15 lines
4.1 KiB
Plaintext
15 lines
4.1 KiB
Plaintext
Repo already cloned at `mopac-bitwarden-go` (correct origin, main). Now let me study the keyproxy build pattern and docker discipline.The live keyproxy code is in `~/projects/meta/MOPAC/keyproxy`. Reading its build pattern:Clear picture now. Let me study keyproxy's remaining patterns (main.go structure, 0600 mode check) and verify the public Secrets Manager API shape.
|
|
|
|
ERROR
|
|
|
|
Message content is shorter than read bytes: 0 < 147.
|
|
|
|
Inputs digested. Checking repo/git/docker state and keyproxy's CLI/config patterns before cloning.Repos understood: the seeded spec clone exists; I'll make the working clone at `bitwarden-go` per instructions. First, grounding the REST shapes from Bitwarden's public docs.The SDK's machine-account flow is now clear. Need three more details: AccessToken parsing (key derivation from client secret), the payload response shape, and EncString formats.Crypto construction confirmed with portable test vectors. Now the REST resource shapes from the generated API client:Protocol research complete — I have the full machine-account flow with portable crypto test vectors. Now building. Starting with the dev harness and crypto core.Now the public API surface — errors, Credentials, Token, and the REST transport:Crypto core done. Now the vector tests (ported from the public Bitwarden SDK test suite) and a first compile check:Vector tests pass — the echo-check trips on the empty-string case (`Contains(x, "")` is always true). Fixing the test:Crypto core green against all published SDK vectors. Now the fake Secrets Manager server (test infrastructure shared by tests + smoke):Now the main table-driven fake-server test suite:Import cycle — the test package must be external (`bitwarden_test`) since fakesm imports the library. Moving white-box clock tests to a separate file:Cleanest fix: rewrite the whole test file with consistent `bw.` qualification:Fake-server bug: plaintext mode must also omit `encrypted_payload`:Library suite green. Now config (0600 env-file discipline) and the CLI:Now the CLI:CLI tests — driving the real command paths against the fake server, with redaction assertions on stdout/stderr:Full gate green. Now the end-to-end smoke: fake server in a container, real CLI driven from the host:`dash` doesn't support bash substring syntax. Fixing the readiness check with `docker inspect`:`BITWARDENGO_CONFIG` was set but not exported:Smoke passes end-to-end. Now gofmt check and the README rewrite:Final gate, then commits in logical chunks:Pushed. Collecting test counts for the report and syncing the stale spec clone:Done. v0 is complete, green, and pushed (`643de0f..9b730af`, 6 commits to origin/main).
|
|
|
|
**What shipped** (`~/projects/meta/MOPAC/bitwarden-go`):
|
|
- **Library** (stdlib-only, zero deps): `Authenticate(ctx, creds) (*Token, error)`, `GetSecret(ctx, token, key)` (name or uuid), `ListSecrets`, `ListProjects` — full wire protocol: client_credentials token exchange, `encrypted_payload` org-key unwrap (HKDF + type-2 EncString decrypt), refresh-before-expiry (30s skew, memory-only), typed log-safe errors.
|
|
- **Protocol grounded**: reconstructed from public API behavior + the SDK's published test vectors (cred format `0.<uuid>.<secret>:<key>`, HKDF derivation, EncString AE) — all vectors pass in `encstring_test.go`; official SDK NOT imported.
|
|
- **Fake server** (`internal/fakesm`): speaks the real protocol incl. crypto; 53 tests green in Docker (auth/expiry/refresh/missing/malformed/tamper-MAC/plaintext modes + redaction sweeps over every error path), plus `./dev.sh smoke` — fake in a container, real CLI driven from host through a 0600 env file → `smoke: OK`.
|
|
- **CLI**: `login | projects | secrets list | get <key>`; creds only via env or 0600 env file (mode checked before read), never flags.
|
|
- **Report**: `~/.coordinate/inbox-pmo/REPORT-20260828-2330-bitwarden-go.md` — surface, results, porting-notes questions answered by code (1, 3, 4), the 5 still needing Charles (incl. 2 new: module wiring via vendor/GOPRIVATE, live-server verification checklist), and the exact keyproxy drop-in at `keyproxy/internal/backend/bitwarden.go:20`.
|