec = sekreto.ProviderSpec;
+
+/// Infisical.
+///
+/// `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
+/// convention is environment-style keys) at a secret path in one environment
+/// of a project. sekreto.Auth is a token, or a universal-auth (machine identity)
+/// login with clientid/clientsecret.
+pub const InfisicalProvider = struct {
+    alloc: Allocator,
+    config: sekreto.Config,
+    addr: []const u8,
+    token: []const u8,
+    clientid: []const u8,
+    clientsecret: []const u8,
+    project: []const u8,
+    environment: []const u8,
+    path: []const u8,
+    livetoken: ?[]const u8,
+    renewat: i64,
+
+    fn login(self: *InfisicalProvider, alloc: Allocator, addr: []const u8) Allocator.Error!Answer([]const u8) {
+        if (0 != self.token.len) {
+            return .{ .ok = self.token };
+        }
+
+        if (0 == self.clientid.len or 0 == self.clientsecret.len) {
+            return .{ .err = try sekreto.fail(
+                alloc,
+                "sekreto: infisical: no token and no client credentials",
+                .{},
+            ) };
+        }
+
+        const url = try std.fmt.allocPrint(alloc, "{s}/api/v1/auth/universal-auth/login", .{addr});
+
+        const body = try httpjson.jsonobject(alloc, &.{
+            .{ .key = "clientId", .value = self.clientid },
+            .{ .key = "clientSecret", .value = self.clientsecret },
+        });
+
+        const headers = [_]httpjson.Header{
+            .{ .name = "content-type", .value = "application/json" },
+        };
+
+        const res = switch (try httpjson.fetchjson(alloc, self.config.io, .POST, url, &headers, body)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        const access = httpjson.jstr(httpjson.jget(res.body, "accessToken"));
+
+        if (200 != res.status or null == access) {
+            return .{ .err = try sekreto.fail(
+                alloc,
+                "sekreto: infisical login failed: {d}",
+                .{res.status},
+            ) };
+        }
+
+        self.renewat = httpjson.renewafter(self.config.io, httpjson.jnum(httpjson.jget(res.body, "expiresIn")));
+
+        return .{ .ok = access.? };
+    }
+
+    pub fn lookup(self: *InfisicalProvider, alloc: Allocator, name: []const u8) Allocator.Error!Found {
+        const addr = httpjson.trimslash(if (0 != self.addr.len) self.addr else "https://app.infisical.com");
+
+        switch (try sekreto.checkaddr(alloc, addr)) {
+            .err => |message| return .{ .err = message },
+            .ok => {},
+        }
+
+        if (0 == self.project.len or 0 == self.environment.len) {
+            return .{ .err = try sekreto.fail(alloc, "sekreto: infisical: no project/environment", .{}) };
+        }
+
+        if (null == self.livetoken or httpjson.nowms(self.config.io) >= self.renewat) {
+            const fresh = switch (try self.login(alloc, addr)) {
+                .err => |message| return .{ .err = message },
+                .ok => |got| got,
+            };
+            if (self.livetoken) |old| {
+                self.alloc.free(old);
+            }
+            self.livetoken = try self.alloc.dupe(u8, fresh);
+        }
+
+        const key = switch (try sekreto.envkey(alloc, name, "")) {
+            .err => |message| return .{ .err = message },
+            .ok => |made| made,
+        };
+
+        const url = try std.fmt.allocPrint(
+            alloc,
+            "{s}/api/v3/secrets/raw/{s}?workspaceId={s}&environment={s}&secretPath={s}",
+            .{
+                addr,
+                key,
+                try httpjson.escape(alloc, self.project),
+                try httpjson.escape(alloc, self.environment),
+                try httpjson.escape(alloc, if (0 != self.path.len) self.path else "/"),
+            },
+        );
+
+        const bearer = try std.fmt.allocPrint(alloc, "Bearer {s}", .{self.livetoken.?});
+        const headers = [_]httpjson.Header{.{ .name = "authorization", .value = bearer }};
+
+        const res = switch (try httpjson.fetchjson(alloc, self.config.io, .GET, url, &headers, null)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        if (404 == res.status) {
+            return .{ .ok = null };
+        }
+
+        if (200 != res.status) {
+            return .{ .err = try sekreto.fail(alloc, "sekreto: infisical error: {d}", .{res.status}) };
+        }
+
+        return .{ .ok = httpjson.jstr(httpjson.jget(httpjson.jget(res.body, "secret"), "secretValue")) };
+    }
+
+    pub fn describe(self: *InfisicalProvider, alloc: Allocator) Allocator.Error![]const u8 {
+        return std.fmt.allocPrint(alloc, "infisical:{s}/{s}", .{ self.project, self.environment });
+    }
+
+    pub fn deinit(self: *InfisicalProvider, alloc: Allocator) void {
+        if (self.livetoken) |token| {
+            alloc.free(token);
+        }
+    }
+};
+
+fn make(alloc: Allocator, config: sekreto.Config, spec: ProviderSpec) Allocator.Error!Answer(Provider) {
+    return .{ .ok = try sekreto.provide(alloc, InfisicalProvider, .{
+        .alloc = alloc,
+        .config = config,
+        .addr = spec.addr,
+        .token = spec.token,
+        .clientid = spec.clientid,
+        .clientsecret = spec.clientsecret,
+        .project = spec.project,
+        .environment = spec.environment,
+        .path = spec.path,
+        .livetoken = null,
+        .renewat = httpjson.NEVER,
+    }) };
+}
+
+/// The `infisical` kind.
+pub const infisical: sekreto.Definition = sekreto.providerplugin("infisical", make);

package/project/.sdk/tm/zig/feature/secrets/plugins/onepassword.zig

@@ -0,0 +1,202 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/onepassword.zig)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! 1Password, through a Connect server - a sekreto plugin. Needs HTTPS.
+
+const std = @import("std");
+
+const sekreto = @import("sekreto");
+const httpjson = @import("httpjson.zig");
+
+const Allocator = std.mem.Allocator;
+const Answer = sekreto.Answer;
+const Found = sekreto.Found;
+const Provider = sekreto.Provider;
+const ProviderSpec = sekreto.ProviderSpec;
+
+/// 1Password, through a Connect server.
+///
+/// The item titled `api.token` (titles keep their dots), in the named vault.
+/// The value is the field with purpose PASSWORD, or the field labelled
+/// `value`. A vault that cannot be found is an error - config names it, so
+/// its absence is a broken store, not a missing secret.
+pub const OnePasswordProvider = struct {
+    alloc: Allocator,
+    config: sekreto.Config,
+    addr: []const u8,
+    token: []const u8,
+    vault: []const u8,
+    vaultid: ?[]const u8,
+
+    fn authheader(self: *OnePasswordProvider, alloc: Allocator) Allocator.Error![]const u8 {
+        return std.fmt.allocPrint(alloc, "Bearer {s}", .{self.token});
+    }
+
+    fn resolvevault(self: *OnePasswordProvider, alloc: Allocator, addr: []const u8) Allocator.Error!Answer([]const u8) {
+        if (0 == self.vault.len) {
+            return .{ .err = try sekreto.fail(alloc, "sekreto: onepassword: no vault", .{}) };
+        }
+
+        const url = try std.fmt.allocPrint(alloc, "{s}/v1/vaults", .{addr});
+        const headers = [_]httpjson.Header{
+            .{ .name = "authorization", .value = try self.authheader(alloc) },
+        };
+
+        const res = switch (try httpjson.fetchjson(alloc, self.config.io, .GET, url, &headers, null)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        const list = res.body orelse std.json.Value{ .null = {} };
+
+        if (200 != res.status or .array != list) {
+            return .{ .err = try sekreto.fail(
+                alloc,
+                "sekreto: onepassword error: {d}: listing vaults",
+                .{res.status},
+            ) };
+        }
+
+        for (list.array.items) |entry| {
+            const id = httpjson.jstr(httpjson.jget(entry, "id"));
+            const named = httpjson.jstr(httpjson.jget(entry, "name"));
+
+            const hit = (null != id and std.mem.eql(u8, self.vault, id.?)) or
+                (null != named and std.mem.eql(u8, self.vault, named.?));
+
+            if (hit and null != id) {
+                return .{ .ok = id.? };
+            }
+        }
+
+        return .{ .err = try sekreto.fail(
+            alloc,
+            "sekreto: onepassword: no vault named {s}",
+            .{self.vault},
+        ) };
+    }
+
+    pub fn lookup(self: *OnePasswordProvider, alloc: Allocator, name: []const u8) Allocator.Error!Found {
+        switch (try sekreto.checkname(alloc, name)) {
+            .err => |message| return .{ .err = message },
+            .ok => {},
+        }
+
+        const addr = httpjson.trimslash(self.addr);
+        if (0 == addr.len) {
+            return .{ .err = try sekreto.fail(alloc, "sekreto: onepassword: no addr", .{}) };
+        }
+
+        switch (try sekreto.checkaddr(alloc, addr)) {
+            .err => |message| return .{ .err = message },
+            .ok => {},
+        }
+
+        if (null == self.vaultid) {
+            const found = switch (try self.resolvevault(alloc, addr)) {
+                .err => |message| return .{ .err = message },
+                .ok => |got| got,
+            };
+            self.vaultid = try self.alloc.dupe(u8, found);
+        }
+
+        const filter = try httpjson.escape(alloc, try std.fmt.allocPrint(alloc, "title eq \"{s}\"", .{name}));
+
+        const findurl = try std.fmt.allocPrint(
+            alloc,
+            "{s}/v1/vaults/{s}/items?filter={s}",
+            .{ addr, self.vaultid.?, filter },
+        );
+
+        const headers = [_]httpjson.Header{
+            .{ .name = "authorization", .value = try self.authheader(alloc) },
+        };
+
+        const found = switch (try httpjson.fetchjson(alloc, self.config.io, .GET, findurl, &headers, null)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        const list = found.body orelse std.json.Value{ .null = {} };
+
+        if (200 != found.status or .array != list) {
+            return .{ .err = try sekreto.fail(
+                alloc,
+                "sekreto: onepassword error: {d}: finding {s}",
+                .{ found.status, name },
+            ) };
+        }
+
+        if (0 == list.array.items.len) {
+            return .{ .ok = null };
+        }
+
+        const itemid = httpjson.jstr(httpjson.jget(list.array.items[0], "id")) orelse "";
+
+        const itemurl = try std.fmt.allocPrint(
+            alloc,
+            "{s}/v1/vaults/{s}/items/{s}",
+            .{ addr, self.vaultid.?, itemid },
+        );
+
+        const item = switch (try httpjson.fetchjson(alloc, self.config.io, .GET, itemurl, &headers, null)) {
+            .err => |message| return .{ .err = message },
+            .ok => |got| got,
+        };
+
+        if (200 != item.status) {
+            return .{ .err = try sekreto.fail(
+                alloc,
+                "sekreto: onepassword error: {d}: reading {s}",
+                .{ item.status, name },
+            ) };
+        }
+
+        const fields = httpjson.jget(item.body, "fields") orelse return .{ .ok = null };
+        if (.array != fields) {
+            return .{ .ok = null };
+        }
+
+        for (fields.array.items) |field| {
+            if (httpjson.jstr(httpjson.jget(field, "purpose"))) |purpose| {
+                if (std.mem.eql(u8, "PASSWORD", purpose)) {
+                    return .{ .ok = httpjson.jstr(httpjson.jget(field, "value")) };
+                }
+            }
+        }
+
+        for (fields.array.items) |field| {
+            if (httpjson.jstr(httpjson.jget(field, "label"))) |label| {
+                if (std.mem.eql(u8, "value", label)) {
+                    return .{ .ok = httpjson.jstr(httpjson.jget(field, "value")) };
+                }
+            }
+        }
+
+        return .{ .ok = null };
+    }
+
+    pub fn describe(self: *OnePasswordProvider, alloc: Allocator) Allocator.Error![]const u8 {
+        return std.fmt.allocPrint(alloc, "onepassword:{s}", .{self.vault});
+    }
+
+    pub fn deinit(self: *OnePasswordProvider, alloc: Allocator) void {
+        if (self.vaultid) |id| {
+            alloc.free(id);
+        }
+    }
+};
+
+fn make(alloc: Allocator, config: sekreto.Config, spec: ProviderSpec) Allocator.Error!Answer(Provider) {
+    return .{ .ok = try sekreto.provide(alloc, OnePasswordProvider, .{
+        .alloc = alloc,
+        .config = config,
+        .addr = spec.addr,
+        .token = spec.token,
+        .vault = spec.vault,
+        .vaultid = null,
+    }) };
+}
+
+/// The `onepassword` kind.
+pub const onepassword: sekreto.Definition = sekreto.providerplugin("onepassword", make);

package/project/.sdk/tm/zig/feature/secrets/plugins/secretspec.zig

@@ -0,0 +1,160 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (zig/plugins/secretspec.zig)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! SecretSpec (https://secretspec.dev) - a sekreto plugin.
+//!
+//! Spawns the secretspec CLI, which is why it is a plugin.
+
+const std = @import("std");
+
+const sekreto = @import("sekreto");
+const httpjson = @import("httpjson.zig");
+
+const Allocator = std.mem.Allocator;
+const Answer = sekreto.Answer;
+const Found = sekreto.Found;
+const Provider = sekreto.Provider;
+const ProviderSpec = sekreto.ProviderSpec;
+
+/// SecretSpec (https://secretspec.dev).
+///
+/// SecretSpec is a declaration - a `secretspec.toml` naming the secrets a
+/// project needs - plus a chain of its own backends to satisfy them from.
+/// That makes it the same shape as sekreto one level down, and the reason
+/// to support it is the same reason sekreto exists: a project that has
+/// already declared its secrets there should not have to declare them
+/// again here.
+///
+/// Read through its CLI, as boru is, because that is the interface it
+/// offers a program in another language: `secretspec get API_TOKEN` prints
+/// the value on stdout and nothing else. A sekreto name maps to a
+/// SecretSpec key exactly as it maps to an environment variable -
+/// `api.token` is `API_TOKEN` - which is the convention SecretSpec's own
+/// examples use.
+///
+/// `backend` selects one of SecretSpec's backends (`--provider`, e.g.
+/// `keyring` or `dotenv://.env`) and is called `backend` here only because
+/// `provider` already means something else in this library.
+///
+/// A reason is required, not optional: SecretSpec records every read in an
+/// audit log and refuses to read at all without one. sekreto sends
+/// `sekreto` unless told otherwise, so the audit trail says which tool
+/// asked.
+pub const SecretspecProvider = struct {
+    config: sekreto.Config,
+    command: []const u8,
+    file: []const u8,
+    profile: []const u8,
+    backend: []const u8,
+    reason: []const u8,
+    prefix: []const u8,
+
+    pub fn lookup(self: *SecretspecProvider, alloc: Allocator, name: []const u8) Allocator.Error!Found {
+        const key = switch (try sekreto.envkey(alloc, name, self.prefix)) {
+            .err => |message| return .{ .err = message },
+            .ok => |made| made,
+        };
+
+        var argv: std.ArrayList([]const u8) = .empty;
+        try argv.append(alloc, self.command);
+
+        if (0 != self.file.len) {
+            try argv.append(alloc, "--file");
+            try argv.append(alloc, self.file);
+        }
+
+        try argv.append(alloc, "get");
+        try argv.append(alloc, key);
+
+        if (0 != self.backend.len) {
+            try argv.append(alloc, "--provider");
+            try argv.append(alloc, self.backend);
+        }
+        if (0 != self.profile.len) {
+            try argv.append(alloc, "--profile");
+            try argv.append(alloc, self.profile);
+        }
+
+        try argv.append(alloc, "--reason");
+        try argv.append(alloc, if (0 != self.reason.len) self.reason else "sekreto");
+
+        const run = std.process.run(alloc, self.config.io, .{
+            .argv = argv.items,
+            .environ_map = self.config.env,
+        }) catch |err| {
+            return .{ .err = try sekreto.fail(
+                alloc,
+                "sekreto: cannot run {s}: {s}",
+                .{ self.command, @errorName(err) },
+            ) };
+        };
+
+        const exited = switch (run.term) {
+            .exited => |code| code,
+            else => 1,
+        };
+
+        if (0 == exited) {
+            // The value and one newline, and nothing else.
+            var value: []const u8 = run.stdout;
+            if (0 != value.len and '\n' == value[value.len - 1]) {
+                value = value[0 .. value.len - 1];
+            }
+            return .{ .ok = value };
+        }
+
+        const why = std.mem.trim(u8, run.stderr, " \t\r\n");
+
+        if (try secretspecmiss(alloc, why, key)) {
+            return .{ .ok = null };
+        }
+
+        if (0 != why.len) {
+            return .{ .err = try sekreto.fail(alloc, "sekreto: secretspec error: {s}", .{why}) };
+        }
+
+        return .{ .err = try sekreto.fail(alloc, "sekreto: secretspec error: exit {d}", .{exited}) };
+    }
+
+    pub fn describe(self: *SecretspecProvider, alloc: Allocator) Allocator.Error![]const u8 {
+        if (0 == self.backend.len) {
+            return alloc.dupe(u8, "secretspec");
+        }
+        return std.fmt.allocPrint(alloc, "secretspec:{s}", .{self.backend});
+    }
+
+    pub fn deinit(_: *SecretspecProvider, _: Allocator) void {}
+};
+
+/// Does this SecretSpec failure mean "no such secret" rather than "I could
+/// not answer"?
+///
+/// SecretSpec says `Secret 'API_TOKEN' not found` for both a name it does
+/// not declare and one declared with no value, and both are misses: this
+/// store does not hold it, so the chain carries on.
+///
+/// MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
+/// `Provider backend 'keyring' not found`, which is a store that could not
+/// answer at all - and reading that as a miss is the worst failure this
+/// library has, because the chain then falls through to a weaker store
+/// without saying so. The key is required to appear, so the two cannot be
+/// confused.
+fn secretspecmiss(alloc: Allocator, why: []const u8, key: []const u8) Allocator.Error!bool {
+    const phrase = try std.fmt.allocPrint(alloc, "Secret '{s}' not found", .{key});
+    return null != std.mem.indexOf(u8, why, phrase);
+}
+
+fn make(alloc: Allocator, config: sekreto.Config, spec: ProviderSpec) Allocator.Error!Answer(Provider) {
+    return .{ .ok = try sekreto.provide(alloc, SecretspecProvider, .{
+        .config = config,
+        .command = if (0 != spec.command.len) spec.command else "secretspec",
+        .file = spec.file,
+        .profile = spec.profile,
+        .backend = spec.backend,
+        .reason = spec.reason,
+        .prefix = spec.prefix,
+    }) };
+}
+
+/// The `secretspec` kind.
+pub const secretspec: sekreto.Definition = sekreto.providerplugin("secretspec", make);