Class: Hermetic::Credentials

Inherits:
Object
  • Object
show all
Defined in:
lib/hermetic/credentials.rb

Overview

Named secrets injected into the guest at exec time — the model-visible command never contains a raw token. Values are callables resolved lazily per run, so short-lived tokens are minted fresh and never cached on the box. :env mode ships in v1; :proxy (guest gets no token at all) is v1.1.

Constant Summary collapse

MODES = 
%i[env proxy].freeze

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(map = {}, mode: :env) ⇒ Credentials

Returns a new instance of Credentials.

Raises:



20
21
22
23
24
25
26
 
# File 'lib/hermetic/credentials.rb', line 20

def initialize(map = {}, mode: :env)
  raise ConfigError, "unknown credential_mode #{mode.inspect} (known: #{MODES.inspect})" unless MODES.include?(mode)
  raise ConfigError, "credential_mode :proxy is deferred (v1.1) — use :env" if mode == :proxy

  @map = map.to_h.transform_keys(&:to_s).freeze
  @mode = mode
end

Instance Attribute Details

#mode ⇒ Object (readonly)

Returns the value of attribute mode.



9
10
11
 
# File 'lib/hermetic/credentials.rb', line 9

def mode
  @mode
end

Class Method Details

.build(value, mode: :env) ⇒ Object 



11
12
13
14
15
16
17
18
 
# File 'lib/hermetic/credentials.rb', line 11

def self.build(value, mode: :env)
  case value
  when nil then new({}, mode: mode)
  when Credentials then value
  when Hash then new(value, mode: mode)
  else raise ConfigError, "credentials must be a Hash of NAME => value-or-callable, got #{value.inspect}"
  end
end

Instance Method Details

#empty? ⇒ Boolean

Returns:

  • (Boolean) 


30
 
# File 'lib/hermetic/credentials.rb', line 30

def empty? = @map.empty?

#inspect ⇒ Object Also known as: to_s

Values (and the closures that mint them) never appear in logs.



38
 
# File 'lib/hermetic/credentials.rb', line 38

def inspect = "#<Hermetic::Credentials mode=#{@mode} names=#{names.inspect} [redacted]>"

#names ⇒ Object 



28
 
# File 'lib/hermetic/credentials.rb', line 28

def names = @map.keys

#resolve ⇒ Object

Fresh values for one run. Callables are invoked now, never memoized.



33
34
35
 
# File 'lib/hermetic/credentials.rb', line 33

def resolve
  @map.transform_values { |v| (v.respond_to?(:call) ? v.call : v).to_s }
end