@voxgig/sdkgen 4.10.0 → 4.12.0

package/project/.sdk/tm/c/feature/secrets/plugins/infisical.c

@@ -0,0 +1,165 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/infisical.c)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Infisical, with universal-auth login.
+ *
+ * A plugin because it opens a socket.
+ *
+ * A port of typescript/plugins/infisical.ts, which is canonical.
+ */
+
+#define _POSIX_C_SOURCE 200809L
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "support.h"
+
+typedef struct {
+  sek_pool *pool;
+  const char *addr;
+  const char *token;
+  const char *clientid;
+  const char *clientsecret;
+  const char *project;
+  const char *environment;
+  const char *path;
+  char *livetoken;
+  long long renewat;
+  char *described;
+} infisicaldata;
+
+static sek_err infisical_login(infisicaldata *data, const char *addr, char **out) {
+  sek_pool *pool = data->pool;
+  sek_json *payload;
+  sek_map *headers;
+  sek_answer res;
+  sek_err err;
+  const char *got;
+
+  if (!sek_empty(data->token)) {
+    *out = sek_strdup(pool, data->token);
+    return NULL;
+  }
+
+  if (sek_empty(data->clientid) || sek_empty(data->clientsecret)) {
+    return sek_strdup(pool, "sekreto: infisical: no token and no client credentials");
+  }
+
+  payload = sek_json_obj(pool);
+  sek_json_set(pool, payload, "clientId", sek_json_str(pool, data->clientid));
+  sek_json_set(pool, payload, "clientSecret", sek_json_str(pool, data->clientsecret));
+
+  headers = sek_map_new(pool);
+  sek_map_set(headers, "content-type", "application/json");
+
+  err = sek_fetchjson(pool, "POST", sek_fmt(pool, "%s/api/v1/auth/universal-auth/login", addr),
+                      headers, sek_json_stringify(pool, payload), &res);
+  if (NULL != err) {
+    return err;
+  }
+
+  got = sek_json_text(pool, sek_json_dig(res.body, "accessToken", NULL));
+  if (200 != res.status || sek_empty(got)) {
+    return sek_fmt(pool, "sekreto: infisical login failed: %d", res.status);
+  }
+
+  /* camelCase, unlike everyone else's expires_in. */
+  data->renewat = sek_renewtime(sek_json_dig(res.body, "expiresIn", NULL));
+  *out = sek_strdup(pool, got);
+
+  return NULL;
+}
+
+static sek_err infisical_lookup(sek_provider *self, const char *name, char **out) {
+  infisicaldata *data = (infisicaldata *)self->data;
+  sek_pool *pool = data->pool;
+  char *addr = sek_trimslash(pool, sek_first(data->addr, "https://app.infisical.com"));
+  char *key = NULL;
+  char *url;
+  sek_map *headers;
+  sek_answer res;
+  sek_err err = sek_checkaddr(pool, addr);
+  const char *text;
+
+  *out = NULL;
+
+  if (NULL != err) {
+    return err;
+  }
+
+  if (sek_empty(data->project) || sek_empty(data->environment)) {
+    return sek_strdup(pool, "sekreto: infisical: no project/environment");
+  }
+
+  if (NULL == data->livetoken || sek_nowms() >= data->renewat) {
+    err = infisical_login(data, addr, &data->livetoken);
+    if (NULL != err) {
+      return err;
+    }
+  }
+
+  /* envkey here takes NO prefix: Infisical's own convention is plain
+   * environment-style keys. */
+  err = sek_envkey(pool, name, NULL, &key);
+  if (NULL != err) {
+    return err;
+  }
+
+  url = sek_fmt(pool, "%s/api/v3/secrets/raw/%s?workspaceId=%s&environment=%s&secretPath=%s", addr,
+                key, sek_uriescape(pool, data->project), sek_uriescape(pool, data->environment),
+                sek_uriescape(pool, sek_first(data->path, "/")));
+
+  headers = sek_map_new(pool);
+  sek_map_set(headers, "authorization", sek_fmt(pool, "Bearer %s", sek_orempty(data->livetoken)));
+
+  err = sek_fetchjson(pool, "GET", url, headers, NULL, &res);
+  if (NULL != err) {
+    return err;
+  }
+
+  if (404 == res.status) {
+    return NULL;
+  }
+
+  if (200 != res.status) {
+    return sek_fmt(pool, "sekreto: infisical error: %d", res.status);
+  }
+
+  text = sek_json_text(pool, sek_json_dig(res.body, "secret", "secretValue", NULL));
+  if (NULL != text) {
+    *out = sek_strdup(pool, text);
+  }
+
+  return NULL;
+}
+
+static const char *infisical_describe(sek_provider *self) {
+  return ((infisicaldata *)self->data)->described;
+}
+
+/* ---- the definition ------------------------------------------------ */
+
+static sek_err infisical_make(sek_pool *pool, const sek_spec *spec, sek_provider **out) {
+  infisicaldata *data = (infisicaldata *)sek_alloc(pool, sizeof(infisicaldata));
+  data->pool = pool;
+  data->addr = sek_own(pool, spec->addr);
+  data->token = sek_own(pool, spec->token);
+  data->clientid = sek_own(pool, spec->clientid);
+  data->clientsecret = sek_own(pool, spec->clientsecret);
+  data->project = sek_own(pool, spec->project);
+  data->environment = sek_own(pool, spec->environment);
+  data->path = sek_own(pool, spec->path);
+  data->livetoken = NULL;
+  data->renewat = SEK_NEVER;
+  data->described = sek_fmt(pool, "infisical:%s/%s", sek_orempty(spec->project),
+                            sek_orempty(spec->environment));
+  *out = sek_provider_new(pool, infisical_lookup, infisical_describe, data);
+  return NULL;
+}
+
+static sek_providerkind INFISICAL_KIND;
+
+Definition *sek_plugin_infisical(void) {
+  return sek_providerplugin(&INFISICAL_KIND, "infisical", infisical_make);
+}

package/project/.sdk/tm/c/feature/secrets/plugins/onepassword.c

@@ -0,0 +1,194 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/onepassword.c)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* 1Password Connect.
+ *
+ * A plugin because it opens a socket.
+ *
+ * A port of typescript/plugins/onepassword.ts, which is canonical.
+ */
+
+#define _POSIX_C_SOURCE 200809L
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "support.h"
+
+typedef struct {
+  sek_pool *pool;
+  const char *addr;
+  const char *token;
+  const char *vault;
+  char *vaultid;
+  char *described;
+} onepassworddata;
+
+static sek_map *opauth(onepassworddata *data) {
+  sek_map *out = sek_map_new(data->pool);
+
+  sek_map_set(out, "authorization", sek_fmt(data->pool, "Bearer %s", sek_orempty(data->token)));
+
+  return out;
+}
+
+/* The vault id, resolved once and memoised. A vault that cannot be found
+ * is an ERROR, not a miss: config names it, so its absence is a broken
+ * store rather than a missing secret. */
+static sek_err opvault(onepassworddata *data, const char *addr, char **out) {
+  sek_pool *pool = data->pool;
+  sek_answer res;
+  sek_err err;
+  const sek_json *list;
+  size_t index;
+
+  if (sek_empty(data->vault)) {
+    return sek_strdup(pool, "sekreto: onepassword: no vault");
+  }
+
+  err = sek_fetchjson(pool, "GET", sek_fmt(pool, "%s/v1/vaults", addr), opauth(data), NULL, &res);
+  if (NULL != err) {
+    return err;
+  }
+
+  list = sek_json_asarr(res.body);
+  if (200 != res.status || NULL == list) {
+    return sek_fmt(pool, "sekreto: onepassword error: %d: listing vaults", res.status);
+  }
+
+  for (index = 0; index < list->itemlen; index++) {
+    const char *id = sek_json_text(pool, sek_json_dig(list->items[index], "id", NULL));
+    const char *label = sek_json_text(pool, sek_json_dig(list->items[index], "name", NULL));
+
+    if ((NULL != id && 0 == strcmp(data->vault, id)) ||
+        (NULL != label && 0 == strcmp(data->vault, label))) {
+      *out = sek_strdup(pool, sek_orempty(id));
+      return NULL;
+    }
+  }
+
+  return sek_fmt(pool, "sekreto: onepassword: no vault named %s", data->vault);
+}
+
+static sek_err onepassword_lookup(sek_provider *self, const char *name, char **out) {
+  onepassworddata *data = (onepassworddata *)self->data;
+  sek_pool *pool = data->pool;
+  sek_err err = sek_checkname(pool, name);
+  char *addr;
+  sek_answer found;
+  sek_answer item;
+  const sek_json *items;
+  const sek_json *fields;
+  size_t index;
+
+  *out = NULL;
+
+  if (NULL != err) {
+    return err;
+  }
+
+  addr = sek_trimslash(pool, sek_orempty(data->addr));
+  if (sek_empty(addr)) {
+    return sek_strdup(pool, "sekreto: onepassword: no addr");
+  }
+
+  err = sek_checkaddr(pool, addr);
+  if (NULL != err) {
+    return err;
+  }
+
+  if (NULL == data->vaultid) {
+    err = opvault(data, addr, &data->vaultid);
+    if (NULL != err) {
+      return err;
+    }
+  }
+
+  /* Item titles keep their dots. */
+  err = sek_fetchjson(
+      pool, "GET",
+      sek_fmt(pool, "%s/v1/vaults/%s/items?filter=%s", addr, data->vaultid,
+              sek_uriescape(pool, sek_fmt(pool, "title eq \"%s\"", name))),
+      opauth(data), NULL, &found);
+  if (NULL != err) {
+    return err;
+  }
+
+  items = sek_json_asarr(found.body);
+  if (200 != found.status || NULL == items) {
+    return sek_fmt(pool, "sekreto: onepassword error: %d: finding %s", found.status, name);
+  }
+
+  /* An empty list is the secret not being there: a miss. */
+  if (0 == items->itemlen) {
+    return NULL;
+  }
+
+  err = sek_fetchjson(pool, "GET",
+                      sek_fmt(pool, "%s/v1/vaults/%s/items/%s", addr, data->vaultid,
+                              sek_orempty(sek_json_text(pool, sek_json_dig(items->items[0], "id",
+                                                                          NULL)))),
+                      opauth(data), NULL, &item);
+  if (NULL != err) {
+    return err;
+  }
+
+  if (200 != item.status) {
+    return sek_fmt(pool, "sekreto: onepassword error: %d: reading %s", item.status, name);
+  }
+
+  fields = sek_json_asarr(sek_json_dig(item.body, "fields", NULL));
+  if (NULL == fields) {
+    return NULL;
+  }
+
+  /* Two full passes, in this order: the password field first, then a
+   * field labelled `value`. */
+  for (index = 0; index < fields->itemlen; index++) {
+    const char *purpose = sek_json_asstr(sek_json_dig(fields->items[index], "purpose", NULL));
+    if (NULL != purpose && 0 == strcmp(purpose, "PASSWORD")) {
+      const char *value = sek_json_text(pool, sek_json_dig(fields->items[index], "value", NULL));
+      if (NULL != value) {
+        *out = sek_strdup(pool, value);
+      }
+      return NULL;
+    }
+  }
+
+  for (index = 0; index < fields->itemlen; index++) {
+    const char *label = sek_json_asstr(sek_json_dig(fields->items[index], "label", NULL));
+    if (NULL != label && 0 == strcmp(label, "value")) {
+      const char *value = sek_json_text(pool, sek_json_dig(fields->items[index], "value", NULL));
+      if (NULL != value) {
+        *out = sek_strdup(pool, value);
+      }
+      return NULL;
+    }
+  }
+
+  return NULL;
+}
+
+static const char *onepassword_describe(sek_provider *self) {
+  return ((onepassworddata *)self->data)->described;
+}
+
+/* ---- the definition ------------------------------------------------ */
+
+static sek_err onepassword_make(sek_pool *pool, const sek_spec *spec, sek_provider **out) {
+  onepassworddata *data = (onepassworddata *)sek_alloc(pool, sizeof(onepassworddata));
+  data->pool = pool;
+  data->addr = sek_own(pool, spec->addr);
+  data->token = sek_own(pool, spec->token);
+  data->vault = sek_own(pool, spec->vault);
+  data->vaultid = NULL;
+  data->described = sek_fmt(pool, "onepassword:%s", sek_orempty(spec->vault));
+  *out = sek_provider_new(pool, onepassword_lookup, onepassword_describe, data);
+  return NULL;
+}
+
+static sek_providerkind ONEPASSWORD_KIND;
+
+Definition *sek_plugin_onepassword(void) {
+  return sek_providerplugin(&ONEPASSWORD_KIND, "onepassword", onepassword_make);
+}

package/project/.sdk/tm/c/feature/secrets/plugins/proc.c

@@ -0,0 +1,233 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (c/plugins/proc.c)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260911-2013-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+/* Running a child: the ONE object in this library that forks.
+ *
+ * The boru and secretspec providers read their secret from a CLI, which
+ * is the interface those tools offer a program in another language. Two
+ * things about doing that are not optional.
+ *
+ * BOTH STREAMS ARE DRAINED CONCURRENTLY. Reading stdout to EOF and only
+ * then reading stderr deadlocks the moment the child writes more than one
+ * pipe buffer (64 KiB on Linux) to stderr: the parent waits on stdout,
+ * the child waits for room on stderr, and neither can move. Nothing here
+ * sets a timeout, so that hang is permanent - get() simply never returns.
+ * secretspec's diagnostics are box-drawn and reach that size easily. A
+ * single poll() over both pipes is what avoids it.
+ *
+ * THE CHILD'S STDIN IS AT EOF, not an open pipe nobody writes to, so a
+ * CLI that reads it - one prompting for a passphrase when its environment
+ * variable is absent - gives up instead of waiting forever.
+ *
+ * argv is an array and never a shell string, and no secret is ever put on
+ * a command line, where the process table publishes it.
+ */
+
+#define _POSIX_C_SOURCE 200809L
+
+#include <errno.h>
+#include <fcntl.h>
+#include <poll.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include "support.h"
+
+static void drainpipe(sek_buf *into, int fd) {
+  char chunk[4096];
+  ssize_t got = read(fd, chunk, sizeof(chunk));
+
+  if (0 < got) {
+    sek_buf_addn(into, chunk, (size_t)got);
+  }
+}
+
+sek_err sek_runcmd(sek_pool *pool, char *const argv[], const char *command, const char *envkey,
+                   const char *envval, sek_ran *out) {
+  int outpipe[2];
+  int errpipe[2];
+  int failpipe[2];
+  pid_t child;
+  sek_buf stdoutbuf;
+  sek_buf stderrbuf;
+  int status = 0;
+  int childerrno = 0;
+
+  out->out = NULL;
+  out->why = NULL;
+  out->status = 0;
+
+  if (0 != pipe(outpipe)) {
+    return sek_fmt(pool, "sekreto: cannot run %s: %s", command, strerror(errno));
+  }
+  if (0 != pipe(errpipe)) {
+    close(outpipe[0]);
+    close(outpipe[1]);
+    return sek_fmt(pool, "sekreto: cannot run %s: %s", command, strerror(errno));
+  }
+  /* A close-on-exec pipe: the child writes its errno into it if exec
+   * fails, and the successful exec closes it silently. Without it a
+   * missing binary is indistinguishable from one that ran and exited. */
+  if (0 != pipe(failpipe)) {
+    close(outpipe[0]);
+    close(outpipe[1]);
+    close(errpipe[0]);
+    close(errpipe[1]);
+    return sek_fmt(pool, "sekreto: cannot run %s: %s", command, strerror(errno));
+  }
+  fcntl(failpipe[1], F_SETFD, FD_CLOEXEC);
+
+  child = fork();
+
+  if (0 > child) {
+    close(outpipe[0]);
+    close(outpipe[1]);
+    close(errpipe[0]);
+    close(errpipe[1]);
+    close(failpipe[0]);
+    close(failpipe[1]);
+    return sek_fmt(pool, "sekreto: cannot run %s: %s", command, strerror(errno));
+  }
+
+  if (0 == child) {
+    int devnull = open("/dev/null", O_RDONLY);
+    int problem;
+
+    if (0 <= devnull) {
+      dup2(devnull, 0);
+      close(devnull);
+    } else {
+      close(0);
+    }
+
+    dup2(outpipe[1], 1);
+    dup2(errpipe[1], 2);
+
+    close(outpipe[0]);
+    close(outpipe[1]);
+    close(errpipe[0]);
+    close(errpipe[1]);
+    close(failpipe[0]);
+
+    if (NULL != envkey && NULL != envval) {
+      setenv(envkey, envval, 1);
+    }
+
+    execvp(argv[0], argv);
+
+    problem = errno;
+    if (sizeof(problem) != (size_t)write(failpipe[1], &problem, sizeof(problem))) {
+      /* Nothing left to do: the parent will see a closed pipe and an
+       * exit status instead. */
+    }
+    _exit(127);
+  }
+
+  close(outpipe[1]);
+  close(errpipe[1]);
+  close(failpipe[1]);
+
+  sek_buf_init(&stdoutbuf, pool);
+  sek_buf_init(&stderrbuf, pool);
+
+  {
+    struct pollfd watch[2];
+    int open_count = 2;
+
+    watch[0].fd = outpipe[0];
+    watch[1].fd = errpipe[0];
+    watch[0].events = POLLIN;
+    watch[1].events = POLLIN;
+
+    while (0 < open_count) {
+      int ready;
+
+      watch[0].revents = 0;
+      watch[1].revents = 0;
+
+      ready = poll(watch, 2, -1);
+      if (0 > ready) {
+        if (EINTR == errno) {
+          continue;
+        }
+        break;
+      }
+
+      {
+        int index;
+        for (index = 0; index < 2; index++) {
+          if (0 > watch[index].fd) {
+            continue;
+          }
+
+          if (0 != (watch[index].revents & POLLIN)) {
+            drainpipe(0 == index ? &stdoutbuf : &stderrbuf, watch[index].fd);
+          }
+
+          if (0 != (watch[index].revents & (POLLHUP | POLLERR))) {
+            /* Drain whatever is still buffered before letting go: a
+             * short-lived child can write and exit between two polls. */
+            for (;;) {
+              char chunk[4096];
+              ssize_t got = read(watch[index].fd, chunk, sizeof(chunk));
+              if (0 >= got) {
+                break;
+              }
+              sek_buf_addn(0 == index ? &stdoutbuf : &stderrbuf, chunk, (size_t)got);
+            }
+            close(watch[index].fd);
+            watch[index].fd = -1;
+            open_count--;
+          }
+        }
+      }
+    }
+
+    if (0 <= watch[0].fd) {
+      close(watch[0].fd);
+    }
+    if (0 <= watch[1].fd) {
+      close(watch[1].fd);
+    }
+  }
+
+  if (sizeof(childerrno) != (size_t)read(failpipe[0], &childerrno, sizeof(childerrno))) {
+    childerrno = 0;
+  }
+  close(failpipe[0]);
+
+  while (0 > waitpid(child, &status, 0)) {
+    if (EINTR != errno) {
+      break;
+    }
+  }
+
+  if (0 != childerrno) {
+    return sek_fmt(pool, "sekreto: cannot run %s: %s", command, strerror(childerrno));
+  }
+
+  out->out = stdoutbuf.data;
+
+  /* stderr trimmed, because the miss/failure decision is made on its
+   * text and a trailing newline is not part of what a tool said. */
+  {
+    size_t start = 0;
+    size_t end = stderrbuf.len;
+    while (start < end && (' ' == stderrbuf.data[start] || '\n' == stderrbuf.data[start] ||
+                           '\r' == stderrbuf.data[start] || '\t' == stderrbuf.data[start])) {
+      start++;
+    }
+    while (end > start && (' ' == stderrbuf.data[end - 1] || '\n' == stderrbuf.data[end - 1] ||
+                           '\r' == stderrbuf.data[end - 1] || '\t' == stderrbuf.data[end - 1])) {
+      end--;
+    }
+    out->why = sek_strndup(pool, stderrbuf.data + start, end - start);
+  }
+
+  out->status = WIFEXITED(status) ? WEXITSTATUS(status) : 1;
+
+  return NULL;
+}