@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/rust/feature/secrets/plugins/doppler.rs

@@ -0,0 +1,102 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/doppler/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! The Doppler provider, as a voxgig/plugin definition.
+
+use std::cell::RefCell;
+use std::collections::BTreeMap;
+use std::rc::Rc;
+
+use crate::feature::secrets::plugin::catalog::Definition;
+use crate::feature::secrets::sekreto::{checkaddr, envkey, providerplugin, Answer, Provider, SekretoError};
+use super::httpjson::json::Json;
+use super::httpjson::{fetchjson, http, trimslash};
+
+/// Doppler.
+///
+/// The whole config is downloaded once - Doppler's own bulk endpoint -
+/// and answered from memory, like a remote .env: `api.token` is the
+/// `API_TOKEN` entry. A service token is config-scoped, so project and
+/// config are only needed with broader tokens.
+#[derive(Default)]
+pub struct DopplerProvider {
+    pub token: String,
+    pub project: String,
+    pub config: String,
+    pub addr: String,
+    values: RefCell<Option<BTreeMap<String, String>>>,
+}
+
+impl DopplerProvider {
+    fn load(&self) -> Answer<BTreeMap<String, String>> {
+        if let Some(values) = self.values.borrow().as_ref() {
+            return Ok(values.clone());
+        }
+
+        let addr = if self.addr.is_empty() {
+            "https://api.doppler.com"
+        } else {
+            &self.addr
+        };
+        let addr = trimslash(addr);
+        checkaddr(addr)?;
+
+        let mut url = format!("{}/v3/configs/config/secrets/download?format=json", addr);
+        if !self.project.is_empty() {
+            url.push_str(&format!("&project={}", http::urlencode(&self.project)));
+        }
+        if !self.config.is_empty() {
+            url.push_str(&format!("&config={}", http::urlencode(&self.config)));
+        }
+
+        let bearer = format!("Bearer {}", self.token);
+        let response = fetchjson("GET", &url, &[("authorization", bearer.as_str())], None)?;
+
+        let entries = match (response.status, &response.body) {
+            (200, Some(Json::Map(entries))) => entries.clone(),
+            _ => {
+                return Err(SekretoError::new(format!(
+                    "sekreto: doppler error: {}",
+                    response.status
+                )))
+            }
+        };
+
+        let mut values = BTreeMap::new();
+        for (key, value) in entries {
+            if !matches!(value, Json::Null) {
+                values.insert(key, value.text());
+            }
+        }
+
+        *self.values.borrow_mut() = Some(values.clone());
+        Ok(values)
+    }
+}
+
+impl Provider for DopplerProvider {
+    fn lookup(&self, name: &str) -> Answer<Option<String>> {
+        Ok(self.load()?.get(&envkey(name, "")?).cloned())
+    }
+
+    fn describe(&self) -> String {
+        if self.project.is_empty() {
+            "doppler".to_string()
+        } else {
+            format!("doppler:{}/{}", self.project, self.config)
+        }
+    }
+}
+
+/// The `doppler` kind, as a plugin definition.
+pub fn plugin() -> Definition {
+    providerplugin("doppler", |spec| {
+        Ok(Rc::new(DopplerProvider {
+            token: spec.token.clone(),
+            project: spec.project.clone(),
+            config: spec.config.clone(),
+            addr: spec.addr.clone(),
+            ..Default::default()
+        }) as Rc<dyn Provider>)
+    })
+}

package/project/.sdk/tm/rust/feature/secrets/plugins/gcpsecrets.rs

@@ -0,0 +1,153 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/gcpsecrets/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! The GCP Secret Manager provider, as a voxgig/plugin definition.
+
+use std::cell::RefCell;
+use std::env;
+use std::rc::Rc;
+use std::time::Instant;
+
+use crate::feature::secrets::plugin::catalog::Definition;
+use crate::feature::secrets::sekreto::{checkaddr, flatname, providerplugin, Answer, Provider, SekretoError};
+use super::httpjson::json::Json;
+use super::httpjson::{
+    expiryseconds, fetchjson, firstof, http, renewdue, renewtime, textat, trimslash,
+};
+
+/// GCP Secret Manager.
+///
+/// `api.token` reads secret `api_token` (dots flattened to `_`; Secret
+/// Manager ids have no hierarchy and reject dots), latest version. The
+/// token comes from config, then `GOOGLE_OAUTH_ACCESS_TOKEN`, then the
+/// GCE/GKE metadata server - so on Google's own platform no credential
+/// configuration is needed at all.
+///
+/// The metadata call itself is plain http to a link-local host by
+/// platform design; no credential rides on it, so `checkaddr` guards the
+/// Secret Manager address instead.
+#[derive(Default)]
+pub struct GcpSecretsProvider {
+    pub project: String,
+    pub token: String,
+    pub addr: String,
+    pub metadataaddr: String,
+    // A configured token is kept forever; a metadata-server token carries
+    // expires_in and is renewed shortly before it runs out.
+    livetoken: RefCell<Option<String>>,
+    renewat: RefCell<Option<Instant>>,
+}
+
+impl GcpSecretsProvider {
+    fn metadataaddr(&self) -> String {
+        if !self.metadataaddr.is_empty() {
+            return self.metadataaddr.clone();
+        }
+        match env::var("GCE_METADATA_HOST") {
+            Ok(host) if !host.is_empty() => format!("http://{}", host),
+            _ => "http://metadata.google.internal".to_string(),
+        }
+    }
+
+    fn login(&self) -> Answer<String> {
+        let configured = firstof(&self.token, &["GOOGLE_OAUTH_ACCESS_TOKEN"]);
+        if !configured.is_empty() {
+            return Ok(configured);
+        }
+
+        let url = format!(
+            "{}/computeMetadata/v1/instance/service-accounts/default/token",
+            trimslash(&self.metadataaddr())
+        );
+
+        let response = fetchjson("GET", &url, &[("Metadata-Flavor", "Google")], None)?;
+
+        let got = textat(&response.body, &["access_token"]).unwrap_or_default();
+
+        if 200 != response.status || got.is_empty() {
+            return Err(SekretoError::new(
+                "sekreto: gcp: no token and metadata server did not answer",
+            ));
+        }
+
+        let expires = expiryseconds(&response.body, &["expires_in"]);
+        *self.renewat.borrow_mut() = renewtime(expires);
+
+        Ok(got)
+    }
+}
+
+impl Provider for GcpSecretsProvider {
+    fn lookup(&self, name: &str) -> Answer<Option<String>> {
+        if self.project.is_empty() {
+            return Err(SekretoError::new("sekreto: gcp: no project"));
+        }
+
+        let addr = if self.addr.is_empty() {
+            "https://secretmanager.googleapis.com"
+        } else {
+            &self.addr
+        };
+        checkaddr(addr)?;
+
+        if self.livetoken.borrow().is_none() || renewdue(&self.renewat) {
+            *self.livetoken.borrow_mut() = Some(self.login()?);
+        }
+        let livetoken = self.livetoken.borrow().clone().unwrap_or_default();
+
+        let url = format!(
+            "{}/v1/projects/{}/secrets/{}/versions/latest:access",
+            trimslash(addr),
+            self.project,
+            flatname(name, "_")?
+        );
+
+        let bearer = format!("Bearer {}", livetoken);
+        let response = fetchjson("GET", &url, &[("authorization", bearer.as_str())], None)?;
+
+        if 404 == response.status {
+            return Ok(None);
+        }
+
+        if 200 != response.status {
+            return Err(SekretoError::new(format!(
+                "sekreto: gcp error: {}: {}",
+                response.status, url
+            )));
+        }
+
+        let data = match response
+            .body
+            .as_ref()
+            .and_then(|body| body.get("payload"))
+            .and_then(|payload| payload.get("data"))
+        {
+            Some(Json::Str(data)) => data.clone(),
+            _ => return Ok(None),
+        };
+
+        // See the aws provider: an undecodable payload is an error, not a
+        // miss.
+        match http::unbase64(&data) {
+            Some(bytes) => Ok(Some(String::from_utf8_lossy(&bytes).to_string())),
+            None => Err(SekretoError::new("sekreto: gcp: undecodable secret".to_string())),
+        }
+    }
+
+    fn describe(&self) -> String {
+        format!("gcpsecrets:{}", self.project)
+    }
+}
+
+/// The `gcpsecrets` kind, as a plugin definition.
+pub fn plugin() -> Definition {
+    providerplugin("gcpsecrets", |spec| {
+        Ok(Rc::new(GcpSecretsProvider {
+            project: spec.project.clone(),
+            token: spec.token.clone(),
+            addr: spec.addr.clone(),
+            metadataaddr: spec.metadataaddr.clone(),
+            ..Default::default()
+        }) as Rc<dyn Provider>)
+    })
+}

package/project/.sdk/tm/rust/feature/secrets/plugins/hashicorp.rs

@@ -0,0 +1,228 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/hashicorp/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! The HashiCorp Vault provider, as a voxgig/plugin definition.
+//!
+//! It is a plugin because it opens a socket: the core reads at most a
+//! local file. Depend on this crate to put `hashicorp` in a chain, and on
+//! nothing else you do not configure.
+
+use std::cell::RefCell;
+use std::collections::BTreeMap;
+use std::fs;
+use std::rc::Rc;
+use std::time::Instant;
+
+use crate::feature::secrets::plugin::catalog::Definition;
+use crate::feature::secrets::sekreto::{checkaddr, providerplugin, vaultref, Answer, AuthSpec, Provider, SekretoError};
+use super::httpjson::json::{self, Json};
+use super::httpjson::{
+    expiryseconds, fetchjson, headerrefs, renewdue, renewtime, textat, trimslash,
+};
+
+/// HashiCorp Vault.
+///
+/// KV v2 (the default): `api.token` reads `{addr}/v1/{mount}/data/api`
+/// and takes the `token` field of `data.data`. KV v1 (`kv: 1`) reads
+/// `{addr}/v1/{mount}/api` and takes the field of `data`. A 404 means
+/// "not here" - a miss - so a vault can sit in a chain with fallbacks.
+///
+/// A Vault Enterprise namespace rides the X-Vault-Namespace header, on
+/// logins as well as reads.
+///
+/// Instead of being handed a token, the provider can log in: Kubernetes
+/// auth (the pod's service-account JWT, from its conventional path) or
+/// AppRole. A failed login is an error, never a miss - it means this
+/// store could not answer at all.
+#[derive(Default)]
+pub struct HashicorpProvider {
+    pub addr: String,
+    pub token: String,
+    pub mount: String,
+    /// KV engine version, 1 or 2.
+    pub kv: u32,
+    pub vaultnamespace: String,
+    pub auth: Option<AuthSpec>,
+    // The working token: a configured token is kept forever, a logged-in
+    // token is renewed shortly before its lease runs out - a long-running
+    // process must not keep presenting a token the vault already expired.
+    livetoken: RefCell<Option<String>>,
+    renewat: RefCell<Option<Instant>>,
+}
+
+impl HashicorpProvider {
+    fn baseheaders(&self) -> Vec<(String, String)> {
+        let mut headers = Vec::new();
+        if !self.vaultnamespace.is_empty() {
+            headers.push((
+                "X-Vault-Namespace".to_string(),
+                self.vaultnamespace.clone(),
+            ));
+        }
+        headers
+    }
+
+    fn login(&self) -> Answer<String> {
+        let auth = match &self.auth {
+            Some(auth) => auth,
+            None => {
+                return Err(SekretoError::new(
+                    "sekreto: hashicorp: no token and no auth method",
+                ))
+            }
+        };
+
+        let mount = if auth.mount.is_empty() {
+            &auth.method
+        } else {
+            &auth.mount
+        };
+        let url = format!(
+            "{}/v1/auth/{}/login",
+            trimslash(&self.addr),
+            mount
+        );
+
+        let body = match auth.method.as_str() {
+            "kubernetes" => {
+                let jwt = match &auth.jwt {
+                    Some(jwt) => jwt.clone(),
+                    None => {
+                        let file = if auth.jwtfile.is_empty() {
+                            "/var/run/secrets/kubernetes.io/serviceaccount/token"
+                        } else {
+                            &auth.jwtfile
+                        };
+                        fs::read_to_string(file)
+                            .map(|text| text.trim().to_string())
+                            .map_err(|_| {
+                                SekretoError::new(format!(
+                                    "sekreto: hashicorp: cannot read jwt file {}",
+                                    file
+                                ))
+                            })?
+                    }
+                };
+                Json::Map(BTreeMap::from([
+                    ("role".to_string(), Json::Str(auth.role.clone())),
+                    ("jwt".to_string(), Json::Str(jwt)),
+                ]))
+            }
+            "approle" => Json::Map(BTreeMap::from([
+                ("role_id".to_string(), Json::Str(auth.roleid.clone())),
+                ("secret_id".to_string(), Json::Str(auth.secretid.clone())),
+            ])),
+            _ => {
+                return Err(SekretoError::new(format!(
+                    "sekreto: hashicorp: unknown auth method: {}",
+                    auth.method
+                )))
+            }
+        };
+
+        let headers = self.baseheaders();
+        let response = fetchjson(
+            "POST",
+            &url,
+            &headerrefs(&headers),
+            Some(&json::stringify(&body)),
+        )?;
+
+        let got = textat(&response.body, &["auth", "client_token"]).unwrap_or_default();
+
+        if 200 != response.status || got.is_empty() {
+            return Err(SekretoError::new(format!(
+                "sekreto: hashicorp login failed: {}: {}",
+                response.status, url
+            )));
+        }
+
+        let lease = expiryseconds(&response.body, &["auth", "lease_duration"]);
+        *self.renewat.borrow_mut() = renewtime(lease);
+
+        Ok(got)
+    }
+}
+
+impl Provider for HashicorpProvider {
+    fn lookup(&self, name: &str) -> Answer<Option<String>> {
+        checkaddr(&self.addr)?;
+
+        if self.livetoken.borrow().is_none() || renewdue(&self.renewat) {
+            let token = if self.token.is_empty() {
+                self.login()?
+            } else {
+                self.token.clone()
+            };
+            *self.livetoken.borrow_mut() = Some(token);
+        }
+        let livetoken = self.livetoken.borrow().clone().unwrap_or_default();
+
+        let reference = vaultref(name)?;
+        let base = format!("{}/v1/{}", trimslash(&self.addr), self.mount);
+        let url = if 1 == self.kv {
+            format!("{}/{}", base, reference.path)
+        } else {
+            format!("{}/data/{}", base, reference.path)
+        };
+
+        let mut headers = self.baseheaders();
+        headers.push(("X-Vault-Token".to_string(), livetoken));
+
+        let response = fetchjson("GET", &url, &headerrefs(&headers), None)?;
+
+        if 404 == response.status {
+            return Ok(None);
+        }
+
+        if 200 != response.status {
+            return Err(SekretoError::new(format!(
+                "sekreto: hashicorp error: {}: {}",
+                response.status, url
+            )));
+        }
+
+        if 1 == self.kv {
+            return Ok(textat(&response.body, &["data", reference.field.as_str()]));
+        }
+        Ok(textat(
+            &response.body,
+            &["data", "data", reference.field.as_str()],
+        ))
+    }
+
+    fn describe(&self) -> String {
+        format!("hashicorp:{}/{}", self.addr, self.mount)
+    }
+}
+
+/// The `hashicorp` kind, as a plugin definition.
+pub fn plugin() -> Definition {
+    providerplugin("hashicorp", |spec| {
+        let kv = if 0 == spec.kv { 2 } else { spec.kv };
+
+        // A version typo like kv: 3 must not quietly behave as v2 and
+        // turn its 404s into misses; there is nothing safe to assume
+        // it meant.
+        if 1 != kv && 2 != kv {
+            return Err(SekretoError::new(format!(
+                "sekreto: hashicorp: unsupported kv version: {}",
+                kv
+            )));
+        }
+
+        Ok(Rc::new(HashicorpProvider {
+            addr: spec.addr.clone(),
+            token: spec.token.clone(),
+            mount: if spec.mount.is_empty() {
+                "secret".to_string()
+            } else {
+                spec.mount.clone()
+            },
+            kv,
+            vaultnamespace: spec.vaultnamespace.clone(),
+            auth: spec.auth.clone(),
+            ..Default::default()
+        }) as Rc<dyn Provider>)
+    })
+}