@voxgig/sdkgen 4.9.0 → 4.10.0

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Httpjson.kt

@@ -0,0 +1,219 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Httpjson.kt)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// The shared HTTP-JSON transport, and the child-process runner.
+//
+// PLUGIN-ONLY, and that is the point of the file. A socket, a TLS
+// handshake and a forked process are exactly what the core does not
+// have, so the bounded, redirect-refusing, one JSON round-trip helper
+// every vault client here is built on lives under `plugins/` with them.
+// A chain of the four built-in kinds never links it.
+//
+// A port of typescript/plugins/httpjson.ts, which is canonical.
+
+package KOTLINPACKAGE.feature.secrets.sekreto.plugins
+
+import KOTLINPACKAGE.feature.secrets.sekreto.Json
+import KOTLINPACKAGE.feature.secrets.sekreto.SekretoError
+
+import java.io.ByteArrayOutputStream
+import java.io.IOException
+import java.net.URI
+import java.net.http.HttpClient
+import java.net.http.HttpRequest
+import java.net.http.HttpResponse
+import java.nio.charset.StandardCharsets
+import java.time.Duration
+
+/** How long any single vault round-trip may take before it is treated
+ * as unreachable. Ports carry the same bound. */
+private val TIMEOUT: Duration = Duration.ofSeconds(10)
+
+/**
+ * How much of a response body will be read before the store is treated
+ * as having answered incoherently. Ports carry the same bound.
+ *
+ * Far above anything real - the largest legitimate payload this library
+ * fetches is Doppler's whole-config download, measured in kilobytes. A
+ * bound is needed because the TIMEOUT is not one: ten seconds on a
+ * loopback or datacentre link is gigabytes, and the body is accumulated
+ * in memory before it is parsed. This runs on an application's startup
+ * path, so the failure is the application never starting.
+ */
+private const val MAXBODY = 8 * 1024 * 1024
+
+/** What a finished child process left behind. */
+internal data class Ran(val out: String, val why: String, val status: Int)
+
+/**
+ * Run a child to completion and collect both its streams.
+ *
+ * The two streams are drained CONCURRENTLY. Reading stdout to EOF and
+ * only then reading stderr deadlocks the moment the child writes more
+ * than one pipe buffer (64 KiB on Linux) to stderr: the parent is blocked
+ * waiting for stdout, the child is blocked waiting for room on stderr,
+ * and neither can move. Nothing in this library sets a timeout, so that
+ * hang is permanent - `get()` simply never returns. secretspec's
+ * diagnostics are box-drawn and reach that size easily.
+ *
+ * The child's stdin is closed rather than left open on a pipe nobody
+ * writes to, so a CLI that reads it - one prompting for a passphrase when
+ * its environment variable is absent - sees EOF and gives up instead of
+ * waiting forever.
+ */
+internal fun runcmd(builder: ProcessBuilder, command: String): Ran {
+    try {
+        val process = builder.start()
+
+        process.outputStream.close()
+
+        val errbuf = ByteArrayOutputStream()
+        val drain = Thread {
+            try {
+                process.errorStream.transferTo(errbuf)
+            } catch (err: IOException) {
+                // The child went away mid-write; waitFor reports how.
+            }
+        }
+        drain.isDaemon = true
+        drain.start()
+
+        val out = String(process.inputStream.readAllBytes(), StandardCharsets.UTF_8)
+        val status = process.waitFor()
+        drain.join()
+
+        return Ran(out, String(errbuf.toByteArray(), StandardCharsets.UTF_8).trim(), status)
+    } catch (err: IOException) {
+        throw SekretoError("sekreto: cannot run $command: ${err.message}")
+    } catch (err: InterruptedException) {
+        Thread.currentThread().interrupt()
+        throw SekretoError("sekreto: interrupted running $command")
+    }
+}
+
+// HTTP/1.1, explicitly.
+//
+// java.net.http defaults to HTTP_2, and over cleartext that means an h2c
+// upgrade: the first request goes out with `Upgrade: h2c`, the declared
+// Content-Length, and NO BODY, and the body follows only after the
+// server declines. A server that checks the two against each other -
+// Fastify does, and Infisical is Fastify - rejects that request outright
+// with "Request body size did not match Content-Length", so every POST
+// this port makes to such a server fails before it is even read.
+//
+// The mocks in test/ are Node's own http module, which does not object,
+// which is why this survived until the same code met a real Infisical.
+// No vault API this library speaks needs HTTP/2.
+//
+// Redirects are never followed: a vault API does not legitimately
+// redirect, and a followed redirect would carry X-Vault-Token to the
+// redirect's host (and could downgrade https to http), which checkaddr -
+// it only validates the configured address - cannot see.
+private val CLIENT: HttpClient = HttpClient.newBuilder()
+    .version(HttpClient.Version.HTTP_1_1)
+    .followRedirects(HttpClient.Redirect.NEVER)
+    .connectTimeout(TIMEOUT)
+    .build()
+
+/** One JSON round-trip's result: the status, and the parsed body. */
+internal data class Answer(val status: Int, val body: Json?)
+
+/**
+ * One JSON round-trip. Network failure is always an error - an
+ * unreachable store is a store that could not answer.
+ */
+internal fun fetchjson(
+    method: String,
+    url: String,
+    headers: Map<String, String> = emptyMap(),
+    body: String? = null,
+): Answer {
+    val builder = HttpRequest.newBuilder()
+        .uri(URI.create(url))
+        .timeout(TIMEOUT)
+        .method(
+            method,
+            if (null == body) {
+                HttpRequest.BodyPublishers.noBody()
+            } else {
+                HttpRequest.BodyPublishers.ofString(body, StandardCharsets.UTF_8)
+            },
+        )
+
+    for ((key, value) in headers) {
+        builder.header(key, value)
+    }
+
+    // ofInputStream, not ofString: ofString buffers whatever arrives, so
+    // an endless body would be accumulated in memory until the deadline -
+    // which on a loopback or datacentre link is gigabytes.
+    val response: HttpResponse<java.io.InputStream> = try {
+        CLIENT.send(builder.build(), HttpResponse.BodyHandlers.ofInputStream())
+    } catch (err: IOException) {
+        // A refused connection arrives with a null message, so the class
+        // name stands in - "cannot reach ...: null" says nothing at all.
+        throw SekretoError(
+            "sekreto: cannot reach ${bare(url)}: ${err.message ?: err.toString()}",
+        )
+    } catch (err: InterruptedException) {
+        Thread.currentThread().interrupt()
+        throw SekretoError("sekreto: cannot reach ${bare(url)}: interrupted")
+    }
+
+    // A success status promised JSON; a body that does not parse means
+    // the store could not answer coherently, and treating it as a miss
+    // would fall through to a weaker store. Error statuses may carry any
+    // body - they are decided on status alone.
+    // One byte over the bound is enough to know it was exceeded. An
+    // endless body is a store that could not answer, so this raises
+    // rather than returning a miss - the latter would fall through to a
+    // weaker store on an attacker's cue.
+    val text = try {
+        response.body().use { stream ->
+            val raw = stream.readNBytes(MAXBODY + 1)
+            if (MAXBODY < raw.size) {
+                throw SekretoError("sekreto: oversized response from ${bare(url)}")
+            }
+            String(raw, StandardCharsets.UTF_8)
+        }
+    } catch (err: IOException) {
+        throw SekretoError(
+            "sekreto: cannot reach ${bare(url)}: ${err.message ?: err.toString()}",
+        )
+    }
+
+    val parsed = Json.parse(text)
+    if (200 == response.statusCode() && null == parsed) {
+        throw SekretoError("sekreto: malformed response from ${bare(url)}")
+    }
+
+    return Answer(response.statusCode(), parsed)
+}
+
+/** A URL without its query string, for a message that must not leak one. */
+internal fun bare(url: String): String = url.substringBefore('?')
+
+/** The first candidate that is set and non-empty, or empty. */
+internal fun first(vararg candidates: String?): String =
+    candidates.firstOrNull { !it.isNullOrEmpty() } ?: ""
+
+internal fun trimslash(text: String): String = text.removeSuffix("/")
+
+/**
+ * When a logged-in token must be renewed, from its expiry in seconds (a
+ * JSON number, or a string as Azure IMDS sends it): now + max(seconds -
+ * 60, 1). A missing or zero expiry means never renew.
+ */
+internal fun renewtime(expires: Json?): Long {
+    val seconds = when (expires) {
+        is Json.Num -> expires.value
+        is Json.Str -> expires.value.toDoubleOrNull() ?: 0.0
+        else -> 0.0
+    }
+
+    if (seconds.isNaN() || 0 >= seconds) {
+        return Long.MAX_VALUE
+    }
+
+    return System.currentTimeMillis() + (maxOf(seconds - 60, 1.0) * 1000).toLong()
+}

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Infisical.kt

@@ -0,0 +1,114 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Infisical.kt)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// Infisical, as a voxgig/plugin definition.
+
+package KOTLINPACKAGE.feature.secrets.sekreto.plugins
+
+import KOTLINPACKAGE.feature.secrets.sekreto.Definition
+import KOTLINPACKAGE.feature.secrets.sekreto.Json
+import KOTLINPACKAGE.feature.secrets.sekreto.Provider
+import KOTLINPACKAGE.feature.secrets.sekreto.Providers.checkaddr
+import KOTLINPACKAGE.feature.secrets.sekreto.SekretoError
+import KOTLINPACKAGE.feature.secrets.sekreto.envkey
+import KOTLINPACKAGE.feature.secrets.sekreto.providerplugin
+
+/**
+ * Infisical.
+ *
+ * `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
+ * convention is environment-style keys) at a secret path in one
+ * environment of a project. Auth is a token, or a universal-auth (machine
+ * identity) login with clientid/clientsecret.
+ */
+class Infisical(
+    private val addr: String? = null,
+    private val token: String? = null,
+    private val clientid: String? = null,
+    private val clientsecret: String? = null,
+    private val project: String? = null,
+    private val environment: String? = null,
+    private val path: String? = null,
+) : Provider {
+
+    // A configured token is kept forever; a universal-auth token carries
+    // expiresIn and is renewed shortly before it runs out.
+    private var livetoken: String? = null
+    private var renewat: Long = Long.MAX_VALUE
+
+    private fun login(useaddr: String): String {
+        if (!token.isNullOrEmpty()) {
+            return token
+        }
+
+        if (clientid.isNullOrEmpty() || clientsecret.isNullOrEmpty()) {
+            throw SekretoError("sekreto: infisical: no token and no client credentials")
+        }
+
+        val body = Json.obj(
+            "clientId" to Json.str(clientid),
+            "clientSecret" to Json.str(clientsecret),
+        )
+
+        val res = fetchjson(
+            "POST",
+            "$useaddr/api/v1/auth/universal-auth/login",
+            mapOf("content-type" to "application/json"),
+            Json.stringify(body),
+        )
+
+        val got = res.body?.dig("accessToken")?.text
+        if (200 != res.status || got.isNullOrEmpty()) {
+            throw SekretoError("sekreto: infisical login failed: ${res.status}")
+        }
+
+        renewat = renewtime(res.body?.dig("expiresIn"))
+
+        return got
+    }
+
+    override fun lookup(name: String): String? {
+        val useaddr = trimslash(first(addr, "https://app.infisical.com"))
+        checkaddr(useaddr)
+
+        val useproject = project ?: ""
+        val useenvironment = environment ?: ""
+        if (useproject.isEmpty() || useenvironment.isEmpty()) {
+            throw SekretoError("sekreto: infisical: no project/environment")
+        }
+
+        if (null == livetoken || System.currentTimeMillis() >= renewat) {
+            livetoken = login(useaddr)
+        }
+
+        val url = "$useaddr/api/v3/secrets/raw/" + envkey(name) +
+            "?workspaceId=" + uriescape(useproject) +
+            "&environment=" + uriescape(useenvironment) +
+            "&secretPath=" + uriescape(first(path, "/"))
+
+        val res = fetchjson("GET", url, mapOf("authorization" to "Bearer $livetoken"))
+
+        if (404 == res.status) {
+            return null
+        }
+
+        if (200 != res.status) {
+            throw SekretoError("sekreto: infisical error: ${res.status}")
+        }
+
+        return res.body?.dig("secret", "secretValue")?.text
+    }
+
+    override fun describe(): String =
+        "infisical:${project ?: ""}/${environment ?: ""}"
+}
+
+/** The `infisical` provider kind, as a voxgig/plugin definition. A
+ * consumer imports this and hands it to `Sekreto`; a consumer that does
+ * not is a `Sekreto` that cannot build a `infisical` chain entry. */
+val infisical: Definition = providerplugin("infisical") { spec ->
+    Infisical(
+        spec.addr, spec.token, spec.clientid, spec.clientsecret,
+        spec.project, spec.environment, spec.path,
+    )
+}

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Onepassword.kt

@@ -0,0 +1,114 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Onepassword.kt)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// 1Password Connect, as a voxgig/plugin definition.
+
+package KOTLINPACKAGE.feature.secrets.sekreto.plugins
+
+import KOTLINPACKAGE.feature.secrets.sekreto.Definition
+import KOTLINPACKAGE.feature.secrets.sekreto.Provider
+import KOTLINPACKAGE.feature.secrets.sekreto.Providers.checkaddr
+import KOTLINPACKAGE.feature.secrets.sekreto.SekretoError
+import KOTLINPACKAGE.feature.secrets.sekreto.checkname
+import KOTLINPACKAGE.feature.secrets.sekreto.providerplugin
+
+/**
+ * 1Password, through a Connect server.
+ *
+ * The item titled `api.token` (titles keep their dots), in the named
+ * vault. The value is the field with purpose PASSWORD, or the field
+ * labelled `value`. A vault that cannot be found is an error - config
+ * names it, so its absence is a broken store, not a missing secret.
+ */
+class Onepassword(
+    private val addr: String? = null,
+    private val token: String? = null,
+    private val vault: String? = null,
+) : Provider {
+
+    private var vaultid: String? = null
+
+    private fun auth(): Map<String, String> =
+        mapOf("authorization" to "Bearer ${token ?: ""}")
+
+    private fun resolvevault(useaddr: String): String {
+        val want = vault ?: ""
+        if (want.isEmpty()) {
+            throw SekretoError("sekreto: onepassword: no vault")
+        }
+
+        val res = fetchjson("GET", "$useaddr/v1/vaults", auth())
+
+        val list = res.body?.asarr
+        if (200 != res.status || null == list) {
+            throw SekretoError("sekreto: onepassword error: ${res.status}: listing vaults")
+        }
+
+        for (entry in list) {
+            val id = entry.dig("id")?.text
+            if (want == id || want == entry.dig("name")?.text) {
+                return id ?: ""
+            }
+        }
+
+        throw SekretoError("sekreto: onepassword: no vault named $want")
+    }
+
+    override fun lookup(name: String): String? {
+        checkname(name)
+
+        val useaddr = trimslash(addr ?: "")
+        if (useaddr.isEmpty()) {
+            throw SekretoError("sekreto: onepassword: no addr")
+        }
+        checkaddr(useaddr)
+
+        val id = vaultid ?: resolvevault(useaddr).also { vaultid = it }
+
+        val filter = uriescape("title eq \"$name\"")
+        val found = fetchjson("GET", "$useaddr/v1/vaults/$id/items?filter=$filter", auth())
+
+        val items = found.body?.asarr
+        if (200 != found.status || null == items) {
+            throw SekretoError("sekreto: onepassword error: ${found.status}: finding $name")
+        }
+
+        if (items.isEmpty()) {
+            return null
+        }
+
+        val item = fetchjson(
+            "GET",
+            "$useaddr/v1/vaults/$id/items/${items[0].dig("id")?.text}",
+            auth(),
+        )
+
+        if (200 != item.status) {
+            throw SekretoError("sekreto: onepassword error: ${item.status}: reading $name")
+        }
+
+        val fields = item.body?.dig("fields")?.asarr ?: emptyList()
+
+        for (field in fields) {
+            if ("PASSWORD" == field.dig("purpose")?.asstr) {
+                return field.dig("value")?.text
+            }
+        }
+        for (field in fields) {
+            if ("value" == field.dig("label")?.asstr) {
+                return field.dig("value")?.text
+            }
+        }
+
+        return null
+    }
+
+    override fun describe(): String = "onepassword:${vault ?: ""}"
+}
+
+/** The `onepassword` provider kind, as a voxgig/plugin definition. A
+ * consumer imports this and hands it to `Sekreto`; a consumer that does
+ * not is a `Sekreto` that cannot build a `onepassword` chain entry. */
+val onepassword: Definition = providerplugin("onepassword") { spec ->
+    Onepassword(spec.addr, spec.token, spec.vault)
+}

package/project/.sdk/tm/kotlin/feature/secrets/sekreto/plugins/Secretspec.kt

@@ -0,0 +1,118 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (kotlin/plugins/Secretspec.kt)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+// SecretSpec, as a voxgig/plugin definition.
+
+package KOTLINPACKAGE.feature.secrets.sekreto.plugins
+
+import KOTLINPACKAGE.feature.secrets.sekreto.Definition
+import KOTLINPACKAGE.feature.secrets.sekreto.Provider
+import KOTLINPACKAGE.feature.secrets.sekreto.SekretoError
+import KOTLINPACKAGE.feature.secrets.sekreto.envkey
+import KOTLINPACKAGE.feature.secrets.sekreto.providerplugin
+
+/**
+ * SecretSpec (https://secretspec.dev).
+ *
+ * SecretSpec is a declaration - a `secretspec.toml` naming the secrets a
+ * project needs - plus a chain of its own backends to satisfy them from.
+ * That makes it the same shape as sekreto one level down, and the reason
+ * to support it is the same reason sekreto exists: a project that has
+ * already declared its secrets there should not have to declare them
+ * again here.
+ *
+ * Read through its CLI, as boru is, because that is the interface it
+ * offers a program in another language: `secretspec get API_TOKEN`
+ * prints the value on stdout and nothing else. A sekreto name maps to a
+ * SecretSpec key exactly as it maps to an environment variable -
+ * `api.token` is `API_TOKEN` - which is the convention SecretSpec's own
+ * examples use.
+ *
+ * `backend` selects one of SecretSpec's backends (`--provider`, e.g.
+ * `keyring` or `dotenv://.env`) and is called `backend` here only
+ * because `provider` already means something else in this library.
+ *
+ * A reason is required, not optional: SecretSpec records every read in
+ * an audit log and refuses to read at all without one. sekreto sends
+ * `sekreto` unless told otherwise, so the audit trail says which tool
+ * asked.
+ */
+class Secretspec(
+    command: String? = null,
+    private val file: String? = null,
+    private val profile: String? = null,
+    private val backend: String? = null,
+    private val reason: String? = null,
+    private val prefix: String? = null,
+) : Provider {
+
+    private val command: String =
+        if (command.isNullOrEmpty()) "secretspec" else command
+
+    override fun lookup(name: String): String? {
+        val key = envkey(name, prefix)
+
+        val args = mutableListOf(command)
+        if (!file.isNullOrEmpty()) {
+            args.add("--file")
+            args.add(file)
+        }
+        args.add("get")
+        args.add(key)
+        if (!backend.isNullOrEmpty()) {
+            args.add("--provider")
+            args.add(backend)
+        }
+        if (!profile.isNullOrEmpty()) {
+            args.add("--profile")
+            args.add(profile)
+        }
+        args.add("--reason")
+        args.add(first(reason, "sekreto"))
+
+        val (out, why, status) = runcmd(ProcessBuilder(args), command)
+
+        if (0 == status) {
+            // The value and one newline, and nothing else.
+            return out.removeSuffix("\n")
+        }
+
+        if (secretspecmiss(why, key)) {
+            return null
+        }
+
+        throw SekretoError(
+            "sekreto: secretspec error: " + why.ifEmpty { "exit $status" },
+        )
+    }
+
+    override fun describe(): String =
+        "secretspec" + if (backend.isNullOrEmpty()) "" else ":$backend"
+}
+
+/**
+ * Does this SecretSpec failure mean "no such secret" rather than "I could
+ * not answer"?
+ *
+ * SecretSpec says `Secret 'API_TOKEN' not found` for both a name it does
+ * not declare and one declared with no value, and both are misses: this
+ * store does not hold it, so the chain carries on.
+ *
+ * MATCHED ON THE WHOLE PHRASE, NOT ON "not found". SecretSpec also says
+ * `Provider backend 'keyring' not found`, which is a store that could not
+ * answer at all - and reading that as a miss is the worst failure this
+ * library has, because the chain then falls through to a weaker store
+ * without saying so. The key is required to appear, so the two cannot be
+ * confused.
+ */
+internal fun secretspecmiss(why: String, key: String): Boolean =
+    why.contains("Secret '$key' not found")
+
+/** The `secretspec` provider kind, as a voxgig/plugin definition. A
+ * consumer imports this and hands it to `Sekreto`; a consumer that does
+ * not is a `Sekreto` that cannot build a `secretspec` chain entry. */
+val secretspec: Definition = providerplugin("secretspec") { spec ->
+    Secretspec(
+        spec.command, spec.file, spec.profile, spec.backend, spec.reason, spec.prefix,
+    )
+}