@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/plugins/httpjson.ex

@@ -0,0 +1,134 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/plugins/httpjson.ex)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# The round-trip every remote store shares - and OUTSIDE THE CORE with the
+# client under it.
+#
+# Eight of the ten plugin kinds read a vault over HTTPS, and all eight
+# want the same three things: one JSON round-trip whose failures are
+# never a miss, a login token renewed shortly before its lease runs out,
+# and a handful of conversions between a JSON value and the string a
+# secret is. Written once here rather than eight times, and never in the
+# core: a chain of the four built-ins must not link an HTTP client.
+#
+# `runcmd` is NOT here. The two kinds that read a store through its own
+# CLI - boru and secretspec - reach `Sekreto.Plugins.Proc` instead, so
+# that secretspec, which opens no socket at all, loads no socket code.
+
+defmodule Sekreto.Plugins.Httpjson do
+  @moduledoc """
+  The shared plugin edge: one JSON round-trip, token renewal, and the
+  small conversions the vault clients share.
+
+  A plugin module: nothing under `src/` names it. See
+  docs/design/plugin-providers.md.
+  """
+
+  alias Sekreto.Cell
+  alias Sekreto.Error
+  alias Sekreto.Json
+  alias Sekreto.Plugins.Http
+
+  @doc """
+  The renewal time of a token that has no expiry: never.
+
+  A configured token is kept forever; only a logged-in one carries a
+  lease. Answered by a function rather than held in a module attribute,
+  because every plugin that keeps a token cell needs the same value and
+  an attribute cannot cross a module.
+  """
+  def never, do: 9_223_372_036_854_775_807
+
+  @doc "An address without its trailing slash."
+  def trimslash(text), do: Sekreto.dropsuffix(text, "/")
+
+  @doc """
+  One JSON round-trip. Answers `%{status: integer, body: json | :none}`.
+
+  Network failure is always an error - an unreachable store is a store that
+  could not answer. A success status promised JSON, so a 200 whose body
+  does not parse is a store that answered incoherently, and treating that
+  as a miss would fall through to a weaker store. Error statuses may carry
+  any body at all: they are decided on status alone.
+  """
+  def fetchjson(method, url, headers \\ [], body \\ nil) do
+    answer = Http.fetch(method, url, headers, body)
+
+    parsed =
+      case Json.parse(answer.body) do
+        {:ok, value} -> value
+        :error -> :none
+      end
+
+    if 200 == answer.status and :none == parsed do
+      raise Error, message: "sekreto: malformed response from " <> Http.bare(url)
+    end
+
+    %{status: answer.status, body: parsed}
+  end
+
+  @doc """
+  When a logged-in token must be renewed, from its expiry in seconds (a
+  JSON number, or a string as Azure IMDS sends it): now + max(seconds - 60,
+  1). A missing or zero expiry means never renew.
+  """
+  def renewtime(expires) do
+    seconds =
+      case expires do
+        {:num, value} ->
+          value
+
+        {:str, value} ->
+          case Float.parse(value) do
+            {value, _rest} -> value
+            :error -> 0.0
+          end
+
+        _other ->
+          0.0
+      end
+
+    if 0 >= seconds do
+      never()
+    else
+      System.system_time(:millisecond) + trunc(max(seconds - 60, 1.0) * 1000)
+    end
+  end
+
+  @doc """
+  Is this token cell due for renewal? A cell holding no token has never
+  logged in; one past its renewal time is about to expire.
+  """
+  def expired?(cell) do
+    held = Cell.get(cell)
+    "" == held.token or System.system_time(:millisecond) >= held.renewat
+  end
+
+  @doc """
+  Strict base64.
+
+  Whitespace is stripped first - the canonical function accepts embedded
+  newlines - and then anything outside the standard alphabet, or a length
+  that is not a multiple of four, is REFUSED. A lenient decoder silently
+  skips what it does not recognise and hands back plausible bytes for a
+  corrupted payload, which then get returned as the secret.
+  """
+  def unbase64(text) do
+    stripped = String.replace(text, ~r/\s/, "")
+
+    case Base.decode64(stripped, padding: true) do
+      {:ok, bytes} -> bytes
+      :error -> :error
+    end
+  end
+
+  @doc "A JSON accessor's `:none` as the miss the chain reads: nil."
+  def nonone(:none), do: nil
+  def nonone(value), do: value
+
+  @doc "Any value as text, for a message: a status code, a kv version."
+  def tostr(value) when is_binary(value), do: value
+  def tostr(value) when is_integer(value), do: Integer.to_string(value)
+  def tostr(value) when is_float(value), do: Json.numstr(value)
+  def tostr(value), do: inspect(value)
+end

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/plugins/infisical.ex

@@ -0,0 +1,125 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/plugins/infisical.ex)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# Infisical, as a sekreto plugin.
+#
+# A port of typescript/plugins/infisical.ts, which is canonical.
+
+defmodule Sekreto.Plugins.Infisical do
+  @moduledoc """
+  The `infisical` provider kind.
+
+  A plugin module: nothing under `src/` names it, and a chain that does not
+  name this kind never loads it. See docs/design/plugin-providers.md.
+  """
+
+  alias Sekreto.Cell
+  alias Sekreto.Error
+  alias Sekreto.Json
+  alias Sekreto.Plugins.Http
+  alias Sekreto.Plugins.Httpjson
+  alias Sekreto.ProviderSpec
+  alias Sekreto.Providers
+
+  @doc """
+  The `infisical` provider kind, as a voxgig/plugin definition.
+
+  The calling project passes it to the constructor, and only then can a
+  chain name the kind:
+
+      Sekreto.new(chain, plugins: [Sekreto.Plugins.Infisical.infisical()])
+  """
+  def infisical, do: Providers.providerplugin("infisical", &fromspec/1)
+
+  @doc """
+  Infisical.
+
+  `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
+  convention is environment-style keys) at a secret path in one environment
+  of a project. Auth is a token, or a universal-auth (machine identity)
+  login with clientid/clientsecret.
+  """
+  def infisical(opts) do
+    cell = Cell.new(%{token: "", renewat: Httpjson.never()})
+
+    login = fn useaddr ->
+      if "" != opts.token do
+        Cell.put(cell, %{token: opts.token, renewat: Httpjson.never()})
+      else
+        if "" == opts.clientid or "" == opts.clientsecret do
+          raise Error, message: "sekreto: infisical: no token and no client credentials"
+        end
+
+        body =
+          Json.obj([
+            {"clientId", Json.str(opts.clientid)},
+            {"clientSecret", Json.str(opts.clientsecret)}
+          ])
+
+        res =
+          Httpjson.fetchjson(
+            "POST",
+            useaddr <> "/api/v1/auth/universal-auth/login",
+            [{"content-type", "application/json"}],
+            Json.stringify(body)
+          )
+
+        got = Json.text(Json.dig(res.body, ["accessToken"]))
+
+        if 200 != res.status or :none == got or "" == got do
+          raise Error, message: "sekreto: infisical login failed: " <> Httpjson.tostr(res.status)
+        end
+
+        # camelCase, unlike everyone else's expires_in.
+        renewat = Httpjson.renewtime(Json.dig(res.body, ["expiresIn"]))
+        Cell.put(cell, %{token: got, renewat: renewat})
+      end
+    end
+
+    %{
+      lookup: fn name ->
+        useaddr = Httpjson.trimslash(Providers.first([opts.addr, "https://app.infisical.com"]))
+        Providers.checkaddr(useaddr)
+
+        if "" == opts.project or "" == opts.environment do
+          raise Error, message: "sekreto: infisical: no project/environment"
+        end
+
+        if Httpjson.expired?(cell), do: login.(useaddr)
+
+        url =
+          useaddr <>
+            "/api/v3/secrets/raw/" <>
+            Sekreto.envkey(name) <>
+            "?workspaceId=" <>
+            Http.uriescape(opts.project) <>
+            "&environment=" <>
+            Http.uriescape(opts.environment) <>
+            "&secretPath=" <> Http.uriescape(Providers.first([opts.path, "/"]))
+
+        res =
+          Httpjson.fetchjson("GET", url, [{"authorization", "Bearer " <> Cell.get(cell).token}])
+
+        cond do
+          404 == res.status -> nil
+          200 != res.status ->
+            raise Error, message: "sekreto: infisical error: " <> Httpjson.tostr(res.status)
+          true -> Httpjson.nonone(Json.text(Json.dig(res.body, ["secret", "secretValue"])))
+        end
+      end,
+      describe: fn -> "infisical:" <> opts.project <> "/" <> opts.environment end
+    }
+  end
+
+  defp fromspec(%ProviderSpec{} = spec) do
+    infisical(%{
+      addr: spec.addr,
+      token: spec.token,
+      clientid: spec.clientid,
+      clientsecret: spec.clientsecret,
+      project: spec.project,
+      environment: spec.environment,
+      path: spec.path
+    })
+  end
+end

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/plugins/onepassword.ex

@@ -0,0 +1,152 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/plugins/onepassword.ex)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# 1Password, through a Connect server, as a sekreto plugin.
+#
+# A port of typescript/plugins/onepassword.ts, which is canonical.
+
+defmodule Sekreto.Plugins.Onepassword do
+  @moduledoc """
+  The `onepassword` provider kind.
+
+  A plugin module: nothing under `src/` names it, and a chain that does not
+  name this kind never loads it. See docs/design/plugin-providers.md.
+  """
+
+  alias Sekreto.Cell
+  alias Sekreto.Error
+  alias Sekreto.Json
+  alias Sekreto.Plugins.Http
+  alias Sekreto.Plugins.Httpjson
+  alias Sekreto.ProviderSpec
+  alias Sekreto.Providers
+
+  @doc """
+  The `onepassword` provider kind, as a voxgig/plugin definition.
+
+  The calling project passes it to the constructor, and only then can a
+  chain name the kind:
+
+      Sekreto.new(chain, plugins: [Sekreto.Plugins.Onepassword.onepassword()])
+  """
+  def onepassword, do: Providers.providerplugin("onepassword", &fromspec/1)
+
+  @doc """
+  1Password, through a Connect server.
+
+  The item titled `api.token` (titles keep their dots), in the named vault.
+  The value is the field with purpose PASSWORD, or the field labelled
+  `value`. A vault that cannot be found is an error - config names it, so
+  its absence is a broken store, not a missing secret.
+  """
+  def onepassword(addr, token, vault) do
+    cell = Cell.new(:unresolved)
+    auth = [{"authorization", "Bearer " <> token}]
+
+    resolvevault = fn useaddr ->
+      if "" == vault, do: raise(Error, message: "sekreto: onepassword: no vault")
+
+      res = Httpjson.fetchjson("GET", useaddr <> "/v1/vaults", auth)
+      list = Json.asarr(res.body)
+
+      if 200 != res.status or :none == list do
+        raise Error,
+          message:
+            "sekreto: onepassword error: " <> Httpjson.tostr(res.status) <> ": listing vaults"
+      end
+
+      found =
+        Enum.find(list, fn entry ->
+          vault == Json.text(Json.dig(entry, ["id"])) or
+            vault == Json.text(Json.dig(entry, ["name"]))
+        end)
+
+      if nil == found do
+        raise Error, message: "sekreto: onepassword: no vault named " <> vault
+      end
+
+      case Json.text(Json.dig(found, ["id"])) do
+        :none -> ""
+        id -> id
+      end
+    end
+
+    %{
+      lookup: fn name ->
+        Sekreto.checkname(name)
+
+        useaddr = Httpjson.trimslash(addr)
+        if "" == useaddr, do: raise(Error, message: "sekreto: onepassword: no addr")
+        Providers.checkaddr(useaddr)
+
+        id =
+          case Cell.get(cell) do
+            :unresolved ->
+              resolved = resolvevault.(useaddr)
+              Cell.put(cell, resolved)
+              resolved
+
+            resolved ->
+              resolved
+          end
+
+        filter = Http.uriescape(~s|title eq "| <> name <> ~s|"|)
+        found =
+          Httpjson.fetchjson(
+            "GET",
+            useaddr <> "/v1/vaults/" <> id <> "/items?filter=" <> filter,
+            auth
+          )
+
+        items = Json.asarr(found.body)
+
+        if 200 != found.status or :none == items do
+          raise Error,
+            message:
+              "sekreto: onepassword error: " <>
+                Httpjson.tostr(found.status) <> ": finding " <> name
+        end
+
+        if [] == items do
+          nil
+        else
+          itemid =
+            case Json.text(Json.dig(hd(items), ["id"])) do
+              :none -> ""
+              value -> value
+            end
+
+          item =
+            Httpjson.fetchjson("GET", useaddr <> "/v1/vaults/" <> id <> "/items/" <> itemid, auth)
+
+          if 200 != item.status do
+            raise Error,
+              message:
+                "sekreto: onepassword error: " <>
+                  Httpjson.tostr(item.status) <> ": reading " <> name
+          end
+
+          fields =
+            case Json.asarr(Json.dig(item.body, ["fields"])) do
+              :none -> []
+              value -> value
+            end
+
+          # Two full passes, in order: purpose first, then label.
+          chosen =
+            Enum.find(fields, fn field ->
+              "PASSWORD" == Json.asstr(Json.dig(field, ["purpose"]))
+            end) ||
+              Enum.find(fields, fn field ->
+                "value" == Json.asstr(Json.dig(field, ["label"]))
+              end)
+
+          if nil == chosen, do: nil, else: Httpjson.nonone(Json.text(Json.dig(chosen, ["value"])))
+        end
+      end,
+      describe: fn -> "onepassword:" <> vault end
+    }
+  end
+
+  defp fromspec(%ProviderSpec{} = spec), do: onepassword(spec.addr, spec.token, spec.vault)
+end

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/plugins/proc.ex

@@ -0,0 +1,80 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/plugins/proc.ex)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# The child-process half of the two plugins that read a store through its
+# own CLI - boru and secretspec - in one place and OUTSIDE THE CORE.
+#
+# A chain of the four built-in kinds never spawns anything, so this module
+# is one of the three things that make a kind a plugin: a socket, a
+# signature, a child. It is its own module rather than part of `httpjson`
+# because secretspec opens no socket at all, and reaching an HTTP helper
+# for a shared string function would load a TLS stack into a process that
+# only ever runs a program.
+#
+# The canonical port has no module of this shape, because node's
+# `spawnSync` needs no wrapper. The BEAM's ports do.
+
+defmodule Sekreto.Plugins.Proc do
+  @moduledoc """
+  Run a child to completion and collect both its streams.
+
+  A plugin module: nothing under `src/` names it. See
+  docs/design/plugin-providers.md.
+  """
+
+  alias Sekreto.Error
+
+  @doc """
+  Run a child to completion and collect both its streams.
+
+  The BEAM's ports cannot give a parent the child's stderr on a channel of
+  its own - and boru's and SecretSpec's miss detection is a phrase they
+  print THERE, so merging it into stdout would put a diagnostic where a
+  secret is supposed to be. The child is therefore started through `sh`
+  with its stderr redirected to a file and its stdin taken from
+  `/dev/null`, which also delivers the other two obligations: a CLI that
+  prompts for a passphrase sees EOF rather than hanging, and a child that
+  writes more than one 64 KiB pipe buffer to stderr cannot deadlock,
+  because nothing is draining a pipe.
+
+  The arguments go through `$0` and `$@`, so nothing is ever parsed by the
+  shell, and the redirect target arrives in the environment rather than
+  spliced into the script text.
+  """
+  def runcmd(command, args, env \\ []) do
+    exe = System.find_executable(command)
+
+    if nil == exe do
+      raise Error, message: "sekreto: cannot run " <> command <> ": no such file or directory"
+    end
+
+    errfile =
+      Path.join(
+        System.tmp_dir() || "/tmp",
+        "sekreto-stderr-#{:erlang.unique_integer([:positive])}"
+      )
+
+    script = ~s|exec "$0" "$@" </dev/null 2>"$SEKRETO_STDERR_FILE"|
+
+    try do
+      {out, status} =
+        System.cmd("/bin/sh", ["-c", script, exe | args],
+          env: [{"SEKRETO_STDERR_FILE", errfile} | env],
+          stderr_to_stdout: false
+        )
+
+      why =
+        case File.read(errfile) do
+          {:ok, text} -> String.trim(text)
+          {:error, _why} -> ""
+        end
+
+      %{out: out, why: why, status: status}
+    rescue
+      err in [ErlangError, ArgumentError] ->
+        raise Error, message: "sekreto: cannot run " <> command <> ": " <> Exception.message(err)
+    after
+      File.rm(errfile)
+    end
+  end
+end

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets/sekreto/plugins/secretspec.ex

@@ -0,0 +1,101 @@
+# VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (elixir/plugins/secretspec.ex)
+# Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+# License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+# SecretSpec, as a sekreto plugin.
+#
+# A child process and nothing else: this is the one plugin kind that opens
+# no socket, so it reaches `Sekreto.Plugins.Proc` and never the HTTP
+# helper. Loading it loads no TLS stack. An exit status is an integer, so
+# the message below formats it with `Integer.to_string/1` rather than with
+# `Httpjson.tostr/1` - reaching a shared HTTP module for a one-line string
+# function is exactly how a socketless kind ends up carrying a client.
+#
+# A port of typescript/plugins/secretspec.ts, which is canonical.
+
+defmodule Sekreto.Plugins.Secretspec do
+  @moduledoc """
+  The `secretspec` provider kind.
+
+  A plugin module: nothing under `src/` names it, and a chain that does not
+  name this kind never loads it. See docs/design/plugin-providers.md.
+  """
+
+  alias Sekreto.Error
+  alias Sekreto.Plugins.Proc
+  alias Sekreto.ProviderSpec
+  alias Sekreto.Providers
+
+  @doc """
+  The `secretspec` provider kind, as a voxgig/plugin definition.
+
+  The calling project passes it to the constructor, and only then can a
+  chain name the kind:
+
+      Sekreto.new(chain, plugins: [Sekreto.Plugins.Secretspec.secretspec()])
+  """
+  def secretspec, do: Providers.providerplugin("secretspec", &fromspec/1)
+
+  @doc """
+  SecretSpec.
+
+  SecretSpec is a declaration - a `secretspec.toml` naming the secrets a
+  project needs - plus a chain of its own backends to satisfy them from.
+  That makes it the same shape as sekreto one level down, and the reason to
+  support it is the same reason sekreto exists: a project that has already
+  declared its secrets there should not have to declare them again here.
+
+  A reason is required, not optional: SecretSpec records every read in an
+  audit log and refuses to read at all without one.
+  """
+  def secretspec(commandgiven, file, profile, backend, reason, prefix) do
+    command = Providers.first([commandgiven, "secretspec"])
+
+    %{
+      lookup: fn name ->
+        key = Sekreto.envkey(name, prefix)
+
+        args =
+          (if "" == file, do: [], else: ["--file", file]) ++
+            ["get", key] ++
+            (if "" == backend, do: [], else: ["--provider", backend]) ++
+            (if "" == profile, do: [], else: ["--profile", profile]) ++
+            ["--reason", Providers.first([reason, "sekreto"])]
+
+        ran = Proc.runcmd(command, args)
+
+        cond do
+          0 == ran.status ->
+            Sekreto.dropsuffix(ran.out, "\n")
+
+          secretspecmiss(ran.why, key) ->
+            nil
+
+          true ->
+            raise Error,
+              message:
+                "sekreto: secretspec error: " <>
+                  if("" == ran.why, do: "exit " <> Integer.to_string(ran.status), else: ran.why)
+        end
+      end,
+      describe: fn -> if "" == backend, do: "secretspec", else: "secretspec:" <> backend end
+    }
+  end
+
+  @doc """
+  Does this SecretSpec failure mean "no such secret" rather than "I could
+  not answer"?
+
+  SecretSpec says `Secret 'API_TOKEN' not found` for both a name it does
+  not declare and one declared with no value, and both are misses.
+
+  MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
+  `Provider backend 'keyring' not found`, which is a store that could not
+  answer at all - and reading that as a miss is the worst failure this
+  library has, because the chain then falls through to a weaker store
+  without saying so.
+  """
+  def secretspecmiss(why, key), do: String.contains?(why, "Secret '" <> key <> "' not found")
+
+  defp fromspec(%ProviderSpec{} = spec),
+    do: secretspec(spec.command, spec.file, spec.profile, spec.backend, spec.reason, spec.prefix)
+end