feat: lazysecrets list prints everything lazysecrets can find, for fzf and editor pickers (#70)
`lazysecrets list` prints every source, vault and secret lazysecrets can find, one per line, for fzf, editor pickers and scripts: what Go to searches, without the TUI. What's cached prints at once; what's missing or older than `--max-age` loads in the background and streams in. It stops when the reader goes (a pick in fzf), saving what it loaded. - Text: kind, mark (✗/⚠, ★, ◷ and the provider icon), name, status (why it couldn't be read, or expired / expires in 12d), note, account and link, tab-separated; kind first and account and link last, so new fields go between. Coloured from the theme; `--color never`, `--icons=false`, `--stars=false`, `--recent`, `--notes=false`, `--expiry=false`. - `--format json`: an object per line, with starred, recent, lastUsed and uses, expires, enabled, note, reference and url too. - `--kind` lists only some kinds, and doesn't load lists only other kinds need; `--cached` loads nothing. - `lazysecrets open --action go|copy|show` skips the "what to do" menu and ends in the list, like Go to; `open` and `get` take `--account`, the account list printed, rather than asking which. - The cache file moved to `internal/cachefile`: saves merge with the file under a lock, so list and the TUI don't undo each other. - `ui.recentIcon` marks items used lately with ◷ in the TUI's lists too; Recent now means the last 90 days. - --demo has stars, notes, recent use, and expired, expiring and disabled secrets. - docs/integration.md documents get, list and an fzf picker; docs/links.md is docs/sharing.md. Reviewed-on: #70 Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>
This commit was merged in pull request #70.
This commit is contained in:
keb authored and 
Karl-Einar Bergstrøm committed
1 parent
dbb0eb2bbd
commit
39454d47a8
45 files changed
+2107
-222
No files matched your search
@@ -218,6 +218,19 @@ func (p *Provider) addContainer(src provider.Source, name, detail string, types
|
||||
return c
|
||||
}
|
||||
|
||||
// Expire sets when the object name in vault expires, for --demo: a date
|
||||
// relative to today in the test data would change the tests' screenshots
|
||||
// from day to day.
|
||||
func (p *Provider) Expire(vault, name string, at time.Time) {
|
||||
for _, objs := range p.objects {
|
||||
for i := range objs {
|
||||
if objs[i].Container.Name == vault && objs[i].Name == name {
|
||||
objs[i].Expires = at
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (p *Provider) add(c provider.Container, t provider.ObjectType, o provider.Object, value string) provider.Object {
|
||||
o.Container = c
|
||||
o.Type = t
|
||||
@@ -287,9 +300,13 @@ func Azure(delay time.Duration) *Provider {
|
||||
Reference: secretRef("kv-app-prod", "api-key"),
|
||||
}, "sk_live_51HxDEMO0000000000000000")
|
||||
p.add(kv, provider.TypeSecret, provider.Object{
|
||||
Name: "legacy-token", Version: "0c11de", Enabled: &no, Updated: base.AddDate(-1, 0, 0),
|
||||
Reference: secretRef("kv-app-prod", "legacy-token"),
|
||||
Name: "legacy-token", Version: "0c11de", Enabled: &yes, Updated: base.AddDate(-1, 0, 0),
|
||||
Expires: base.AddDate(0, -3, 0), Reference: secretRef("kv-app-prod", "legacy-token"),
|
||||
}, "deprecated")
|
||||
p.add(kv, provider.TypeSecret, provider.Object{
|
||||
Name: "smtp-password", Version: "7d2e90", Enabled: &no, Updated: base.AddDate(0, -2, 0),
|
||||
Reference: secretRef("kv-app-prod", "smtp-password"),
|
||||
}, "smtp-demo-password")
|
||||
|
||||
p.add(kv, provider.TypeKey, provider.Object{
|
||||
Name: "signing-key", Version: "5e21b7", Enabled: &yes, Updated: base.AddDate(0, -3, 0),
|
||||
@@ -349,6 +366,19 @@ func Azure(delay time.Duration) *Provider {
|
||||
p.add(kvDev, provider.TypeSecret, provider.Object{
|
||||
Name: "db-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-app-dev", "db-password"),
|
||||
}, "dev-password")
|
||||
// Left behind, as dev vaults are: expired, disabled, or both.
|
||||
p.add(kvDev, provider.TypeSecret, provider.Object{
|
||||
Name: "stripe-webhook-secret", Enabled: &yes, Updated: base.AddDate(-1, 0, 0),
|
||||
Expires: base.AddDate(0, -2, 0), Reference: secretRef("kv-app-dev", "stripe-webhook-secret"),
|
||||
}, "whsec_demo_expired")
|
||||
p.add(kvDev, provider.TypeSecret, provider.Object{
|
||||
Name: "test-user-password", Enabled: &no, Updated: base.AddDate(0, -5, 0),
|
||||
Reference: secretRef("kv-app-dev", "test-user-password"),
|
||||
}, "disabled-demo-password")
|
||||
p.add(kvDev, provider.TypeSecret, provider.Object{
|
||||
Name: "vendor-token", Enabled: &no, Updated: base.AddDate(-2, 0, 0),
|
||||
Expires: base.AddDate(-1, 0, 0), Reference: secretRef("kv-app-dev", "vendor-token"),
|
||||
}, "expired-and-disabled")
|
||||
|
||||
return p
|
||||
}
|
||||
@@ -366,7 +396,8 @@ func AzureOps(delay time.Duration) *Provider {
|
||||
breakGlass := p.addContainer(prod, "kv-breakglass", "https://kv-breakglass.vault.azure.net", allTypes...)
|
||||
p.add(breakGlass, provider.TypeSecret, provider.Object{
|
||||
Name: "emergency-admin", Enabled: &yes, Updated: base.AddDate(0, -4, 0),
|
||||
Tags: map[string]string{"owner": "ops"}, Reference: secretRef("kv-breakglass", "emergency-admin"),
|
||||
Expires: time.Now().AddDate(0, 0, 5).Truncate(24 * time.Hour), // soon, whenever the demo runs
|
||||
Tags: map[string]string{"owner": "ops"}, Reference: secretRef("kv-breakglass", "emergency-admin"),
|
||||
}, "break-glass-demo-password")
|
||||
shared := p.addContainer(prod, "kv-shared-prod", "https://kv-shared-prod.vault.azure.net", allTypes...)
|
||||
p.add(shared, provider.TypeSecret, provider.Object{
|
||||
@@ -384,6 +415,12 @@ func AzureOps(delay time.Duration) *Provider {
|
||||
p.add(kv, provider.TypeSecret, provider.Object{
|
||||
Name: "pagerduty-token", Enabled: &yes, Updated: base.AddDate(0, -1, 0), Reference: secretRef("kv-ops-tools", "pagerduty-token"),
|
||||
}, "pd-demo-token")
|
||||
// Expiring soon whenever the demo runs: the other dates are fixed,
|
||||
// and would have passed. Tests use the first account only.
|
||||
p.add(kv, provider.TypeSecret, provider.Object{
|
||||
Name: "grafana-api-key", Enabled: &yes, Updated: base.AddDate(0, -11, 0),
|
||||
Expires: time.Now().AddDate(0, 0, 12).Truncate(24 * time.Hour), Reference: secretRef("kv-ops-tools", "grafana-api-key"),
|
||||
}, "glsa_demo_expiring")
|
||||
|
||||
return p
|
||||
}
|
||||
|
||||
@@ -0,0 +1,65 @@
|
||||
package fake
|
||||
|
||||
import (
|
||||
"cmp"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"git.kebcloud.no/keb/lazysecrets/internal/store"
|
||||
)
|
||||
|
||||
// Seed stars, notes and uses a few of the demo's secrets, so --demo
|
||||
// shows Favourites (F), Recent (R), notes, and stars in lazysecrets list. alice and
|
||||
// admin are the two Azure accounts' provider IDs.
|
||||
func Seed(st *store.Store, alice, admin string) {
|
||||
type item struct {
|
||||
link, account, source string
|
||||
name string // else the link's last part
|
||||
note string
|
||||
path []string
|
||||
star bool
|
||||
uses int
|
||||
ago time.Duration
|
||||
}
|
||||
const azure, dbx = "lazysecrets://azure/", "lazysecrets://databricks/adb-1111111111111111.11.azuredatabricks.net/"
|
||||
for _, it := range []item{
|
||||
{link: azure + "kv-app-prod.vault.azure.net/secrets/db-password", account: alice, source: "sub-prod",
|
||||
path: []string{"platform-prod", "kv-app-prod"}, star: true, uses: 12, ago: 20 * time.Minute,
|
||||
note: "rotated by the data team each quarter"},
|
||||
{link: azure + "kv-app-prod.vault.azure.net/secrets/api-key", account: alice, source: "sub-prod",
|
||||
path: []string{"platform-prod", "kv-app-prod"}, uses: 4, ago: 2 * time.Hour},
|
||||
{link: azure + "kv-breakglass.vault.azure.net/secrets/emergency-admin", account: admin, source: "sub-prod",
|
||||
path: []string{"platform-prod", "kv-breakglass"}, star: true, note: "incidents only: tell #ops when used"},
|
||||
{link: azure + "kv-shared-prod.vault.azure.net/secrets/smtp-password", account: alice, source: "sub-prod",
|
||||
path: []string{"platform-prod", "kv-shared-prod"}, uses: 2, ago: 26 * time.Hour},
|
||||
{link: azure + "kv-app-prod.vault.azure.net/secrets/smtp-password", account: alice, source: "sub-prod",
|
||||
path: []string{"platform-prod", "kv-app-prod"}, note: "migrated to Microsoft Graph sendMail; delete after Q4"},
|
||||
{link: dbx + "app/storage-key", account: "Databricks", source: "dbx-prod",
|
||||
path: []string{"prod", "app"}, star: true, uses: 3, ago: 5 * time.Hour},
|
||||
// A subscription, for both accounts, and a repo's file.
|
||||
{link: azure + "subscriptions/sub-prod", account: alice, source: "sub-prod",
|
||||
name: "platform-prod", star: true},
|
||||
{link: azure + "subscriptions/sub-prod", account: admin, source: "sub-prod",
|
||||
name: "platform-prod", star: true},
|
||||
{link: "lazysecrets://repo/github.com%2Facme%2Flazysecrets-demo/deploy%2Fprod%2Fsecrets.yaml", account: "Repos",
|
||||
source: "/home/dev/git/lazysecrets-demo", name: "deploy/prod/secrets.yaml",
|
||||
path: []string{"lazysecrets-demo"}, star: true},
|
||||
} {
|
||||
context := func(n *store.Node) {
|
||||
n.Name = cmp.Or(it.name, it.link[strings.LastIndex(it.link, "/")+1:])
|
||||
n.Path, n.Source, n.Account = it.path, it.source, it.account
|
||||
}
|
||||
if it.star || it.note != "" {
|
||||
_ = st.Update(it.link, func(n *store.Node) {
|
||||
context(n)
|
||||
if it.star {
|
||||
n.ToggleStar(it.account)
|
||||
}
|
||||
n.Note = it.note
|
||||
})
|
||||
}
|
||||
for range it.uses {
|
||||
_ = st.Use(it.link, time.Now().Add(-it.ago), context)
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user