@voxgig/sdkgen 4.8.2 → 4.9.0

package/project/.sdk/tm/go/feature/secrets/plugins/aws/aws.go

@@ -0,0 +1,292 @@
+// VENDORED: @voxgig/sekreto sdk-20260907-0029-0 (go/plugins/aws/aws.go)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The aws plugin: Secrets Manager and SSM Parameter Store, with requests
+// SigV4-signed in-tree (sigv4.go, beside this file). Needs HTTPS and
+// HMAC-SHA256 - the one cryptographic dependency in the library, which is
+// why this is a plugin and why the core never imports crypto. A port of
+// typescript/plugins/aws.ts.
+package aws
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"GOMODULE/feature/secrets/plugins/httpjson"
+	"GOMODULE/feature/secrets/sekreto"
+)
+
+// awsnow is the YYYYMMDDTHHMMSSZ timestamp SigV4 wants, for now.
+func awsnow() string {
+	return time.Now().UTC().Format("20060102T150405Z")
+}
+
+// awscreds is a resolved set of AWS credentials.
+type awscreds struct {
+	region  string
+	keyid   string
+	secret  string
+	session string
+}
+
+// awsauth resolves region and credentials, from config first and the
+// standard AWS_* environment variables second - those are AWS's own
+// convention, and a pod or CI job that has them set should just work.
+// Missing either is an error: an AWS store with no credentials could not
+// answer.
+func awsauth(region string, keyid string, secret string, session string) (*awscreds, error) {
+	if "" == region {
+		region = os.Getenv("AWS_REGION")
+	}
+	if "" == region {
+		region = os.Getenv("AWS_DEFAULT_REGION")
+	}
+	if "" == keyid {
+		keyid = os.Getenv("AWS_ACCESS_KEY_ID")
+	}
+	if "" == secret {
+		secret = os.Getenv("AWS_SECRET_ACCESS_KEY")
+	}
+	if "" == session {
+		session = os.Getenv("AWS_SESSION_TOKEN")
+	}
+
+	if "" == region {
+		return nil, sekreto.Fail("sekreto: aws: no region (set region or AWS_REGION)")
+	}
+	if "" == keyid || "" == secret {
+		return nil, sekreto.Fail("sekreto: aws: no credentials (set keyid/secret or " +
+			"AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)")
+	}
+
+	return &awscreds{region: region, keyid: keyid, secret: secret, session: session}, nil
+}
+
+// awscall makes one signed call to an AWS JSON-1.1 API.
+func awscall(
+	region string, keyid string, secret string, session string, addr string,
+	service string, target string, payload string,
+) (int, any, error) {
+	auth, err := awsauth(region, keyid, secret, session)
+	if nil != err {
+		return 0, nil, err
+	}
+
+	if "" == addr {
+		// The China partition lives under its own suffix; every other
+		// commercial region is plain amazonaws.com.
+		suffix := ".amazonaws.com"
+		if strings.HasPrefix(auth.region, "cn-") {
+			suffix = ".amazonaws.com.cn"
+		}
+		addr = "https://" + service + "." + auth.region + suffix
+	}
+	if err := sekreto.CheckAddr(addr); nil != err {
+		return 0, nil, err
+	}
+
+	requrl := strings.TrimSuffix(addr, "/") + "/"
+	headers := map[string]string{
+		"content-type": "application/x-amz-json-1.1",
+		"x-amz-target": target,
+	}
+
+	signed, err := SigV4(&Sigv4Input{
+		Method:   http.MethodPost,
+		URL:      requrl,
+		Headers:  headers,
+		Body:     payload,
+		Service:  service,
+		Region:   auth.region,
+		KeyID:    auth.keyid,
+		Secret:   auth.secret,
+		Session:  auth.session,
+		Datetime: awsnow(),
+	})
+	if nil != err {
+		return 0, nil, err
+	}
+
+	for key, value := range signed {
+		headers[key] = value
+	}
+
+	return httpjson.Call(http.MethodPost, requrl, headers, payload)
+}
+
+// awsmiss reports whether this AWS error body names one of the not-found
+// types. Those are a miss; every other failure is a store that could not
+// answer.
+func awsmiss(body any, types []string) bool {
+	errtype, _ := httpjson.Dig(body, "__type").(string)
+
+	for _, name := range types {
+		if strings.Contains(errtype, name) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// SecretsProvider reads AWS Secrets Manager.
+//
+// api.token reads the secret named `api` (the vaultref path, so
+// db.pass.main reads db/pass) and takes the `token` field of its JSON
+// SecretString - the AWS idiom of one JSON map per secret. A SecretString
+// that is not JSON is the value itself, under the conventional field
+// `value`. Requests are SigV4-signed in-tree; see sigv4.go.
+type SecretsProvider struct {
+	Region  string
+	KeyID   string
+	Secret  string
+	Session string
+	Addr    string
+}
+
+func (provider *SecretsProvider) Lookup(name string) (string, bool, error) {
+	ref, err := sekreto.NameVaultRef(name)
+	if nil != err {
+		return "", false, err
+	}
+
+	payload, _ := sekreto.WriteJSON(struct {
+		SecretID string `json:"SecretId"`
+	}{SecretID: ref.Path})
+
+	status, body, err := awscall(
+		provider.Region, provider.KeyID, provider.Secret, provider.Session, provider.Addr,
+		"secretsmanager", "secretsmanager.GetSecretValue", string(payload))
+	if nil != err {
+		return "", false, err
+	}
+
+	if http.StatusBadRequest == status && awsmiss(body, []string{"ResourceNotFoundException"}) {
+		return "", false, nil
+	}
+
+	if http.StatusOK != status {
+		return "", false, sekreto.Fail("sekreto: aws secretsmanager error: " + strconv.Itoa(status))
+	}
+
+	text, is := httpjson.Dig(body, "SecretString").(string)
+
+	if !is {
+		// A binary secret has no fields to address; only the conventional
+		// `value` field can mean "the bytes themselves".
+		bin, is := httpjson.Dig(body, "SecretBinary").(string)
+		if is && "value" == ref.Field {
+			// The error was discarded, so a corrupted payload decoded to
+			// whatever came before the bad byte and was returned as the
+			// secret. A store that answered incoherently is an error.
+			decoded, err := base64.StdEncoding.DecodeString(bin)
+			if nil != err {
+				return "", false, sekreto.Fail("sekreto: aws secretsmanager: undecodable secret")
+			}
+			return string(decoded), true, nil
+		}
+		return "", false, nil
+	}
+
+	var parsed map[string]any
+	if err := json.Unmarshal([]byte(text), &parsed); nil == err && nil != parsed {
+		value, has := parsed[ref.Field]
+		if !has || nil == value {
+			return "", false, nil
+		}
+		return httpjson.ToString(value), true, nil
+	}
+
+	// A plain-string secret is the whole value; it has no named fields.
+	if "value" == ref.Field {
+		return text, true, nil
+	}
+
+	return "", false, nil
+}
+
+// Config only, never the environment: Describe feeds the spec's sources
+// group, which must answer the same everywhere.
+func (provider *SecretsProvider) Describe() string {
+	return "awssecrets:" + provider.Region
+}
+
+// ParamsProvider reads AWS SSM Parameter Store.
+//
+// db.pass.main reads the parameter /db/pass/main (under an optional prefix
+// path), decrypted. Parameter Store carries flat strings, so there is no
+// field indirection.
+type ParamsProvider struct {
+	Region  string
+	KeyID   string
+	Secret  string
+	Session string
+	Addr    string
+	Prefix  string
+}
+
+func (provider *ParamsProvider) Lookup(name string) (string, bool, error) {
+	param, err := sekreto.AwsParam(name, provider.Prefix)
+	if nil != err {
+		return "", false, err
+	}
+
+	payload, _ := sekreto.WriteJSON(struct {
+		Name           string `json:"Name"`
+		WithDecryption bool   `json:"WithDecryption"`
+	}{Name: param, WithDecryption: true})
+
+	status, body, err := awscall(
+		provider.Region, provider.KeyID, provider.Secret, provider.Session, provider.Addr,
+		"ssm", "AmazonSSM.GetParameter", string(payload))
+	if nil != err {
+		return "", false, err
+	}
+
+	if http.StatusBadRequest == status && awsmiss(body, []string{"ParameterNotFound"}) {
+		return "", false, nil
+	}
+
+	if http.StatusOK != status {
+		return "", false, sekreto.Fail("sekreto: aws ssm error: " + strconv.Itoa(status))
+	}
+
+	value := httpjson.Dig(body, "Parameter", "Value")
+	if nil == value {
+		return "", false, nil
+	}
+
+	return httpjson.ToString(value), true, nil
+}
+
+func (provider *ParamsProvider) Describe() string {
+	return "awsparams:" + provider.Region + provider.Prefix
+}
+
+// Secrets is the `awssecrets` provider kind, as a voxgig/plugin definition.
+var Secrets = sekreto.ProviderPlugin("awssecrets", func(spec *sekreto.ProviderSpec) (sekreto.Provider, error) {
+	return &SecretsProvider{
+		Region:  spec.Region,
+		KeyID:   spec.KeyID,
+		Secret:  spec.Secret,
+		Session: spec.Session,
+		Addr:    spec.Addr,
+	}, nil
+})
+
+// Params is the `awsparams` provider kind, as a voxgig/plugin definition.
+var Params = sekreto.ProviderPlugin("awsparams", func(spec *sekreto.ProviderSpec) (sekreto.Provider, error) {
+	return &ParamsProvider{
+		Region:  spec.Region,
+		KeyID:   spec.KeyID,
+		Secret:  spec.Secret,
+		Session: spec.Session,
+		Addr:    spec.Addr,
+		Prefix:  spec.Prefix,
+	}, nil
+})

package/project/.sdk/tm/go/feature/secrets/plugins/aws/sigv4.go

@@ -0,0 +1,201 @@
+// VENDORED: @voxgig/sekreto sdk-20260907-0029-0 (go/plugins/aws/sigv4.go)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// AWS Signature Version 4, hand-rolled.
+//
+// The AWS providers need exactly one thing from the AWS SDK - request
+// signing - and taking the SDK for it would break the no-dependency rule
+// that keeps ten ports honest. SigV4 is a stable, published algorithm
+// built from HMAC-SHA256, which the standard library already has.
+//
+// SigV4 is pure: the caller passes the timestamp, so the same input yields
+// the same signature everywhere. That is what lets the shared spec carry
+// known-answer cases that all ten ports must reproduce bit-for-bit, and
+// lets the integration mock recompute the signature server-side.
+//
+// A port of typescript/plugins/sigv4.ts, which is canonical. It lives
+// with the aws plugin because it is the one place the library needs
+// HMAC-SHA256, and a built-in must not.
+
+package aws
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"net/url"
+	"regexp"
+	"sort"
+	"strings"
+
+	"GOMODULE/feature/secrets/plugins/httpjson"
+	"GOMODULE/feature/secrets/sekreto"
+)
+
+// Sigv4Input is one request to sign. The JSON tags match the shared
+// spec's sigv4 group, so a spec case decodes straight into it.
+type Sigv4Input struct {
+	Method string `json:"method"`
+	// URL is the full request URL; the host, path and query are signed.
+	URL string `json:"url"`
+	// Headers are extra headers to sign, e.g. content-type and
+	// x-amz-target.
+	Headers map[string]string `json:"headers"`
+	Body    string            `json:"body"`
+	Service string            `json:"service"`
+	Region  string            `json:"region"`
+	KeyID   string            `json:"keyid"`
+	Secret  string            `json:"secret"`
+	// Session is the STS session token; signed as x-amz-security-token
+	// when present.
+	Session string `json:"session"`
+	// Datetime is the signing moment, YYYYMMDDTHHMMSSZ. Passed in, never
+	// sampled, so the function stays pure.
+	Datetime string `json:"datetime"`
+}
+
+// whitespace is one run of whitespace, collapsed to a single space in
+// canonical header values.
+var whitespace = regexp.MustCompile(`\s+`)
+
+func sha256hex(text string) string {
+	sum := sha256.Sum256([]byte(text))
+	return hex.EncodeToString(sum[:])
+}
+
+func hmacsha256(key []byte, text string) []byte {
+	mac := hmac.New(sha256.New, key)
+	mac.Write([]byte(text))
+	return mac.Sum(nil)
+}
+
+// percentdecode undoes percent-encoding without treating `+` as a space,
+// the way the canonical port's decodeURIComponent does. A malformed
+// escape is left as it came - there is nothing better to sign.
+func percentdecode(text string) string {
+	decoded, err := url.PathUnescape(text)
+	if nil != err {
+		return text
+	}
+	return decoded
+}
+
+// canonicalquery is the canonical query string: each pair RFC 3986-escaped,
+// sorted by escaped key then escaped value.
+func canonicalquery(query string) string {
+	if "" == query {
+		return ""
+	}
+
+	pairs := [][2]string{}
+	for _, pair := range strings.Split(query, "&") {
+		key := pair
+		value := ""
+		if eq := strings.Index(pair, "="); -1 != eq {
+			key = pair[:eq]
+			value = pair[eq+1:]
+		}
+		pairs = append(pairs, [2]string{
+			httpjson.Escape(percentdecode(key)),
+			httpjson.Escape(percentdecode(value)),
+		})
+	}
+
+	sort.Slice(pairs, func(left, right int) bool {
+		if pairs[left][0] != pairs[right][0] {
+			return pairs[left][0] < pairs[right][0]
+		}
+		return pairs[left][1] < pairs[right][1]
+	})
+
+	parts := []string{}
+	for _, pair := range pairs {
+		parts = append(parts, pair[0]+"="+pair[1])
+	}
+
+	return strings.Join(parts, "&")
+}
+
+// SigV4 signs one request. It returns the headers to attach: authorization,
+// x-amz-date, and x-amz-security-token when a session token was given.
+func SigV4(input *Sigv4Input) (map[string]string, error) {
+	parsed, err := url.Parse(input.URL)
+	if nil != err {
+		return nil, sekreto.Fail("sekreto: sigv4: bad url: " + input.URL)
+	}
+
+	date := input.Datetime
+	if 8 < len(date) {
+		date = date[:8]
+	}
+	body := input.Body
+
+	// Every header that will be signed: the caller's extras, plus host and
+	// x-amz-date (and the session token when present), lower-cased and
+	// trimmed the way the canonical form requires.
+	// Canonical header values are trimmed AND internally collapsed -
+	// AWS folds sequential whitespace to one space before signing, so a
+	// header like "a  b" must sign as "a b" or the service refuses it.
+	headers := map[string]string{}
+	for key, value := range input.Headers {
+		headers[strings.ToLower(key)] = whitespace.ReplaceAllString(strings.TrimSpace(value), " ")
+	}
+	headers["host"] = parsed.Host
+	headers["x-amz-date"] = input.Datetime
+	if "" != input.Session {
+		headers["x-amz-security-token"] = input.Session
+	}
+
+	names := []string{}
+	for name := range headers {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+
+	var canonicalheaders strings.Builder
+	for _, name := range names {
+		canonicalheaders.WriteString(name + ":" + headers[name] + "\n")
+	}
+	signedheaders := strings.Join(names, ";")
+
+	path := parsed.EscapedPath()
+	if "" == path {
+		path = "/"
+	}
+
+	canonicalrequest := strings.Join([]string{
+		strings.ToUpper(input.Method),
+		path,
+		canonicalquery(parsed.RawQuery),
+		canonicalheaders.String(),
+		signedheaders,
+		sha256hex(body),
+	}, "\n")
+
+	scope := date + "/" + input.Region + "/" + input.Service + "/aws4_request"
+
+	stringtosign := strings.Join([]string{
+		"AWS4-HMAC-SHA256",
+		input.Datetime,
+		scope,
+		sha256hex(canonicalrequest),
+	}, "\n")
+
+	kdate := hmacsha256([]byte("AWS4"+input.Secret), date)
+	kregion := hmacsha256(kdate, input.Region)
+	kservice := hmacsha256(kregion, input.Service)
+	ksigning := hmacsha256(kservice, "aws4_request")
+	signature := hex.EncodeToString(hmacsha256(ksigning, stringtosign))
+
+	out := map[string]string{
+		"authorization": "AWS4-HMAC-SHA256 Credential=" + input.KeyID + "/" + scope +
+			", SignedHeaders=" + signedheaders + ", Signature=" + signature,
+		"x-amz-date": input.Datetime,
+	}
+
+	if "" != input.Session {
+		out["x-amz-security-token"] = input.Session
+	}
+
+	return out, nil
+}

package/project/.sdk/tm/go/feature/secrets/plugins/azuresecrets/azuresecrets.go

@@ -0,0 +1,187 @@
+// VENDORED: @voxgig/sekreto sdk-20260907-0029-0 (go/plugins/azuresecrets/azuresecrets.go)
+// Source: https://github.com/voxgig/sekreto @ 86ba35a646e68a311bdece43cd5689369ca62e9d  [tag: sdk-20260907-0029-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The azuresecrets plugin: Azure Key Vault. Needs HTTPS. A port of
+// typescript/plugins/azuresecrets.ts.
+package azuresecrets
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"GOMODULE/feature/secrets/plugins/httpjson"
+	"GOMODULE/feature/secrets/sekreto"
+)
+
+// azureresource is the audience Azure Key Vault tokens are scoped to.
+const azureresource = "https://vault.azure.net"
+
+// Provider reads Azure Key Vault.
+//
+// api.token reads secret api-token (dots flattened to `-`; Key Vault names
+// allow nothing else), current version. The token comes from config, then
+// a client-credentials login when tenant/clientid/clientsecret are given,
+// then the IMDS managed-identity endpoint - so on Azure's own platform no
+// credential configuration is needed.
+//
+// As with GCP, the IMDS call is plain http to a link-local host by
+// platform design and carries no credential; the login and vault addresses
+// are checkaddr-guarded.
+type Provider struct {
+	Vault        string
+	Token        string
+	Tenant       string
+	ClientID     string
+	ClientSecret string
+	LoginAddr    string
+	ImdsAddr     string
+	ApiVersion   string
+	// A configured token is kept forever; logged-in and IMDS tokens carry
+	// expires_in and are renewed shortly before they run out.
+	livetoken string
+	havetoken bool
+	renewat   time.Time
+	mu        sync.Mutex
+}
+
+func (provider *Provider) login() (string, error) {
+	if "" != provider.Token {
+		return provider.Token, nil
+	}
+
+	if "" != provider.Tenant && "" != provider.ClientID && "" != provider.ClientSecret {
+		loginaddr := provider.LoginAddr
+		if "" == loginaddr {
+			loginaddr = "https://login.microsoftonline.com"
+		}
+		if err := sekreto.CheckAddr(loginaddr); nil != err {
+			return "", err
+		}
+
+		target := strings.TrimSuffix(loginaddr, "/") + "/" + provider.Tenant +
+			"/oauth2/v2.0/token"
+		form := "grant_type=client_credentials&client_id=" + httpjson.Escape(provider.ClientID) +
+			"&client_secret=" + httpjson.Escape(provider.ClientSecret) +
+			"&scope=" + httpjson.Escape(azureresource+"/.default")
+
+		status, body, err := httpjson.Call(http.MethodPost, target,
+			map[string]string{"content-type": "application/x-www-form-urlencoded"}, form)
+		if nil != err {
+			return "", err
+		}
+
+		got := httpjson.DigText(body, "access_token")
+		if http.StatusOK != status || "" == got {
+			return "", sekreto.Fail("sekreto: azure login failed: " + strconv.Itoa(status))
+		}
+
+		provider.renewat = httpjson.Expiry(httpjson.Dig(body, "expires_in"))
+		return got, nil
+	}
+
+	imdsaddr := provider.ImdsAddr
+	if "" == imdsaddr {
+		imdsaddr = "http://169.254.169.254"
+	}
+	imds := strings.TrimSuffix(imdsaddr, "/") +
+		"/metadata/identity/oauth2/token?api-version=2018-02-01&resource=" +
+		httpjson.Escape(azureresource)
+
+	status, body, err := httpjson.Get(imds, map[string]string{"Metadata": "true"})
+	if nil != err {
+		return "", err
+	}
+
+	got := httpjson.DigText(body, "access_token")
+	if http.StatusOK != status || "" == got {
+		return "", sekreto.Fail("sekreto: azure: no token, no client credentials, and IMDS did not answer")
+	}
+
+	provider.renewat = httpjson.Expiry(httpjson.Dig(body, "expires_in"))
+	return got, nil
+}
+
+func (provider *Provider) Lookup(name string) (string, bool, error) {
+	// Serialize per-provider access: Lookup reads and refreshes the cached
+	// login token, and a secrets client may resolve from several goroutines.
+	provider.mu.Lock()
+	defer provider.mu.Unlock()
+
+	if "" == provider.Vault {
+		return "", false, sekreto.Fail("sekreto: azure: no vault")
+	}
+
+	// Only an explicit scheme is a URL; a vault NAMED httpvault must
+	// still become https://httpvault.vault.azure.net.
+	vaulturl := provider.Vault
+	if !strings.HasPrefix(vaulturl, "http://") && !strings.HasPrefix(vaulturl, "https://") {
+		vaulturl = "https://" + vaulturl + ".vault.azure.net"
+	}
+	if err := sekreto.CheckAddr(vaulturl); nil != err {
+		return "", false, err
+	}
+
+	if !provider.havetoken || httpjson.Due(provider.renewat) {
+		token, err := provider.login()
+		if nil != err {
+			return "", false, err
+		}
+		provider.livetoken = token
+		provider.havetoken = true
+	}
+
+	flat, err := sekreto.FlatName(name, "-")
+	if nil != err {
+		return "", false, err
+	}
+
+	apiversion := provider.ApiVersion
+	if "" == apiversion {
+		apiversion = "7.4"
+	}
+	target := strings.TrimSuffix(vaulturl, "/") + "/secrets/" + flat +
+		"?api-version=" + apiversion
+
+	status, body, err := httpjson.Get(target,
+		map[string]string{"authorization": "Bearer " + provider.livetoken})
+	if nil != err {
+		return "", false, err
+	}
+
+	if http.StatusNotFound == status {
+		return "", false, nil
+	}
+
+	if http.StatusOK != status {
+		return "", false, sekreto.Fail("sekreto: azure error: " + strconv.Itoa(status) + ": " +
+			httpjson.SafeURL(target))
+	}
+
+	value := httpjson.Dig(body, "value")
+	if nil == value {
+		return "", false, nil
+	}
+
+	return httpjson.ToString(value), true, nil
+}
+
+func (provider *Provider) Describe() string {
+	return "azuresecrets:" + provider.Vault
+}
+
+// Plugin is the `azuresecrets` provider kind, as a voxgig/plugin definition.
+var Plugin = sekreto.ProviderPlugin("azuresecrets", func(spec *sekreto.ProviderSpec) (sekreto.Provider, error) {
+	return &Provider{
+		Vault:        spec.Vault,
+		Token:        spec.Token,
+		Tenant:       spec.Tenant,
+		ClientID:     spec.ClientID,
+		ClientSecret: spec.ClientSecret,
+		LoginAddr:    spec.LoginAddr,
+		ImdsAddr:     spec.ImdsAddr,
+		ApiVersion:   spec.ApiVersion,
+	}, nil
+})