TASK: mopac-bitwarden-go v0 — Secrets Manager REST client (fake-server tested)

Context

keyproxy v0 is LIVE (ukrrs/mopac-keyproxy: file/env backends, bitwarden: backend is a 501 stub awaiting this library). Charles: the credential gateway is key infrastructure; Bitwarden backend is phase 3. This account has NO Bitwarden access today — so v0 is built and tested entirely against a FAKE Bitwarden Secrets Manager REST server in tests; live creds attach later with zero code change.

Inputs to read first

~/projects/meta/MOPAC/harness/docs/PORTING-NOTES-secrets.md — design sketch + 7 open questions; answer what code can answer, list the rest.
The spec README already seeded in the repo.
Public Bitwarden Secrets Manager API docs (machine accounts: client_id + client_secret -> access token via /identity/connect/token, client_credentials grant; then /api/accounts/{id}/secrets etc.). Plain REST only — the official SDK is source-available and AGPL-incompatible (DESIGN.md), do NOT import it.

Scope

Clone https://git.knownelement.com/ukrrs/mopac-bitwarden-go to ~/projects/meta/MOPAC/bitwarden-go (default branch main).
Go package + thin CLI (bitwarden-go):
- login — exchange machine credentials (from env refs or 0600 file, NEVER flags/args) for an access token; memory-only, refresh before expiry; never logged.
- projects / secrets list / get <key> — read paths keyproxy needs.
- Library surface: Authenticate(ctx, creds) (Token, error), GetSecret(ctx, token, key) (string, error) — keyproxy's bitwarden: backend will call exactly this.
Fake server in tests: table-driven, covers auth failure, expiry, missing secret, malformed payloads, redaction assertions (token/secret values never in logs or errors).
Config via env-file (0600) — same KEY=VALUE discipline as keyproxy. No admin UI, no persistence of tokens to disk. EVER.
Docs per the standard: README (purpose, status line, verified quickstart against the fake server, config table).

Build discipline

ALL DEV IN DOCKER: digest-pinned golang:1.26 builder, repo bind-mounted; Makefile/dev.sh pattern copied from ukrrs/mopac-keyproxy.
NEVER broad pkill — kill exact PIDs you spawned.
Commits in logical chunks, push to origin main.

Deliverable

REPORT-20260828-2330-bitwarden-go.md in ~/.coordinate/inbox-pmo/: library surface, CLI usage, fake-server test results, the open questions still needing Charles, and the exact keyproxy integration point.

2.5 KiB Raw Blame History