@voxgig/sdkgen 4.8.3 → 4.10.0

package/project/.sdk/tm/php/feature/secrets/sekreto/plugins/aws.php

@@ -0,0 +1,274 @@
+<?php
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (php/plugins/aws.php)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+
+/**
+ * AWS Secrets Manager and SSM Parameter Store, as voxgig/plugin
+ * definitions - TWO kinds from one file, because they share request signing
+ * and the credential chain.
+ *
+ * A PLUGIN, not a built-in, and the sharpest instance of why: it opens a
+ * socket AND it signs, so `sigv4.php` - the only hashing in this port - is
+ * required from here and from nowhere in the core.
+ */
+
+declare(strict_types=1);
+
+namespace Voxgig\Sekreto\Plugins;
+
+require_once __DIR__ . '/../src/Providers.php';
+require_once __DIR__ . '/../src/Addr.php';
+require_once __DIR__ . '/httpjson.php';
+require_once __DIR__ . '/sigv4.php';
+
+use Voxgig\Sekreto\Name;
+use Voxgig\Sekreto\Provider;
+use Voxgig\Sekreto\SekretoError;
+
+use function Voxgig\Sekreto\checkaddr;
+use function Voxgig\Sekreto\providerplugin;
+use function Voxgig\Sekreto\writejson;
+
+/** The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now. */
+function awsnow(): string
+{
+    return gmdate('Ymd\THis\Z');
+}
+
+/**
+ * Region and credentials, from config first and the standard AWS_*
+ * environment variables second - those are AWS's own convention, and a
+ * pod or CI job that has them set should just work. Missing either is an
+ * error: an AWS store with no credentials could not answer.
+ *
+ * @param array<string, mixed> $opts
+ * @return array{region: string, keyid: string, secret: string, session: ?string}
+ */
+function awsauth(array $opts): array
+{
+    $region = ($opts['region'] ?? null)
+        ?: (getenv('AWS_REGION') ?: (getenv('AWS_DEFAULT_REGION') ?: ''));
+    $keyid = ($opts['keyid'] ?? null) ?: (getenv('AWS_ACCESS_KEY_ID') ?: '');
+    $secret = ($opts['secret'] ?? null) ?: (getenv('AWS_SECRET_ACCESS_KEY') ?: '');
+    $session = ($opts['session'] ?? null) ?: (getenv('AWS_SESSION_TOKEN') ?: null);
+
+    if ('' === $region) {
+        throw new SekretoError('sekreto: aws: no region (set region or AWS_REGION)');
+    }
+    if ('' === $keyid || '' === $secret) {
+        throw new SekretoError(
+            'sekreto: aws: no credentials'
+            . ' (set keyid/secret or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)'
+        );
+    }
+
+    return ['region' => $region, 'keyid' => $keyid, 'secret' => $secret, 'session' => $session];
+}
+
+/**
+ * One signed call to an AWS JSON-1.1 API.
+ *
+ * @param array<string, mixed> $opts
+ * @param array<string, mixed> $payload
+ * @return array{0: int, 1: mixed}
+ */
+function awscall(array $opts, string $service, string $target, array $payload): array
+{
+    $auth = awsauth($opts);
+    // The China partition lives under its own suffix; every other
+    // commercial region is plain amazonaws.com.
+    $suffix = str_starts_with($auth['region'], 'cn-') ? '.amazonaws.com.cn' : '.amazonaws.com';
+    $addr = ($opts['addr'] ?? null)
+        ?: 'https://' . $service . '.' . $auth['region'] . $suffix;
+    checkaddr($addr);
+
+    $url = preg_replace('#/$#', '', $addr) . '/';
+    // writejson, so the body signed here is byte-identical to the canonical
+    // port's JSON.stringify output: unescaped slashes AND unescaped unicode.
+    // With only the slashes turned off, a non-ASCII secret path still signed
+    // different bytes from every other port.
+    $body = writejson($payload);
+    $headers = [
+        'content-type' => 'application/x-amz-json-1.1',
+        'x-amz-target' => $target,
+    ];
+
+    $signed = sigv4([
+        'method' => 'POST',
+        'url' => $url,
+        'headers' => $headers,
+        'body' => $body,
+        'service' => $service,
+        'region' => $auth['region'],
+        'keyid' => $auth['keyid'],
+        'secret' => $auth['secret'],
+        'session' => $auth['session'],
+        'datetime' => awsnow(),
+    ]);
+
+    $lines = [];
+    foreach (array_merge($headers, $signed) as $key => $value) {
+        $lines[] = $key . ': ' . $value;
+    }
+
+    return fetchjson('POST', $url, $lines, $body);
+}
+
+/**
+ * Does this AWS error body name one of the not-found types? Those are a
+ * miss; every other failure is a store that could not answer.
+ *
+ * @param array<int, string> $types
+ */
+function awsmiss(mixed $body, array $types): bool
+{
+    $errtype = is_array($body) && is_string($body['__type'] ?? null) ? $body['__type'] : '';
+
+    foreach ($types as $name) {
+        if (str_contains($errtype, $name)) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
+/**
+ * AWS Secrets Manager.
+ *
+ * `api.token` reads the secret named `api` (the vaultref path, so
+ * `db.pass.main` reads `db/pass`) and takes the `token` field of its JSON
+ * SecretString - the AWS idiom of one JSON map per secret. A SecretString
+ * that is not JSON is the value itself, under the conventional field
+ * `value`. Requests are SigV4-signed in-tree; see sigv4.php.
+ */
+class AwsSecretsProvider implements Provider
+{
+    /** @param array<string, mixed> $opts */
+    public function __construct(private array $opts = [])
+    {
+    }
+
+    public function lookup(string $name): ?string
+    {
+        $ref = Name::vaultref($name);
+
+        [$status, $body] = awscall(
+            $this->opts,
+            'secretsmanager',
+            'secretsmanager.GetSecretValue',
+            ['SecretId' => $ref['path']]
+        );
+
+        if (400 === $status && awsmiss($body, ['ResourceNotFoundException'])) {
+            return null;
+        }
+
+        if (200 !== $status) {
+            throw new SekretoError('sekreto: aws secretsmanager error: ' . $status);
+        }
+
+        $text = $body['SecretString'] ?? null;
+
+        if (!is_string($text)) {
+            // A binary secret has no fields to address; only the conventional
+            // `value` field can mean "the bytes themselves".
+            $bin = $body['SecretBinary'] ?? null;
+            if (is_string($bin) && 'value' === $ref['field']) {
+                // strict: base64_decode SKIPS characters outside the
+                // alphabet by default, so a corrupted payload decoded to
+                // plausible-looking bytes that were then returned as the
+                // secret. A store that answered incoherently is an error.
+                $decoded = base64_decode($bin, true);
+                if (false === $decoded) {
+                    throw new SekretoError('sekreto: aws secretsmanager: undecodable secret');
+                }
+
+                return $decoded;
+            }
+            return null;
+        }
+
+        // Decoded without assoc, so a JSON object is distinguishable from a
+        // JSON array: only an object carries named fields.
+        $parsed = json_decode($text);
+
+        if ($parsed instanceof \stdClass) {
+            $value = $parsed->{$ref['field']} ?? null;
+            return null === $value ? null : (string) $value;
+        }
+
+        // A plain-string secret is the whole value; it has no named fields.
+        return 'value' === $ref['field'] ? $text : null;
+    }
+
+    // Config only, never the environment: describe() feeds the spec's
+    // sources group, which must answer the same everywhere.
+    public function describe(): string
+    {
+        return 'awssecrets:' . ($this->opts['region'] ?? '');
+    }
+}
+
+/**
+ * AWS SSM Parameter Store.
+ *
+ * `db.pass.main` reads the parameter `/db/pass/main` (under an optional
+ * prefix path), decrypted. Parameter Store carries flat strings, so there
+ * is no field indirection.
+ */
+class AwsParamsProvider implements Provider
+{
+    /** @param array<string, mixed> $opts */
+    public function __construct(private array $opts = [])
+    {
+    }
+
+    public function lookup(string $name): ?string
+    {
+        [$status, $body] = awscall($this->opts, 'ssm', 'AmazonSSM.GetParameter', [
+            'Name' => Name::awsparam($name, $this->opts['prefix'] ?? null),
+            'WithDecryption' => true,
+        ]);
+
+        if (400 === $status && awsmiss($body, ['ParameterNotFound'])) {
+            return null;
+        }
+
+        if (200 !== $status) {
+            throw new SekretoError('sekreto: aws ssm error: ' . $status);
+        }
+
+        $value = $body['Parameter']['Value'] ?? null;
+
+        return null === $value ? null : (string) $value;
+    }
+
+    public function describe(): string
+    {
+        return 'awsparams:' . ($this->opts['region'] ?? '') . ($this->opts['prefix'] ?? '');
+    }
+}
+
+/**
+ * The `awssecrets` provider kind, as a voxgig/plugin definition. Pass it to
+ * `Sekreto` in the `plugins` option; nothing else loads it.
+ *
+ * @return array<string, mixed>
+ */
+function awssecrets(): array
+{
+    return providerplugin('awssecrets', fn(array $spec) => new AwsSecretsProvider($spec));
+}
+
+/**
+ * The `awsparams` provider kind, as a voxgig/plugin definition. Pass it to
+ * `Sekreto` in the `plugins` option; nothing else loads it.
+ *
+ * @return array<string, mixed>
+ */
+function awsparams(): array
+{
+    return providerplugin('awsparams', fn(array $spec) => new AwsParamsProvider($spec));
+}

package/project/.sdk/tm/php/feature/secrets/sekreto/plugins/azuresecrets.php

@@ -0,0 +1,170 @@
+<?php
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (php/plugins/azuresecrets.php)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+
+/**
+ * Azure Key Vault, as a voxgig/plugin definition.
+ *
+ * A PLUGIN, not a built-in: it opens a socket.
+ */
+
+declare(strict_types=1);
+
+namespace Voxgig\Sekreto\Plugins;
+
+require_once __DIR__ . '/../src/Providers.php';
+require_once __DIR__ . '/../src/Addr.php';
+require_once __DIR__ . '/httpjson.php';
+
+use Voxgig\Sekreto\Name;
+use Voxgig\Sekreto\Provider;
+use Voxgig\Sekreto\SekretoError;
+
+use function Voxgig\Sekreto\checkaddr;
+use function Voxgig\Sekreto\providerplugin;
+
+/**
+ * Azure Key Vault.
+ *
+ * `api.token` reads secret `api-token` (dots flattened to `-`; Key Vault
+ * names allow nothing else), current version. The token comes from
+ * config, then a client-credentials login when tenant/clientid/
+ * clientsecret are given, then the IMDS managed-identity endpoint - so on
+ * Azure's own platform no credential configuration is needed.
+ *
+ * As with GCP, the IMDS call is plain http to a link-local host by
+ * platform design and carries no credential; the login and vault
+ * addresses are `checkaddr`-guarded.
+ */
+class AzureSecretsProvider implements Provider
+{
+    private const RESOURCE = 'https://vault.azure.net';
+
+    // A configured token is kept forever; logged-in and IMDS tokens carry
+    // expires_in and are renewed shortly before they run out.
+    private ?string $livetoken = null;
+    private float $renewat = INF;
+
+    /** @param array<string, mixed> $opts */
+    public function __construct(private array $opts = [])
+    {
+    }
+
+    /** The renewal moment for an expires_in (which may be a string). */
+    private function expiry(mixed $expires): float
+    {
+        $seconds = (float) $expires;
+
+        return 0 < $seconds ? microtime(true) + max($seconds - 60, 1) : INF;
+    }
+
+    private function login(): string
+    {
+        $opts = $this->opts;
+
+        if ($opts['token'] ?? null) {
+            return $opts['token'];
+        }
+
+        if (($opts['tenant'] ?? null) && ($opts['clientid'] ?? null)
+            && ($opts['clientsecret'] ?? null)
+        ) {
+            $loginaddr = ($opts['loginaddr'] ?? null) ?: 'https://login.microsoftonline.com';
+            checkaddr($loginaddr);
+
+            $url = rtrim($loginaddr, '/') . '/' . $opts['tenant'] . '/oauth2/v2.0/token';
+            $form = 'grant_type=client_credentials'
+                . '&client_id=' . rawurlencode($opts['clientid'])
+                . '&client_secret=' . rawurlencode($opts['clientsecret'])
+                . '&scope=' . rawurlencode(self::RESOURCE . '/.default');
+
+            [$status, $body] = fetchjson(
+                'POST',
+                $url,
+                ['Content-Type: application/x-www-form-urlencoded'],
+                $form
+            );
+
+            $got = $body['access_token'] ?? null;
+            if (200 !== $status || !$got) {
+                throw new SekretoError('sekreto: azure login failed: ' . $status);
+            }
+
+            $this->renewat = $this->expiry($body['expires_in'] ?? null);
+
+            return (string) $got;
+        }
+
+        $imds = rtrim(($opts['imdsaddr'] ?? null) ?: 'http://169.254.169.254', '/')
+            . '/metadata/identity/oauth2/token?api-version=2018-02-01&resource='
+            . rawurlencode(self::RESOURCE);
+
+        [$status, $body] = fetchjson('GET', $imds, ['Metadata: true']);
+
+        $got = $body['access_token'] ?? null;
+        if (200 !== $status || !$got) {
+            throw new SekretoError(
+                'sekreto: azure: no token, no client credentials, and IMDS did not answer'
+            );
+        }
+
+        $this->renewat = $this->expiry($body['expires_in'] ?? null);
+
+        return (string) $got;
+    }
+
+    public function lookup(string $name): ?string
+    {
+        $vault = $this->opts['vault'] ?? '';
+        if ('' === $vault || null === $vault) {
+            throw new SekretoError('sekreto: azure: no vault');
+        }
+
+        // Only an explicit scheme is a URL; a vault NAMED httpvault must
+        // still become https://httpvault.vault.azure.net.
+        $vaulturl = str_starts_with($vault, 'http://') || str_starts_with($vault, 'https://')
+            ? $vault
+            : 'https://' . $vault . '.vault.azure.net';
+        checkaddr($vaulturl);
+
+        if (null === $this->livetoken || microtime(true) >= $this->renewat) {
+            $this->livetoken = $this->login();
+        }
+
+        $url = rtrim($vaulturl, '/') . '/secrets/' . Name::flatname($name, '-')
+            . '?api-version=' . (($this->opts['apiversion'] ?? null) ?: '7.4');
+
+        [$status, $body] = fetchjson('GET', $url, ['Authorization: Bearer ' . $this->livetoken]);
+
+        if (404 === $status) {
+            return null;
+        }
+
+        if (200 !== $status) {
+            throw new SekretoError(
+                'sekreto: azure error: ' . $status . ': ' . explode('?', $url)[0]
+            );
+        }
+
+        $value = $body['value'] ?? null;
+
+        return null === $value ? null : (string) $value;
+    }
+
+    public function describe(): string
+    {
+        return 'azuresecrets:' . ($this->opts['vault'] ?? '');
+    }
+}
+
+/**
+ * The `azuresecrets` provider kind, as a voxgig/plugin definition. Pass it to
+ * `Sekreto` in the `plugins` option; nothing else loads it.
+ *
+ * @return array<string, mixed>
+ */
+function azuresecrets(): array
+{
+    return providerplugin('azuresecrets', fn(array $spec) => new AzureSecretsProvider($spec));
+}

package/project/.sdk/tm/php/feature/secrets/sekreto/plugins/boru.php

@@ -0,0 +1,163 @@
+<?php
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (php/plugins/boru.php)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+
+/**
+ * The boru vault, as a voxgig/plugin definition.
+ *
+ * A PLUGIN, not a built-in: it spawns a child process, and over the wire it
+ * opens a socket too.
+ */
+
+declare(strict_types=1);
+
+namespace Voxgig\Sekreto\Plugins;
+
+require_once __DIR__ . '/../src/Providers.php';
+require_once __DIR__ . '/../src/Addr.php';
+require_once __DIR__ . '/httpjson.php';
+require_once __DIR__ . '/runcmd.php';
+
+use Voxgig\Sekreto\Name;
+use Voxgig\Sekreto\Provider;
+use Voxgig\Sekreto\SekretoError;
+
+use function Voxgig\Sekreto\checkaddr;
+use function Voxgig\Sekreto\providerplugin;
+
+/**
+ * A boru vault (https://github.com/boru-lang/boru).
+ *
+ * Two ways in, both boru's own.
+ *
+ * With no `addr`, the CLI: `boru vault get --reveal <alias>` prints the
+ * secret on stdout and nothing else. The passphrase is read by boru itself
+ * from `BORU_VAULT_PASSPHRASE`; sekreto never accepts it as config and
+ * never puts it on a command line, where it would show up in the process
+ * table.
+ *
+ * With an `addr`, boru's wire protocol: `boru vault serve` publishes a
+ * read-only, HashiCorp-shaped provision API (boru's
+ * design/VAULT-WIRE-PROTOCOL.0.md), authenticated by a capability token
+ * from `boru vault grant`. A sekreto name is already a valid boru alias,
+ * and boru aliases keep their dots, so `api.token` is the single path
+ * segment `api.token` - not the `api`/`token` split a HashiCorp KV gets.
+ * The value is the `value` field. A 404 is a miss; anything else the
+ * server refuses (a revoked capability, a sealed vault) is an error.
+ *
+ * boru's `vault proxy` and `vault mcp` remain out of bounds: they are a
+ * credential *broker*, built precisely so the caller never receives the
+ * credential. `vault serve` is the provision endpoint, built to hand the
+ * value back - that is the one sekreto uses.
+ */
+class BoruProvider implements Provider
+{
+    private string $command;
+    private ?string $addr;
+
+    public function __construct(
+        ?string $command = null,
+        private ?string $namespace = null,
+        private ?string $home = null,
+        ?string $addr = null,
+        private ?string $token = null,
+        private ?string $mount = null
+    ) {
+        $this->command = $command ?? 'boru';
+        $this->addr = $addr ? preg_replace('#/$#', '', $addr) : null;
+    }
+
+    private function wirelookup(string $name): ?string
+    {
+        Name::check($name);
+        checkaddr($this->addr);
+
+        $alias = $this->namespace ? $this->namespace . '/' . $name : $name;
+        $url = $this->addr . '/v1/' . ($this->mount ?: 'secret') . '/data/' . $alias;
+
+        [$status, $body] = fetchjson('GET', $url, ['X-Vault-Token: ' . ($this->token ?? '')]);
+
+        if (404 === $status) {
+            return null;
+        }
+
+        if (200 !== $status) {
+            throw new SekretoError('sekreto: boru serve error: ' . $status . ': ' . $url);
+        }
+
+        $data = $body['data']['data'] ?? null;
+        $value = is_array($data) ? ($data['value'] ?? null) : null;
+
+        return null === $value ? null : (string) $value;
+    }
+
+    public function lookup(string $name): ?string
+    {
+        if ($this->addr) {
+            return $this->wirelookup($name);
+        }
+
+        Name::check($name);
+
+        $alias = $this->namespace ? $this->namespace . ':' . $name : $name;
+
+        [$out, $why, $status] = runcmd(
+            [$this->command, 'vault', 'get', '--reveal', $alias],
+            $this->home ? ['BORU_HOME' => $this->home] : []
+        );
+
+        if (0 === $status) {
+            // boru prints the value and one newline, and nothing else.
+            return preg_replace('/\n\z/', '', $out, 1);
+        }
+
+        // "no alias named" is boru saying it does not hold this secret, which
+        // is a miss: the chain carries on to the next provider. A locked vault
+        // or a wrong passphrase is not a miss - treating it as one would fall
+        // through to a weaker store without saying so.
+        if (borumiss($why)) {
+            return null;
+        }
+
+        throw new SekretoError(
+            'sekreto: boru vault error: ' . ('' === $why ? 'exit ' . $status : $why)
+        );
+    }
+
+    public function describe(): string
+    {
+        if ($this->addr) {
+            return 'boru:' . $this->addr;
+        }
+
+        return 'boru' . ($this->namespace ? ':' . $this->namespace : '');
+    }
+}
+
+/**
+ * Does this boru failure mean "no such secret" rather than "I could not
+ * answer"? Matched on boru's own wording for a missing alias.
+ */
+function borumiss(string $why): bool
+{
+    return str_contains($why, 'no alias named');
+}
+
+/**
+ * The `boru` provider kind, as a voxgig/plugin definition. Pass it to
+ * `Sekreto` in the `plugins` option; nothing else loads it.
+ *
+ * @return array<string, mixed>
+ */
+function boru(): array
+{
+    return providerplugin('boru', fn(array $spec) => new BoruProvider(
+        $spec['command'] ?? null,
+        $spec['namespace'] ?? null,
+        $spec['home'] ?? null,
+        $spec['addr'] ?? null,
+        $spec['token'] ?? null,
+        $spec['mount'] ?? null
+    ));
+}