mrcharles
b43bc55963
Introduce the single Backend interface every credential source implements.
v0 ships two working backends: file (0600 KEY=VALUE env files, parsed in
pure Go, never sourced; looser permission masks refused before read) and
env (process-environment indirection). Bitwarden Secrets Manager and
HashiCorp Vault ship as explicit not-implemented stubs behind the same
interface so the phase-3 connectors are drop-ins. All failures are typed
ResolveErrors carrying only the ref, backend, and a fixed reason enum —
never material.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
23 lines
741 B
Go
23 lines
741 B
Go
package backend
|
|
|
|
import "context"
|
|
|
|
// Vault is the phase-3 HashiCorp Vault backend (KV v2 + AppRole via the
|
|
// official Go api package, MPL-2.0, vendored). v0 ships the interface
|
|
// slot ONLY: it resolves nothing and returns an explicit
|
|
// not-implemented error naming the ref and backend, so the connector is
|
|
// a drop-in behind the same interface later and misconfigured rollouts
|
|
// fail loudly today.
|
|
type Vault struct{}
|
|
|
|
// NewVault returns the vault stub.
|
|
func NewVault() *Vault { return &Vault{} }
|
|
|
|
// Name implements Backend.
|
|
func (v *Vault) Name() string { return "vault" }
|
|
|
|
// Resolve implements Backend.
|
|
func (v *Vault) Resolve(ctx context.Context, ref Ref) (string, error) {
|
|
return "", Err(ref, v.Name(), ReasonNotImplemented)
|
|
}
|