-
Notifications
You must be signed in to change notification settings - Fork 9
/
secrets.go
102 lines (82 loc) · 2.75 KB
/
secrets.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
// Copyright 2022 Namespace Labs Inc; All rights reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
package onepassword
import (
"bytes"
"context"
"fmt"
"os"
"os/exec"
"sync"
"time"
"namespacelabs.dev/foundation/framework/secrets/combined"
"namespacelabs.dev/foundation/internal/console"
"namespacelabs.dev/foundation/internal/fnerrors"
"namespacelabs.dev/foundation/std/tasks"
"namespacelabs.dev/foundation/universe/onepassword"
)
const cmdTimeout = time.Minute
func Register() {
p := provider{
cache: map[string][]byte{},
}
combined.RegisterSecretsProvider(func(ctx context.Context, cfg *onepassword.Secret) ([]byte, error) {
if cfg.SecretReference == "" {
return nil, fnerrors.BadInputError("invalid 1Password secret configuration: missing field secret_reference")
}
return p.Read(ctx, cfg.SecretReference)
})
}
type provider struct {
mu sync.Mutex
ensureAccountErr error
once sync.Once
cache map[string][]byte
}
func (p *provider) Read(ctx context.Context, ref string) ([]byte, error) {
// Serialize reads to ensure there is only one approval pop-up.
p.mu.Lock()
defer p.mu.Unlock()
if data, ok := p.cache[ref]; ok {
return data, nil
}
return tasks.Return(ctx, tasks.Action("1password.read").Arg("ref", ref), func(ctx context.Context) ([]byte, error) {
// If no account is configured, `op read` does not fail but waits for user input.
// Hence, we ensure that a user account is indeed configured.
if err := p.ensureAccount(ctx); err != nil {
return nil, err
}
c := exec.CommandContext(ctx, "op", "read", ref)
var b bytes.Buffer
c.Stdout = &b
c.Stderr = console.Output(ctx, "1Password")
if err := c.Run(); err != nil {
return nil, fnerrors.InvocationError("1Password", "failed to invoke %q: %w", c.String(), err)
}
// `\n` is added by `op read`.
data := bytes.TrimSuffix(b.Bytes(), []byte{'\n'})
p.cache[ref] = data
return data, nil
})
}
func (p *provider) ensureAccount(ctx context.Context) error {
// Only check once if there is an account.
p.once.Do(func() {
if os.Getenv("OP_SERVICE_ACCOUNT_TOKEN") != "" {
return
}
// Handle manual logins.
c := exec.CommandContext(ctx, "op", "account", "list")
var b bytes.Buffer
c.Stdout = &b
c.Stderr = console.Output(ctx, "1Password")
if err := c.Run(); err != nil {
p.ensureAccountErr = fnerrors.InvocationError("1Password", "failed to invoke %q: %w", c.String(), err)
} else if b.String() == "" {
p.ensureAccountErr = fnerrors.InvocationError("1Password", "no 1Password account configured")
}
fmt.Fprintf(console.Debug(ctx), "Configured 1Password accounts:\n%s\n", b.String())
})
return p.ensureAccountErr
}