50 lines
2.5 KiB
Markdown
50 lines
2.5 KiB
Markdown
# TASK: mopac-bitwarden-go v0 — Secrets Manager REST client (fake-server tested)
|
|
|
|
## Context
|
|
keyproxy v0 is LIVE (ukrrs/mopac-keyproxy: file/env backends, `bitwarden:`
|
|
backend is a 501 stub awaiting this library). Charles: the credential
|
|
gateway is key infrastructure; Bitwarden backend is phase 3. This account
|
|
has NO Bitwarden access today — so v0 is built and tested entirely against
|
|
a FAKE Bitwarden Secrets Manager REST server in tests; live creds attach
|
|
later with zero code change.
|
|
|
|
## Inputs to read first
|
|
- `~/projects/meta/MOPAC/harness/docs/PORTING-NOTES-secrets.md` — design
|
|
sketch + 7 open questions; answer what code can answer, list the rest.
|
|
- The spec README already seeded in the repo.
|
|
- Public Bitwarden Secrets Manager API docs (machine accounts: client_id +
|
|
client_secret -> access token via /identity/connect/token,
|
|
client_credentials grant; then /api/accounts/{id}/secrets etc.).
|
|
Plain REST only — the official SDK is source-available and
|
|
AGPL-incompatible (DESIGN.md), do NOT import it.
|
|
|
|
## Scope
|
|
1. Clone `https://git.knownelement.com/ukrrs/mopac-bitwarden-go` to
|
|
`~/projects/meta/MOPAC/bitwarden-go` (default branch main).
|
|
2. Go package + thin CLI (`bitwarden-go`):
|
|
- `login` — exchange machine credentials (from env refs or 0600 file,
|
|
NEVER flags/args) for an access token; memory-only, refresh before
|
|
expiry; never logged.
|
|
- `projects` / `secrets list` / `get <key>` — read paths keyproxy needs.
|
|
- Library surface: `Authenticate(ctx, creds) (Token, error)`,
|
|
`GetSecret(ctx, token, key) (string, error)` — keyproxy's `bitwarden:`
|
|
backend will call exactly this.
|
|
3. Fake server in tests: table-driven, covers auth failure, expiry,
|
|
missing secret, malformed payloads, redaction assertions (token/secret
|
|
values never in logs or errors).
|
|
4. Config via env-file (0600) — same KEY=VALUE discipline as keyproxy.
|
|
No admin UI, no persistence of tokens to disk. EVER.
|
|
5. Docs per the standard: README (purpose, status line, verified
|
|
quickstart against the fake server, config table).
|
|
|
|
## Build discipline
|
|
- ALL DEV IN DOCKER: digest-pinned golang:1.26 builder, repo bind-mounted;
|
|
Makefile/dev.sh pattern copied from ukrrs/mopac-keyproxy.
|
|
- NEVER broad pkill — kill exact PIDs you spawned.
|
|
- Commits in logical chunks, push to origin main.
|
|
|
|
## Deliverable
|
|
`REPORT-20260828-2330-bitwarden-go.md` in `~/.coordinate/inbox-pmo/`:
|
|
library surface, CLI usage, fake-server test results, the open questions
|
|
still needing Charles, and the exact keyproxy integration point.
|