@voxgig/sdkgen 4.8.2 → 4.8.3

package/project/.sdk/tm/go/feature/secrets/plugins/httpjson/httpjson.go

@@ -0,0 +1,241 @@
+// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/httpjson/httpjson.go)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The HTTP half of every plugin that speaks to a store over the wire, in
+// one place and OUTSIDE the core: a chain of built-ins never links this
+// package, which is what keeps `net/http` out of a binary whose secrets
+// come from the environment and a .env file.
+//
+// One JSON round-trip, bounded in time and in size, refusing redirects and
+// ignoring proxies; and the small helpers every store client needs to read
+// a decoded body. A port of typescript/plugins/httpjson.ts.
+package httpjson
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"GOMODULE/feature/secrets/sekreto"
+)
+
+// A vault API never legitimately redirects, and a followed redirect would
+// carry X-Vault-Token to the redirect's host (and could downgrade https to
+// http) - checkaddr only validates the configured address, so it cannot
+// see the target. Refuse to follow one.
+var client = &http.Client{
+	Timeout: 10 * time.Second,
+	CheckRedirect: func(_ *http.Request, _ []*http.Request) error {
+		return http.ErrUseLastResponse
+	},
+	// A secrets client dials the address it was configured with and nowhere
+	// else. http.DefaultTransport reads HTTP_PROXY; its resolver exempts
+	// loopback, so the local dev vault was never exposed - but the GCP and
+	// Azure metadata endpoints are not loopback, and the access tokens they
+	// return would have gone through whatever the variable named, which can
+	// read them and substitute its own.
+	Transport: &http.Transport{Proxy: nil},
+}
+
+// maxbody is how much of a response body will be read before the store is
+// treated as having answered incoherently. Ports carry the same bound.
+//
+// Far above anything real - the largest legitimate payload this library
+// fetches is Doppler's whole-config download, measured in kilobytes. A bound
+// is needed because the TIMEOUT is not one: ten seconds on a loopback or
+// datacentre link is gigabytes, and the body is accumulated in memory before
+// it is parsed. This runs on an application's startup path, so the failure is
+// the application never starting.
+const maxbody = 8 * 1024 * 1024
+
+// SafeURL is a url with its query string removed, for messages.
+//
+// A query here carries the vault path, the secret name or a filter -
+// `secretPath=/prod/payments/stripe` - which does not belong in a log or a
+// stack trace. Every message in this file goes through it.
+//
+// It exists because the obvious spelling was silently defeated: the messages
+// used to strip the query themselves and then append err.Error(), and a
+// *url.Error prints as `Get "<full url>": <reason>` - putting the query
+// straight back. Stripping in one place, and using it on the wrapped error
+// too, is what makes the intent hold.
+func SafeURL(target string) string {
+	return strings.SplitN(target, "?", 2)[0]
+}
+
+// Call makes one JSON round-trip, returning the status and decoded
+// body. Network failure is always an error - an unreachable store is a
+// store that could not answer.
+func Call(method string, target string, headers map[string]string, payload string) (int, any, error) {
+	var reader io.Reader
+	if "" != payload {
+		reader = strings.NewReader(payload)
+	}
+
+	request, err := http.NewRequest(method, target, reader)
+	if nil != err {
+		return 0, nil, sekreto.Fail("sekreto: bad url: " + SafeURL(target))
+	}
+
+	for key, value := range headers {
+		request.Header.Set(key, value)
+	}
+
+	response, err := client.Do(request)
+	if nil != err {
+		// The error is scrubbed too, not just the prefix: *url.Error prints
+		// as `Get "<full url>": <reason>`, so appending it verbatim undid
+		// the stripping on the line above.
+		return 0, nil, sekreto.Fail("sekreto: cannot reach " + SafeURL(target) + ": " +
+			strings.ReplaceAll(err.Error(), target, SafeURL(target)))
+	}
+	defer response.Body.Close()
+
+	// LimitReader, not ReadAll: an endless body would otherwise be
+	// accumulated in memory until the deadline, which on a loopback or
+	// datacentre link is gigabytes. One byte over the bound is enough to
+	// know it was exceeded.
+	text, err := io.ReadAll(io.LimitReader(response.Body, maxbody+1))
+	if nil != err {
+		return response.StatusCode, nil, sekreto.Fail("sekreto: cannot read " + SafeURL(target))
+	}
+	if maxbody < int64(len(text)) {
+		return response.StatusCode, nil, sekreto.Fail("sekreto: oversized response from " + SafeURL(target))
+	}
+
+	var body any
+	if err := json.Unmarshal(text, &body); nil != err {
+		// A success status promised JSON; a body that does not parse means
+		// the store could not answer coherently, and treating it as a miss
+		// would fall through to a weaker store. Error statuses may carry
+		// any body - they are decided on status alone.
+		if http.StatusOK == response.StatusCode {
+			return response.StatusCode, nil, sekreto.Fail("sekreto: malformed response from " +
+				SafeURL(target))
+		}
+		body = nil
+	}
+
+	return response.StatusCode, body, nil
+}
+
+// Get GETs a URL, returning the status and decoded body. A 404 is a
+// normal answer here, not a failure: it means the vault has no such secret.
+func Get(target string, headers map[string]string) (int, any, error) {
+	return Call(http.MethodGet, target, headers, "")
+}
+
+// Dig walks a decoded JSON body by key, answering nil as soon as a step is
+// not an object or the key is absent.
+func Dig(body any, keys ...string) any {
+	node := body
+
+	for _, key := range keys {
+		object, is := node.(map[string]any)
+		if !is {
+			return nil
+		}
+		node = object[key]
+	}
+
+	return node
+}
+
+// DigText is Dig rendered as text, with nil (and so any missing step)
+// answering the empty string.
+func DigText(body any, keys ...string) string {
+	value := Dig(body, keys...)
+	if nil == value {
+		return ""
+	}
+	return ToString(value)
+}
+
+// ToNumber reads a decoded JSON value as a number the way the canonical
+// port's Number() does: numbers pass through, numeric strings parse
+// (Azure's IMDS hands expires_in back as a string), and anything else -
+// missing, malformed - is zero.
+func ToNumber(value any) float64 {
+	switch typed := value.(type) {
+	case float64:
+		return typed
+	case string:
+		number, err := strconv.ParseFloat(typed, 64)
+		if nil != err {
+			return 0
+		}
+		return number
+	default:
+		return 0
+	}
+}
+
+// Expiry is the moment a login token should be renewed: shortly before
+// its lifetime (in seconds, from the login response) runs out. A missing
+// or zero lifetime answers the zero time, which means never renew.
+func Expiry(lifetime any) time.Time {
+	seconds := ToNumber(lifetime)
+	if 0 >= seconds {
+		return time.Time{}
+	}
+
+	wait := seconds - 60
+	if 1 > wait {
+		wait = 1
+	}
+
+	return time.Now().Add(time.Duration(wait * float64(time.Second)))
+}
+
+// Due reports whether a renewal moment has arrived; the zero time never
+// arrives.
+func Due(renewat time.Time) bool {
+	return !renewat.IsZero() && !time.Now().Before(renewat)
+}
+
+// ToString renders a decoded JSON scalar the way the canonical port's
+// String() does.
+func ToString(value any) string {
+	switch typed := value.(type) {
+	case string:
+		return typed
+	case bool:
+		return strconv.FormatBool(typed)
+	case float64:
+		return strconv.FormatFloat(typed, 'f', -1, 64)
+	default:
+		text, err := json.Marshal(typed)
+		if nil != err {
+			return ""
+		}
+		return string(text)
+	}
+}
+
+// Escape is RFC 3986 escaping, which is stricter than most standard
+// escapers: everything but the unreserved characters is escaped, with
+// uppercase hex - `!`, `'`, `(`, `)` and `*` included. It is what AWS
+// signing wants, and what the canonical port's encodeURIComponent-built
+// query strings decode identically from.
+func Escape(text string) string {
+	const hexdigit = "0123456789ABCDEF"
+
+	var out strings.Builder
+
+	for _, char := range []byte(text) {
+		if 'A' <= char && 'Z' >= char || 'a' <= char && 'z' >= char ||
+			'0' <= char && '9' >= char ||
+			'-' == char || '_' == char || '.' == char || '~' == char {
+			out.WriteByte(char)
+		} else {
+			out.WriteByte('%')
+			out.WriteByte(hexdigit[char>>4])
+			out.WriteByte(hexdigit[char&0xf])
+		}
+	}
+
+	return out.String()
+}

package/project/.sdk/tm/go/feature/secrets/plugins/infisical/infisical.go

@@ -0,0 +1,151 @@
+// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/infisical/infisical.go)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The infisical plugin: Infisical. Needs HTTPS. A port of
+// typescript/plugins/infisical.ts.
+package infisical
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"GOMODULE/feature/secrets/plugins/httpjson"
+	"GOMODULE/feature/secrets/sekreto"
+)
+
+// Provider reads Infisical.
+//
+// api.token reads the secret keyed API_TOKEN (Infisical's own convention
+// is environment-style keys) at a secret path in one environment of a
+// project. Auth is a token, or a universal-auth (machine identity) login
+// with clientid/clientsecret.
+type Provider struct {
+	Addr         string
+	Token        string
+	ClientID     string
+	ClientSecret string
+	Project      string
+	Environment  string
+	Path         string
+	// A configured token is kept forever; a universal-auth token carries
+	// expiresIn and is renewed shortly before it runs out.
+	livetoken string
+	havetoken bool
+	renewat   time.Time
+	mu        sync.Mutex
+}
+
+func (provider *Provider) login(addr string) (string, error) {
+	if "" != provider.Token {
+		return provider.Token, nil
+	}
+
+	if "" == provider.ClientID || "" == provider.ClientSecret {
+		return "", sekreto.Fail("sekreto: infisical: no token and no client credentials")
+	}
+
+	payload, _ := json.Marshal(struct {
+		ClientID     string `json:"clientId"`
+		ClientSecret string `json:"clientSecret"`
+	}{ClientID: provider.ClientID, ClientSecret: provider.ClientSecret})
+
+	status, body, err := httpjson.Call(http.MethodPost, addr+"/api/v1/auth/universal-auth/login",
+		map[string]string{"content-type": "application/json"}, string(payload))
+	if nil != err {
+		return "", err
+	}
+
+	got := httpjson.DigText(body, "accessToken")
+	if http.StatusOK != status || "" == got {
+		return "", sekreto.Fail("sekreto: infisical login failed: " + strconv.Itoa(status))
+	}
+
+	provider.renewat = httpjson.Expiry(httpjson.Dig(body, "expiresIn"))
+
+	return got, nil
+}
+
+func (provider *Provider) Lookup(name string) (string, bool, error) {
+	// Serialize per-provider access: Lookup reads and refreshes the cached
+	// login token, and a secrets client may resolve from several goroutines.
+	provider.mu.Lock()
+	defer provider.mu.Unlock()
+
+	addr := provider.Addr
+	if "" == addr {
+		addr = "https://app.infisical.com"
+	}
+	addr = strings.TrimSuffix(addr, "/")
+	if err := sekreto.CheckAddr(addr); nil != err {
+		return "", false, err
+	}
+
+	if "" == provider.Project || "" == provider.Environment {
+		return "", false, sekreto.Fail("sekreto: infisical: no project/environment")
+	}
+
+	if !provider.havetoken || httpjson.Due(provider.renewat) {
+		token, err := provider.login(addr)
+		if nil != err {
+			return "", false, err
+		}
+		provider.livetoken = token
+		provider.havetoken = true
+	}
+
+	key, err := sekreto.EnvKey(name, "")
+	if nil != err {
+		return "", false, err
+	}
+
+	path := provider.Path
+	if "" == path {
+		path = "/"
+	}
+	target := addr + "/api/v3/secrets/raw/" + key +
+		"?workspaceId=" + httpjson.Escape(provider.Project) +
+		"&environment=" + httpjson.Escape(provider.Environment) +
+		"&secretPath=" + httpjson.Escape(path)
+
+	status, body, err := httpjson.Get(target,
+		map[string]string{"authorization": "Bearer " + provider.livetoken})
+	if nil != err {
+		return "", false, err
+	}
+
+	if http.StatusNotFound == status {
+		return "", false, nil
+	}
+
+	if http.StatusOK != status {
+		return "", false, sekreto.Fail("sekreto: infisical error: " + strconv.Itoa(status))
+	}
+
+	value := httpjson.Dig(body, "secret", "secretValue")
+	if nil == value {
+		return "", false, nil
+	}
+
+	return httpjson.ToString(value), true, nil
+}
+
+func (provider *Provider) Describe() string {
+	return "infisical:" + provider.Project + "/" + provider.Environment
+}
+
+// Plugin is the `infisical` provider kind, as a voxgig/plugin definition.
+var Plugin = sekreto.ProviderPlugin("infisical", func(spec *sekreto.ProviderSpec) (sekreto.Provider, error) {
+	return &Provider{
+		Addr:         spec.Addr,
+		Token:        spec.Token,
+		ClientID:     spec.ClientID,
+		ClientSecret: spec.ClientSecret,
+		Project:      spec.Project,
+		Environment:  spec.Environment,
+		Path:         spec.Path,
+	}, nil
+})

package/project/.sdk/tm/go/feature/secrets/plugins/onepassword/onepassword.go

@@ -0,0 +1,152 @@
+// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/onepassword/onepassword.go)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The onepassword plugin: 1Password, through a Connect server. Needs
+// HTTPS. A port of typescript/plugins/onepassword.ts.
+package onepassword
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+
+	"GOMODULE/feature/secrets/plugins/httpjson"
+	"GOMODULE/feature/secrets/sekreto"
+)
+
+// Provider reads 1Password, through a Connect server.
+//
+// The item titled api.token (titles keep their dots), in the named vault.
+// The value is the field with purpose PASSWORD, or the field labelled
+// `value`. A vault that cannot be found is an error - config names it, so
+// its absence is a broken store, not a missing secret.
+type Provider struct {
+	Addr  string
+	Token string
+	Vault string
+	// Guards the memoised state below: a Sekreto may resolve from several
+	// goroutines, and a racy map read is either a crash or a zero value - a
+	// MISS where the store does hold the secret, which falls through to a
+	// weaker store.
+	mu        sync.Mutex
+	vaultid   string
+	havevault bool
+}
+
+func (provider *Provider) auth() map[string]string {
+	return map[string]string{"authorization": "Bearer " + provider.Token}
+}
+
+func (provider *Provider) resolvevault(addr string) (string, error) {
+	want := provider.Vault
+	if "" == want {
+		return "", sekreto.Fail("sekreto: onepassword: no vault")
+	}
+
+	status, body, err := httpjson.Get(addr+"/v1/vaults", provider.auth())
+	if nil != err {
+		return "", err
+	}
+
+	list, is := body.([]any)
+	if http.StatusOK != status || !is {
+		return "", sekreto.Fail("sekreto: onepassword error: " + strconv.Itoa(status) + ": listing vaults")
+	}
+
+	for _, entry := range list {
+		if want == httpjson.DigText(entry, "id") || want == httpjson.DigText(entry, "name") {
+			return httpjson.DigText(entry, "id"), nil
+		}
+	}
+
+	return "", sekreto.Fail("sekreto: onepassword: no vault named " + want)
+}
+
+func (provider *Provider) Lookup(name string) (string, bool, error) {
+	if err := sekreto.CheckName(name); nil != err {
+		return "", false, err
+	}
+
+	addr := strings.TrimSuffix(provider.Addr, "/")
+	if "" == addr {
+		return "", false, sekreto.Fail("sekreto: onepassword: no addr")
+	}
+	if err := sekreto.CheckAddr(addr); nil != err {
+		return "", false, err
+	}
+
+	provider.mu.Lock()
+	if !provider.havevault {
+		vaultid, err := provider.resolvevault(addr)
+		if nil != err {
+			provider.mu.Unlock()
+			return "", false, err
+		}
+		provider.vaultid = vaultid
+		provider.havevault = true
+	}
+	vaultid := provider.vaultid
+	provider.mu.Unlock()
+
+	filter := httpjson.Escape(`title eq "` + name + `"`)
+	status, body, err := httpjson.Get(
+		addr+"/v1/vaults/"+vaultid+"/items?filter="+filter, provider.auth())
+	if nil != err {
+		return "", false, err
+	}
+
+	found, is := body.([]any)
+	if http.StatusOK != status || !is {
+		return "", false, sekreto.Fail("sekreto: onepassword error: " + strconv.Itoa(status) +
+			": finding " + name)
+	}
+
+	if 0 == len(found) {
+		return "", false, nil
+	}
+
+	itemid := httpjson.DigText(found[0], "id")
+	status, body, err = httpjson.Get(
+		addr+"/v1/vaults/"+vaultid+"/items/"+itemid, provider.auth())
+	if nil != err {
+		return "", false, err
+	}
+
+	if http.StatusOK != status {
+		return "", false, sekreto.Fail("sekreto: onepassword error: " + strconv.Itoa(status) +
+			": reading " + name)
+	}
+
+	fields, _ := httpjson.Dig(body, "fields").([]any)
+
+	for _, field := range fields {
+		if "PASSWORD" == httpjson.DigText(field, "purpose") {
+			value := httpjson.Dig(field, "value")
+			if nil == value {
+				return "", false, nil
+			}
+			return httpjson.ToString(value), true, nil
+		}
+	}
+	for _, field := range fields {
+		if "value" == httpjson.DigText(field, "label") {
+			value := httpjson.Dig(field, "value")
+			if nil == value {
+				return "", false, nil
+			}
+			return httpjson.ToString(value), true, nil
+		}
+	}
+
+	return "", false, nil
+}
+
+func (provider *Provider) Describe() string {
+	return "onepassword:" + provider.Vault
+}
+
+// Plugin is the `onepassword` provider kind, as a voxgig/plugin definition.
+var Plugin = sekreto.ProviderPlugin("onepassword", func(spec *sekreto.ProviderSpec) (sekreto.Provider, error) {
+	return &Provider{Addr: spec.Addr, Token: spec.Token, Vault: spec.Vault}, nil
+})

package/project/.sdk/tm/go/feature/secrets/plugins/secretspec/secretspec.go

@@ -0,0 +1,143 @@
+// VENDORED: @voxgig/sekreto sdk-20260904-1610-0 (go/plugins/secretspec/secretspec.go)
+// Source: https://github.com/voxgig/sekreto @ a5a00db6e6d3a1ddbdef7ac62e8a75be53a9e042  [tag: sdk-20260904-1610-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The secretspec plugin: SecretSpec, through its CLI. Needs a child
+// process. A port of typescript/plugins/secretspec.ts.
+package secretspec
+
+import (
+	"bytes"
+	"errors"
+	"os/exec"
+	"strconv"
+	"strings"
+
+	"GOMODULE/feature/secrets/sekreto"
+)
+
+// Provider reads SecretSpec (https://secretspec.dev).
+//
+// SecretSpec is a declaration - a secretspec.toml naming the secrets a
+// project needs - plus a chain of its own backends to satisfy them from.
+// That makes it the same shape as sekreto one level down, and the reason to
+// support it is the same reason sekreto exists: a project that has already
+// declared its secrets there should not have to declare them again here.
+//
+// Read through its CLI, as boru is, because that is the interface it offers
+// a program in another language: `secretspec get API_TOKEN` prints the value
+// on stdout and nothing else. A sekreto name maps to a SecretSpec key
+// exactly as it maps to an environment variable - api.token is API_TOKEN -
+// which is the convention SecretSpec's own examples use.
+//
+// Backend selects one of SecretSpec's backends (--provider, e.g. `keyring`
+// or `dotenv://.env`) and is called Backend here only because Provider
+// already means something else in this library.
+//
+// A reason is required, not optional: SecretSpec records every read in an
+// audit log and refuses to read at all without one. sekreto sends `sekreto`
+// unless told otherwise, so the audit trail says which tool asked.
+type Provider struct {
+	Command string
+	File    string
+	Profile string
+	Backend string
+	Reason  string
+	Prefix  string
+}
+
+func (provider *Provider) command() string {
+	if "" == provider.Command {
+		return "secretspec"
+	}
+	return provider.Command
+}
+
+func (provider *Provider) Lookup(name string) (string, bool, error) {
+	key, err := sekreto.EnvKey(name, provider.Prefix)
+	if nil != err {
+		return "", false, err
+	}
+
+	args := []string{}
+	if "" != provider.File {
+		args = append(args, "--file", provider.File)
+	}
+	args = append(args, "get", key)
+	if "" != provider.Backend {
+		args = append(args, "--provider", provider.Backend)
+	}
+	if "" != provider.Profile {
+		args = append(args, "--profile", provider.Profile)
+	}
+	reason := provider.Reason
+	if "" == reason {
+		reason = "sekreto"
+	}
+	args = append(args, "--reason", reason)
+
+	run := exec.Command(provider.command(), args...)
+
+	var out, errout bytes.Buffer
+	run.Stdout = &out
+	run.Stderr = &errout
+
+	runerr := run.Run()
+
+	if nil == runerr {
+		// The value and one newline, and nothing else.
+		return strings.TrimSuffix(out.String(), "\n"), true, nil
+	}
+
+	var exiterr *exec.ExitError
+	if !errors.As(runerr, &exiterr) {
+		return "", false, sekreto.Fail("sekreto: cannot run " + provider.command() + ": " + runerr.Error())
+	}
+
+	why := strings.TrimSpace(errout.String())
+
+	if secretspecmiss(why, key) {
+		return "", false, nil
+	}
+
+	if "" == why {
+		why = "exit " + strconv.Itoa(exiterr.ExitCode())
+	}
+
+	return "", false, sekreto.Fail("sekreto: secretspec error: " + why)
+}
+
+func (provider *Provider) Describe() string {
+	if "" != provider.Backend {
+		return "secretspec:" + provider.Backend
+	}
+	return "secretspec"
+}
+
+// secretspecmiss reports whether a SecretSpec failure means "no such secret"
+// rather than "I could not answer".
+//
+// SecretSpec says `Secret 'API_TOKEN' not found` for both a name it does not
+// declare and one declared with no value, and both are misses: this store
+// does not hold it, so the chain carries on.
+//
+// MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
+// `Provider backend 'keyring' not found`, which is a store that could not
+// answer at all - and reading that as a miss is the worst failure this
+// library has, because the chain then falls through to a weaker store
+// without saying so. The key is required to appear, so the two cannot be
+// confused.
+func secretspecmiss(why string, key string) bool {
+	return strings.Contains(why, "Secret '"+key+"' not found")
+}
+
+// Plugin is the `secretspec` provider kind, as a voxgig/plugin definition.
+var Plugin = sekreto.ProviderPlugin("secretspec", func(spec *sekreto.ProviderSpec) (sekreto.Provider, error) {
+	return &Provider{
+		Command: spec.Command,
+		File:    spec.File,
+		Profile: spec.Profile,
+		Backend: spec.Backend,
+		Reason:  spec.Reason,
+		Prefix:  spec.Prefix,
+	}, nil
+})