@voxgig/sdkgen 4.9.0 → 4.11.0

package/project/.sdk/tm/rust/feature/secrets/plugins/httpjson/json.rs

@@ -0,0 +1,300 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/httpjson/src/json.rs)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! Minimal JSON support for sekreto.
+//!
+//! sekreto adds no third-party dependencies, so it carries just enough JSON
+//! to read a vault's answer and write the CLI's own line of output. It is
+//! deliberately not a general-purpose library.
+
+use std::collections::BTreeMap;
+
+/// A JSON value.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Json {
+    Null,
+    Bool(bool),
+    Num(f64),
+    Str(String),
+    List(Vec<Json>),
+    Map(BTreeMap<String, Json>),
+}
+
+impl Json {
+    /// The named entry of a map, if this is a map that has it.
+    pub fn get(&self, key: &str) -> Option<&Json> {
+        match self {
+            Json::Map(entries) => entries.get(key),
+            _ => None,
+        }
+    }
+
+    /// This value as a string, the way the canonical port's String() renders
+    /// it: strings verbatim, scalars as text, containers as JSON.
+    pub fn text(&self) -> String {
+        match self {
+            Json::Null => "null".to_string(),
+            Json::Bool(value) => value.to_string(),
+            Json::Num(value) => numstr(*value),
+            Json::Str(value) => value.clone(),
+            _ => stringify(self),
+        }
+    }
+}
+
+/// Render a number without a trailing `.0`, so 5.0 prints as `5`.
+pub fn numstr(value: f64) -> String {
+    if value.is_finite() && value == value.trunc() && value.abs() < 1e15 {
+        return format!("{}", value as i64);
+    }
+    format!("{}", value)
+}
+
+/// Render a value as compact JSON.
+pub fn stringify(value: &Json) -> String {
+    match value {
+        Json::Null => "null".to_string(),
+        Json::Bool(entry) => entry.to_string(),
+        Json::Num(entry) => numstr(*entry),
+        Json::Str(entry) => quote(entry),
+        Json::List(entries) => {
+            let parts: Vec<String> = entries.iter().map(stringify).collect();
+            format!("[{}]", parts.join(","))
+        }
+        Json::Map(entries) => {
+            let parts: Vec<String> = entries
+                .iter()
+                .map(|(key, entry)| format!("{}:{}", quote(key), stringify(entry)))
+                .collect();
+            format!("{{{}}}", parts.join(","))
+        }
+    }
+}
+
+/// Quote a string as JSON.
+pub fn quote(text: &str) -> String {
+    let mut out = String::from("\"");
+
+    for head in text.chars() {
+        match head {
+            '"' => out.push_str("\\\""),
+            '\\' => out.push_str("\\\\"),
+            '\n' => out.push_str("\\n"),
+            '\r' => out.push_str("\\r"),
+            '\t' => out.push_str("\\t"),
+            _ if (head as u32) < 0x20 => out.push_str(&format!("\\u{:04x}", head as u32)),
+            _ => out.push(head),
+        }
+    }
+
+    out.push('"');
+    out
+}
+
+/// The deepest nesting the parser will follow. A response is trusted only
+/// as far as its status; the body arrives before any check, so a hostile
+/// or buggy upstream must not be able to overflow the stack with `[[[...`.
+const MAX_DEPTH: usize = 128;
+
+/// Parse JSON text, answering None for anything unreadable.
+pub fn parse(text: &str) -> Option<Json> {
+    let chars: Vec<char> = text.chars().collect();
+    let mut at = 0usize;
+    let value = value(&chars, &mut at, 0)?;
+    Some(value)
+}
+
+fn skip(chars: &[char], at: &mut usize) {
+    while *at < chars.len() && chars[*at].is_whitespace() {
+        *at += 1;
+    }
+}
+
+fn value(chars: &[char], at: &mut usize, depth: usize) -> Option<Json> {
+    if depth > MAX_DEPTH {
+        return None;
+    }
+
+    skip(chars, at);
+
+    if *at >= chars.len() {
+        return None;
+    }
+
+    match chars[*at] {
+        '{' => map(chars, at, depth),
+        '[' => list(chars, at, depth),
+        '"' => string(chars, at).map(Json::Str),
+        't' => literal(chars, at, "true", Json::Bool(true)),
+        'f' => literal(chars, at, "false", Json::Bool(false)),
+        'n' => literal(chars, at, "null", Json::Null),
+        _ => number(chars, at),
+    }
+}
+
+fn literal(chars: &[char], at: &mut usize, word: &str, value: Json) -> Option<Json> {
+    for (offset, head) in word.chars().enumerate() {
+        if *at + offset >= chars.len() || chars[*at + offset] != head {
+            return None;
+        }
+    }
+    *at += word.len();
+    Some(value)
+}
+
+fn map(chars: &[char], at: &mut usize, depth: usize) -> Option<Json> {
+    let mut out = BTreeMap::new();
+    *at += 1; // {
+    skip(chars, at);
+
+    if *at < chars.len() && '}' == chars[*at] {
+        *at += 1;
+        return Some(Json::Map(out));
+    }
+
+    loop {
+        skip(chars, at);
+        let key = string(chars, at)?;
+        skip(chars, at);
+
+        if *at >= chars.len() || ':' != chars[*at] {
+            return None;
+        }
+        *at += 1;
+
+        out.insert(key, value(chars, at, depth + 1)?);
+        skip(chars, at);
+
+        if *at >= chars.len() {
+            return None;
+        }
+
+        if ',' == chars[*at] {
+            *at += 1;
+            continue;
+        }
+
+        *at += 1; // }
+        break;
+    }
+
+    Some(Json::Map(out))
+}
+
+fn list(chars: &[char], at: &mut usize, depth: usize) -> Option<Json> {
+    let mut out = Vec::new();
+    *at += 1; // [
+    skip(chars, at);
+
+    if *at < chars.len() && ']' == chars[*at] {
+        *at += 1;
+        return Some(Json::List(out));
+    }
+
+    loop {
+        out.push(value(chars, at, depth + 1)?);
+        skip(chars, at);
+
+        if *at >= chars.len() {
+            return None;
+        }
+
+        if ',' == chars[*at] {
+            *at += 1;
+            continue;
+        }
+
+        *at += 1; // ]
+        break;
+    }
+
+    Some(Json::List(out))
+}
+
+fn string(chars: &[char], at: &mut usize) -> Option<String> {
+    if *at >= chars.len() || '"' != chars[*at] {
+        return None;
+    }
+
+    let mut out = String::new();
+    *at += 1;
+
+    while *at < chars.len() {
+        let head = chars[*at];
+        *at += 1;
+
+        if '"' == head {
+            return Some(out);
+        }
+
+        if '\\' != head {
+            out.push(head);
+            continue;
+        }
+
+        if *at >= chars.len() {
+            return None;
+        }
+
+        let next = chars[*at];
+        *at += 1;
+
+        match next {
+            'n' => out.push('\n'),
+            'r' => out.push('\r'),
+            't' => out.push('\t'),
+            'b' => out.push('\u{0008}'),
+            'f' => out.push('\u{000c}'),
+            'u' => {
+                if *at + 4 > chars.len() {
+                    return None;
+                }
+                let hex: String = chars[*at..*at + 4].iter().collect();
+                *at += 4;
+                let code = u32::from_str_radix(&hex, 16).ok()?;
+                out.push(char::from_u32(code)?);
+            }
+            _ => out.push(next),
+        }
+    }
+
+    None
+}
+
+fn number(chars: &[char], at: &mut usize) -> Option<Json> {
+    let start = *at;
+
+    while *at < chars.len() && !",]}\r\n\t ".contains(chars[*at]) {
+        *at += 1;
+    }
+
+    let text: String = chars[start..*at].iter().collect();
+
+    // Reject non-finite results: `1e999` parses to f64::INFINITY, which
+    // later panics Duration::from_secs_f64 when it lands in a token-expiry
+    // field. JSON has no infinity, so this is also stricter-correct.
+    match text.parse::<f64>() {
+        Ok(value) if value.is_finite() => Some(Json::Num(value)),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::parse;
+
+    #[test]
+    fn deep_nesting_does_not_overflow() {
+        // A hostile/buggy upstream must not crash the client with `[[[...`.
+        let deep = "[".repeat(100_000) + &"]".repeat(100_000);
+        assert!(parse(&deep).is_none());
+    }
+
+    #[test]
+    fn non_finite_numbers_are_rejected() {
+        // 1e999 -> f64::INFINITY would later panic Duration::from_secs_f64.
+        assert!(parse("1e999").is_none());
+        assert!(parse("[1e999]").is_none());
+        assert!(parse("5").is_some());
+    }
+}

package/project/.sdk/tm/rust/feature/secrets/plugins/httpjson.rs

@@ -0,0 +1,137 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/httpjson/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! The HTTP-JSON client the vault plugins share, and the helpers that go
+//! with it.
+//!
+//! It lives under `plugins/` because a chain of BUILT-IN kinds must never
+//! link it: `http.rs` is a TCP socket and a rustls session, and the core
+//! reads at most a local file. `voxgig_sekreto` does not depend on this
+//! crate; this crate depends on it.
+//!
+//! `json.rs` travels with it rather than staying in the core for the same
+//! reason it was written at all: the only things that parse JSON here are
+//! the vault clients and the CLI that calls a JSON API.
+
+pub mod http;
+pub mod json;
+
+use std::cell::RefCell;
+use std::env;
+use std::time::{Duration, Instant};
+
+use super::super::sekreto::{Answer, SekretoError};
+
+pub use self::json::Json;
+
+/// A base URL with one trailing slash removed, so paths join cleanly.
+pub fn trimslash(addr: &str) -> &str {
+    addr.strip_suffix('/').unwrap_or(addr)
+}
+
+/// The first non-empty answer: the configured value, then each named
+/// environment variable in turn.
+pub fn firstof(config: &str, envnames: &[&str]) -> String {
+    if !config.is_empty() {
+        return config.to_string();
+    }
+
+    for name in envnames {
+        if let Ok(value) = env::var(name) {
+            if !value.is_empty() {
+                return value;
+            }
+        }
+    }
+
+    String::new()
+}
+
+/// Owned headers as the borrowed pairs the http client takes.
+pub fn headerrefs(headers: &[(String, String)]) -> Vec<(&str, &str)> {
+    headers
+        .iter()
+        .map(|(name, value)| (name.as_str(), value.as_str()))
+        .collect()
+}
+
+/// What a store answered: the status, and the body when it parsed as JSON.
+pub struct JsonResponse {
+    pub status: u16,
+    pub body: Option<Json>,
+}
+
+/// One JSON round-trip. Network failure is always an error - an
+/// unreachable store is a store that could not answer.
+pub fn fetchjson(
+    method: &str,
+    url: &str,
+    headers: &[(&str, &str)],
+    body: Option<&str>,
+) -> Answer<JsonResponse> {
+    let response = self::http::request(method, url, headers, body)?;
+
+    let parsed = self::json::parse(&response.body);
+
+    // A success status promised JSON; a body that does not parse means
+    // the store could not answer coherently, and treating it as a miss
+    // would fall through to a weaker store. Error statuses may carry
+    // any body - they are decided on status alone.
+    if 200 == response.status && parsed.is_none() {
+        return Err(SekretoError::new(format!(
+            "sekreto: malformed response from {}",
+            url.split('?').next().unwrap_or(url)
+        )));
+    }
+
+    Ok(JsonResponse {
+        status: response.status,
+        body: parsed,
+    })
+}
+
+/// When a token obtained by a login should be renewed: shortly before
+/// the expiry the login response named, or never (None) when it named
+/// none - a store that does not say when a token dies cannot have it
+/// renewed on a guess.
+pub fn renewtime(seconds: f64) -> Option<Instant> {
+    if 0.0 < seconds && seconds.is_finite() {
+        // Clamp before constructing the Duration: from_secs_f64 panics on a
+        // non-finite or too-large value, and a token expiry comes from the
+        // (untrusted) auth response. A century is more than any real lease.
+        let bounded = (seconds - 60.0).max(1.0).min(3_153_600_000.0);
+        Some(Instant::now() + Duration::from_secs_f64(bounded))
+    } else {
+        None
+    }
+}
+
+/// The expiry a login response named, in seconds - zero when it named
+/// none (or named it unreadably). Some stores send the number as a JSON
+/// string, so the text form is parsed rather than the number taken.
+pub fn expiryseconds(body: &Option<Json>, path: &[&str]) -> f64 {
+    textat(body, path)
+        .and_then(|text| text.parse::<f64>().ok())
+        .unwrap_or(0.0)
+}
+
+/// Is a cached login token due for renewal? A token that never expires
+/// (a configured one, or one whose login named no expiry) never is.
+pub fn renewdue(renewat: &RefCell<Option<Instant>>) -> bool {
+    renewat.borrow().map_or(false, |at| Instant::now() >= at)
+}
+
+/// The value at a path of map keys, as text - or None when absent or null.
+pub fn textat(body: &Option<Json>, path: &[&str]) -> Option<String> {
+    let mut at = body.as_ref()?;
+
+    for key in path {
+        at = at.get(key)?;
+    }
+
+    if matches!(at, Json::Null) {
+        return None;
+    }
+
+    Some(at.text())
+}

package/project/.sdk/tm/rust/feature/secrets/plugins/infisical.rs

@@ -0,0 +1,148 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/infisical/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! The Infisical provider, as a voxgig/plugin definition.
+
+use std::cell::RefCell;
+use std::collections::BTreeMap;
+use std::rc::Rc;
+use std::time::Instant;
+
+use crate::feature::secrets::plugin::catalog::Definition;
+use crate::feature::secrets::sekreto::{checkaddr, envkey, providerplugin, Answer, Provider, SekretoError};
+use super::httpjson::json::{self, Json};
+use super::httpjson::{
+    expiryseconds, fetchjson, http, renewdue, renewtime, textat, trimslash,
+};
+
+/// Infisical.
+///
+/// `api.token` reads the secret keyed `API_TOKEN` (Infisical's own
+/// convention is environment-style keys) at a secret path in one
+/// environment of a project. Auth is a token, or a universal-auth
+/// (machine identity) login with clientid/clientsecret.
+#[derive(Default)]
+pub struct InfisicalProvider {
+    pub addr: String,
+    pub token: String,
+    pub clientid: String,
+    pub clientsecret: String,
+    pub project: String,
+    pub environment: String,
+    pub path: String,
+    // A configured token is kept forever; a universal-auth token carries
+    // expiresIn and is renewed shortly before it runs out.
+    livetoken: RefCell<Option<String>>,
+    renewat: RefCell<Option<Instant>>,
+}
+
+impl InfisicalProvider {
+    fn login(&self, addr: &str) -> Answer<String> {
+        if !self.token.is_empty() {
+            return Ok(self.token.clone());
+        }
+
+        if self.clientid.is_empty() || self.clientsecret.is_empty() {
+            return Err(SekretoError::new(
+                "sekreto: infisical: no token and no client credentials",
+            ));
+        }
+
+        let body = json::stringify(&Json::Map(BTreeMap::from([
+            ("clientId".to_string(), Json::Str(self.clientid.clone())),
+            (
+                "clientSecret".to_string(),
+                Json::Str(self.clientsecret.clone()),
+            ),
+        ])));
+
+        let response = fetchjson(
+            "POST",
+            &format!("{}/api/v1/auth/universal-auth/login", addr),
+            &[("content-type", "application/json")],
+            Some(&body),
+        )?;
+
+        let got = textat(&response.body, &["accessToken"]).unwrap_or_default();
+
+        if 200 != response.status || got.is_empty() {
+            return Err(SekretoError::new(format!(
+                "sekreto: infisical login failed: {}",
+                response.status
+            )));
+        }
+
+        let expires = expiryseconds(&response.body, &["expiresIn"]);
+        *self.renewat.borrow_mut() = renewtime(expires);
+
+        Ok(got)
+    }
+}
+
+impl Provider for InfisicalProvider {
+    fn lookup(&self, name: &str) -> Answer<Option<String>> {
+        let addr = if self.addr.is_empty() {
+            "https://app.infisical.com"
+        } else {
+            &self.addr
+        };
+        let addr = trimslash(addr).to_string();
+        checkaddr(&addr)?;
+
+        if self.project.is_empty() || self.environment.is_empty() {
+            return Err(SekretoError::new(
+                "sekreto: infisical: no project/environment",
+            ));
+        }
+
+        if self.livetoken.borrow().is_none() || renewdue(&self.renewat) {
+            *self.livetoken.borrow_mut() = Some(self.login(&addr)?);
+        }
+        let livetoken = self.livetoken.borrow().clone().unwrap_or_default();
+
+        let url = format!(
+            "{}/api/v3/secrets/raw/{}?workspaceId={}&environment={}&secretPath={}",
+            addr,
+            envkey(name, "")?,
+            http::urlencode(&self.project),
+            http::urlencode(&self.environment),
+            http::urlencode(if self.path.is_empty() { "/" } else { &self.path })
+        );
+
+        let bearer = format!("Bearer {}", livetoken);
+        let response = fetchjson("GET", &url, &[("authorization", bearer.as_str())], None)?;
+
+        if 404 == response.status {
+            return Ok(None);
+        }
+
+        if 200 != response.status {
+            return Err(SekretoError::new(format!(
+                "sekreto: infisical error: {}",
+                response.status
+            )));
+        }
+
+        Ok(textat(&response.body, &["secret", "secretValue"]))
+    }
+
+    fn describe(&self) -> String {
+        format!("infisical:{}/{}", self.project, self.environment)
+    }
+}
+
+/// The `infisical` kind, as a plugin definition.
+pub fn plugin() -> Definition {
+    providerplugin("infisical", |spec| {
+        Ok(Rc::new(InfisicalProvider {
+            addr: spec.addr.clone(),
+            token: spec.token.clone(),
+            clientid: spec.clientid.clone(),
+            clientsecret: spec.clientsecret.clone(),
+            project: spec.project.clone(),
+            environment: spec.environment.clone(),
+            path: spec.path.clone(),
+            ..Default::default()
+        }) as Rc<dyn Provider>)
+    })
+}