@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/c/feature/secrets/plugins/encode.c

@@ -0,0 +1,144 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/encode.c)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* The two encoders every HTTP store needs: strict base64 decoding and
+ * RFC 3986 percent-encoding.
+ *
+ * WITH THE TRANSPORT, NOT WITH THE SIGNER, and that placement is the
+ * whole reason this file exists. Percent-encoding builds the URLs of
+ * four stores that hash nothing - azure, onepassword, doppler,
+ * infisical - and base64 decodes an AWS binary secret and a GCP payload.
+ * Leaving either beside the SigV4 code would put SHA-256 in the link of
+ * every one of them, because a static archive is pulled in an object at a
+ * time. SigV4 depends on this file; this file depends on nothing but the
+ * core.
+ */
+
+#define _POSIX_C_SOURCE 200809L
+
+#include <string.h>
+
+#include "support.h"
+
+/* ---- base64, decode only ------------------------------------------- */
+
+static int unb64digit(char ch) {
+  if ('A' <= ch && 'Z' >= ch) {
+    return ch - 'A';
+  }
+  if ('a' <= ch && 'z' >= ch) {
+    return ch - 'a' + 26;
+  }
+  if ('0' <= ch && '9' >= ch) {
+    return ch - '0' + 52;
+  }
+  if ('+' == ch) {
+    return 62;
+  }
+  if ('/' == ch) {
+    return 63;
+  }
+  return -1;
+}
+
+/* Strict, and that is the point. A lenient decoder skips bytes outside
+ * the alphabet and hands back plausible bytes for a corrupted payload -
+ * and this library then returns those bytes AS THE SECRET. Anything
+ * rejected here is an error at its call site, never a miss. */
+unsigned char *sek_unbase64(sek_pool *pool, const char *text, size_t *outlen) {
+  sek_buf packed;
+  size_t index;
+  size_t pad = 0;
+  unsigned char *out;
+  size_t at = 0;
+
+  if (NULL == text) {
+    return NULL;
+  }
+
+  /* Whitespace is stripped first: the canonical function accepts embedded
+   * newlines, which a strict decoder would otherwise reject. */
+  sek_buf_init(&packed, pool);
+  for (index = 0; '\0' != text[index]; index++) {
+    char ch = text[index];
+    if (' ' == ch || '\t' == ch || '\n' == ch || '\r' == ch || '\v' == ch || '\f' == ch) {
+      continue;
+    }
+    sek_buf_addch(&packed, ch);
+  }
+
+  if (0 != packed.len % 4) {
+    return NULL;
+  }
+
+  while (2 > pad && pad < packed.len && '=' == packed.data[packed.len - 1 - pad]) {
+    pad++;
+  }
+
+  for (index = 0; index + pad < packed.len; index++) {
+    if (0 > unb64digit(packed.data[index])) {
+      return NULL;
+    }
+  }
+
+  out = (unsigned char *)sek_alloc(pool, packed.len / 4 * 3 + 4);
+
+  for (index = 0; index + 3 < packed.len; index += 4) {
+    int a = unb64digit(packed.data[index]);
+    int b = unb64digit(packed.data[index + 1]);
+    int c = unb64digit(packed.data[index + 2]);
+    int d = unb64digit(packed.data[index + 3]);
+    unsigned int acc;
+
+    if (0 > a || 0 > b) {
+      return NULL;
+    }
+
+    acc = (unsigned int)(a << 18) | (unsigned int)(b << 12);
+    out[at++] = (unsigned char)((acc >> 16) & 0xff);
+
+    if (0 <= c) {
+      acc |= (unsigned int)(c << 6);
+      out[at++] = (unsigned char)((acc >> 8) & 0xff);
+    }
+    if (0 <= d) {
+      acc |= (unsigned int)d;
+      out[at++] = (unsigned char)(acc & 0xff);
+    }
+  }
+
+  out[at] = '\0';
+  *outlen = at;
+
+  return out;
+}
+
+/* ---- percent-encoding ---------------------------------------------- */
+
+/* RFC 3986 escaping, stricter than any stdlib encoder: the unreserved set
+ * is exactly A-Za-z0-9-_.~ and everything else, byte by byte over UTF-8,
+ * becomes %XX with UPPERCASE hex. `!'()*` are escaped, which is the gap
+ * against the usual encodeURIComponent. */
+char *sek_uriescape(sek_pool *pool, const char *text) {
+  static const char digits[] = "0123456789ABCDEF";
+  sek_buf out;
+  size_t index;
+
+  sek_buf_init(&out, pool);
+
+  for (index = 0; NULL != text && '\0' != text[index]; index++) {
+    unsigned char ch = (unsigned char)text[index];
+
+    if (('A' <= ch && 'Z' >= ch) || ('a' <= ch && 'z' >= ch) || ('0' <= ch && '9' >= ch) ||
+        '-' == ch || '_' == ch || '.' == ch || '~' == ch) {
+      sek_buf_addch(&out, (char)ch);
+    } else {
+      sek_buf_addch(&out, '%');
+      sek_buf_addch(&out, digits[(ch >> 4) & 0x0f]);
+      sek_buf_addch(&out, digits[ch & 0x0f]);
+    }
+  }
+
+  return out.data;
+}
+

package/project/.sdk/tm/c/feature/secrets/plugins/gcpsecrets.c

@@ -0,0 +1,177 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/gcpsecrets.c)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Google Secret Manager, with metadata-server login.
+ *
+ * A plugin because it opens a socket. The base64 it decodes a payload
+ * with lives in `encode.c` with the transport, not with the signer, so
+ * this kind links no SHA-256.
+ *
+ * A port of typescript/plugins/gcpsecrets.ts, which is canonical.
+ */
+
+#define _POSIX_C_SOURCE 200809L
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "support.h"
+
+typedef struct {
+  sek_pool *pool;
+  const char *project;
+  const char *token;
+  const char *addr;
+  const char *metadataaddr;
+  char *livetoken;
+  long long renewat;
+  char *described;
+} gcpdata;
+
+static sek_err gcp_login(gcpdata *data, char **out) {
+  sek_pool *pool = data->pool;
+  const char *configured = sek_first(data->token, getenv("GOOGLE_OAUTH_ACCESS_TOKEN"));
+  const char *base;
+  char *url;
+  sek_map *headers;
+  sek_answer res;
+  sek_err err;
+  const char *got;
+
+  if (!sek_empty(configured)) {
+    *out = sek_strdup(pool, configured);
+    return NULL;
+  }
+
+  if (!sek_empty(data->metadataaddr)) {
+    base = data->metadataaddr;
+  } else {
+    const char *host = getenv("GCE_METADATA_HOST");
+    base = sek_empty(host) ? "http://metadata.google.internal" : sek_fmt(pool, "http://%s", host);
+  }
+
+  url = sek_fmt(pool, "%s/computeMetadata/v1/instance/service-accounts/default/token",
+                sek_trimslash(pool, base));
+
+  headers = sek_map_new(pool);
+  sek_map_set(headers, "Metadata-Flavor", "Google");
+
+  /* The metadata call is plain http to a link-local host by platform
+   * design and carries no credential, so it is deliberately NOT
+   * checkaddr-guarded; the Secret Manager address is. */
+  err = sek_fetchjson(pool, "GET", url, headers, NULL, &res);
+  if (NULL != err) {
+    return err;
+  }
+
+  got = sek_json_text(pool, sek_json_dig(res.body, "access_token", NULL));
+  if (200 != res.status || sek_empty(got)) {
+    return sek_strdup(pool, "sekreto: gcp: no token and metadata server did not answer");
+  }
+
+  data->renewat = sek_renewtime(sek_json_dig(res.body, "expires_in", NULL));
+  *out = sek_strdup(pool, got);
+
+  return NULL;
+}
+
+static sek_err gcp_lookup(sek_provider *self, const char *name, char **out) {
+  gcpdata *data = (gcpdata *)self->data;
+  sek_pool *pool = data->pool;
+  const char *addr;
+  char *flat = NULL;
+  char *url;
+  sek_map *headers;
+  sek_answer res;
+  sek_err err;
+  const char *encoded;
+
+  *out = NULL;
+
+  if (sek_empty(data->project)) {
+    return sek_strdup(pool, "sekreto: gcp: no project");
+  }
+
+  addr = sek_first(data->addr, "https://secretmanager.googleapis.com");
+  err = sek_checkaddr(pool, addr);
+  if (NULL != err) {
+    return err;
+  }
+
+  if (NULL == data->livetoken || sek_nowms() >= data->renewat) {
+    err = gcp_login(data, &data->livetoken);
+    if (NULL != err) {
+      return err;
+    }
+  }
+
+  /* Dots flatten to `_`: Secret Manager ids have no hierarchy and reject
+   * dots. */
+  err = sek_flatname(pool, name, "_", &flat);
+  if (NULL != err) {
+    return err;
+  }
+
+  url = sek_fmt(pool, "%s/v1/projects/%s/secrets/%s/versions/latest:access",
+                sek_trimslash(pool, addr), data->project, flat);
+
+  headers = sek_map_new(pool);
+  sek_map_set(headers, "authorization", sek_fmt(pool, "Bearer %s", sek_orempty(data->livetoken)));
+
+  err = sek_fetchjson(pool, "GET", url, headers, NULL, &res);
+  if (NULL != err) {
+    return err;
+  }
+
+  if (404 == res.status) {
+    return NULL;
+  }
+
+  if (200 != res.status) {
+    return sek_fmt(pool, "sekreto: gcp error: %d: %s", res.status, url);
+  }
+
+  encoded = sek_json_asstr(sek_json_dig(res.body, "payload", "data", NULL));
+  if (NULL == encoded) {
+    return NULL;
+  }
+
+  {
+    size_t len = 0;
+    unsigned char *raw = sek_unbase64(pool, encoded, &len);
+
+    if (NULL == raw) {
+      return sek_strdup(pool, "sekreto: gcp: undecodable secret");
+    }
+
+    *out = sek_strndup(pool, (const char *)raw, len);
+  }
+
+  return NULL;
+}
+
+static const char *gcp_describe(sek_provider *self) {
+  return ((gcpdata *)self->data)->described;
+}
+
+/* ---- the definition ------------------------------------------------ */
+
+static sek_err gcpsecrets_make(sek_pool *pool, const sek_spec *spec, sek_provider **out) {
+  gcpdata *data = (gcpdata *)sek_alloc(pool, sizeof(gcpdata));
+  data->pool = pool;
+  data->project = sek_own(pool, spec->project);
+  data->token = sek_own(pool, spec->token);
+  data->addr = sek_own(pool, spec->addr);
+  data->metadataaddr = sek_own(pool, spec->metadataaddr);
+  data->livetoken = NULL;
+  data->renewat = SEK_NEVER;
+  data->described = sek_fmt(pool, "gcpsecrets:%s", sek_orempty(spec->project));
+  *out = sek_provider_new(pool, gcp_lookup, gcp_describe, data);
+  return NULL;
+}
+
+static sek_providerkind GCPSECRETS_KIND;
+
+Definition *sek_plugin_gcpsecrets(void) {
+  return sek_providerplugin(&GCPSECRETS_KIND, "gcpsecrets", gcpsecrets_make);
+}

package/project/.sdk/tm/c/feature/secrets/plugins/hashicorp.c

@@ -0,0 +1,239 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/hashicorp.c)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* HashiCorp Vault, over its HTTP API.
+ *
+ * KV v1 and v2, a configured token or a login (kubernetes, approle, jwt),
+ * and Vault Enterprise namespaces. A plugin because it opens a socket:
+ * `sekreto: unknown provider kind: hashicorp` is what a chain naming it
+ * gets when the consumer did not pass this definition in.
+ *
+ * A port of typescript/plugins/hashicorp.ts, which is canonical.
+ */
+
+#define _POSIX_C_SOURCE 200809L
+
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "support.h"
+
+typedef struct {
+  sek_pool *pool;
+  const char *addr;
+  const char *mount;
+  int kv;
+  const char *vaultnamespace;
+  sek_authspec *auth;
+  char *livetoken;
+  long long renewat;
+  char *described;
+} hashicorpdata;
+
+static sek_map *vaultheaders(hashicorpdata *data) {
+  sek_map *out = sek_map_new(data->pool);
+
+  /* A Vault Enterprise namespace rides the header on LOGINS as well as
+   * reads: a login to the wrong namespace fails in a way that reads like
+   * a bad credential. */
+  if (!sek_empty(data->vaultnamespace)) {
+    sek_map_set(out, "X-Vault-Namespace", data->vaultnamespace);
+  }
+
+  return out;
+}
+
+static sek_err hashicorp_login(hashicorpdata *data, char **out) {
+  sek_pool *pool = data->pool;
+  sek_authspec *use = data->auth;
+  char *url;
+  sek_json *payload;
+  sek_answer res;
+  sek_err err;
+  const char *got;
+
+  if (NULL == use) {
+    return sek_strdup(pool, "sekreto: hashicorp: no token and no auth method");
+  }
+
+  url = sek_fmt(pool, "%s/v1/auth/%s/login", sek_trimslash(pool, data->addr),
+                sek_first(use->mount, use->method));
+
+  if (NULL != use->method && 0 == strcmp(use->method, "kubernetes")) {
+    const char *jwt = use->jwt;
+
+    if (sek_empty(jwt)) {
+      const char *path = sek_empty(use->jwtfile)
+                             ? "/var/run/secrets/kubernetes.io/serviceaccount/token"
+                             : use->jwtfile;
+      int why = 0;
+      char *text = sek_readfile(pool, path, &why);
+
+      if (NULL == text) {
+        /* No underlying error text: the path is what a reader needs, and
+         * the strerror string follows the machine's locale. */
+        return sek_fmt(pool, "sekreto: hashicorp: cannot read jwt file %s", path);
+      }
+
+      {
+        size_t start = 0;
+        size_t end = strlen(text);
+        while (start < end && (' ' == text[start] || '\n' == text[start] || '\r' == text[start] ||
+                               '\t' == text[start])) {
+          start++;
+        }
+        while (end > start && (' ' == text[end - 1] || '\n' == text[end - 1] ||
+                               '\r' == text[end - 1] || '\t' == text[end - 1])) {
+          end--;
+        }
+        jwt = sek_strndup(pool, text + start, end - start);
+      }
+    }
+
+    payload = sek_json_obj(pool);
+    sek_json_set(pool, payload, "role", sek_json_str(pool, sek_orempty(use->role)));
+    sek_json_set(pool, payload, "jwt", sek_json_str(pool, jwt));
+  } else if (NULL != use->method && 0 == strcmp(use->method, "approle")) {
+    payload = sek_json_obj(pool);
+    sek_json_set(pool, payload, "role_id", sek_json_str(pool, sek_orempty(use->roleid)));
+    sek_json_set(pool, payload, "secret_id", sek_json_str(pool, sek_orempty(use->secretid)));
+  } else {
+    return sek_fmt(pool, "sekreto: hashicorp: unknown auth method: %s", sek_orempty(use->method));
+  }
+
+  err = sek_fetchjson(pool, "POST", url, vaultheaders(data), sek_json_stringify(pool, payload),
+                      &res);
+  if (NULL != err) {
+    return err;
+  }
+
+  got = sek_json_text(pool, sek_json_dig(res.body, "auth", "client_token", NULL));
+
+  /* A failed login is an ERROR, never a miss: it means this store could
+   * not answer at all. */
+  if (200 != res.status || sek_empty(got)) {
+    return sek_fmt(pool, "sekreto: hashicorp login failed: %d: %s", res.status, url);
+  }
+
+  data->renewat = sek_renewtime(sek_json_dig(res.body, "auth", "lease_duration", NULL));
+  *out = sek_strdup(pool, got);
+
+  return NULL;
+}
+
+static sek_err hashicorp_lookup(sek_provider *self, const char *name, char **out) {
+  hashicorpdata *data = (hashicorpdata *)self->data;
+  sek_pool *pool = data->pool;
+  sek_vaultref ref;
+  sek_map *headers;
+  sek_answer res;
+  sek_err err;
+  char *url;
+  sek_json *found;
+
+  *out = NULL;
+
+  err = sek_checkaddr(pool, data->addr);
+  if (NULL != err) {
+    return err;
+  }
+
+  if (NULL == data->livetoken || sek_nowms() >= data->renewat) {
+    err = hashicorp_login(data, &data->livetoken);
+    if (NULL != err) {
+      return err;
+    }
+  }
+
+  err = sek_vaultref_of(pool, name, &ref);
+  if (NULL != err) {
+    return err;
+  }
+
+  if (1 == data->kv) {
+    url = sek_fmt(pool, "%s/v1/%s/%s", sek_trimslash(pool, data->addr), data->mount, ref.path);
+  } else {
+    url = sek_fmt(pool, "%s/v1/%s/data/%s", sek_trimslash(pool, data->addr), data->mount, ref.path);
+  }
+
+  headers = vaultheaders(data);
+  sek_map_set(headers, "X-Vault-Token", sek_orempty(data->livetoken));
+
+  err = sek_fetchjson(pool, "GET", url, headers, NULL, &res);
+  if (NULL != err) {
+    return err;
+  }
+
+  /* A 404 means "not here" - a miss - so a vault can sit in a chain with
+   * fallbacks behind it. */
+  if (404 == res.status) {
+    return NULL;
+  }
+
+  if (200 != res.status) {
+    return sek_fmt(pool, "sekreto: hashicorp error: %d: %s", res.status, url);
+  }
+
+  if (1 == data->kv) {
+    found = sek_json_dig(res.body, "data", ref.field, NULL);
+  } else {
+    found = sek_json_dig(res.body, "data", "data", ref.field, NULL);
+  }
+
+  {
+    const char *text = sek_json_text(pool, found);
+    if (NULL != text) {
+      *out = sek_strdup(pool, text);
+    }
+  }
+
+  return NULL;
+}
+
+static const char *hashicorp_describe(sek_provider *self) {
+  return ((hashicorpdata *)self->data)->described;
+}
+
+/* ---- the definition ------------------------------------------------ */
+
+static sek_err hashicorp_make(sek_pool *pool, const sek_spec *spec, sek_provider **out) {
+  hashicorpdata *data = (hashicorpdata *)sek_alloc(pool, sizeof(hashicorpdata));
+  data->pool = pool;
+  data->addr = sek_own(pool, sek_orempty(spec->addr));
+  data->mount = sek_own(pool, sek_empty(spec->mount) ? "secret" : spec->mount);
+  data->kv = spec->haskv ? spec->kv : 2;
+  data->vaultnamespace = sek_own(pool, spec->vaultnamespace);
+  data->livetoken = sek_empty(spec->token) ? NULL : sek_strdup(pool, spec->token);
+  data->renewat = SEK_NEVER;
+  data->described = sek_fmt(pool, "hashicorp:%s/%s", data->addr, data->mount);
+
+  if (NULL != spec->auth) {
+    data->auth = (sek_authspec *)sek_alloc(pool, sizeof(sek_authspec));
+    data->auth->method = sek_own(pool, spec->auth->method);
+    data->auth->mount = sek_own(pool, spec->auth->mount);
+    data->auth->role = sek_own(pool, spec->auth->role);
+    data->auth->jwt = sek_own(pool, spec->auth->jwt);
+    data->auth->jwtfile = sek_own(pool, spec->auth->jwtfile);
+    data->auth->roleid = sek_own(pool, spec->auth->roleid);
+    data->auth->secretid = sek_own(pool, spec->auth->secretid);
+  } else {
+    data->auth = NULL;
+  }
+
+  /* A version typo like `kv: 3` must not quietly behave as v2 and turn
+   * its 404s into misses; there is nothing safe to assume it meant. So
+   * it is refused at CONSTRUCTION, before an address is even looked at. */
+  if (1 != data->kv && 2 != data->kv) {
+    return sek_fmt(pool, "sekreto: hashicorp: unsupported kv version: %d", data->kv);
+  }
+
+  *out = sek_provider_new(pool, hashicorp_lookup, hashicorp_describe, data);
+  return NULL;
+}
+
+static sek_providerkind HASHICORP_KIND;
+
+Definition *sek_plugin_hashicorp(void) {
+  return sek_providerplugin(&HASHICORP_KIND, "hashicorp", hashicorp_make);
+}