@voxgig/sdkgen 4.8.3 → 4.10.0

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/Support.kt

@@ -0,0 +1,205 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/src/Support.kt)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// How a provider kind becomes a voxgig/plugin definition.
+//
+// This file is the whole bridge between the two libraries. A provider
+// kind is a plugin `Definition` named after the kind; its `define` reads
+// the instance's options as a `ProviderSpec`, builds the provider, and
+// exports it under the key `provider`. `Sekreto` reads it back off the
+// host. One helper makes every one of them, built-in or plugin, shipped
+// or custom:
+//
+//     val mystore = providerplugin("mystore") { spec -> Mystore(spec.addr) }
+//
+// A port of typescript/src/provider/support.ts, which is canonical.
+
+package KOTLINPACKAGE.feature.secrets.sekreto
+
+import java.util.TreeMap
+import KOTLINPACKAGE.feature.secrets.plugin.Inst
+import KOTLINPACKAGE.feature.secrets.plugin.PluginError
+
+/**
+ * A voxgig/plugin definition.
+ *
+ * plugin's value model is `Any?`, and a definition is a map of `name` to
+ * the kind and `define` to the callback - which is what makes a catalog a
+ * data structure a document could produce. The alias exists so that a
+ * `plugins` list reads as what it is rather than as `List<Map<String, Any?>>`.
+ */
+typealias Definition = Map<String, Any?>
+
+/** The export key under which a provider definition publishes the
+ * provider it built. `Sekreto` reads `<ref>/provider` off the host. */
+const val PROVIDER_EXPORT: String = "provider"
+
+/**
+ * The voxgig/plugin error code a SekretoError travels under when it is
+ * raised inside a definition's `define`.
+ *
+ * plugin wraps a code-less error raised by a callback as
+ * `plugin_define_failed`, and keeps one that already carries a code. A
+ * provider that refuses its own configuration - `kv: 3`, a missing
+ * project - raises a SekretoError, and the spec pins that message byte
+ * for byte, so it must come back out of the host exactly as it went in.
+ * `providerplugin` gives it this code on the way in; `Sekreto` takes it
+ * off on the way out. Nowhere else catches and rewraps.
+ */
+const val ERROR_CODE: String = "sekreto_error"
+
+/**
+ * A provider kind, as a voxgig/plugin definition.
+ *
+ * Nothing runs at `activate`: a provider opens nothing until its first
+ * lookup, so there is nothing to capture - a provider that does hold a
+ * resource acquires it there and lets the instance scope unwind it.
+ */
+fun providerplugin(kind: String, make: (ProviderSpec) -> Provider): Definition = mapOf(
+    "name" to kind,
+    // A kotlin lambda, so plugin's `run` sees a Function1 and calls it.
+    "define" to { inst: Inst ->
+        val provider = try {
+            make(specof(inst.options))
+        } catch (err: SekretoError) {
+            val text = err.message ?: ""
+            throw PluginError(ERROR_CODE, text, mapOf("ref" to inst.ref, "cause" to text))
+        }
+
+        inst.export(PROVIDER_EXPORT, provider)
+    },
+)
+
+// --- the spec across the plugin boundary -----------------------------
+//
+// plugin's options are its own value model - a map of strings to
+// `null`, Boolean, Double, String, List and Map - and sekreto's spec is a
+// typed data class, so the two are written out field by field rather than
+// reflected over. `optionsof` is what `Sekreto.declare` hands to
+// `host.load`; `specof` is what a definition's `define` reads back. They
+// are inverses, and `PluginsTest.a_provider_spec_survives_the_plugin_boundary`
+// is what says so - a field added to one and forgotten in the other would
+// otherwise be lost in silence, and only for the kinds no conformance
+// case exercises.
+
+private fun put(out: MutableMap<String, Any?>, key: String, value: Any?) {
+    if (null != value) {
+        out[key] = value
+    }
+}
+
+private fun str(options: Map<String, Any?>, key: String): String? = options[key] as? String
+
+/** A ProviderSpec as plugin instance options. */
+fun optionsof(spec: ProviderSpec): Map<String, Any?> {
+    val out = TreeMap<String, Any?>()
+
+    out["kind"] = spec.kind
+    put(out, "name", spec.name)
+    put(out, "prefix", spec.prefix)
+    put(out, "file", spec.file)
+    put(out, "values", spec.values?.let { TreeMap<String, Any?>(it) })
+    put(out, "dir", spec.dir)
+    put(out, "addr", spec.addr)
+    put(out, "token", spec.token)
+    put(out, "mount", spec.mount)
+    // Every number in plugin's model is a Double, JSON's one number type.
+    put(out, "kv", spec.kv?.toDouble())
+    put(out, "vaultnamespace", spec.vaultnamespace)
+    put(
+        out, "auth",
+        spec.auth?.let { auth ->
+            val nested = TreeMap<String, Any?>()
+            nested["method"] = auth.method
+            put(nested, "mount", auth.mount)
+            put(nested, "role", auth.role)
+            put(nested, "jwt", auth.jwt)
+            put(nested, "jwtfile", auth.jwtfile)
+            put(nested, "roleid", auth.roleid)
+            put(nested, "secretid", auth.secretid)
+            nested
+        },
+    )
+    put(out, "command", spec.command)
+    put(out, "profile", spec.profile)
+    put(out, "backend", spec.backend)
+    put(out, "reason", spec.reason)
+    put(out, "namespace", spec.namespace)
+    put(out, "home", spec.home)
+    put(out, "region", spec.region)
+    put(out, "keyid", spec.keyid)
+    put(out, "secret", spec.secret)
+    put(out, "session", spec.session)
+    put(out, "project", spec.project)
+    put(out, "vault", spec.vault)
+    put(out, "tenant", spec.tenant)
+    put(out, "clientid", spec.clientid)
+    put(out, "clientsecret", spec.clientsecret)
+    put(out, "loginaddr", spec.loginaddr)
+    put(out, "imdsaddr", spec.imdsaddr)
+    put(out, "metadataaddr", spec.metadataaddr)
+    put(out, "apiversion", spec.apiversion)
+    put(out, "config", spec.config)
+    put(out, "environment", spec.environment)
+    put(out, "path", spec.path)
+
+    return out
+}
+
+/** Plugin instance options as a ProviderSpec. */
+fun specof(options: Map<String, Any?>): ProviderSpec {
+    val values = (options["values"] as? Map<*, *>)?.let { given ->
+        LinkedHashMap<String, String>().also { out ->
+            given.forEach { (key, value) -> out["$key"] = "$value" }
+        }
+    }
+
+    val auth = (options["auth"] as? Map<*, *>)?.let { given ->
+        AuthSpec(
+            method = given["method"] as? String ?: "",
+            mount = given["mount"] as? String,
+            role = given["role"] as? String,
+            jwt = given["jwt"] as? String,
+            jwtfile = given["jwtfile"] as? String,
+            roleid = given["roleid"] as? String,
+            secretid = given["secretid"] as? String,
+        )
+    }
+
+    return ProviderSpec(
+        kind = str(options, "kind") ?: "",
+        name = str(options, "name"),
+        prefix = str(options, "prefix"),
+        file = str(options, "file"),
+        values = values,
+        dir = str(options, "dir"),
+        addr = str(options, "addr"),
+        token = str(options, "token"),
+        mount = str(options, "mount"),
+        kv = (options["kv"] as? Number)?.toInt(),
+        vaultnamespace = str(options, "vaultnamespace"),
+        auth = auth,
+        command = str(options, "command"),
+        profile = str(options, "profile"),
+        backend = str(options, "backend"),
+        reason = str(options, "reason"),
+        namespace = str(options, "namespace"),
+        home = str(options, "home"),
+        region = str(options, "region"),
+        keyid = str(options, "keyid"),
+        secret = str(options, "secret"),
+        session = str(options, "session"),
+        project = str(options, "project"),
+        vault = str(options, "vault"),
+        tenant = str(options, "tenant"),
+        clientid = str(options, "clientid"),
+        clientsecret = str(options, "clientsecret"),
+        loginaddr = str(options, "loginaddr"),
+        imdsaddr = str(options, "imdsaddr"),
+        metadataaddr = str(options, "metadataaddr"),
+        apiversion = str(options, "apiversion"),
+        config = str(options, "config"),
+        environment = str(options, "environment"),
+        path = str(options, "path"),
+    )
+}

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Aws.kt

@@ -0,0 +1,251 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Aws.kt)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The two AWS stores, as voxgig/plugin definitions.
+//
+// One file, because they share the SigV4 request signing and the
+// credential resolution in this file and nothing else does.
+
+package KOTLINPACKAGE.feature.secrets.sekreto.plugins
+
+import KOTLINPACKAGE.feature.secrets.sekreto.Definition
+import KOTLINPACKAGE.feature.secrets.sekreto.Json
+import KOTLINPACKAGE.feature.secrets.sekreto.Provider
+import KOTLINPACKAGE.feature.secrets.sekreto.Providers.checkaddr
+import KOTLINPACKAGE.feature.secrets.sekreto.SekretoError
+import KOTLINPACKAGE.feature.secrets.sekreto.awsparam
+import KOTLINPACKAGE.feature.secrets.sekreto.providerplugin
+import KOTLINPACKAGE.feature.secrets.sekreto.vaultref
+
+import java.nio.charset.StandardCharsets
+import java.time.Instant
+import java.time.ZoneOffset
+import java.time.format.DateTimeFormatter
+import java.util.Base64
+
+/** The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now. */
+internal fun awsnow(): String =
+    DateTimeFormatter.ofPattern("yyyyMMdd'T'HHmmss'Z'")
+        .withZone(ZoneOffset.UTC)
+        .format(Instant.now())
+
+/** Region and credentials, resolved for one call. */
+internal data class Awsauth(
+    val region: String,
+    val keyid: String,
+    val secret: String,
+    val session: String?,
+)
+
+/**
+ * Region and credentials, from config first and the standard AWS_*
+ * environment variables second - those are AWS's own convention, and a
+ * pod or CI job that has them set should just work. Missing either is an
+ * error: an AWS store with no credentials could not answer.
+ */
+internal fun awsauth(
+    region: String?,
+    keyid: String?,
+    secret: String?,
+    session: String?,
+): Awsauth {
+    val useregion =
+        first(region, System.getenv("AWS_REGION"), System.getenv("AWS_DEFAULT_REGION"))
+    val usekeyid = first(keyid, System.getenv("AWS_ACCESS_KEY_ID"))
+    val usesecret = first(secret, System.getenv("AWS_SECRET_ACCESS_KEY"))
+    val usesession = first(session, System.getenv("AWS_SESSION_TOKEN"))
+
+    if (useregion.isEmpty()) {
+        throw SekretoError("sekreto: aws: no region (set region or AWS_REGION)")
+    }
+    if (usekeyid.isEmpty() || usesecret.isEmpty()) {
+        throw SekretoError(
+            "sekreto: aws: no credentials" +
+                " (set keyid/secret or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)",
+        )
+    }
+
+    return Awsauth(useregion, usekeyid, usesecret, usesession.ifEmpty { null })
+}
+
+/** One signed call to an AWS JSON-1.1 API. */
+internal fun awscall(
+    region: String?,
+    keyid: String?,
+    secret: String?,
+    session: String?,
+    addr: String?,
+    service: String,
+    target: String,
+    payload: String,
+): Answer {
+    val auth = awsauth(region, keyid, secret, session)
+
+    // The China partition lives under its own suffix; every other
+    // commercial region is plain amazonaws.com.
+    val suffix =
+        if (auth.region.startsWith("cn-")) ".amazonaws.com.cn" else ".amazonaws.com"
+    val useaddr = first(addr, "https://$service.${auth.region}$suffix")
+    checkaddr(useaddr)
+
+    val url = trimslash(useaddr) + "/"
+
+    val extras = linkedMapOf(
+        "content-type" to "application/x-amz-json-1.1",
+        "x-amz-target" to target,
+    )
+
+    val signed = sigv4(
+        Signing(
+            method = "POST",
+            url = url,
+            service = service,
+            region = auth.region,
+            keyid = auth.keyid,
+            secret = auth.secret,
+            datetime = awsnow(),
+            headers = extras,
+            body = payload,
+            session = auth.session,
+        ),
+    )
+
+    return fetchjson("POST", url, extras + signed, payload)
+}
+
+/**
+ * Does this AWS error body name one of the not-found types? Those are a
+ * miss; every other failure is a store that could not answer.
+ */
+internal fun awsmiss(body: Json?, vararg types: String): Boolean {
+    val errtype = body?.dig("__type")?.asstr ?: return false
+    return types.any { errtype.contains(it) }
+}
+
+/**
+ * AWS Secrets Manager.
+ *
+ * `api.token` reads the secret named `api` (the vaultref path, so
+ * `db.pass.main` reads `db/pass`) and takes the `token` field of its JSON
+ * SecretString - the AWS idiom of one JSON map per secret. A SecretString
+ * that is not JSON is the value itself, under the conventional field
+ * `value`. Requests are SigV4-signed in-tree; see Sigv4.kt.
+ */
+class Awssecrets(
+    private val region: String? = null,
+    private val keyid: String? = null,
+    private val secret: String? = null,
+    private val session: String? = null,
+    private val addr: String? = null,
+) : Provider {
+
+    override fun lookup(name: String): String? {
+        val ref = vaultref(name)
+
+        val res = awscall(
+            region, keyid, secret, session, addr,
+            "secretsmanager", "secretsmanager.GetSecretValue",
+            Json.stringify(Json.obj("SecretId" to Json.str(ref.path))),
+        )
+
+        if (400 == res.status && awsmiss(res.body, "ResourceNotFoundException")) {
+            return null
+        }
+
+        if (200 != res.status) {
+            throw SekretoError("sekreto: aws secretsmanager error: ${res.status}")
+        }
+
+        val text = res.body?.dig("SecretString")?.asstr
+
+        if (null == text) {
+            // A binary secret has no fields to address; only the
+            // conventional `value` field can mean "the bytes themselves".
+            val bin = res.body?.dig("SecretBinary")?.asstr
+            if (null != bin && "value" == ref.field) {
+                // decode() throws IllegalArgumentException on a bad
+                // payload, which is not a SekretoError and so escaped
+                // the library's own error type. A store that answered
+                // incoherently is an error.
+                return try {
+                    String(Base64.getDecoder().decode(bin), StandardCharsets.UTF_8)
+                } catch (err: IllegalArgumentException) {
+                    throw SekretoError("sekreto: aws secretsmanager: undecodable secret")
+                }
+            }
+            return null
+        }
+
+        val parsed = Json.parse(text)
+
+        if (parsed is Json.Obj) {
+            return parsed.value[ref.field]?.text
+        }
+
+        // A plain-string secret is the whole value; it has no named fields.
+        return if ("value" == ref.field) text else null
+    }
+
+    // Config only, never the environment: describe() feeds the spec's
+    // sources group, which must answer the same everywhere.
+    override fun describe(): String = "awssecrets:${region ?: ""}"
+}
+
+/**
+ * AWS SSM Parameter Store.
+ *
+ * `db.pass.main` reads the parameter `/db/pass/main` (under an optional
+ * prefix path), decrypted. Parameter Store carries flat strings, so there
+ * is no field indirection.
+ */
+class Awsparams(
+    private val region: String? = null,
+    private val keyid: String? = null,
+    private val secret: String? = null,
+    private val session: String? = null,
+    private val addr: String? = null,
+    private val prefix: String? = null,
+) : Provider {
+
+    override fun lookup(name: String): String? {
+        val payload = Json.obj(
+            "Name" to Json.str(awsparam(name, prefix)),
+            "WithDecryption" to Json.bool(true),
+        )
+
+        val res = awscall(
+            region, keyid, secret, session, addr,
+            "ssm", "AmazonSSM.GetParameter", Json.stringify(payload),
+        )
+
+        if (400 == res.status && awsmiss(res.body, "ParameterNotFound")) {
+            return null
+        }
+
+        if (200 != res.status) {
+            throw SekretoError("sekreto: aws ssm error: ${res.status}")
+        }
+
+        return res.body?.dig("Parameter", "Value")?.text
+    }
+
+    override fun describe(): String = "awsparams:${region ?: ""}${prefix ?: ""}"
+}
+
+/** The `awssecrets` provider kind, as a voxgig/plugin definition. A
+ * consumer imports this and hands it to `Sekreto`; a consumer that does
+ * not is a `Sekreto` that cannot build a `awssecrets` chain entry. */
+val awssecrets: Definition = providerplugin("awssecrets") { spec ->
+    Awssecrets(
+        spec.region, spec.keyid, spec.secret, spec.session, spec.addr,
+    )
+}
+
+/** The `awsparams` provider kind, as a voxgig/plugin definition. A
+ * consumer imports this and hands it to `Sekreto`; a consumer that does
+ * not is a `Sekreto` that cannot build a `awsparams` chain entry. */
+val awsparams: Definition = providerplugin("awsparams") { spec ->
+    Awsparams(
+        spec.region, spec.keyid, spec.secret, spec.session, spec.addr, spec.prefix,
+    )
+}

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Azuresecrets.kt

@@ -0,0 +1,145 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Azuresecrets.kt)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Azure Key Vault, as a voxgig/plugin definition.
+
+package KOTLINPACKAGE.feature.secrets.sekreto.plugins
+
+import KOTLINPACKAGE.feature.secrets.sekreto.Definition
+import KOTLINPACKAGE.feature.secrets.sekreto.Provider
+import KOTLINPACKAGE.feature.secrets.sekreto.Providers.checkaddr
+import KOTLINPACKAGE.feature.secrets.sekreto.SekretoError
+import KOTLINPACKAGE.feature.secrets.sekreto.flatname
+import KOTLINPACKAGE.feature.secrets.sekreto.providerplugin
+
+/**
+ * Azure Key Vault.
+ *
+ * `api.token` reads secret `api-token` (dots flattened to `-`; Key Vault
+ * names allow nothing else), current version. The token comes from
+ * config, then a client-credentials login when tenant/clientid/
+ * clientsecret are given, then the IMDS managed-identity endpoint - so on
+ * Azure's own platform no credential configuration is needed.
+ *
+ * As with GCP, the IMDS call is plain http to a link-local host by
+ * platform design and carries no credential; the login and vault
+ * addresses are `checkaddr`-guarded.
+ */
+class Azuresecrets(
+    private val vault: String? = null,
+    private val token: String? = null,
+    private val tenant: String? = null,
+    private val clientid: String? = null,
+    private val clientsecret: String? = null,
+    private val loginaddr: String? = null,
+    private val imdsaddr: String? = null,
+    private val apiversion: String? = null,
+) : Provider {
+
+    // A configured token is kept forever; logged-in and IMDS tokens carry
+    // expires_in and are renewed shortly before they run out.
+    private var livetoken: String? = null
+    private var renewat: Long = Long.MAX_VALUE
+
+    private fun login(): String {
+        if (!token.isNullOrEmpty()) {
+            return token
+        }
+
+        if (!tenant.isNullOrEmpty() &&
+            !clientid.isNullOrEmpty() &&
+            !clientsecret.isNullOrEmpty()
+        ) {
+            val useloginaddr = first(loginaddr, "https://login.microsoftonline.com")
+            checkaddr(useloginaddr)
+
+            val url = trimslash(useloginaddr) + "/" + tenant + "/oauth2/v2.0/token"
+            val form = "grant_type=client_credentials&client_id=" + uriescape(clientid) +
+                "&client_secret=" + uriescape(clientsecret) +
+                "&scope=" + uriescape("$RESOURCE/.default")
+
+            val res = fetchjson(
+                "POST",
+                url,
+                mapOf("content-type" to "application/x-www-form-urlencoded"),
+                form,
+            )
+
+            val got = res.body?.dig("access_token")?.text
+            if (200 != res.status || got.isNullOrEmpty()) {
+                throw SekretoError("sekreto: azure login failed: ${res.status}")
+            }
+
+            renewat = renewtime(res.body?.dig("expires_in"))
+            return got
+        }
+
+        val imds = trimslash(first(imdsaddr, "http://169.254.169.254")) +
+            "/metadata/identity/oauth2/token?api-version=2018-02-01&resource=" +
+            uriescape(RESOURCE)
+
+        val res = fetchjson("GET", imds, mapOf("Metadata" to "true"))
+
+        val got = res.body?.dig("access_token")?.text
+        if (200 != res.status || got.isNullOrEmpty()) {
+            throw SekretoError(
+                "sekreto: azure: no token, no client credentials, and IMDS did not answer",
+            )
+        }
+
+        renewat = renewtime(res.body?.dig("expires_in"))
+        return got
+    }
+
+    override fun lookup(name: String): String? {
+        val usevault = vault ?: ""
+        if (usevault.isEmpty()) {
+            throw SekretoError("sekreto: azure: no vault")
+        }
+
+        // Only an explicit scheme is a URL; a vault NAMED httpvault must
+        // still become https://httpvault.vault.azure.net.
+        val vaulturl =
+            if (usevault.startsWith("http://") || usevault.startsWith("https://")) {
+                usevault
+            } else {
+                "https://$usevault.vault.azure.net"
+            }
+        checkaddr(vaulturl)
+
+        if (null == livetoken || System.currentTimeMillis() >= renewat) {
+            livetoken = login()
+        }
+
+        val url = trimslash(vaulturl) + "/secrets/" + flatname(name, "-") +
+            "?api-version=" + first(apiversion, "7.4")
+
+        val res = fetchjson("GET", url, mapOf("authorization" to "Bearer $livetoken"))
+
+        if (404 == res.status) {
+            return null
+        }
+
+        if (200 != res.status) {
+            throw SekretoError("sekreto: azure error: ${res.status}: ${bare(url)}")
+        }
+
+        return res.body?.dig("value")?.text
+    }
+
+    override fun describe(): String = "azuresecrets:${vault ?: ""}"
+
+    private companion object {
+        const val RESOURCE = "https://vault.azure.net"
+    }
+}
+
+/** The `azuresecrets` provider kind, as a voxgig/plugin definition. A
+ * consumer imports this and hands it to `Sekreto`; a consumer that does
+ * not is a `Sekreto` that cannot build a `azuresecrets` chain entry. */
+val azuresecrets: Definition = providerplugin("azuresecrets") { spec ->
+    Azuresecrets(
+        spec.vault, spec.token, spec.tenant, spec.clientid, spec.clientsecret,
+        spec.loginaddr, spec.imdsaddr, spec.apiversion,
+    )
+}